Privacy Policy

1. Controller

2. Website hosting by Vercel

The website and the technical API endpoint for voice input are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the site, Vercel processes technically necessary connection data. This can include, in particular, IP address, date and time, the page accessed, referrer, browser type, operating system, domain name, HTTP status, and a request ID.

This processing is necessary to provide the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of our offering.

Vercel is a provider based in the USA and may process data in the USA as well as through subprocessors it engages. For contracts covered by the Vercel Data Processing Addendum, Vercel describes appropriate safeguards, including the EU Standard Contractual Clauses. Further information is available in the Data Processing Addendum and in Vercel's privacy notice.

The availability of log data depends on the plan used with Vercel and its settings there. We use this data only for operation, security, and error analysis. The website does not integrate Vercel Web Analytics, Speed Insights, or any of our own analytics or marketing services.

3. Local data in the Noah app

Profile details about the child, everyday entries, highlights, challenges, and reports generated from them are processed locally on your device. No user account is required for these core functions. The app contains no advertising or tracking SDKs.

You determine which content you enter and export. If you delete app data or the app, locally stored content may be lost. Shared PDF reports are further processed outside of Noah by the app you select.

4. Optional voice input and AI processing

Only when you actively start voice input does the app record audio data via the microphone. The recording may contain information about your child and therefore particularly sensitive or health-related information. The one-time voice input when setting up the profile is free; daily voice input is part of Noah Plus. Recordings are limited to two minutes. Alternatively, use free manual entry if you do not want any transfer to external services.

Vercel – protected API endpoint

The recording is first transmitted to our API endpoint operated on Vercel. There, authorization for daily Noah Plus recordings is checked and processing is brokered to Groq and Google. We do not use the recording or transcript for advertising or profiling and do not permanently store them in a Noah cloud database.

Groq – transcription

The audio file is transmitted to Groq, Inc.'s transcription API to be converted into text. The recording, technical connection data, and the resulting transcript are processed.

Google Gemini – structuring

The transcript is then transmitted to Google's Gemini API in order to structure the explicitly named profile details, or, for daily entries, the type, area, and text. Noah does not create a diagnosis, interpretation, summary, or pattern analysis in this process. The assignment can be inaccurate, so you should review every draft before saving it.

5. Subscriptions and RevenueCat

For Noah Plus, we use RevenueCat, Inc. as technical infrastructure to manage in-app purchases and subscription entitlements. RevenueCat processes, in particular, a randomly generated anonymous app user ID, purchase and subscription status, product identifier, and technical app, device, and store information. A Noah user account, name, or email address is not required for this.

Payment itself is handled by Apple through the App Store. Noah does not receive complete payment data. The anonymous app user ID is also transmitted to our API endpoint to check active Noah Plus entitlement before a daily voice entry.

6. Microphone permission

Access to the microphone only occurs after your authorization in iOS and only when you start a recording. You can withdraw this permission at any time in the iOS settings. The legal basis for accessing the end device is Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), to the extent the recording is necessary for the voice function you expressly requested.

7. Recipients and transfers

When the website is accessed and the API endpoint is used, Vercel receives the technically necessary connection data. When voice input is actively used, Groq and Google respectively receive the content described above. For Noah Plus, Apple and RevenueCat receive the data required for purchase and entitlement management. These providers may process data in the USA or other third countries; depending on the provider, appropriate safeguards such as the EU Standard Contractual Clauses apply. Beyond this, we only share app content if you trigger it yourself, a legal obligation exists, or you have given your consent.

8. Your rights

To the extent the respective requirements are met, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw any consent given, with effect for the future. You manage locally stored data directly in the app or on your device.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is, in particular, that of your habitual residence, your workplace, or the place of the alleged infringement.

9. Security and changes

We use appropriate technical and organizational measures to protect personal data. This policy will be updated when features, providers, or legal requirements change. The version published here at any given time is authoritative.