Privacy Policy

Nuvelorb is a bilingual (English and Arabic) catalog of AI and digital tools, with plain-language guides, starter kits and an "I want to" assistant that suggests tools for a goal. Nuvelorb is responsible for the personal information described in this policy.

Contact: support@nuvelorb.com. Write to us about anything in this policy, including requests to see, correct or delete your data.

• An account is optional. If you sign in with Google, we receive only your name, email address and profile picture.
• We use that information only to create and identify your account. We never sell it, never use it for advertising, and share it only with the service providers that run Nuvelorb for us.
• Questions you type into the assistant are stored without your IP address or account ID.
• We use no advertising or tracking cookies.
• You can delete your account and saved items at any time from the Saved page, or by emailing us.

Account information (only if you sign in). You can sign in with Google or with a one-time link sent to your email address.

• Google sign-in: Google shares your name, email address and profile picture with us (the basic "openid", "email" and "profile" permissions). We do not request access to your Gmail, Google Drive, contacts, calendar or any other Google data.
• Email sign-in: your email address.
• We store your email address and sign-in records with our authentication provider, a display name on your profile (your Google name, or the part of your email address before the @), and your profile picture link as part of your account record.

Saved items. If you are signed in, the tools, guides, kits and prompts you save, and any collections you create, are stored with your account so they sync across devices. If you are not signed in, saved items stay in your browser's local storage and are never sent to us.

Assistant questions. When you use the "I want to" assistant, the text of your question is sent to Anthropic to generate tool suggestions (see section 6). We keep an anonymized log of questions to improve the catalog: the question in lower case with email addresses, web addresses and phone numbers removed, the language, the tools suggested and how long the answer took. This log contains no IP address and no account ID. Identical questions are answered from a cache for 24 hours. Please don't type personal information into the assistant.

Rate limiting. To prevent abuse, we count assistant requests per hour. For visitors we store a salted, one-way hash of the IP address, never the IP address itself. For signed-in users we store the account ID. These counters are deleted after 2 hours.

Tool suggestions. If you suggest a tool through the Submit form, we store what you write and, if you choose to give it, your email address so we can follow up.

Analytics. We use Vercel Web Analytics to count page views. It is cookieless, does not track you across other websites, and gives us only aggregated statistics.

Server logs. Our hosting provider processes technical request data such as IP address, browser type and the page requested, to deliver pages and protect the service. These logs are kept for a short period.

Tool logos. When a tool has no stored logo, your browser loads its icon from Google's favicon service (www.google.com/s2/favicons). Google then receives your IP address and the tool's web address under Google's Privacy Policy.

• To create your account, sign you in, recognize you on return visits and show who is signed in.
• To save and sync your favorites and collections.
• To answer assistant questions and to find gaps in the catalog (for example, questions with no good tool).
• To keep the service secure and available, including rate limiting and preventing abuse.
• To reply when you contact us or suggest a tool.
• To understand, in aggregate, which pages are useful.

We process account information to provide the service you asked for, and the other information on the basis of our legitimate interest in running a secure, useful catalog. We do not sell personal information, use it for advertising, or build advertising profiles.

If you choose "Continue with Google", we receive only your name, email address and profile picture from your Google Account.

• We use this information only to create your Nuvelorb account, identify you when you sign in, and show your name and picture while you are signed in.
• We do not sell it, and we do not use it for advertising, retargeting or interest-based ads.
• We do not share it with anyone except the service providers listed in section 6 that process it on our behalf to run Nuvelorb, or where the law requires it.
• We do not use it to develop, improve or train generalized artificial intelligence or machine-learning models.
• No person at Nuvelorb reads it unless you ask us to (for example, for support), it is needed for security, or the law requires it.

Nuvelorb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Nuvelorb's access at any time in your Google Account permissions. Removing access does not delete your Nuvelorb account; see section 9 for that.

We use these service providers (processors). They process information only on our instructions and to provide their service to us:

• Supabase: database and authentication. Stores your account, profile and saved items.
• Vercel: hosting and cookieless analytics. Processes request data to deliver the site.
• Anthropic: processes the text of assistant questions to generate suggestions. It receives the question, not your name, email or account ID. Under Anthropic's commercial terms, API inputs are not used to train its models.
• Resend: delivers our emails, such as sign-in links. It receives your email address and the message.

Google acts as the sign-in provider when you choose Google sign-in. We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply to your information.

Our service providers may process information in the United States and other countries. Where required, we rely on their standard contractual safeguards for these transfers.

• Account information, profile and saved items: until you delete them or delete your account.
• Anonymized assistant question log: 12 months, then deleted automatically.
• Assistant answer cache: 24 hours.
• Rate-limit counters: 2 hours.
• Tool suggestions and any email address you included: as long as needed to review the suggestion and keep an editorial record. Ask us and we will remove your email address.
• Server logs: a short period set by our hosting provider.

When you delete your account, your account, profile, favorites and collections are removed from our live database immediately. Copies may remain in our providers' encrypted backups for up to 30 days before they are overwritten.

Delete your account yourself: sign in, open the Saved page and choose "Delete account". This permanently deletes your account, profile, favorites and collections.

Or email us at support@nuvelorb.com from the address on your account, and we will delete it within 30 days.

Depending on where you live, you may also have the right to access, correct, export or restrict the use of your personal information, and to object to its processing. Email us to make a request; we will reply within 30 days. You can also complain to your local data-protection authority.

We use only what the site needs to work:

• Sign-in cookies from our authentication provider, set only when you sign in, to keep you signed in.
• A language cookie that remembers whether you chose English or Arabic.
• Your browser's local storage for your light or dark theme choice and, if you are not signed in, your saved items.

We do not use advertising or cross-site tracking cookies, and our analytics are cookieless. Clearing your browser's cookies and site data removes all of the above.

Information is encrypted in transit (HTTPS). Access to the database is restricted by row-level security, so each account can read only its own saved items, and administrative access is limited to the people who run Nuvelorb. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Nuvelorb is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email us and we will delete it.

We may update this policy as Nuvelorb changes. We will change the effective date at the top, and for significant changes we will put a notice on the site or email signed-in users before the change takes effect.

Questions or requests: support@nuvelorb.com.