Privacy Policy
How Norvayo handles your information
Norvayo helps you track and quit nicotine pouches. Because that means logging health-related information about yourself, we've written this policy to be genuinely readable — not just legally complete. The short version is below; the full detail follows.
In plain English
- An account is optional. Norvayo works fully offline with no sign-up. Creating one only adds cross-device sync.
- Your tracking data is yours. Usage logs, cravings, notes, and your reason for quitting are private by default and never sold or used for advertising — Norvayo has no ad or analytics SDKs at all.
- Circles sharing is opt-in, field by field. Nothing about your progress is visible to anyone else unless you specifically turn it on.
- We use three service providers — Supabase (your account and data), RevenueCat (subscriptions), and Sentry (crash reports) — and nobody else.
- We keep data only as long as it's needed — account and tracking data until you delete it. See Data retention below.
- You can export or delete everything, anytime, from inside the app.
1. Information we collect
Account information (optional). If you create an account, we collect your email address and the authentication credentials needed to sign you in securely. Those credentials are handled by our authentication provider, which stores a securely hashed credential — we never see or store your password in plain text. You never have to create an account — every core feature works fully offline.
Tracking data. Information you log while using the app: pouch-used and craving-resisted events with timestamps and quantities; optional brand, flavor, and nicotine strength; optional craving triggers and intensity ratings; and any freeform notes you choose to write.
Quit plan information. Your quit method, start and target dates, baseline usage, and an optional freeform "reason for quitting" — written for you, not for us.
Circles (optional social feature). If you use Circles, you may share a display name and specific progress details you explicitly opt into — for example, your current streak or a goal you've set — with people you've personally invited into a private circle. Every shared field defaults to off. You choose exactly what's visible, to whom, and can stop at any time.
Purchase information. If you subscribe to Norvayo Premium, your purchase and subscription status is processed through Google Play or the Apple App Store and our payments partner, RevenueCat. RevenueCat identifies you by an anonymous or pseudonymous ID — never your email address or name.
Crash and diagnostic data. We use Sentry to catch and fix bugs. This includes device type, operating system version, app version, and technical crash reports. We have configured Sentry to minimize the collection of personal information where those settings are available, and we do not intentionally use IP addresses for analytics or user profiling.
We do not use push notifications. Reminders you enable are scheduled entirely on your own device, and no notification token is ever collected or transmitted.
Website analytics, only if you agree. Our website (norvayo.com) can use Google Analytics to understand which pages people find useful — pages viewed, approximate location by country/region, device type, and how visitors arrived. It is off until you choose to allow it. If you decline, or simply ignore the banner, nothing is requested from Google at all and no analytics cookies are set; we do not load the script first and ask afterwards.
This applies to the website only. The Norvayo app contains no analytics SDK, and nothing you log in the app is visible to Google Analytics or connected to your browsing here. Our hosted sign-in redirect page is excluded entirely, so authentication details are never sent to a third party.
Your choice is stored in this browser and you can change it at any time: Change my analytics choice. You can also opt out across every site with Google's browser add-on.
2. Health-related information
Information you choose to record in Norvayo — such as nicotine use, cravings, quit goals, and related habits — may relate to your health or wellness. We use this information only to provide the features you request, such as tracking your progress, syncing your data across devices (if you create an account), and enabling optional sharing through Circles. We do not use this information for advertising, and we do not sell it to third parties.
3. How we use it
- Provide the app's core tracking, coaching, and progress features
- Sync your data across your devices, if you've created an account
- Process subscription purchases
- Diagnose and fix technical problems
- Enable the optional Circles feature, strictly according to your own sharing choices
We do not sell your personal information, and we do not use it for advertising. Norvayo contains no advertising or analytics-tracking SDKs beyond the crash-reporting and payment-processing services described in this policy.
In short, we process your information to provide the services you request, maintain your account (if you create one), fulfill our obligations to you, protect the security of the app, comply with legal obligations, and improve Norvayo's reliability.
5. Your choices and rights
- Use Norvayo without an account. Every core feature works fully offline, with no sign-up required.
- Control what you share in Circles. Every shared field is off by default; turn on only what you want, and change your mind whenever you like.
- Export your data. Download your full tracking history as a CSV or PDF, anytime, directly from the app.
- Delete your account and data. Permanently delete your account and all associated cloud data from Settings → Account → Delete Account. You'll also be asked whether to erase your locally stored data on that device. This cannot be undone. We begin deleting your cloud data promptly after your request, although backup copies may persist for a limited period before being automatically removed.
Depending on your state of residence, you may have additional privacy rights under applicable state law — for example, the right to know what information we hold about you, to correct or delete it, or to receive a copy in a portable format. Nothing in this policy limits any privacy right you have under your state's law that cannot be waived by agreement. The export and deletion tools above are available to every user regardless of location; to ask about any additional right that may apply to you, contact us at support@norvayo.com.
6. Data retention
We keep your information only as long as it's needed for the purposes described in this policy:
- Account and tracking data is retained until you delete your account, or delete specific entries yourself from within the app.
- Crash and diagnostic data is retained only as long as reasonably necessary to diagnose and resolve technical issues.
- Backup copies of deleted data may persist for a limited period before being automatically removed.
7. Data security
Data sent to our servers is encrypted in transit (HTTPS/TLS). Cloud-stored data is protected by database-level access rules that restrict it to your account only — except for the specific fields you've explicitly chosen to share through Circles.
If you access Norvayo from outside the United States, your information may be processed and stored in the United States.
8. Business transfers
If Norvayo is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy.
9. Children's privacy
Norvayo is not directed at children and is not intended for use by anyone under the age of 18.
10. Changes to this policy
We may update this privacy policy from time to time. When we do, we'll update the "Last updated" date at the top of this page.
11. Contact us
Questions about this policy or your data? Contact us at support@norvayo.com.