1. What data we collect
We collect the personal data you provide when you create and use your account, including your email address, full name, tasks, calendar events, notes, AI conversation history, and business information you choose to enter or connect. We also collect technical data such as your IP address, browser type, and device information, which are generated automatically when you interact with the service.
2. How we use your data
We use your data to provide, operate, and improve Nerve OS; to authenticate you and keep your account secure; to synchronise with connected services such as Google Calendar; to communicate with you about your account, updates, and support requests; and to understand how the service is used so we can improve it. We do not sell your personal data to third parties.
We do not use your personal data to train AI models, and we do not use it for marketing purposes. Any AI features in Nerve OS process your data only to deliver the requested functionality to you, and your content is not used to train our models or those of our subprocessors.
Before sending your workspace data to an AI model, our server replaces personal identifiers — names, email addresses, and phone numbers — with neutral placeholders such as [PERSON_1]. The mapping between a placeholder and the real value lives only in memory for the duration of that single request, and is never written to disk, sent to the AI provider, or shared with anyone. You can turn this redaction off in Settings → AI privacy if you prefer the assistant to see raw data.
3. Legal basis for processing
We process personal data where we have a lawful basis to do so, such as performing the contract with you, complying with legal obligations, pursuing our legitimate interests in operating and securing the service, or where you have given consent (for example, to receive marketing updates). You can withdraw consent at any time by contacting us.
4. Data sharing and subprocessors
We rely on carefully selected third-party services to host, secure, and operate Nerve OS. These currently include Supabase (database and authentication), Google Calendar (optional calendar integration), hCaptcha (spam prevention), analytics providers, and Resend (transactional email). Each subprocessor is contractually bound to handle data only for the purposes of providing their service to us and in line with applicable data protection requirements.
4a. Google API Services User Data Policy
Nerve OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we access. When you choose to connect a Google account, Nerve OS uses Google OAuth to request read and write access to your Google Calendar events and the email address associated with the connected calendar account. We do not request access to your Gmail messages, Google Drive files, Contacts, or any other Google service.
How we use it. We access your Google Calendar via OAuth to display your upcoming schedule on your dashboard and calendar views, to detect scheduling conflicts, and to allow our AI assistant, Rook, to analyse your daily availability and suggest task breakdowns, reminders, and time blocks. When you ask Rook to create, edit, or cancel an event, we write that change back to the originating Google Calendar on your behalf.
How we store it. We store only the calendar event metadata necessary to operate your dashboard — typically the event title, start and end time, location, attendees, description, recurrence rule, and the Google-issued event ID used to keep our copy in sync with Google's. OAuth refresh tokens, chat messages, email bodies, and push-notification subscription keys are encrypted at rest using AES-256-GCM at the application layer, on top of the underlying database's disk encryption. This data is scoped to your account and protected by row-level security so it is only readable by you and the Nerve OS server processes acting on your behalf.
How we share it. Data we receive from Google APIs is never sold, never used for advertising, never used to train AI or machine-learning models (ours or anyone else's), and never shared with third parties except as needed to provide the feature you requested (for example, sending your edits back to Google). Before any calendar content is sent to an AI subprocessor to power Rook, the personal-identifier redaction described in Section 2 applies: names, email addresses, and phone numbers are replaced with neutral placeholders unless you have explicitly turned redaction off in Settings → AI privacy.
How to revoke access. You can disconnect Google Calendar at any time from Settings → Calendar accounts. Disconnecting removes the OAuth tokens and the synced calendar events from Nerve OS. You can additionally revoke Nerve OS's access from your Google account at myaccount.google.com/permissions.
5. Cookies and analytics
We use essential cookies and similar technologies required for authentication, security, and core service functionality. We also use analytics cookies — only after you opt in — to understand how visitors use Nerve OS, which helps us improve the product. You can review the categories we use, and change or withdraw your consent at any time, in our cookie policy or via the button below.
6. Data retention
We keep your personal data for as long as your account is active and as needed to provide the service. When you delete your account, your personal data is removed from our live systems. We may retain historical, anonymised analytics data that cannot reasonably be linked back to you.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to receive a copy of data you provided in a portable format. To exercise these rights, or if you have questions about how we handle your data, contact us at support@nerve-os.app.
8. Security
We implement reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse. However, no online service can guarantee absolute security. You are responsible for keeping your account credentials safe and for notifying us promptly of any suspected unauthorised access.
9. Children's privacy
Nerve OS is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children. If we learn that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that information.
10. Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. Your continued use of Nerve OS after changes take effect constitutes acceptance of the revised policy.
11. Contact
If you have questions or concerns about this Privacy Policy or how we handle your data, contact us at support@nerve-os.app.