Privacy Policy

Draft pending legal review. This draft describes Nightingain's actual data practices. It has not yet been reviewed by an attorney.

The short version

• Your check-ins, notes, and AI conversations are yours. We use them only to provide Nightingain to you.
• We don't sell your data and don't use your wellness entries for advertising.
• Employers that sponsor access never see individual data.
• You can export or delete your data at any time from Settings → Privacy & data.

What we collect

• Account information: email, name you choose, password (hashed by our authentication provider), and two-step verification settings.
• Profile and preferences: profession, work setting, shift pattern, goals, region, time zone, and notification settings.
• Wellness entries you choose to add: check-ins (mood, stress, energy, sleep, workload, habits), private notes, shifts, reminders, intentions, and recovery-session history.
• AI companion conversations, kept for the period you choose (default 30 days).
• Billing records: subscription status and invoices. Card details are handled by Stripe and never reach us.
• Usage analytics (optional): events like "check-in completed" linked to a pseudonymous identifier — never your answers, notes, or messages. You can turn this off.
• Support requests you send us.

How it's protected

Data is stored with Supabase (database and authentication) and the app is hosted by Vercel, both in the United States. Data is encrypted in transit and at rest. In addition, notes and AI conversations are encrypted by our application before storage, so database access alone doesn't reveal them. Our application servers can decrypt this content to show it to you — this is not end-to-end encryption. Access to production systems is restricted to the owner and protected with two-step verification and audit logging.

AI processing

When you message the companion, the message, recent conversation, and (only if you turned it on) a short summary of your check-in trends are sent to our AI provider (Anthropic) to generate a reply. Your notes are never sent. The provider processes this data under its commercial terms.

Employers

Sponsoring organisations see seat status (invited/active/removed) and, only for groups of at least 10 active members, broad anonymous totals. They never see individual entries, and we will not provide them any.

Sharing

We share data only with service providers needed to run Nightingain (hosting, database, email, payments, AI), when you ask us to, or when legally required. If we receive a legal demand for your data, we will notify you unless prohibited.

Retention and deletion

Wellness data is kept until you delete it or your account. Deleting your account permanently removes your wellness data; we keep de-identified billing records as required for accounting and tax purposes. Backups expire on a rolling schedule.

Your rights

You can access, export, correct, and delete your data in the app. Depending on where you live (for example, Washington, Nevada, California, or other states with consumer-health-data laws), you may have additional rights. See Consumer Health Data Notice or contact us.

HIPAA

Nightingain is a consumer wellness service and is not offered as a HIPAA-covered service. We do not claim HIPAA compliance.