Nana

Privacy Policy

Last Updated: 22 September 2026 Effective Date: 6 September 2026

1. Introduction

Nana ("we", "our", or "the App"), operated by Cosmos One, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use Nana.

Nana is powered by Cosmos Services, a cloud-based API platform operated by Cosmos One that provides AI processing, authentication, and usage tracking. When you sign in with Google, the App communicates with Cosmos Services on your behalf.

Nana is local-first: your notes, transcripts, and knowledge graph are stored in an encrypted database on your device. Audio, note text, search queries, and questions with relevant note excerpts are sent to Cosmos Services for transcription, organisation, semantic search, and answers. Results are returned to your device; cloud-processing retention is explained in §10.

By using Nana, you agree to the practices described in this Privacy Policy.

2. Overview

Nana is a voice-first personal knowledge app for Android. Capture a spoken or typed thought — from the App or its home-screen Quick Capture widgets — and Nana transcribes it, extracts the people, places, topics, decisions, and facts it mentions, and connects them into a searchable personal knowledge graph that you can query with plain-language questions.

Key Points:

Sign in with Google. Nana uses Android Credential Manager with an ID-token flow. We never see or store your Google password.
Your note library is stored on your device. Transcripts, summaries, the knowledge graph, and search embeddings are stored in an AES-256-encrypted database on your device. The App does not sync your notes to a server.
AI processing via Cosmos Services. Audio, transcript text, semantic-search queries, and questions with supporting note excerpts are sent to Cosmos Services and its configured AI provider to perform those features. Results are returned to your device and stored locally.
No note-database synchronisation. Nana does not synchronise your local note database to a server. It sends only the processing payloads, account information, and usage information described in this policy.
Optional approximate location. In versions with regional age checks, Nana asks for consent and Android location permission to identify your country/state. Android location and geocoding providers may process location; Nana does not retain coordinates or send them to Cosmos Services. See §4.4.
No advertising. Nana shows no ads and contains no advertising SDK.
No analytics or crash reporting. The App contains no analytics or crash-reporting SDKs.
Google API Services compliance. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements (see §3.6).
You are in control. Delete your server account in the App or at cosmosone.cloud/account-deletion, and delete your local data at any time (see §10).

3. Google User Data

Nana uses Google Sign-In for authentication. This section explains exactly what Google data is involved, as required by the Google API Services User Data Policy.

3.1 Data Accessed from Google

For authentication, Nana requests only the standard sign-in scopes — openid, email, and profile — all of which are classified as non-sensitive under Google's scope classification. No sensitive or restricted scopes are requested, and Nana does not request access to any other part of your Google account (such as Gmail, Drive, Calendar, or Contacts).

Google User Data	Source	Purpose
Google Account ID (sub)	Google ID token, issued during sign-in	Verify your identity and associate future sign-ins with your account
Email address	Google ID token	Account identification and communication
Email verification status	Google ID token	Confirm your email is verified
Display name	Google ID token	Provide registration information during sign-in
Profile picture URL	Google ID token	Provide registration information during sign-in

These fields are contained in the Google ID token that is passed directly to Cosmos Services to complete sign-in. Cosmos Services issues its own user identifier and retains the Google Account ID as the external identity used to recognise future sign-ins.

3.2 How Google User Data Is Used

Google user data is used only to:

Authenticate you when you sign in to Nana.
Create and maintain your account using your email address and Google Account ID. Display name and profile-picture URL may be processed during registration; they are not fields in the persistent Cosmos Services user record.
Communicate with you about your account (for example, security notices or deletion confirmations).
Apply age-related access rules using the separate Google Play signals described in §4.4.

We do not use Google user data for advertising, for training machine learning models, for profiling, or for any purpose unrelated to the App's disclosed sign-in, account and age-related access features.

3.3 How Google User Data Is Shared

Google user data is shared only as follows:

Recipient	What Is Shared	Why
Google	Authentication handshake and age-signal requests through Google Play	Authenticate you and support regional age checks
Cosmos Services (operated by us), using its infrastructure providers listed in §9	The Google ID token, including the fields in §3.1	Verify identity and create or recognise your account

Google account-profile fields are not attached to AI requests and are not sold or shared with advertisers or data brokers. Personal information you put in a note or question can be included in AI processing. Infrastructure providers in §9 process account and technical data on our behalf; legal disclosures are described in §8.4.

3.4 How Google User Data Is Stored and Protected

Data	Stored Where	Protection
Google ID token	In memory only, during the sign-in exchange	Nana does not write it to local storage; the App's network logger redacts the `Authorization` header
Email address	Your device (encrypted preferences) and the Cosmos Services account profile	AES-256 encryption on device; TLS in transit to the server
Google Account ID	Cosmos Services account record	TLS in transit; access-controlled storage
Display name, profile picture URL	Processed during sign-in and registration, including a short-lived registration token; not persistent user-profile fields	TLS in transit; signed registration token
Cosmos access and refresh tokens	Your device (encrypted preferences); server-side token records	On-device tokens are protected by Android Keystore-backed encrypted preferences; server-side handling follows Cosmos Services account and security processes

Security measures include TLS for Nana's communications with Cosmos Services (cleartext traffic is disabled in the App), Android Keystore-backed encryption for on-device credentials, and no storage of your Google password in any form (sign-in is handled entirely by Google's Credential Manager).

3.5 Google User Data Retention and Deletion

Account profile data is retained while your account is active, subject to the deletion and retention details in §10. Nana uses the Google ID token for sign-in and does not persist it in its local credential storage.

How to request deletion of your data:

Visit https://cosmosone.cloud/account-deletion
Sign in with the Google account you used in the app
Select the app to delete your account from
Click "Submit Request"

After verifying the request, Cosmos Services removes the email and replaces the Google identity in the active account record, marks the account deleted, and revokes access. Some billing, usage, security, and audit records remain as described in §10.1. Website requests are processed through the account-deletion request service, which notifies you of the outcome.

In-app alternative: In Nana, open Settings → Advanced → Delete Account. After Cosmos Services confirms account deletion, Nana signs you out and attempts to erase its local note database and recordings. If local cleanup fails, Nana displays an error; clear Nana’s Android app storage or uninstall it to remove remaining local data. Completed account deletion is irreversible.

Timing and memberships: website requests require processing; in-app deletion reports the server’s result. Self-service deletion may be blocked while a subscription entitlement remains active, including a cancelled subscription whose paid period has not ended. Cancel renewal in Google Play and contact support if you need help with deletion. Deletion does not itself cancel Google Play billing. Alternative: Email [email protected] with subject "Data Deletion Request". Revoking access: Google Account Permissions → remove "Cosmos Services". Revokes the Google authorisation; it does not itself delete your Cosmos account or local data, and you can authorise sign-in again.

A deletion request made through the website cannot erase data on your phone. In-app account deletion also attempts local cleanup as described above. Copies exported or backed up outside Nana remain until you delete them yourself (§10.3).

3.6 Google API Services: Limited Use Disclosure

Cosmos Services' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide and improve the user-facing features that are visible and prominent in the application's user interface.
We do not transfer Google user data to third parties except: (a) as necessary to provide the user-facing features described in this policy, (b) to comply with applicable laws, or (c) as part of a merger, acquisition, or asset sale with prior user notice.
We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
We do not allow humans to read Google user data unless: (a) we have your explicit consent, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.

4. Information We Collect

4.1 Information You Provide and Create

Account information obtained through Google Sign-In (see §3): your email address, display name, and profile picture.
Voice notes: audio recordings you create with the microphone.
Text notes: typed notes you create in the App or via the Quick Text widget.
Note content: transcripts (raw and cleaned), titles, summaries, tags, topics, knowledge graph entries (people, places, organisations, and the relationships between them), and your edits to any of these.
Personal names list: names you add so that Nana can correct their spelling in transcripts. The list remains on your device; corrected note text may be sent when you request AI processing for that note.
Questions you ask about your notes, and the answers and citations Nana generates for them.
Subscription and entitlement status: purchase validation tokens and membership status (Plus or Premium) needed to verify your entitlement.

4.2 Information Collected Automatically

On our servers (Cosmos Services):

Account and security logs can contain identifiers such as your email address. Their retention is separate from the active account record (§10.1).
Usage aggregates: request counts, input/output token counts, approximate processing costs, AI model names, and timestamps.
Quota and tier status used to enforce usage limits.
Standard technical request metadata (such as IP address, timestamps, and app version) processed to deliver responses and to protect the security and integrity of the service.

On your device only (not transmitted):

App preferences (for example, whether audio files are retained after processing, and onboarding completion).
Processing job state for pending note processing (including per-job idempotency keys).
Optional debug logs, only if you enable them. Logging turns off automatically after 24 hours. The log file remains on your device until you clear it or remove the App's data, and may contain technical error details. It is not sent automatically; review it before sharing it with support.

4.3 Information We Do NOT Collect

No precise or background location. Nana requests approximate foreground location only to identify the country and, where needed, state for regional age checks. See §4.4.
No address-book or photo-library access. Nana does not request access to your device contacts, photo gallery, or videos. Google Sign-In may provide your profile-picture URL (§3); this is separate from photo-library access. Nana reads a backup file when you explicitly select it for restoration.
No Gmail, Drive, Calendar or Contacts access. Google sign-in scopes remain unchanged. Separately, Nana uses Google Play Age Signals for age-related access decisions (§4.4).
No analytics or crash telemetry — the App contains no analytics or crash-reporting SDKs.
No payment card or financial account data — purchases are processed entirely by Google Play; we never see or store your payment details (see §9.2).
No advertising ID or cross-app tracking. Nana contains no advertising or tracking SDK and does not use the Android advertising ID.

4.4 Regional Age Checks

The location and age-checking practices in this section apply to Nana versions that include regional age checks. Older versions may not include this feature. Publishing this disclosure does not itself enable the feature on your device or replace any separate notice required for an app change.

Nana explains this use and offers a choice to continue with or without location before any location lookup or Android permission request. Nana may request approximate foreground location to identify your country and, where needed, state. Android's location and geocoding services may send location information to their providers to resolve your country/state. The provider depends on your device; Google-provided services are governed by Google's Privacy Policy, and other device providers apply their own policies. Their processing and retention are separate from Nana's; we do not promise that provider processing is memory-only or has zero retention. Nana does not retain coordinates or addresses, send them to Cosmos Services, or use them for advertising or profiling. If permission is declined or the required region cannot be determined, production Nana skips the regional age check, except that an already-pending Google verification step must still be resolved.

Nana remembers your location choice. You can withdraw Android location permission in Android Settings to stop future location lookups. Test releases attempt the same lookup only after consent and permission, but run the age flow everywhere, including when location is unavailable. An already-cleared signed-in session can remain open during a routine background refresh; a new restriction takes effect when received.

Where the regional age flow applies, Nana requests age information through Google Play Age Signals. Google may ask you or your parent to permit sharing. Nana uses the returned age band and applicable app-change approval status only for age-related access decisions. Google Play's account may differ from the account used to sign into Nana. Nana does not collect identity documents or an exact birth date, and does not send age signals to Cosmos Services or an AI provider.

If age information is not shared, Nana asks for an age group. A self-declared adult can continue; a self-declared minor cannot use that fallback. Where Google explicitly requires verification or supervision, you must complete Google's process and return for another check. Nana retains minimal markers for pending verification, a previously reported underage restriction, and outstanding app-change approval, plus your choice to allow or decline the disclosed location use. Google-related restrictions are updated when a new shared response resolves them; withholding age sharing cannot replace a known restriction with a self-declaration. Age bands and self-declared groups are not written to storage; current access state otherwise remains in process memory. These values are excluded from Nana's note exports and Android backups. Clearing app data removes the markers.

5. Permissions We Request

Permission	Purpose	Required
`INTERNET`	Communicate with Cosmos Services for sign-in and AI processing	Required
`ACCESS_COARSE_LOCATION`	Determine country/state for regional age checking while the app is open	Optional and consent-based; production skips a new regional check when location is declined or unavailable; test releases still check age
`ACCESS_NETWORK_STATE`	Check connectivity before running background note processing	Required
`RECORD_AUDIO`	Record voice notes	Required for voice notes; not needed if you only create text notes
`FOREGROUND_SERVICE`	Keep a recording running when you switch away or the screen turns off	Required for voice notes
`FOREGROUND_SERVICE_MICROPHONE`	Declares the microphone type for the recording foreground service	Required for voice notes
`POST_NOTIFICATIONS`	Show the ongoing-recording notification, which is your way back to stop a recording (Android 13+)	Required for voice notes

Foreground service: Nana runs a single foreground service of type microphone (RecordingService). It exists so a voice note keeps recording after the screen turns off or you go home, and it displays the notification that returns you to the recording. It runs only while you are actively recording.

Package visibility: The App declares visibility of Google Play Services for sign-in diagnostics and the Google Play Store to open it when verification is needed. Package visibility does not grant access to account data.

6. How We Use Your Information

6.1 Core Functionality

Authenticate you and manage your Cosmos Services account.
Transcribe your voice notes to text.
Extract knowledge from your notes: titles, summaries, tags, topics, people, places, organisations, relationships, decisions, action items, questions, opinions, and facts.
Generate search embeddings so you can find and connect related notes.
Answer questions about your notes, with citations back to the notes used.
Enforce usage quotas and rate limits, and compute the usage aggregates described in §4.2.
Validate Google Play subscription purchases and manage your entitlement (§9.2).
Determine regional age-check applicability and apply age-related access rules (§4.4).
Maintain the security, reliability, and integrity of Cosmos Services (including abuse prevention).
Respond to support requests you send us.
Comply with applicable legal obligations.

6.2 We Do NOT Use Your Data For

Advertising or advertising profiles — Nana shows no ads, and your email, profile, and notes are never used for advertising (see §3.6).
Selling or renting your data.
Developing or training models within Nana. Nana sends content for inference, not model-training jobs. Provider handling is explained in §11.
Any purpose unrelated to the features described in this policy.

7. Data Storage and Security

7.1 Storage Architecture

Nana does not store your note database on external servers. Your notes, transcripts, knowledge graph, embeddings, and question history live on your device. What is transmitted is limited to the processing payloads described in §8, plus account and usage data.

Component	Location	Protection
Note database (transcripts, summaries, knowledge graph, embeddings, tags, question history)	Your device — SQLCipher-encrypted Room database	AES-256 database encryption; the key is generated with a cryptographically secure random generator and stored in Android Keystore-wrapped encrypted preferences
Audio recordings	Your device — app-private internal storage	Protected by the Android app sandbox. On a new installation, recordings are deleted after processing unless you enable "Keep original recordings". An installation upgraded with an existing database may retain recordings until you review that setting.
Auth tokens and account email	Your device — EncryptedSharedPreferences	AES-256-GCM values with an Android Keystore master key (hardware-backed where available)
App preferences and processing state	Your device — app-private storage	Android app sandbox
Location choice and minimal age-access restriction markers	Your device — app-private preferences	Android app sandbox; excluded from note exports and Android backups
Approximate coordinates and returned region; age bands and self-declared age groups	Used temporarily in Nana memory, not written to Nana storage	Not sent to Cosmos Services; provider processing is described in §4.4
Debug logs (opt-in)	Your device — `filesDir`	Logging turns off after 24 hours; existing files remain until cleared or App data is removed and may include technical error details
Exports and backups	Your device — app cache, then wherever you save them	Markdown/JSON exports are plaintext; `.nana` backups are encrypted with AES-256-GCM using a passphrase-derived key (PBKDF2, 210,000 iterations)
Account, authentication, usage and billing records	Cosmos Services using Supabase database infrastructure	TLS in transit; access-controlled infrastructure
Temporary AI results	Cosmos Services using Supabase database infrastructure	AES-256-GCM encrypted result payloads; replay and cleanup limits in §10.1
Subscription entitlement cache (status and tier only)	Your device — app preferences	Android app sandbox

7.2 Security Measures

Encryption in transit: Nana's communications with Cosmos Services use TLS, and cleartext traffic is disabled for the App. Android location and geocoding services operate under their providers' security practices; the App's network configuration does not control those system services.
Encryption at rest on your device: the note database is SQLCipher-encrypted (AES-256); tokens use AES-256-GCM encrypted preferences backed by the Android Keystore.
No backups of your data leave the device automatically: Android backup and device-transfer are disabled for the database and preferences, so your notes are not copied to Google cloud backups or other devices without your explicit action.
Minimal logging: release builds do not log request bodies and redact the Authorization header from network logging. Debug logging is off by default, user-enabled only, and turns off after 24 hours; review a debug archive before sharing it.
No advertising or analytics libraries are included in the App.
Retry protection: processing identifiers help avoid duplicate work. Encrypted AI results are temporarily cached by Cosmos Services for retry/replay handling (§10.1).
Credential security: on-device authentication tokens are stored in encrypted preferences backed by the Android Keystore.

8. Data Sharing and Disclosure

8.1 What Is NOT Shared

Nana does not automatically upload or synchronise your note database, knowledge graph, or search index as a library. Audio, note text, search queries, questions, and excerpts do leave your device for the processing in §8.2. You can also export or back up your library.
Your personal names list remains on your device; name-spelling correction runs locally before any requested AI processing.
Nana does not attach your Google account profile to AI requests. If you include your name, email address, or other personal information in a note or question, that content may be sent for processing.
We do not sell, rent, or trade your information, and we do not share it with advertisers or ad networks.

8.2 Third-Party Sharing

Content is shared only to provide the App's core features:

Purpose	Recipient	What Is Sent
Sign-in and account management	Google (authentication); Cosmos Services (operated by us)	Google ID token fields listed in §3.1
Resolve the region for age checks	Android location and geocoding providers, which depend on the device	Approximate location used for country/state lookup after consent and permission; Nana does not send it to Cosmos Services
Age-related access decisions	Google Play	Age-signal access/check requests; Play returns available age bands and applicable app-change approval status to Nana
Voice transcription	Cosmos Services and its configured AI provider	The complete audio recording of a note
Knowledge extraction and answers to your questions	Cosmos Services and its configured AI provider	The complete transcript text; for questions: your question plus excerpts (title, capture time, and content) of the notes used to answer
Search embeddings	Cosmos Services and its configured AI provider	Chunks of the cleaned transcript text and semantic-search queries
Usage metering and quota enforcement	Cosmos Services (operated by us)	Request counts, token counts, approximate costs, model names, timestamps
Subscription validation	Cosmos Services and Google Play Billing	Purchase token, product identifier, and an obfuscated account identifier — never payment card details

AI providers receive the processing payloads described above to provide the requested feature. Structured AI requests also include a hashed account identifier for safety monitoring; this is not your Google profile or email. Netlify hosts the API and Supabase provides its database infrastructure (§9), so these providers process the corresponding payloads or stored records on our behalf. Cosmos Services selects the provider and model; see §9 for the current service list.

8.3 User-Initiated Sharing

The only other ways your data leaves your device are actions you take explicitly:

Exporting notes to Markdown or JSON files via the share sheet.
Creating encrypted backups (.nana files protected by your passphrase).
Sharing a debug log archive with us for support (only if you enable debug logging, review the archive, and choose to share it).

Files you export or share are under your control from that point on.

8.4 Our Commitments

We do not sell your personal information, do not share it with data brokers, and do not share it with any third party not described in this policy. Your Google profile data and note content are never used for advertising. We may disclose information if required by applicable law, or to protect the rights, property, or safety of Cosmos One, our users, or the public, and only to the extent necessary.

9. Third-Party Services

9.1 Third-Party Service Providers

Service	Purpose	Data Involved	Privacy Policy
Google Sign-In for Android (Google Play Services)	Authentication via Android Credential Manager	Email address, display name, profile picture, Google Account ID (during sign-in only)	policies.google.com/privacy
Google Play Age Signals	Regional age-related access decisions	Age-signal requests, available age bands and applicable app-change approval status; no age signals sent to Cosmos Services	Google Privacy Policy
Android location and geocoding providers	Resolve country/state for regional age checks after consent and permission	Location and lookup information; provider processing and retention depend on the device and service	Google Privacy Policy for Google-provided services; otherwise your device provider's privacy policy
OpenAI	AI processing accessed through Cosmos Services	Audio recordings, transcript text, semantic-search queries, note excerpts, questions, and a hashed account safety identifier for structured AI requests	openai.com/policies/privacy-policy
Google Play Billing	Subscription purchases and entitlement validation	Purchase token and an obfuscated account identifier; payment details remain with Google	Google Play Terms of Service
Netlify	Cosmos Services API hosting	Request payloads and technical connection metadata needed to run the service	Netlify Privacy Statement
Supabase	Cosmos Services database infrastructure	Account, authentication, billing and usage records, and encrypted AI results used for replay	Supabase Privacy Policy

Cosmos Services itself (api.cosmosone.live) is operated by Cosmos One and is not a third party; its data handling is described throughout this policy.

Local interface and storage libraries such as Jetpack Compose, Room, SQLCipher, and Hilt do not independently collect your content. Nana uses OkHttp/Retrofit for the network transfers described in this policy and WorkManager to schedule processing.

9.2 Google Play Billing and Subscriptions

Nana memberships are auto-renewing subscriptions (Plus and Premium tiers, each with monthly and yearly plans):

Payment processing: All payments and billing are handled directly by Google Play. Cosmos One never receives, processes, or stores your credit card, debit card, or financial account details.
Purchase validation: Google Play issues a purchase token and an obfuscated account identifier to validate your purchase and maintain your membership tier.
Renewal and cancellation: Subscriptions renew automatically through Google Play until cancelled. You can view, manage, or cancel your subscription at any time in Google Play (Settings → Manage subscription in Nana opens your Google Play subscription management page).
Refunds: Handled directly by Google under Google Play's refund policy.
Account deletion: Deleting your Nana account does not automatically cancel an active Google Play subscription. Cancel renewal in Google Play. Self-service account deletion may remain unavailable until the current entitlement expires; contact support if you need help with deletion.

10. Data Retention and Deletion

10.1 Retention

Data	Retention	How to Delete
Approximate coordinates, returned region, age bands and self-declared age groups	Used temporarily by Nana; not written to Nana storage or sent to Cosmos Services. Provider retention is separate (§4.4)	Withdraw Android location permission to stop future lookups; manage Google/device-provider data under their controls
Location choice and minimal age-access restriction markers	Stored locally until updated or app data is cleared; restriction markers are updated as Google responses resolve them	Clearing Android app storage or uninstalling removes these values and other local app data
Active account email and Google Account ID	Until account deletion; the account row remains marked deleted with its email removed and external identity replaced	Delete your account (§10.2)
Usage records (requests, tokens, costs)	Subject to scheduled retention cleanup; the standard setting is 35 days. Account deletion does not immediately purge them	Contact support to exercise applicable rights
Authentication records	Refresh tokens are revoked at account deletion; historical records may remain under service retention rules	Delete your account to revoke access; contact support about retained records
Notes, transcripts, knowledge graph, embeddings	Until you delete them on your device	Delete notes in-app; Settings → Advanced → Delete All Local Data; or uninstall (§10.3)
Audio recordings	On a new installation, deleted after processing unless "Keep original recordings" is enabled; an upgraded installation may retain recordings until the setting is reviewed	Delete the note, disable retention and delete the note, wipe local data, or uninstall
Debug logs	Logging turns off after 24 hours; the existing file remains until cleared or App data is removed	Clear debug logs in the App, delete App data, or uninstall
Purchase and subscription records	Some records and purchase-token bindings remain after account deletion for billing integrity and purchase recovery; deletion removes the account mapping and disables entitlement	Manage billing in Google Play; contact support about retained records
AI result replay cache	Encrypted results, such as transcripts, embeddings and generated answers, have a 24-hour replay window; expired entries are removed by scheduled cleanup, not necessarily at the exact expiry time	Account deletion does not immediately clear this cache; contact support about applicable deletion rights
Service logs and audit records	Standard configured retention is 30 days for service logs and 365 days for audit records, followed by scheduled cleanup; settings may vary. Existing records can include account identifiers and are not all anonymised by account deletion	Contact support about retained personal information
Exports and backups (`.nana`, Markdown, JSON)	Wherever you saved them	Delete the files yourself

10.2 Deleting Your Server Account

Visit https://cosmosone.cloud/account-deletion
Sign in with the Google account you used in the app
Select the app to delete your account from
Click "Submit Request"

In-app alternative: Settings → Advanced → Delete Account in Nana. The App sends a deletion request, signs you out, and removes its local note database and recordings when the local cleanup succeeds. Deletion is irreversible once it has been completed by Cosmos Services.

Website versus in-app deletion: a website request deletes server-side account data but cannot erase your phone. In-app account deletion also attempts to erase the local note database and recordings after server deletion succeeds. If Nana reports that local cleanup failed, clear its storage in Android Settings or uninstall it. Neither method removes files you previously exported or saved as backups outside the App.

10.3 Deleting Your Local Data

Delete individual notes in the App at any time.
Delete everything in the Nana library: Settings → Advanced → Delete All Local Data wipes the local database, recordings, exports held in the App's storage, and pending processing state. It does not reset every App preference or automatically clear opt-in debug-log files.
Uninstall the App: because Android backup and transfer are disabled, uninstalling removes all App data, including the encrypted database, recordings, and tokens.
Files you exported or backed up (Markdown, JSON, .nana backups) persist wherever you saved them and must be deleted manually.

11. AI Services and Model Selection

Nana accesses AI processing through Cosmos Services for transcription, knowledge extraction, search embeddings, and answers to your questions. Cosmos Services selects the provider and model for a requested operation and may change that selection over time. Cloud processing is distinct from synchronising your note library: encrypted processing results can remain temporarily on the server for retries (§10.1). The App does not contain an on-device AI model runtime.

AI-provider terms and policies apply to the processing service. OpenAI states that API content is not used for training unless the API customer opts in; its retention rules depend on the endpoint and account settings. For example, some text-processing endpoints retain abuse-monitoring records by default for up to 30 days, with exceptions. Nana does not promise zero retention across all providers or endpoints. See OpenAI API data controls. You may not use Nana to generate content that violates applicable law or the relevant provider's usage policies. Nana uses your notes as context and can provide supporting references, but AI output may contain errors, omissions, or unsupported statements. References do not guarantee correctness or that every statement came from your notes. Review important answers against your original notes and recordings before relying on them.

12. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate personal information.
Delete your personal information (see §10).
Export your information in a portable format.
Object to or restrict certain processing.

Because Nana stores your notes locally, most rights over your note content can be exercised directly in the App (by viewing, editing, exporting, or deleting notes) without contacting us. To exercise rights over your server-side account and usage data, contact [email protected].

12.1 GDPR

For users in the European Economic Area and the United Kingdom: Cosmos One is the data controller for your account profile and usage data. We process account data to perform our contract with you (authentication and service delivery), note content to carry out your instructions (transcription, extraction, embeddings, and answers), and technical metadata on legitimate-interest grounds (security and abuse prevention). OpenAI acts as a processor engaged by us for AI processing. You may lodge a complaint with your local supervisory authority.

12.2 CCPA/CPRA

For users in California: we may process identifiers (such as email address), audio and text note content that you submit for processing, and usage information (such as request and token counts). We do not sell personal information as defined by the CCPA, and Nana shows no advertising. You may request deletion at any time via the methods in §10.

13. Children's Privacy

Nana is intended for people aged 13 and over, including teenagers. Where regional age checks apply, Nana may process limited age information and access-restriction markers to prevent under-13 access, as described in §4.4. We do not knowingly accept note content from children under 13. Nana shows no advertising, and subscriptions must be authorised by the Google Play account holder. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided us personal information, contact [email protected].

14. International Data Transfers

Cosmos One operates from Australia. Cosmos Services uses Netlify for API hosting and Supabase for database infrastructure, which may process data outside your country; AI providers process requests in the United States and other regions, and Google processes purchase-validation and age-related signals in the United States and elsewhere. Android location and geocoding providers may also process location and lookup information outside your country under their policies (§4.4). If you access Nana from outside these regions, your information will be transferred to and processed in those jurisdictions. Nana's transfers to Cosmos Services use TLS. Overseas processing is also subject to the relevant providers’ terms and privacy policies and the safeguards described in §7; this does not mean that all processing occurs in Australia.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the current version. Where notice is required by applicable law, we will provide it through an appropriate channel. Continued use of Nana after changes take effect constitutes acceptance of the updated policy.

16. Contact Information

If you have any questions about this Privacy Policy or how we handle your information:

Email: [email protected]
Subject Line: [Nana Privacy]
Website: https://cosmosone.cloud
Response Time: Within 5 business days

17. Summary

Aspect	Details
What Nana is	Voice-first personal knowledge app for Android
Where your notes are stored	On your device, in an AES-256-encrypted database — never synced to a server
What is sent for processing	Audio recordings, transcript text, semantic-search queries, questions, and note excerpts — sent to Cosmos Services and its configured AI provider to transcribe, organise, embed, and answer questions
What the App sends to Cosmos Services	Account information, usage information, and purchase-validation records needed for the features described in this policy; Nana does not synchronise the local note database
Location and age checks	Optional approximate foreground location for country/state checks; provider processing disclosed in §4.4; no coordinates or age bands stored by Nana or sent to Cosmos Services
Advertising	None — no ads and no advertising SDK
Analytics and tracking	No analytics, crash-reporting, or tracking SDKs, and no use of the advertising ID
Data selling	Never
Subscriptions	Plus/Premium memberships billed entirely by Google Play; we never see payment details (§9.2)
Account deletion	In-app (Settings → Advanced → Delete Account) or cosmosone.cloud/account-deletion; Cosmos Services processes verified requests and confirms the outcome
Local data deletion	Delete notes, Settings → Advanced → Delete All Local Data, or uninstall
Google account access	Sign-in scopes (`openid`, `email`, `profile`) and separate Play Age Signals where applicable — no Gmail, Drive, Calendar, or Contacts
Contact	[email protected]