Nostos Privacy Policy

Effective date: October 10, 2026 Last updated: October 19, 2026

Nostos is a habit app. You set daily goals, and when you meet them you earn in-app points called FitCoins, build streaks, and unlock chapters of Tigur's story. The current version of Nostos is free: there are no payments and no in-app purchases. FitCoins can't be bought, sold or cashed out. During the beta, a limited number of FitCoins can be swapped for small Amazon.com gift cards, which we send to you by email. FitCoins can also unlock discount codes from partner brands.

This policy explains what information Nostos collects, why, where it goes, and the choices you have. We've tried to keep it short and specific.

Health data has its own policy. How we handle health and fitness information is also described in our Consumer Health Data Privacy Policy, which is written for the Washington My Health My Data Act and similar state laws. The two documents are consistent; if they ever seem to differ on health data, the Consumer Health Data Privacy Policy controls.

At a glance

• We collect what we need to run your account and back up your progress: your email address, an optional name, your goals, streaks and FitCoins, and, if you connect Apple Health, one daily total for the metric your challenge tracks.
• We do not sell your information, we do not share it for advertising, and there are no ads, ad networks or tracking SDKs in the app.
• Apple Health data is read-only, used only to check your goals, and never used for advertising or marketing.
• You can turn off usage analytics and delete your account and data from inside the app (Settings → Data & privacy).
• Nostos is run from India. Your information is stored on a server in India that we operate ourselves (see §7).

1. Who we are

Nostos is operated by the Nostos team ("Nostos," "we," "us"), based in India. Privacy questions and requests: [email protected] General support: [email protected]

This policy covers the Nostos iOS app, the Nostos servers the app talks to, and the website at nostos.fit. It is written for users in the United States, and also covers users in Canada, Australia, New Zealand and Singapore, where the beta is open (see §10).

2. What we collect

Information you give us

Information from Apple Health (only if you allow it)

If you choose to sync a challenge from Apple Health, Nostos first shows its own explanation screen and then the iPhone's Health permission sheet. In that sheet you decide which of these types Nostos may read:

• steps
• active energy (active calories)
• exercise minutes
• resting heart rate
• sleep (time asleep)

Nostos only reads; it never writes anything to Apple Health. It reads only the type your active challenge uses, as one total per day (for example, total steps for Tuesday, or hours asleep). It doesn't read individual workouts, heart-rate samples, locations or any other Health data.

Each day's result is saved as: the date, the metric, that day's total, your target, and whether you met it. This result is stored on your iPhone and backed up to our server with the rest of your progress (see "Your synced progress" below), so you can restore it on a new phone.

Information collected automatically

Information from Apple about the app

If you've chosen in your iPhone settings to share analytics with app developers, Apple may give us aggregated statistics and crash reports about Nostos through App Store Connect. Apple controls that sharing under its own privacy policy.

3. What we don't collect

Nostos does not collect:

• payment card, bank or any other financial information (the app has no payments);
• your precise or approximate location (we only know your time zone setting);
• your contacts, photos, camera, microphone or files;
• the advertising identifier (IDFA), and we don't track you across other companies' apps or websites;
• any Apple Health data other than the daily totals described above.

The app contains no third-party SDKs: no advertising, analytics, crash-reporting or social-media libraries. Analytics go only to our own server.

4. Apple Health (HealthKit): our commitments

For any information that comes from Apple Health, we commit that we:

• use it only to check your goals, award FitCoins and streaks, and show your history;
• never use it for advertising, marketing or data mining, and never let anyone else use it for those purposes;
• never sell it, and never share it with advertisers, data brokers or information resellers;
• don't share it with any third party except the service providers that store or carry it for us under contract (see §6), or when the law requires it;
• don't store it in iCloud;
• never write data to Apple Health.

You can stop Nostos reading Apple Health at any time in the iPhone Settings → Health → Data Access & Devices → Nostos (or in the Health app). See §9 to delete what we've already stored.

5. How we use information

We use information to:

• run the app: create and secure your account, sign you in, email you a code to confirm your email address or to reset your password, track your goals and streaks, award FitCoins, unlock story chapters, and back up and restore your progress;
• give you Tigur's gifts, and deliver a gift card if you receive one or swap FitCoins for one;
• answer you: reply to feedback and support or privacy requests;
• run the beta: choose testers from beta sign-ups and email them a TestFlight invite and beta updates;
• improve Nostos: understand, mostly in aggregate (for example retention charts and onboarding drop-off), which features help people keep their goals. Only the founder can see this;
• keep Nostos safe: prevent abuse and fix problems;
• meet legal obligations, and enforce our Terms.

We do not use your information for advertising, we do not build advertising profiles, and we do not make decisions about you that have legal or similarly significant effects based on automated processing. If we ever want to use your information for a new purpose that this policy doesn't describe, we'll ask for your consent first.

6. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. We have never done so.

We share information only with:

• Cloudflare, Inc., our network and security provider. Traffic between the app or website and our server passes through Cloudflare's network (including Cloudflare Tunnel), encrypted in transit. Cloudflare also provides the cookie-free visit counts for the nostos.fit website (Cloudflare Web Analytics).
• Our email provider, which stores the emails you send us.
• Brevo (Sendinblue SAS), which delivers the emails our server sends, such as a code to confirm your email address or reset your password. It receives your email address and that email's content. Nothing else, and never health information.
• Amazon, only if you swap FitCoins for an Amazon.com gift card. We buy the eGift card on amazon.com and give Amazon your email address and the gift amount so it can email the card to you. Nothing else, and never health information. Amazon handles that information under its own privacy notice.
• Partner brands get nothing from us. When you unlock a partner reward, we just show you the brand's code; if you then shop with that brand, you're dealing with them directly under their own privacy policy.
• Tremendous, only if we offer you a gift card through it. To create the gift card we send Tremendous the gift amount and our internal gift ID. We do not send your name, email or health information (the order uses a generic recipient name). When you open the gift-card link, you're dealing with Tremendous directly and its own privacy policy applies to what you give it.
• Apple and Google, only to verify your sign-in if you choose Sign in with Apple or Sign in with Google. They act under their own privacy policies.
• Authorities or others when the law requires it, for example a valid subpoena or court order, or when we believe in good faith that disclosure is needed to protect someone's safety or to protect Nostos against fraud or abuse. Where the law allows, we'll tell you first.
• A successor, if Nostos is transferred to a company the founder sets up or to a buyer. This policy will continue to protect your information, and we'll notify you before your information becomes subject to a different policy.

Every service provider processes information only to provide its service to us and is required to protect it at least as well as this policy does. We don't have any affiliates.

7. Where your information is stored, and international transfer

Nostos is run from India. Your account and synced progress are stored in a database on a server in India that we operate ourselves, and the founder accesses and administers it from India. Your information therefore leaves your country and is processed in India, where data-protection law differs from US law (India's law in this area is the Digital Personal Data Protection Act, 2023). Cloudflare carries traffic through its worldwide network.

Wherever your information is processed, it's protected as described in this policy.

8. How long we keep information

When you delete your account, we delete your account details, your synced progress (including all daily health results), your gift records, your time zone and any feedback you sent while signed in from our live database straight away. Analytics records are kept only as unlinked records under the random install ID (the app also starts a new random ID on your phone), and we don't try to re-identify them.

9. Your choices and rights

In the app

• Turn off usage analytics: Settings → Data & privacy → "Share anonymous usage data". When off, the app sends no analytics and deletes any not yet sent.
• Stop Apple Health access: iPhone Settings → Health → Data Access & Devices → Nostos.
• Delete your account and data: Settings → Data & privacy → Delete my data. This deletes your account and data on our server and then wipes Nostos data from your phone. It needs an internet connection: if our server can't confirm the deletion, the app tells you and nothing is deleted, so you can try again. You can also email [email protected] and we'll delete your data and confirm.
• Sign out: signs you out; your progress stays on that phone until you delete it.

Your rights

Whatever US state you live in, you can ask us to:

• confirm whether we hold your information, and access it (we'll send you a copy in a portable, machine-readable format);
• correct inaccurate information;
• delete your information;
• withdraw consent for health data (we'll stop processing it and, if you ask, delete what we hold);
• give you the list of third parties we've shared your information with (it's the list in §6).

Some state laws give these rights only to their own residents or only once a business reaches a certain size. We honor them for every US user. Nostos doesn't sell or share personal information for targeted advertising and doesn't profile users, so there's nothing to opt out of; if you send us an opt-out request anyway, we'll confirm it.

How to ask: email [email protected] from the email address on your account (or include it), and say what you'd like. To protect you, we verify requests by checking you control that email address or account; we may ask for one more detail. An authorized agent can make a request for you with your signed permission; we may still verify with you directly.

Timing and cost: we respond within 45 days. If we need more time (up to 45 more days), we'll tell you why. Requests are free; for repeated or excessive requests (more than two a year), we may charge a reasonable fee or decline, and we'll explain why.

Appeals: if we decline your request, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject. We'll answer within 45 days and explain our reasons. If you're still unhappy, you can contact your state attorney general (for example, the Washington Attorney General at https://www.atg.wa.gov/file-complaint).

No discrimination: we will never deny you the service, charge you differently, or treat you worse for using your privacy rights.

10. State-specific information

California

The California Consumer Privacy Act (CCPA) may not apply to Nostos because of its size, but we follow it voluntarily. In the last 12 months we have collected the following categories of personal information, for the purposes in §5, from the sources in §2:

Retention for each category is in §8. We use sensitive personal information only to provide the service you asked for, as allowed by the CCPA regulations, so we don't offer a "limit the use" option. We don't sell or share personal information of anyone, including anyone under 16.

California "Shine the Light": we don't share personal information with third parties for their own direct marketing.

Washington, Nevada and Connecticut

Our Consumer Health Data Privacy Policy describes the health data we collect and your rights under the Washington My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules.

Other states

Residents of Colorado, Virginia, Texas, Oregon and other states with privacy laws have the rights described in §9, including appeal. We honor them for everyone.

Canada, Australia, New Zealand and Singapore

If you live in one of these countries, you have the rights in §9: to know what we hold about you, get a copy, correct it, delete it, and withdraw your consent (for example to Apple Health access or usage analytics) at any time. We ask for your consent before using health information, use it only for the purposes in this policy, and protect it as described in §13. Your information is stored and processed in India (§7); we transfer it there only to run Nostos for you, and we apply the protections in this policy wherever it is processed.

To make a request or a complaint, email [email protected]; we reply within 30 days. If you're not satisfied, you can contact your privacy regulator: the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, New Zealand's Office of the Privacy Commissioner, or Singapore's Personal Data Protection Commission.

11. Do Not Track and Global Privacy Control

Nostos doesn't track you across other companies' websites or apps and doesn't allow anyone else to collect information about you over time across sites through Nostos. Because there's no tracking to switch off, our website doesn't change its behavior for browser "Do Not Track" signals. If your browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of sale and sharing, which matches what we already do for everyone.

The nostos.fit website doesn't use advertising or analytics cookies. To count visits, it uses Cloudflare Web Analytics, which works without cookies or other identifiers stored on your device and doesn't follow you across sites: it records page views, the page you came from, and your country, browser and device type, and gives us only totals. It runs on the website only, not in the app. Cloudflare may set strictly necessary security cookies to protect the site from bots and attacks.

12. Age requirement

Nostos is for people 13 and older, and the app asks you to confirm this when you create an account. It isn't directed to children under 13, and we don't knowingly collect personal information from them. If we learn that a child under 13 has an account, we'll delete it and its data. If you're 13 to 17, please use Nostos with a parent's or guardian's permission. We treat everyone's data the same way: no advertising, no selling and no sharing for targeted ads, and that includes teens. If you believe a child under 13 is using Nostos, please email [email protected].

13. Security

We protect information with:

• encryption in transit (HTTPS) between the app, Cloudflare and our server;
• passwords stored only as salted one-way hashes;
• your sign-in token stored in the iPhone Keychain;
• admin functions protected by a secret key, with access limited to the founder;
• keeping as little as we need (the app reads one daily total, not raw health data streams).

No system is perfectly secure. If a breach affects your information, we'll notify you and the authorities as the law requires, including under the FTC's Health Breach Notification Rule and state breach laws.

14. Changes to this policy

When we change this policy, we'll update the "Last updated" date above. For a material change, such as a new kind of data or a new use or recipient of your information, we'll tell you in the app (or by email) before the change takes effect, and we'll ask for your consent where the law requires it (for example, before any new use of health data). Previous versions are available on request.

15. Contact us

The Nostos team Privacy: [email protected] · Support: [email protected] · Website: https://nostos.fit

Effective date: October 10, 2026