Privacy Policy
NOVAS (“we,” “us,” or “our”) operates Prism Dot (prismdot.app), a journaling application (the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have.
Please read this carefully. If you do not agree with this Policy, please do not use the Service.
1. Information We Collect
1.1 Information from Google Sign-In
We use Google OAuth for authentication. From Google, we receive:
- Email address
- Name
- Profile picture URL
We never receive or store your Google password.
1.2 Content You Create
- Journal entries (text), titles, and the dates you assign to them
- Images you attach
- Folders and tags you create or adjust
- Onboarding responses and display preferences
1.3 Information Generated by the Service
- AI-generated classifications, tags, reminders, reflection prompts, and empathy responses
- Vector representations (embeddings) of your entries, used for similarity search
1.4 Automatically Collected Information
- Authentication session cookies
- Infrastructure access logs maintained by our hosting providers, which may include IP addresses
We do not use analytics or advertising trackers. There is no Google Analytics, no advertising pixel, and no cross-site tracking in the Service.
2. ★ How AI Processing Works
This section describes the core of how the Service works. Please read it.
2.1 What Is Sent to AI Providers
| Feature | Sent to | What is sent | When |
|---|---|---|---|
| Classification, tags, empathy response | OpenAI, L.L.C. | The full text of the entry you just wrote, the first 50 characters of up to 10 entries from the past 7 days, your display name, your folder list | Each time you save an entry |
| Similarity search | OpenAI, L.L.C. | The full text of the entry | On save |
| Reflection tools (AI Reflect) | Anthropic, PBC | The content of that entry | Only when you explicitly run it |
| Insights | Anthropic, PBC | First 200 characters of up to 50 entries, plus tags | When you open Insights |
| Morning brief | Anthropic, PBC | First 200 characters of up to 50 entries from the previous day, plus recurring themes from the past 30 days | When the brief is generated |
Images you attach are never sent to any AI provider. They are stored and displayed only.
2.2 What AI Providers Do With It
Based on each provider’s published policies as of August 2026:
- OpenAI: Data submitted through the API is not used to train their models. Inputs and outputs are retained for up to 30 days for abuse monitoring, then deleted.
- Anthropic: Data submitted through the API is not used to train their models. API logs are retained for 7 days.
These policies are set by the providers and may change. Current versions:
- OpenAI: https://openai.com/policies/
- Anthropic: https://www.anthropic.com/legal/
2.3 Opting Out
AI processing is essential to how the Service works and cannot currently be disabled separately. If you do not want your entries processed this way, please do not use the Service.
3. How We Use Your Information
- To operate and maintain the Service
- To classify, tag, and organize your entries
- To generate reflections, summaries, and reminders
- To respond to your support requests
- To detect and prevent abuse
We do not sell your personal information or your journal entries. We do not share them with advertisers, marketers, or data brokers.
4. Where Your Data Is Stored
| Component | Provider | Location |
|---|---|---|
| Database, authentication, file storage | Supabase Inc. | Seoul, South Korea (AWS ap-northeast-2) |
| Application hosting | Vercel Inc. | Seoul region execution |
| AI processing | OpenAI, L.L.C. / Anthropic, PBC | United States |
Your entries are stored in South Korea. When AI features run, the content described in Section 2.1 is transmitted to providers in the United States for processing.
If you are located outside South Korea, your information will be transferred to and stored in South Korea. By using the Service, you consent to this transfer.
5. Data Retention and Deletion
| Data | Retention |
|---|---|
| Account and content | Until you delete your account |
| Data sent to AI providers | Per provider policy — OpenAI up to 30 days, Anthropic 7 days |
| Infrastructure logs | Per hosting provider policy |
You can delete your account at any time from Settings. Deletion removes all of your entries, images, folders, and tags immediately and permanently.
⚠️ In rare cases a technical failure may leave an image file behind. We remove such files when identified.
Before deleting, you can export your entries using the Export feature in Settings.
6. Disclosure to Third Parties
We disclose your information only in these circumstances:
- Service providers: The infrastructure and AI providers listed in Section 4, who process data on our behalf
- Legal requirements: When required by law, subpoena, or valid government request
- Business transfers: In connection with a merger or acquisition, provided the receiving party honors this Policy
6A. Payment Information (When Paid Plans Launch)
The Service is currently in beta and free. We do not collect payment information.
When paid plans launch, we will use Paddle.com Market Limited as our Merchant of Record.
- Your card and billing details will be collected and processed by Paddle. We will not store them.
- We will receive only the minimum information needed to provide the Service — subscription status and payment confirmation.
- Paddle’s handling of your information is governed by their privacy policy: https://www.paddle.com/legal/privacy
We will update this Policy with specifics before paid plans take effect.
7. Your Privacy Rights
7.1 All Users
- Access: View everything you have written within the Service
- Correct: Edit any entry at any time
- Delete: Delete individual entries or your entire account
- Export: Download your content as a file from Settings
7.2 California Residents (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Access a copy of your personal information
- Request deletion of your personal information
- Request correction of inaccurate information
- Opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising
To exercise these rights, contact us at tajolab1003@gmail.com. We will not discriminate against you for exercising them.
7.3 Other U.S. State Privacy Laws
Residents of states with comparable privacy laws (including Virginia, Colorado, Connecticut, and Utah) have similar rights. Please contact us to exercise them.
8. Children’s Privacy (COPPA)
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information without verifiable parental consent, we will delete it promptly.
⚠️ Note: Under South Korean law, the Service is restricted to users 14 and older. The Korean-language version of this policy reflects that requirement.
9. Security
- Encryption: Data is encrypted at rest using AES-256 and in transit using TLS, as provided by our infrastructure provider Supabase.
- Access control: Row-level security is enabled on every database table, restricting access to your own data.
- Storage isolation: Attached images are kept in a private bucket accessible only to you.
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
10. Changes to This Policy
We may update this Policy. We will post changes here and update the “Last Updated” date. Material changes affecting your rights will be announced at least 30 days in advance.
11. Contact Us
NOVAS
HYEOK KIM, Representative
Business Registration No. 560-79-00212
2F J414, 106 Jangdae-ro, Yuseong-gu, Daejeon, Republic of Korea
Email: tajolab1003@gmail.com