Privacy policy

• Your email is never public. We use it for sign-in, security, and essential account notifications.
• We never store your exact address. City and country are optional and you can hide them.
• No behavioural advertising or selling data. Essential hosting, authentication, and security logs are still processed to operate Narumelo.
• Request a copy of your data. Use the profile export control where available, or contact privacy@narumelo.com.
• Request account deletion anytime. We complete deletion requests within 30 days and delete or de-identify associated personal data, subject to the limited retention explained below.

Account information: your email address, display name, username, and (optionally) a bio, city, country, age range, and avatar image.

Google sign-in information: if you choose Continue with Google, Google and Supabase provide the basic profile information required for sign-in, such as your email address, name, and profile image. Narumelo does not request access to your Gmail, contacts, files, or other Google services.

Pricing waitlist: if you voluntarily join the waitlist, we store the email address you enter, the future plan you select, your consent record, and the dates you joined or updated your choice. Joining the waitlist does not create a purchase or subscription.

What you create: circle messages, direct messages, Daily Prompt responses, reactions, circle house rules, reports, membership requests, and connections. A Daily Prompt answer is private by default and appears in your personal prompt archive. It becomes a community thought only when you deliberately choose “Share with Narumelo”.

Payments: Narumelo does not offer a public checkout, paid subscription, or one-time payment at launch. We will update this policy before introducing a payment provider or collecting billing information.

Technical and security data: our hosting and authentication providers may process request paths, timestamps, IP addresses, browser or device information, status codes, and security events to deliver and protect the service. We do not currently use third-party behavioural analytics, advertising pixels, or device fingerprinting.

What we never collect: your exact home or street address, your phone number (unless you choose to add it to your private account recovery later), your precise location, or your contacts list.

We use your data only to:

• Operate your account and sign you in securely.
• Match you to circles and people based on your stated interests and preferences.
• Deliver circle messages, direct messages, and notifications.
• Deliver relevant in-app announcements, which may be targeted by account plan, circle membership, or account status.
• Investigate reports and keep the community safe.
• Send essential account emails such as password resets and security notices.
• If you expressly join the pricing waitlist, email you only about that waitlist and the optional future plan you selected.

The following fields are visible to other members on your public profile:

• Display name, username, avatar, bio
• City and country (only if you haven’t hidden them)
• Age range (optional)
• Interests, introvert type, reply style, social battery

Never public: your email, password, exact address, reports you’ve filed, people you’ve blocked, or any administrative information.

Daily Prompt visibility: a private answer is visible only to you. If you share it with Narumelo, eligible signed-in members can see the answer with your display name, username, avatar, reaction totals, and share count. You can make it private again or delete it. Your earlier answers remain in your private archive unless you delete them.

We use a small number of service providers to operate Narumelo:

• Supabase provides authentication, PostgreSQL database hosting, private avatar storage, and realtime updates.
• Google provides optional Google sign-in when you choose that method.
• Hostinger hosts and delivers the website and processes limited request and runtime logs.

These providers process information on our behalf under their own security and privacy terms. Data may be processed in countries other than your own. We will update this policy before adding a marketing-email or behavioural-analytics provider.

Narumelo runs on Supabase PostgreSQL and uses Row Level Security, server-side authorisation, and application access controls to help enforce who can read or write each type of information. For example:

• Circle messages are ordinarily readable by approved members of that circle.
• Direct messages are only visible to the two accepted participants.
• Reports are visible to the reporter and authorised administrators.
• Blocked users cannot message each other.
• Only you can edit your own profile.
• Only you can read your private Daily Prompt answers; community thoughts are shown only after you choose to share them.

Authorised administrators cannot browse private conversations. When a user reports a specific message or community thought, moderators may access that exact reported content and the report details needed to review it. Other messages, private prompt answers, and unrelated content are not included.

We keep your data for as long as your account is active. If you request account deletion, we complete the request within 30 days and delete or de-identify your profile, connections, memberships, preferences, private account information, and associated personal data. We may retain limited security, moderation, audit, or legal records only where reasonably necessary or required by law, and only for as long as that purpose requires.

If you leave a circle without deleting your account, messages you sent may remain visible to its members so the conversation remains understandable. After account deletion, any retained message content is de-identified unless limited retention is required for a safety or legal reason. You may request removal of specific content by contacting privacy@narumelo.com.

Waitlist records are kept while the waitlist is active or until you ask us to remove your email. You can update your plan choice by submitting the same email again, or withdraw by contacting privacy@narumelo.com.

Daily Prompt answers remain in your private archive while your account is active unless you delete them. Making a shared thought private removes it from the community view. Deleting it removes the answer from your archive and community view, subject to limited moderation or legal retention where a specific report requires it.

You have the right to:

• Access your data — use “My profile → Your data” where available, or request a copy at privacy@narumelo.com.
• Correct your data — edit any field on your profile anytime.
• Delete your account — request deletion from “Your data” or email privacy@narumelo.com if the in-app control is unavailable.
• Pause — hush notifications, pause matching, or take a quiet break.
• Object — report any processing you’re uncomfortable with.
• Withdraw from the waitlist — email privacy@narumelo.com and we will remove your waitlist record.

Depending on where you live, applicable privacy law may give you additional access, correction, deletion, restriction, objection, or appeal rights. To exercise them, use the in-app tools first; if you need help, contact privacy@narumelo.com.

Supabase Auth handles password and Google sign-in sessions. Narumelo uses server-managed session cookies, Row Level Security, private storage with expiring avatar links, server-side authorisation, and input validation. Avatar uploads are restricted to supported image types, re-encoded to strip embedded metadata, and capped at 4MB. Server-only Supabase credentials are never included in public frontend code, and sensitive actions have abuse-prevention limits.

No system is perfectly secure. If you believe you’ve found a vulnerability, please report it responsibly to security@narumelo.com and we’ll respond within 72 hours.

Narumelo is for adults 18 and older. We do not knowingly collect data from minors. If we learn an account belongs to someone under 18, we disable it and take appropriate deletion and safety action. Our rules for child sexual abuse and exploitation are published in the Child safety standards.

We’ll update the “last updated” date above whenever we change this policy in a material way. We’ll never silently weaken your privacy — if we did, that would defeat the whole point.