Privacy Policy
1. Who we are
Noreto is a private relationship, promise, rhythm, and reminder app operated by Urfin Inc., a company incorporated in Canada, and available at noreto.life. For privacy questions, requests, or complaints, contact privacy@noreto.life.
2. What Noreto is not
Noreto is not a medical, mental-health, therapy, legal, financial, or emergency service. The app helps you organize personal intentions and reminders; it does not diagnose, treat, advise, or guarantee personal outcomes.
3. Information we collect
- Account data: display name, email address, date of birth or age confirmation, public alias, timezone, language, theme, and notification preferences.
- App content: people you add, relationship type, optional birthday, optional selected phone number, contact rhythm, contact history notes, promises, rituals, radar items, vault entries, and other content you choose to create.
- Authentication and security data: auth tokens, OTP challenges, password reset events, sign-in/sign-out events, account deletion events, IP address, user agent, request IDs, and audit logs.
- Notification data: in-app notifications, email delivery status, push notification preferences, and Firebase Cloud Messaging device tokens when you enable notifications.
- Purchase data: subscription tier, product identifiers, entitlement status, renewal state, and purchase metadata from Google Play, Apple, and RevenueCat. We do not receive or store full card numbers.
- Contact permission data: if you choose to link a phone contact, Noreto opens your device contact picker and saves only the selected information needed for the feature, such as a phone number. We do not bulk upload your address book.
- Local device storage: secure auth token storage plus local preferences such as intro completion and home tour completion.
4. How we use information
- Provide the app, account, reminders, people, promises, rituals, vault, billing, and notification features.
- Send transactional emails, OTP codes, account notices, subscription notices, notification emails, and user-requested support replies.
- Register push tokens and deliver push or in-app notifications when enabled.
- Maintain security, prevent abuse, debug service failures, and keep audit records.
- Honor account deletion, access, correction, support, and privacy requests.
- Improve product reliability and user experience without advertising profiles or sale of personal data.
5. Legal bases and regional rights
Depending on where you live, laws such as GDPR/UK GDPR, CCPA/CPRA, PIPEDA, LGPD, Indian privacy law, and similar rules may apply. Our usual legal bases are contract performance, legitimate interests in security and service operation, legal obligations, and consent where required, such as optional permissions, push notifications, or marketing.
6. Your privacy choices and rights
- Access, correct, delete, or request a copy of your personal data.
- Withdraw consent for optional permissions such as contacts or notifications through device settings.
- Object to or restrict certain processing where local law gives that right.
- Opt out of marketing emails if we send any. Transactional and security emails may still be sent.
- Request account deletion in Profile or by contacting privacy@noreto.life. You may also complain to your local privacy authority where applicable.
7. Sharing and processors
We do not sell personal data and do not share personal data with advertisers. We use service providers only to run Noreto, including hosting/database infrastructure, transactional email providers such as Brevo, Firebase Cloud Messaging for push notifications, RevenueCat for subscription entitlement management, Google Play and Apple for in-app purchases, and support or security tooling where needed.
8. International transfers
Your information may be processed in countries other than your own. Where required, we use reasonable safeguards such as contractual protections, provider security terms, and transfer mechanisms recognized by applicable law.
9. Retention and deletion
We keep account and app content while your account is active. Requesting deletion starts a 30-day grace period that you can cancel before the deadline. After the deadline, active account data is scheduled for permanent deletion. Backups and security logs may take additional time to cycle out, generally up to 60 days unless a longer period is required for security, fraud prevention, dispute handling, or legal obligations.
10. Children and age limits
Noreto is for adults 18 and older. We do not knowingly collect personal data from children or allow children to create accounts. If you believe a child has provided data to Noreto, contact privacy@noreto.life so we can review and delete it where appropriate.
11. Security
We use HTTPS, authentication tokens, encrypted local token storage on supported devices, access controls, audit logs, and operational safeguards. No system is perfectly secure, so you should use a strong password, protect your device, and contact security@noreto.life if you suspect unauthorized access.
12. Contact
Noreto is operated by Urfin Inc., a company incorporated in Canada. Company and legal contact: contact@urfininc.com (registered mailing address available on request).
Privacy: privacy@noreto.life · Security: security@noreto.life · Support: support@noreto.life · Billing: billing@noreto.life