Privacy Policy
Effective Date: May 1, 2026
Last Updated: October 18, 2026
Welcome to Noereli. We believe your mental space is sacred. This Privacy Policy explains how your information across the Noereli mobile application, our website, and TestFlight beta testing is being handled. Our philosophy is rooted in transparency: We do not sell personal data, run advertisements, or use personal data for targeted advertising.
Noereli is currently intended only for users located in the United States, Canada, Australia, and New Zealand. This policy also covers invited beta testers in other jurisdictions. Using Noereli or accepting our Terms of Service does not replace the separate system permissions required for optional features.
Who is responsible for your data
The data controller is Gammahammer LLC (United States), which operates Noereli. For any privacy question or to exercise your rights, contact noereli@gammahammer.co
Company: Gammahammer LLC ("we", "us", or "our")
Local Storage & Encrypted Cloud Backup
Your Device (Local-First Architecture)
By default, your journal entries, saved AI insights, imported health snapshots, AI memory, and search embeddings are stored locally on your physical device. You can use core journaling features without creating a credentialed account. Optional online features process information as described in this policy even if you do not use cloud backup.
End-to-End Encrypted (E2EE) Cloud Backup
If you enable cloud backup or sync, your private journal data—including saved insights, health snapshots, AI memory, and search embeddings—is encrypted on your device prior to being uploaded to Google Firestore. We employ AES-GCM 256-bit encryption. Gammahammer LLC does not possess the master encryption key required to decrypt your stored backups. Account metadata and operational usage records are managed separately and are not protected by end-to-end encryption.
Your Controls
Disabling cloud sync stops future data uploads; it does not delete an existing cloud backup or local AI memory. Turning off AI features halts future AI processing but does not erase previously saved information. Use the app’s data or account deletion controls in Settings, or contact us for assistance.
Exports
Noereli does not encrypt exported JSON files. Exports contain sensitive journal content, health snapshots, and saved AI information. Anyone with physical or digital access to an exported file can read its contents. You are solely responsible for choosing a secure storage location (such as an encrypted operating system container) and protecting any copies you create. Deleting data within Noereli does not delete exports you have saved elsewhere.
How We Use Artificial Intelligence (AI)
Optional Cloud AI
We request affirmative permission before enabling AI features. We currently utilize Google Gemini via Google’s Vertex AI enterprise services. AI features include entry-level, daily, weekly, and epiphany analyses, personalized search, generated summaries and visual displays ("GenUI"), voice transcription, and persistent AI memory.
What Is Transmitted
AI requests may include journal text, user prompts, structured responses, saved analyses, and AI memory context. Apple Health information is included only if you grant separate Health integration and AI permissions. Historical context is assembled on your device prior to cloud transmission and may include earlier entries and personal profiles beyond what is visible on screen.
Persistent AI Memory & Profiling
While AI features are enabled, Noereli performs automated profiling to personalize your experience by building and updating a local relationship graph and personal profile. This memory tracks mentioned entities, life events, behavioral patterns, and coping preferences, and may include inferences regarding emotions and health status. This profiling data is stored locally on your device, included in your encrypted cloud backups (if enabled), and sent as context in cloud AI requests. You have the right to pause this automated profiling by toggling AI off in Settings or to request a reset of saved memory files.
Search Embeddings
While AI features are enabled, entries and generated analyses are processed via Google’s embedding service to create numerical representations used for local semantic search. Returned embeddings are stored and searched locally on your device and may be included in encrypted backups. We do not maintain a cloud vector database. Relationship graphs and personal profiles are used as context inputs rather than embedded vectors.
Processing Safeguards & Provider Commitments
Data transmitted for AI inference must be decrypted transiently by the service provider to perform the request; backup encryption does not cover processing in memory. Google’s Vertex AI enterprise terms prohibit model training or fine-tuning with user content without explicit permission, which we do not give. We do not train our own models on your private journal or health content. Gammahammer LLC maintains an approved exception to Google’s standard abuse-monitoring prompt logging, and request/response logging is disabled for our project. Temporary processing and limited operational records may occur solely as required for service delivery, security, or legal compliance.
Voice Transcription
With AI enabled, Noereli transmits temporary voice recordings to Google for cloud transcription. The raw audio recording is deleted from your device immediately after successful transcription, or when cancelled or discarded, and is excluded from encrypted backups. Transcribed text is handled as standard journal text. System dictation features (such as iOS Dictation) follow your operating system’s privacy practices and device settings.
AI Output Limits
AI outputs and profiles are generated to support self-reflection and personalization. They do not constitute medical, psychiatric, or clinical advice and are not used for decisions producing legal or similarly significant effects. Gammahammer LLC does not provide human monitoring of journal content.
Apple Health (HealthKit) Information
With your permission, Noereli accesses the Apple HealthKit framework ("Apple Health") to attach health snapshots to entries and analyze mind-body patterns over time. Available categories may include sleep duration/stages, heart rate, heart rate variability (HRV), sleeping respiratory rate, activity, exercise, mindfulness minutes, daylight exposure, wrist temperature shifts, and environmental sound exposure. No import occurs unless you enable Health integration in Noereli and grant relevant Apple HealthKit system authorizations.
Before you enable Health integration, we explain that health information may be included in cloud AI processing for personalized analysis. This permission is completely separate from general AI consent and Apple HealthKit system authorizations.
In accordance with Apple Developer Guidelines, information obtained through the HealthKit framework is never used for advertising, marketing, data brokerage, or training AI models. You can turn Health integration off in Noereli at any time to halt future imports and stop including health snapshots in cloud AI requests. Existing health snapshots follow this policy’s storage, E2EE backup, and deletion rules.
Security & Your Device Responsibilities
We implement reasonable administrative, technical, and physical safeguards, including AES-GCM 256-bit encryption for private cloud backups. However, no method of electronic storage or transmission is 100% secure.
You are solely responsible for maintaining physical device security, protecting your account credentials, and keeping your Noereli Recovery Key in a secure, offline location. Gammahammer LLC cannot recreate your Recovery Key or decrypt an inaccessible backup for you if your key is lost.
If a security incident triggers notification obligations, we will notify affected individuals and relevant authorities as required by applicable law.
Other Information We Collect
Account & App State: We process account identifiers, authentication tokens, interface preferences, consent records, and subscription status required to operate Noereli. An anonymous account identifier is used if you browse without a credentialed account. If you sign in via Apple, Google or Email, we receive limited profile information (such as your email address and a unique user identifier); we never receive or store your third-party account passwords.
Payments: Purchases and subscriptions are processed via Apple App Store payments, managed through RevenueCat. They process transaction details and relevant identifiers. We do not receive or store credit card numbers.
Optional Usage Statistics & Crash Reports: With your explicit permission, Firebase Analytics, Crashlytics, and our custom usage statistics collect aggregated telemetry regarding feature interactions, performance, and crash reports. Custom statistics explicitly exclude journal text, mood scores, imported health metrics, and AI-generated insights. Telemetry records may be linked to an app or account identifier and stored in Google Firestore / BigQuery without end-to-end encryption. You can opt out of analytics and crash reporting in Settings at any time.
Device Permissions: We request Apple Health, microphone, notification, or camera/photo-library permissions only when required for features you explicitly activate. You can manage or revoke system permissions in your device settings.
Wellness Purpose & Legal Disclaimers
HIPAA Status
Noereli is a self-help journaling and wellness tool, not a medical device or clinical healthcare service. Gammahammer LLC is not a "Covered Entity" or "Business Associate" under the Health Insurance Portability and Accountability Act (HIPAA), and information provided in the app is not considered Protected Health Information (PHI) under US federal law. Other state privacy laws and consumer health privacy frameworks may apply.
Emergency & Crisis Disclaimer
Noereli is not equipped to provide emergency crisis management or suicide prevention services. If you are experiencing a mental health emergency, please contact national crisis helplines (such as 988 in the US and Canada) or contact local emergency services immediately.
Consumer Health Data & Anti-Geofencing Disclosures
Under applicable consumer health privacy laws (including the Washington My Health My Data Act), we collect health-related journal entries and biometrics solely with your affirmative, opt-in consent to deliver requested wellness features.
We strictly prohibit and do not utilize geofencing technology around healthcare facilities, mental health clinics, hospitals, or medical service providers to track users, collect consumer health data, or deliver targeted content.
Data Retention & Deletion Timelines
Local Device Data: Entries, health snapshots, AI memory, and embeddings remain on your physical device until deleted within the app or until local application storage is cleared. Toggling a feature off stops new processing but does not erase saved local records.
Encrypted Cloud Backups: At launch, backups remain in Google Firestore while your backup account remains open and the backup service is available, even if paid access ends. Disabling cloud sync stops future uploads without deleting an existing backup. You can delete the backup or your backup account through the available data controls. Any future retention limit or service discontinuation is handled as described in our Terms. TestFlight beta data and backups may be reset or removed as described in Section 19 of the Terms.
Account & Operational Metadata: Account state, subscription tokens and TelemetryState metrics are retained while your account remains open and are deleted or de-identified within 30 days after we receive a verified account deletion request, except for limited records we must retain by law. Records retained by law are kept only for that purpose and deleted when the requirement ends.
Support & Contact Records: Customer support submissions and email communications are retained for up to 12 months to resolve follow-up inquiries, then deleted unless further retention is required by law. A valid deletion request may require earlier deletion under applicable law.
Account Deletion Procedure: You can request account deletion directly within Noereli settings. This removes your online account and encrypted backups and starts deletion of associated operational records under the timelines above, subject to limited retention required by law. Use the app’s local data controls to manage information stored on your device. Deletion within Noereli does not remove exported files saved elsewhere or automatically cancel an App Store subscription; manage subscriptions through your Apple ID settings.
Third-Party Service Providers
We share limited information with trusted service providers strictly as necessary to operate Noereli. These providers are bound by contractual confidentiality, security, and processing restrictions:
Google Cloud / Firebase: Infrastructure, authentication, Firestore database, Vertex AI, Analytics, Crashlytics, and BigQuery.
Apple: App distribution, in-app purchases, and optional Apple Sign-In.
RevenueCat: Subscription state verification and purchase management.
Featurebase: Feature requests and customer support submissions. Avoid submitting private health or journal details in support tickets.
Email & Subscriber Management Providers: We use service providers to manage waitlist signups, beta applications and email communications. Information processed may include email addresses, application responses, subscription preferences, consent records and limited account-status information supplied by Noereli. These providers may also process IP addresses and approximate location. Marketing emails are sent only to people who opt in, and you can unsubscribe at any time.
Website Hosting & Analytics Providers: We use service providers to host our website, process information submitted through website forms and understand how the website is used. We use privacy-focused website analytics without third-party advertising cookies or cross-site tracking.
TestFlight Beta Testing
Apple automatically collects and shares beta crash logs and usage metrics with us during TestFlight testing. Apple may share your name, email address, and submitted feedback/screenshots based on your beta invitation settings. We use this information strictly to improve Noereli and communicate regarding beta testing. In-app analytics toggles do not stop Apple's native TestFlight collection. You can stop beta testing at any time within the TestFlight app.
Legal Requests & Business Transfers
Legal Requests
We may disclose information we hold if required by a legally binding subpoena, court order or governmental mandate, or to protect rights, safety or service security. Gammahammer LLC cannot decrypt your end-to-end encrypted journal backups or provide readable copies of their encrypted contents. Other records may include account and operational information, usage or crash records and support or beta communications, subject to this policy’s permissions and retention rules. Journal or health information you voluntarily include in a support message, feedback or screenshot is separate from the encrypted backup and may be readable in that context. Apple-provided TestFlight information remains subject to Section 11 and applicable law.
Business Transfers
If Gammahammer LLC is involved in a merger, acquisition, reorganization, or sale of business assets, user information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.
Age Requirements
Noereli is strictly intended for individuals aged 18 or older. We do not knowingly collect personal information from minors under 18. If we learn that a minor has created an online account, we will take immediate steps to terminate the account and purge associated data under our control. Contact us immediately if you believe a minor has provided us with personal information.
International Data Transfers
Gammahammer LLC is based in the United States. Information processed through Noereli and our service providers may be stored and transferred in the United States and other countries that may have different data protection laws than your home jurisdiction. Where required by applicable law, we utilize recognized data transfer mechanisms (such as Standard Contractual Clauses) to protect international data transfers.
Your Privacy Rights & Appeals
Depending on your jurisdiction, you may have specific statutory rights regarding your personal information and consumer health data, including the right to:
Confirm whether we process your personal data and access a copy.
Correct inaccuracies in your personal information.
Request permanent deletion of your personal data.
Withdraw consent for optional AI features, Apple Health integration, or marketing communications.
Request a list of third-party processors with whom data has been shared.
To exercise any of these rights, email us at team@gammahammer.co or noereli.app@gmail.com with the subject line "Privacy Request". We will verify your request and respond within legal deadlines (typically 30 to 45 days). We do not discriminate against users for exercising their legal privacy rights.
Appeals Process
If we refuse action on a privacy request, you may appeal our decision by emailing team@gammahammer.co with the subject line "Privacy Appeal". We will review your appeal and provide a written explanation of our decision. If your appeal is denied, you may contact your state Attorney General or local privacy regulator.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our service, technology, or legal obligations. We will post the revised policy on this page and update the "Last Updated" date at the top. For material changes affecting how we handle sensitive personal data, we will provide prominent notice through the app, website, or email and obtain new opt-in consent where required by law.
Contact Us
If you have questions, feedback, or privacy requests regarding this policy, please contact us at:
Gammahammer LLC
8 The Green, Suite A, Dover, DE 19901, United States
Email: noereli@gammahammer.co