NOVA privacy policy

Last updated October 18, 2026

NOVA is a personal AI assistant operated by The Transformation Room ("we"). Anyone 18 or older can create an account. This policy explains what NOVA collects, how it is used and protected, and the choices you have.

Who we are

The Transformation Room, 8401 Mayland Dr, Ste A, Richmond, VA 23294, USA. Contact: support@yournovabrain.com.

Signing in

NOVA uses Google sign-in, or Sign in with Apple in the iPhone app, only to confirm who you are. From Google it receives your name, email address and profile photo. From Apple it receives a private identifier, your name the first time (if you share it) and your email address, or the private relay address Apple makes if you choose to hide yours. Nothing else is received from that step. If you delete your account, NOVA also asks Apple to end its Sign in with Apple link.

Payments

If you choose a plan, Stripe (on the website and the downloaded app) or Google Play (in the Play Store app) takes your payment on their own pages. NOVA never receives your full card number. NOVA keeps your plan, its status and renewal date, and the customer or purchase reference those services give it, so it can show you your plan and let you change or cancel it.

What NOVA collects, and only when you choose

• Your account details and settings.
• What you tell NOVA, the memories it keeps from your conversations, and files you choose to import, each with a note of where it came from.
• Data from accounts you choose to connect, such as email, calendar, tasks and files, used as you ask.
• From the NOVA phone apps and NOVA for Mac, only what you switch on: on Android, notifications and messages, places, health data and the "Hey NOVA" wake word (and, in the version downloaded from our website, texts and call history); on iPhone, Apple Health data, messages you choose to pass on with a Shortcuts automation, and your location while you share a journey; on a Mac with NOVA for Mac, one-to-one texts with people in your Contacts. One-time codes and promotions are not kept. Each is explained below.
• Financial data from bank accounts you connect through Plaid, or from statements you import.
• A record of actions NOVA takes and the approvals you give.

You decide what to connect, and you give consent each time you connect an account. Nothing is collected from a service until you connect it.

How it is used

Only to provide NOVA to you: to answer your questions, organize your information and prepare actions for your approval. We do not sell, rent or share your information for advertising or marketing, and it is never used to advertise to you.

Sharing with people you choose (NOVA Together)

NOVA Together lets you share parts of your life with other NOVA users you invite, such as a partner, family or friends. Nothing is shared until you choose it, and nothing of theirs is shared with you until they choose it.

• You choose, item by item and person by person. For each person you pick what they can see (for example when you're free, your trips, a shared list, your goals) and how much: a one-word signal, a summary or detail. You can see exactly what each person sees, change it, pause it or stop it at any time.
• Health data is off until you turn it on. Wellness from Oura, WHOOP or your phone can only be shared after you switch on Health data in Together, and only at the level you pick for each person. Heart rate, heart rate variability and temperature stay private unless you turn each on. Turning Health data off stops every wellness share at once.
• Money is only ever joint accounts you pick, and only with your partner. Personal accounts are never shared.
• Never shared: your work data, your emails and texts, your private memories and conversations, your business internals, agent drafts, and your connected accounts' credentials.
• Live views, not copies. What someone shares with you is read from their account at the moment you look, after NOVA checks their choices on its server. It is not copied into your account or your memories, and it is not kept on your phone for offline use. When they stop sharing, it is gone from your view. The only exception is a short suggestion NOVA makes from it, such as “Mia’s on a 14-day streak. Send a cheer?”, which stays on your Together screen for up to 7 days, and any reminder you choose to accept.
• Nobody is told when you look. NOVA keeps no record of who viewed what.
• What others see about you in shared features. If you send a cheer, the other person sees your name and what you cheered. If you join a challenge, the people in it see your name and how many days you kept your own habit, never what the habit is or any amounts. If you share a journey ("on my way"), the people you pick see where you're headed and when you expect to arrive, only for the time you set.
• Notifications. If you leave "On your phone" on, NOVA can send a notification for a cheer, a challenge or a suggestion based on what people share with you. They never arrive before 8am or after 9pm, and you can turn them off on the Together screen.
• Invites. An invite link works once and expires after 7 days. NOVA keeps only a scrambled (hashed) form of the link.
• Ending it. Removing someone stops sharing in both directions at once. Deleting your account ends every share you have.

The NOVA phone app (Android)

The Android app collects nothing from your phone until you turn each item on in Connections › This phone. Before Android asks for a permission, NOVA explains what it will collect and why, and you can say no. You can turn any of these off at any time in NOVA or in your phone's settings.

• Places (location). When you turn on Places, NOVA collects this phone's location and sends it to your private NOVA account: in the version of the app from our website, including when the app is closed or not in use; in the Google Play version, only while NOVA is open. It uses it only to learn your places, routines and trips for Places & travel and your daily brief.
• Health (Health Connect). With your permission in Health Connect, NOVA reads, for the last few days: daily step totals, average and resting heart rate, sleep sessions (start, end and hours) and workouts (type and length). It uses them only to show you your activity, sleep and readiness in Wellness and your daily brief, and to answer your own questions. NOVA never writes to Health Connect. Health data is never sold, never used for advertising, and never shared with anyone else, except our service providers processing it to provide NOVA to you, and other NOVA users you yourself choose to share wellness with in NOVA Together (above). NOVA is not a medical app and does not diagnose or treat any condition. NOVA's use of Health Connect data follows the Health Connect Permissions policy, including its Limited Use requirements.
• Notifications. With notification access, NOVA reads the notifications this phone receives (which app, who it's from, and the text), so it can remember conversations and notice what needs a reply. This can include messages from texting apps. One-time codes and promotions are skipped.
• "Hey NOVA" (microphone). When you turn on the wake word, the phone listens for "Hey NOVA" while a notification shows that it is listening. That listening happens on the phone itself: no audio is recorded, kept or sent anywhere. When it hears its name, NOVA opens so you can talk. When you talk to NOVA, your phone's speech service turns your words into text and NOVA receives the text, not a recording.
• Photos and things you share. When you share a photo, link or text into NOVA, it is sent to your NOVA account so NOVA can read it and save what matters. NOVA does not browse your photo library.
• Texts, call history and contacts (website version only). The version of the app downloaded from our website can also read texts and call history if you turn them on, and looks up contact names so it can show who a message or call was with. The Google Play version does not read texts or call history.
• Device. When you connect a phone, NOVA gives it its own identifier and keeps the phone's model name, so you can see and disconnect it in Connections.

NOVA for iPhone

The iPhone app collects nothing from your phone until you turn each item on, and iOS asks for your permission before NOVA can use any of them. You can turn each off at any time in NOVA or in the iPhone's Settings.

• Apple Health. Only after you turn it on in NOVA and allow it in Apple Health, NOVA reads, for the last few days: daily step totals, average and resting heart rate, heart rate variability, sleep (start, end and hours) and workouts (type and length). Apple Health lets you choose which of these NOVA may read, and NOVA sends only what it is allowed to read. NOVA uses this data only to show you your activity, sleep and readiness in Wellness and your daily brief, and to answer your own questions. NOVA never writes to Apple Health. Health data is never sold, never used for advertising or marketing, never used to profile you for anyone else, never stored in iCloud, and never shared with anyone else, except our service providers processing it to provide NOVA to you, and other NOVA users you yourself choose to share wellness with in NOVA Together (above). NOVA is not a medical app and does not diagnose or treat any condition. To stop, remove NOVA's access in the iPhone's Settings › Health › Data Access & Devices › NOVA; to remove what NOVA already has, email us or delete your account.
• Siri and Shortcuts. When you say "Ask NOVA", the question Siri hears is sent to your NOVA account and answered like anything you type, and the conversation is kept in NOVA. If you set up a Shortcuts automation for Messages, it passes the sender and text of messages from the people you choose to NOVA, so Relationships knows who has been in touch. NOVA cannot read your messages on its own: only the automation you build sends them, and you can delete it at any time in Shortcuts.
• Location (On my way). Only while you share a journey with someone you pick in NOVA Together, NOVA uses your location to show them you're coming. It is not used for anything else.
• Notifications. If you allow them, NOVA sends reminders and notifications for things you asked for (for example a cheer from someone in Together or a reminder you set). Apple delivers them; NOVA keeps a device token for that, removed when you sign out or delete the app.
• Microphone and speech. Used only while you tap Talk or the microphone. What you say is turned into text, by Apple's speech service on the iPhone or by NOVA's speech service (OpenAI) when NOVA is listening for a reply. The recording is used only for that and is not kept.
• Camera, photos and Share to NOVA. A photo, document, link or text reaches NOVA only when you take, pick or share it. NOVA does not browse your photo library. On a video call with your camera on, NOVA can see you: see "Video calls with your camera on" below.
• Device. When you sign in, NOVA gives this iPhone its own key and keeps the model name, so you can see and disconnect it in Connections.

NOVA for iPhone has no advertising, no third-party analytics and no tracking across other companies' apps or websites.

NOVA for Mac

NOVA for Mac is a small menu bar app. Only after you connect it and give it Full Disk Access and Contacts access (macOS asks you for both), it reads Messages on that Mac, read-only, and sends NOVA one-to-one texts with people saved in your Contacts: who, when, which direction, and the words unless you turn "Include what was said" off. Group chats, short codes (banks, deliveries, sign-in codes) and businesses are never read or sent. Contacts are used only to put a name to a number. You can pause it or disconnect it at any time.

Emails from NOVA

NOVA sends a few emails to the address you sign in with: a welcome, short tips during your first days, and notices about your free trial ending. They come from hello@yournovabrain.com. Every one has a link to stop them, and you can switch them off in Customize › Privacy & security. We never share your email address or use it for anyone else's marketing.

Google account data

When you connect a Google account (for example Gmail, Calendar or Drive), NOVA uses that data only to provide NOVA's features to you, as you ask. NOVA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is not sold, not used for advertising, and not used to train general AI models.

Outlook and Hotmail account data

When you connect an Outlook, Hotmail, Live, MSN or Microsoft 365 account, you sign in with Microsoft through Pipedream, and NOVA never sees your Microsoft password. NOVA can then read the email and calendar in that account, and uses them only to provide NOVA's features to you, as you ask: answering your questions, your inbox brief, trips, meeting notes and the agents you switch on. NOVA saves drafts in your Outlook Drafts and sends an email only after you approve it. It never marks your messages as read, moves them or deletes them. When you disconnect the account in Connections, NOVA's access ends at once.

Yahoo, iCloud, AOL and other email

You can connect Yahoo Mail, iCloud Mail, AOL Mail or another mailbox with an app password: a separate password your email provider makes for NOVA, never your usual one. NOVA checks that it signs in, then keeps it encrypted on NOVA's server. It is never shown again, never sent to your browser or phone, never written to logs and never sent to AI services. NOVA uses it only to read your mail, over a secure connection, for NOVA's features as you ask; it never marks messages as read, moves, deletes or sends anything. When you disconnect the mailbox in Connections, NOVA deletes the app password at once, and you can also revoke it any time in your email provider's security settings.

Bank accounts and Plaid

NOVA uses Plaid Inc. to connect to your bank. When you connect an account, Plaid shows you what will be shared and asks for your consent, and Plaid's handling of your data is covered by the Plaid End User Privacy Policy.

• NOVA receives account names and types, balances and transactions. Access is read-only: NOVA cannot move money, make payments or trade.
• This data is used only to show you your own finances and to answer your own questions about them.
• Connecting a bank requires a code from your authenticator app (two-step verification) first.
• The Plaid access token is encrypted and kept on NOVA's server. It never reaches your browser or phone.
• When you disconnect a bank, NOVA revokes its access with Plaid and deletes the financial data received from it within 30 days.

AI services

These companies do NOVA's thinking, pictures, voices and video. Each one gets only what its own job needs, and uses it only to do that job for NOVA.

• OpenAI answers your questions, turns what you say into text, speaks NOVA's replies, holds live voice conversations, helps NOVA find your related notes, and makes some pictures. It gets what you ask, the notes related to it, and what you say while you talk with NOVA. Requests are sent without asking OpenAI to store them.
• Anthropic answers some requests, depending on the kind of work. It gets what you ask and the notes related to it.
• Google Gemini answers some requests and makes pictures. It gets what you ask and the notes related to it, or the description of a picture and any pictures you give it to work from.
• Ideogram makes pictures with words in them, such as a poster or a quote. It gets the description of the picture and any pictures you give it to work from.
• Black Forest Labs (FLUX) makes photo-style pictures. It gets the description of the picture and any pictures you give it to work from.
• HeyGen makes short videos you ask for and speaks with some of NOVA's voices. It gets the video's script or the text being spoken.
• ElevenLabs turns NOVA's replies into speech when its voice is the one in use. Only the text being spoken is sent.
• LemonSlice animates NOVA's face on a video call. It gets only the sound of NOVA's reply, never your voice or your camera.
• Video calls with your camera on. Your camera is off until you turn it on. While it is on, when NOVA needs to look to answer you (for example "What am I holding?"), one still picture from your camera, taken as you finished speaking and made small on your device, is sent to OpenAI (or, if it is busy, Anthropic or Google Gemini) to answer that moment. Nothing is streamed, and no picture is taken while you are silent or with your camera off. The picture itself is never kept: not by NOVA, not in your memory, conversations, receipts or data export, and it is not sent to the voice or face services. NOVA passes on what it saw only when that is needed to do what you asked (for example "add this to my shopping list"), and then only the words, kept like anything else you ask NOVA. NOVA does not use it to recognise who anyone is, and does not guess sensitive things about anyone in it. Turn the camera off at any time and NOVA stops seeing at once.
• When you connect an email account (Gmail, Outlook and Hotmail, Yahoo, iCloud, AOL or another mailbox), NOVA reads the mail it needs to answer you, and the parts related to your question (who wrote, the subject and the words of those messages) are sent to these AI services with it.
• Before anything is sent to these AI services, NOVA asks you once. You can change your answer any time in Customize › Privacy & security › Sharing with AI services. Until you agree, nothing is sent to them, and NOVA can’t answer questions or talk with you.

Services NOVA uses

• Vercel and Neon host the app and its database.
• Pipedream handles sign-in to services you choose to connect.
• Stripe and Google Play take payments for plans and add-ons.
• Apple provides Sign in with Apple, notifications to iPhones and, on your iPhone, Siri and speech recognition.
• LiveKit carries the video of NOVA's face to your screen during a video call.
• Plaid connects bank accounts, and Oura and WHOOP provide sleep, readiness and recovery data, when you choose to connect them.
• Open-Meteo looks up the coordinates and timezone of a birthplace, if you add one in the optional Astrology section. Only the place name is sent; your birth date and time stay in NOVA.

These providers process data only to provide their service to NOVA.

Our website

Our website, about.yournovabrain.com, is separate from the NOVA app. To understand how people find it, the website uses two measurement tools:

• Google Analytics counts visits, pages viewed, where visitors came from, approximate location (country and city), device type, and when someone plays a video. It uses cookies. If you are in the EU, the EEA, the UK or Switzerland, it runs only after you choose Allow. Everywhere else you can choose No thanks. Google signals and ad personalization are turned off, we do not use it for advertising, and Google keeps this data for up to 14 months.
• Vercel Web Analytics counts visits and pages without cookies and without storing personal information.

Your choice is saved in your browser. To change it, clear this website's data in your browser and the choice will appear again. Website measurement is never linked to your NOVA account, and nothing from the NOVA app is sent to these tools.

How it is protected

• All traffic is encrypted in transit (HTTPS, TLS 1.2 or higher).
• You sign in with Google or Apple, and connecting a bank needs two-step verification.
• Stored data is encrypted at rest, and access tokens for connected accounts are encrypted again before they are stored.
• Each person's data is kept separate inside NOVA: one person can never see another's information, except what that person chooses to share with them in NOVA Together, checked by NOVA's server every time it is read.
• NOVA never moves money. It sends email, changes calendars or takes other actions for you only with your explicit approval, or within an automatic action you deliberately switch on.

How long it is kept

Your information is kept while you use NOVA. When you disconnect an account, its access is removed at once. When you ask us to delete your information, or close your account, it is removed from NOVA within 30 days, and from backups when those backups expire. The full schedule is in data retention and deletion. When an account is deleted, NOVA keeps only a one-way fingerprint of the Google account and email with the date its free trial began, so a new account can’t start a second free trial; it can’t be turned back into an email address.

Your choices and rights

You can disconnect any connected account at any time. You can ask to see, correct, export or delete your information by emailing privacy@yournovabrain.com, and you can download a copy of everything or delete your account yourself in NOVA: Customize › Privacy & security.

Children

NOVA is not for anyone under 18.

Changes

If this policy changes, the date at the top changes too.