Privacy Policy

Effective date: 21 September 2026

Last updated: 21 September 2026

Nabu is an AI-powered relationship reflection and self-reflection app. You answer questions about yourself and your relationship, and Nabu helps you notice patterns and, if you link a partner, share selected answers with them.

That means you tell us personal things. This policy explains exactly what we collect, why, who else sees it, how long we keep it, and how you get it back or get rid of it. We have tried to write it in plain language rather than legalese.

The short version. We collect what you type into Nabu and the account details needed to sign you in. We use it to run the app and to generate reflections with an AI service. We do not sell your data, and we do not share it for advertising. Your answers are encrypted in transit and at rest. You can delete everything at any time from Settings ▸ My Data, and you can ask us by email for a copy of it.

1. Who we are

DULF DAVID-FERENC ("Nabu", "we", "us", "our") is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible to you for it.

Nabu is currently operated by an individual established in Romania, not by a company. That does not reduce your rights or our obligations in any way — a sole trader is a controller with exactly the same duties under the GDPR.

Registered address: Cluj-Napoca, Romania
Privacy contact: nabuaicoach@gmail.com
Data protection officer: We have not appointed one. Our processing does not meet the criteria in Article 37 of the GDPR that would require it, and we would rather tell you that than name a role nobody fills. Send privacy questions to nabuaicoach@gmail.com and a person will read them.

If you are in the European Economic Area, the United Kingdom, or Switzerland, this policy is written to meet the General Data Protection Regulation (GDPR). If you are a California resident, see section 11 for your rights under the California Consumer Privacy Act as amended by the CPRA (CCPA).

2. What we collect

We only collect data you give us or that the app needs in order to work. We do not buy data about you, and we do not collect data about you from other companies.

How we collect it. Everything in this section reaches us in one of three ways: you type it into the app; the app records your progress as you use it; or your device and our authentication provider supply it automatically, such as a push token, an IP address or a sign-in timestamp. We collect nothing about you from any other source.

2.1 Account data

Your email address, which you provide at sign-up and which identifies your account.
A user ID, a random identifier generated by our authentication provider.
Your password, which is handled entirely by Google Firebase Authentication. It is stored as a salted hash by that service. We never see, receive, or store your password.
Sign-in metadata kept by our authentication provider, including account creation time, last sign-in time, and the IP address used to sign in.

2.2 Your profile answers

During onboarding we ask you, and store:

Your nickname or first name, which your linked partner can see.
How you identify (woman, man, non-binary, or a description you write yourself).
Your relationship status (good friends, just started dating, long-term relationship, married).
What you want to improve in your relationship.
How you behave in arguments, on a five-point scale.
The dynamic you want more of (deep talks, fun, romance, teamwork, adventure, gratitude, and similar).
What kind of activity you prefer in the app.

2.3 What you write in the app

Answers to daily questions, including free-text answers you type yourself.
Messages you send to the Nabu coach, which is a chat feature. People often write about how they feel, about conflicts, and about their relationship here.
Mini-game answers.
Your partner invite code and the record of which account you are linked to.

2.4 Usage and progress data

Number of questions answered and skipped, in a session and over your lifetime in the app.
Questions you and your partner answered together.
Streak days, experience points, and in-app coins.
Time spent in question sessions.
The date of your last session and last streak.
Your device's time zone offset, so reminders and daily sessions land at a sensible local time.

2.5 What we work out from your answers

Insights. Nabu uses OpenAI, our AI provider, to write short observations about your answers — about your communication, appreciation, conflict, intimacy, shared activities, and emotional patterns, both individually and as a couple. These insights are derived personal data about you, they are stored with your account, and they are covered by every right described in section 10.

Your relationship profile ("DNA"). When you finish Nabu's 25 onboarding questions, our servers turn your answers into a profile. It contains: an archetype with a one-line description; your primary love style; where you sit on four scales (how you pace conflict, how directly you communicate, independence versus togetherness, and spontaneity versus structure); how strongly each of four love languages shows up in your answers; and four wellbeing scores describing how you feel in your relationship. It also holds three private notes drawn from your answers — how you tend to handle outside stress, what gives your relationship meaning to you, and the relationship you hope for. Those three are used only as background for the Nabu coach, which means they are sent to OpenAI as described in section 4. They are never shown on any screen, including yours.

Building this profile is profiling in the GDPR sense: an automated evaluation of personal aspects of you. It is a reflection for you and your partner, not a decision about you, and it has no legal or similarly significant effect (see section 4). Like everything else here, it is covered by every right in section 10.

What your linked partner sees of your profile: your archetype and its description, your primary love style, your four scale positions and your love-language scores. Your partner never sees your wellbeing scores or the three private notes — our servers remove them before your profile is sent to your partner's app. You see your partner's profile on exactly the same terms.

2.6 Device and technical data

A push notification token for your device, plus whether it is Android or iOS, so we can send you the reminders you enable.
Standard technical data that any internet service receives when your app talks to our servers, such as your IP address and the time of the request.

2.7 What we deliberately do NOT collect

We want to be specific about this, because a lot of apps in this category do collect these things:

No audio. Nabu does not record you. The app does not request microphone permission on Android or iOS. An earlier voice feature that streamed audio to a third-party provider was removed before launch.
No analytics or behavioural tracking SDKs. There is no Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude, no advertising SDK.
No crash-reporting SDK.
No advertising identifiers, no cross-app or cross-site tracking, no ad targeting, no profiling for advertising.
No location data. We do not request or collect GPS or precise location.
No contacts, photos, camera, calendar, or health-app access.
We never ask for special category data. No question in Nabu asks about your health, sexual orientation, religion, ethnicity, political opinions, or biometrics, and we collect none of it by design. But free-text fields are free text, and a reflection app about your relationship is somewhere people do write about how they feel, about intimacy, and about their mental health. We treat that content as capable of revealing special category data and ask for your explicit consent before OpenAI processes it — see section 4.

3. Why we use it, and our legal basis

Under the GDPR we must have a lawful basis for each purpose. Ours are:

To create and run your account — providing the service you asked for. Legal basis: performance of a contract (Article 6(1)(b)).

To show you questions, store your answers, track your progress, and build the relationship profile described in section 2.5 — this is the core function of the app. Legal basis: performance of a contract (Article 6(1)(b)).

To generate AI reflections and insights from your answers — the feature you signed up for. Legal basis: performance of a contract (Article 6(1)(b)), supported by the separate explicit consent you gave when you created your account (Article 6(1)(a)).

To process, through OpenAI, content that may reveal information about your health, your mental health, or your sex life — because free-text answers and coach messages sometimes do. Legal basis: your explicit consent (Article 9(2)(a)). This is the third tick box at sign-up, kept separate from the Terms and from your age declaration so that it is a decision of its own. Without it we do not send your content to the AI service at all: the coach is unavailable and no new insights are generated. You can withdraw it at any time in Settings ▸ My Data, and turn it back on in the same place.

To share selected answers with the partner you linked — only answers marked as shared, plus the parts of your relationship profile listed in section 2.5, and only with the account you deliberately linked. Legal basis: performance of a contract (Article 6(1)(b)) and your consent, given by linking a partner and marking answers as shared (Article 6(1)(a)).

To send reminders and notifications you switched on — you control every category in Settings ▸ Notifications. Legal basis: your consent (Article 6(1)(a)), withdrawable at any time by turning the toggle off.

To keep the service secure, prevent abuse, and debug faults. Legal basis: our legitimate interests in operating a safe and functioning service (Article 6(1)(f)).

To comply with legal obligations and to establish or defend legal claims. Legal basis: legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).

We do not use your data for advertising, for building marketing profiles, or for any purpose incompatible with the ones listed here.

4. AI processing — how your answers are used

This is the part people most want to understand, so here it is in detail.

None of it happens without your explicit consent. When you create your account you tick a box, separate from the Terms and from your age declaration, agreeing that content which may reveal sensitive details about you can be sent to OpenAI, our AI provider. That is your consent under Article 9(2)(a) of the GDPR, and it is the entire lawful basis for this section. That tick box names OpenAI, and so does the How Nabu uses AI screen linked beside it, so you know who receives your content before any of it is sent.

You can withdraw it at any time, in Settings ▸ My Data, in one tap. When you do, we stop sending anything to OpenAI immediately: the coach becomes unavailable and no new insights are generated. Nothing is deleted — insights already written stay in your account, and withdrawing does not make our earlier processing unlawful (Article 7(3)). You can turn it back on from the same screen whenever you want.

What is sent, and to whom. When you use the Nabu coach chat, or when Nabu generates insights, the relevant content is sent from our servers to OpenAI (OpenAI Ireland Limited), through their commercial business API. Your phone never contacts OpenAI directly. That content is: the messages you write to the coach; your answers to Nabu's questions, including free text; the background notes from your relationship profile described in section 2.5; and, for a couple insight, the answers you and your partner have shared with each other. OpenAI is the only AI provider we use, and we send your content to no other AI company.

How it travels and how it is stored. Content is encrypted in transit using TLS 1.2 or higher, both between your device and our servers and between our servers and the AI provider. It is encrypted at rest in our database and backups using industry-standard encryption managed by our hosting provider.

It is not used to train AI models. We use OpenAI's commercial API under terms which provide that data submitted through the API is not used to train or improve their models. Your relationship answers do not become training data. This is a contractual commitment from the provider, not merely a setting.

Limited provider-side retention. OpenAI may retain API content for up to 30 days for abuse monitoring and legal compliance, after which it is deleted.

They are held to the same protection we are. OpenAI processes your content only as our processor: they may only use it to provide the service to us, and for no purpose of their own. That is set out in a written data processing agreement which imposes confidentiality, security measures, controls on any sub-processor they use, and assistance with the rights described in section 10 — obligations equivalent to the protections this policy promises you. Where content leaves the European Economic Area, that agreement incorporates the European Commission's Standard Contractual Clauses. No processor we use may offer you a lower standard of protection than we do.

No human review by us as routine. We do not read your answers or coach messages as a matter of course. Access is restricted to the small number of people who need it to operate the service, and only where necessary — for example investigating a fault you report, or where we are legally required to.

No automated decisions with legal effect. Nabu's insights are reflections, prompts, and observations. They are not decisions about you, and they produce no legal or similarly significant effect. You are not subject to automated decision-making within the meaning of Article 22 of the GDPR.

AI output can be wrong. AI-generated insights and coach responses may be inaccurate, incomplete, or simply unhelpful. They are not professional advice. See the Mental Health Disclaimer in our Terms of Service.

We do not sell your personal data. We never have, and we do not share it for cross-context behavioural advertising. There is no exception to this hiding elsewhere in the policy.

We share data with a small number of service providers (processors) who help us run Nabu. Each is bound by a contract that limits them to acting on our instructions, requires appropriate security, forbids using your data for their own purposes, and requires a standard of protection equivalent to the one this policy promises you.

Google Firebase Authentication (Google Ireland Limited / Google LLC) — handles sign-in. Receives your email address, password, user ID, IP address and sign-in timestamps. Processed in the United States.

Google Firebase Cloud Messaging (Google Ireland Limited / Google LLC) — delivers push notifications. Receives your device push token and the content of the notification. Processed in the United States.

OpenAI (OpenAI Ireland Limited) — generates coach responses and insights. Receives the content described in section 4. Processed in the United States, and potentially other countries where OpenAI or its sub-processors operate, under the safeguards in section 6. Bound by a data processing agreement, and contractually prohibited from training on your data.

Railway — hosts our backend servers and database, where your account and all your answers live. Processed in European Union (EU).

Google Forms (Google Ireland Limited / Google LLC) — used only as a fallback channel for data requests. This applies only if you choose to use the linked form rather than the in-app request or email.

We may also disclose personal data where we are legally required to — to comply with a valid court order, subpoena, or legal obligation; to enforce our Terms of Service; or to protect the rights, safety, or property of our users or the public. Where we are permitted to tell you about such a request, we will.

If Nabu is ever involved in a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity. We will notify you before that happens and before any new privacy policy applies to you, and you will have the opportunity to delete your account first.

6. International transfers

We are established in Romania. Some of our processors — notably Google and OpenAI — process personal data in the United States and potentially other countries outside the European Economic Area.

Where personal data leaves the EEA, UK, or Switzerland, we rely on one or more of the following safeguards under Chapter V of the GDPR:

The European Commission's Standard Contractual Clauses (SCCs), incorporated into our contracts with each processor, together with transfer impact assessments and supplementary technical measures such as encryption in transit and at rest.
The EU–US Data Privacy Framework and its UK Extension, where the recipient is certified under it.
The UK International Data Transfer Addendum for transfers from the United Kingdom.

You may request a copy of the relevant safeguards by writing to nabuaicoach@gmail.com.

7. How long we keep it

While your account is open, we keep your account data, profile answers, written answers, insights, relationship profile, and progress data so the app works and so your history is there for you.

When you delete your account or ask for erasure, we delete your personal data from our active systems within 30 days, unless a specific legal obligation requires us to keep something for longer.

Backups. Deleted data may persist in encrypted backups for up to 30 days before those backups rotate out. During that window the data is not used for anything — it is only there for disaster recovery — and it is deleted when the backup expires.

Server and security logs are kept for up to 30 days and then deleted.

Records we must keep. We retain a record of your consent to this policy and to our Terms — the version and the date — for as long as necessary to demonstrate compliance, as required by Article 7(1) of the GDPR. We may also retain the minimum data needed to comply with tax, accounting, or other legal obligations, or to establish or defend a legal claim.

Partner-linked answers. If you delete your account, answers you shared with a linked partner are removed and your partner sees that the answer is no longer available. Your partner's own answers belong to your partner and are not deleted by your request.

8. How we protect it

Encryption in transit. All traffic between the app, our servers, and our processors uses TLS 1.2 or higher. The app makes no unencrypted network requests.
Encryption at rest. Our database and its backups are encrypted at rest with industry-standard encryption managed by our hosting provider.
Authentication. Sign-in is handled by Google Firebase Authentication. Every request to our backend must carry a short-lived, signed identity token; there are no unauthenticated data endpoints.
Access control. Access to production data is limited to personnel who need it to operate the service, and it is logged.
Data minimisation. We collect only what the app needs. We do not maintain analytics pipelines, advertising profiles, or third-party trackers that would multiply where your data lives. The app's typefaces are bundled inside it rather than downloaded, so opening Nabu does not announce your IP address to a font service.

No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33, and we will notify you without undue delay where the breach is likely to result in a high risk to you, as required by Article 34.

9. Children

Nabu is not intended for anyone under 16, and we do not knowingly collect personal data from anyone under 16.

You must confirm that you are 16 or older when you create an account. If we learn that we have collected personal data from someone under 16, we will delete that account and its data promptly. If you believe a child has provided us with personal data, please write to nabuaicoach@gmail.com and we will act on it.

10. Your rights

These rights are yours under the GDPR if you are in the EEA, UK, or Switzerland. We extend the substance of them to all our users regardless of where you live, because we think that is the right way to run this app.

Right of access (Article 15). You can ask us for a copy of the personal data we hold about you, and for information about how we use it. Email nabuaicoach@gmail.com from the address on your account. Section 2 of this policy already lists everything we hold, and Settings ▸ My Data shows you the same list inside the app.

Right to data portability (Article 20). You can receive the data you provided to us in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible. Email us and we will assemble it for you. There is no download button in the app: we would rather do this by hand and do it properly than ship an automatic export we have not built.

Right to rectification (Article 16). You can correct inaccurate data. Your nickname is editable in Settings ▸ Account; for anything else, write to us and we will fix it.

Right to erasure — the "right to be forgotten" (Article 17). You can have your personal data deleted. Use Settings ▸ My Data ▸ Delete my data, or Settings ▸ Account ▸ Delete account, which removes your account and your data. We complete erasure within 30 days, subject to the backup and legal-retention points in section 7.

Right to restriction of processing (Article 18). You can ask us to pause processing your data in certain circumstances — for example while we check a correction you have requested.

Right to object (Article 21). You can object to processing we carry out on the basis of legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests.

Right to withdraw consent (Article 7(3)). Where we rely on your consent, you can withdraw it at any time, and it is as easy to withdraw as it was to give:

AI processing of sensitive content — Settings ▸ My Data ▸ Turn off AI reflections. One tap, no email, no explanation required.
Notifications — turn off any category in Settings ▸ Notifications.
Partner sharing — unlink in Settings ▸ Partner.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Rights relating to automated decision-making (Article 22). As explained in section 4, we do not make automated decisions producing legal or similarly significant effects about you.

Right to complain. You can lodge a complaint with a supervisory authority, in particular in the country where you live, work, or where you believe an infringement occurred. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. We would appreciate the chance to address your concern first, but you do not have to come to us before going to them.

How to exercise your rights

Erasure and consent withdrawal are in the app: Settings ▸ My Data. For everything else, including a copy of your data, email nabuaicoach@gmail.com from the address on your account.

How these requests are handled today. Turning off AI reflections, deleting your account, and unlinking a partner all happen immediately in the app. Requests for a copy of your data, and requests to erase it without deleting your account, are fulfilled by email rather than automatically: a person reads your message and acts on it by hand. It is a real route and the 30-day deadline below applies to it in full — we would rather describe it accurately than imply an automated export that does not exist.

We respond within 30 days. If a request is unusually complex we may extend by up to two further months, and we will tell you within the first month if that happens and why. Exercising your rights is free; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain our reasoning if we ever do. We may need to verify your identity — usually by confirming you control the account email — before acting on a request, so that nobody else can obtain or delete your data.

11. California residents

If you are a California resident, the CCPA gives you the following rights, in addition to everything in section 10.

Right to know. You can request the specific pieces of personal information we have collected about you, the categories collected, the sources, the business purpose, and the categories of third parties we disclose to. All of this is set out in sections 2, 3, and 5 above.

Right to delete. You can request deletion of personal information we collected from you, subject to the exceptions in the statute.

Right to correct. You can request correction of inaccurate personal information.

Right to opt out of sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined in the CCPA. We have not done so in the preceding 12 months. Because we do not do it, there is no "Do Not Sell or Share My Personal Information" mechanism to offer you — but if that ever changed, we would tell you and provide one before it took effect.

Right to limit use of sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA.

Right to non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights. We offer no financial incentives in exchange for personal information.

Categories collected in the past 12 months, in CCPA terms: identifiers (email, user ID, device token, IP address); internet or network activity (app usage and progress data); geolocation limited to time zone offset and the coarse location implied by an IP address, and no precise geolocation; other personal information you voluntarily provide in your answers and messages; and inferences drawn from your answers (your insights and your relationship profile). We collect these from you directly and from your use of the app. We disclose them for a business purpose to the service providers listed in section 5.

Authorised agents. You may use an authorised agent to submit a request. We will require written proof of authorisation and verification of your identity.

To exercise the right to delete, use Settings ▸ My Data. For the right to know, the right to correct, or anything else in this section, email nabuaicoach@gmail.com.

12. Changes to this policy

If we make material changes to this policy, we will:

Update the effective date at the top.
Increment the policy version bundled in the app.
Ask you to review and accept the new version in the app before you continue using Nabu, so that a material change never takes effect silently.

Non-material changes — fixing a typo, clarifying wording — may be made without re-prompting you.

You can always read the current policy in Settings ▸ Privacy Policy

13. Contact us

Questions, requests, or complaints about this policy or your data:

Email: nabuaicoach@gmail.com — this is also the privacy and data protection contact; we have no separate data protection officer, as explained in section 1.
Post: DULF DAVID-FERENC, Cluj-Napoca, Romania

We read everything sent to these addresses, and we will respond within 30 days.