Privacy Policy — Nova
1. Who we are
Nova (the "app") is published by EXO Studio, based in Hanoi, Vietnam ("we", "us", "our"). This policy explains what information the app handles and how. It applies to the Nova iOS application only.
2. Information we collect
Nova works without accounts and keeps your content on your device. It does, however, use advertising and app-configuration services that process device and usage data. Specifically:
| Category | What it is | Where it lives |
|---|---|---|
| Chat content you send | The prompts you type and a bounded amount of recent conversation history sent with each request so the assistant has context. | Transmitted to the AI model provider to generate a reply (see Service providers). Also stored locally as history. |
| Conversation history | Your chats, titles, and pinned/unpinned state. | On your device only, in the app's Application Support storage. |
| App preferences | Language, chosen model, whether the assistant's reasoning is shown, onboarding completion, and your advertising-consent choice. | On your device only, in iOS UserDefaults. |
| Advertising identifiers & ad data | A device advertising identifier (IDFA, only if you allow tracking) and identifiers set by the ad SDK, plus coarse data such as ad interactions and, where available, approximate location derived from your IP address, used to select and measure ads. | Processed by Google AdMob and its ad partners to serve and measure ads. |
| App configuration data | A Firebase installation identifier and basic technical data (device model, OS version, coarse region) used to deliver runtime configuration such as which model endpoint to use and whether a given ad placement is enabled. | Processed by Google Firebase Remote Config. |
| Content reports | If you tap Report on a reply, an email you send to us containing the reported text and a reason. | Sent from your own email app to our contact address, only when you choose to send it. |
We do not collect account credentials, contacts, precise location, photos, microphone, or camera data.
3. How we process information
When you send a message, the app transmits your prompt together with a limited number of recent turns from the same conversation (currently up to the last 20 turns) to an OpenAI-compatible AI endpoint so the model can produce a response. The response is streamed back and shown to you. History is stored on your device; it is not uploaded anywhere except as part of the messages sent to the model provider described above. Separately, the app requests ads and reports ad performance and configuration data as described in the next section.
4. Advertising, consent & tracking
Nova displays advertising through Google AdMob. Ads may appear as banners, native ads, full-screen interstitials, and app-open ads. To serve and measure these ads, AdMob and its ad partners process device and usage data, including advertising and device identifiers, ad interactions, and technical and approximate-location (IP-based) data.
Consent (EEA, UK & similar regions). Where required, we present a Google-certified consent form (via Google's User Messaging Platform) the first time you open the app, so you can accept or decline personalized ads and related data processing. Your choice governs how ads are personalized and which data is used. You can reopen this form and change your choice at any time from the app's Settings → Privacy options (shown where a choice is available).
App Tracking Transparency (IDFA). On iOS, the app may ask for permission to track you across apps and websites using Apple's App Tracking Transparency prompt. Only if you allow it does the app access your device's advertising identifier (IDFA) for cross-app advertising. If you decline, ads are still shown but are less personalized. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
Remote Config. Nova uses Google Firebase Remote Config to deliver runtime settings — such as which model endpoint to use and whether a given ad placement is enabled — and, to do so, may process a Firebase installation identifier and basic technical data. Nova does not use Firebase Analytics or any other analytics SDK; the app ships no analytics product.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Generate AI replies to your messages. | Performance of a contract (providing the service you requested). |
| Store your chats and preferences on your device. | Performance of a contract; the data stays local. |
| Show and measure advertising (personalized where allowed). | Your consent, obtained through the consent form / ATT prompt where required; otherwise our legitimate interest in showing non-personalized ads to fund a free app. |
| Deliver runtime configuration (Firebase Remote Config). | Legitimate interests in operating and maintaining the app. |
| Review content you report to us. | Legitimate interests in safety and abuse prevention; your consent when you send the report. |
6. Service providers
We rely on the following third parties. We share only what the feature needs.
| Provider | Role | Data involved |
|---|---|---|
| OpenCode Zen (opencode.ai) | AI model provider that generates replies. | The message text and recent conversation turns you send. Handled under that provider's own terms and privacy practices. |
| Google AdMob & Google's User Messaging Platform | Serves the ads shown in the app and gathers advertising consent where required. | Advertising and device identifiers, ad interactions, technical and approximate-location (IP-based) data, and your consent choice. Governed by Google's privacy policy. |
| Google Firebase Remote Config | Delivers runtime configuration such as which model endpoint or default model to use and which ad placements are enabled. | A Firebase installation identifier and basic technical data. Governed by Google's Firebase privacy and security terms. |
Because Nova's AI replies are produced by OpenCode Zen, the messages you send are necessarily processed by that provider. Avoid entering information you consider sensitive or that you do not want sent to a third-party model.
7. Sharing and sale of data
We do not sell your personal information for money. We share data with the service providers listed above to operate the app, including for advertising and its measurement. Sharing device identifiers and ad data with Google AdMob and its ad partners for personalized advertising may be considered "sharing" or "sale" for cross-context behavioral advertising under some U.S. state laws. You can limit this by declining the ATT tracking prompt, declining personalized ads in the consent form where offered, or using the controls in the "Your rights" section.
8. Data retention
Conversation history and preferences remain on your device until you delete a chat, clear all chats, or uninstall the app. Deleting the app removes this local data. Messages sent to the AI model provider are retained according to that provider's own policies. Advertising and configuration data processed by Google is retained under Google's own retention practices. Content reports you email to us are kept only as long as needed to review and act on them.
9. Security
Requests to the AI endpoint are made over HTTPS. On-device data is protected by iOS app sandboxing and the device's own encryption. No method of transmission or storage is perfectly secure, but we work to protect information appropriately.
10. Device permissions
Nova requests no special device permissions beyond the optional App Tracking Transparency prompt described above. It does not access your camera, photos, microphone, precise location, or contacts. AI processing of your messages happens on the model provider's servers, not on-device.
11. Children
Nova is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided such information, contact us and we will address it.
12. Your rights (GDPR & CCPA)
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. Because Nova keeps chats and preferences on your device, you can exercise most of these directly: delete individual chats, clear all chats, or uninstall the app. For advertising, you can reopen the consent form from the app's Settings, decline the ATT tracking prompt, or reset your advertising identifier in iOS Settings. California residents have the right to know, delete, and opt out of the sale/sharing of personal information; you can opt out of personalized advertising using the controls just described. To make a request, contact us using the details below.
13. International transfers
We operate from Vietnam, and our service providers (including Google and the AI model provider) may process data in other countries, including the United States. Where personal data is transferred internationally, it is handled under the receiving provider's applicable safeguards.
14. Changes to this policy
We may update this policy as the app evolves. When we do, we will revise the "Last updated" date above. Material changes will be reflected in the app or its store listing.
15. Contact
Questions or privacy requests? Email thongintech@gmail.com.