Privacy Policy

Last updated: 6 June 2026

nustate is a personal performance-tracking app published by Nustate (legal entity name to be confirmed) (“nustate”, “we”, “us”, or “our”). It helps you understand how your sleep, caffeine, supplements, exercise, and daily habits affect your focus, mood, and productivity.

This policy explains what we collect, why, how we protect it, and the choices and rights you have. We’ve written it in plain language on purpose. If anything is unclear, email us at support@nustate.ae

The short version: We collect only the data needed to give you your personal performance score and insights. We never sell your data. We never use your health or wearable data for advertising. You can export or permanently delete everything at any time.

1. Who we are

The data controller responsible for your information is Nustate (legal entity name to be confirmed). For any privacy question or request, contact us at support@nustate.ae

2. What we collect

We collect the following categories of information:

Account data. Your email address and an encrypted password, used to create and secure your account.

Onboarding profile. Information you choose to provide when you set up the app — such as your name, age range, city, biological sex, time zone, life context, goals, and your main performance challenge. We use this to personalise your experience and assign your performer category.

Daily check-ins. Your answers to short morning/midday/evening check-ins — including how you slept, your energy, focus, mood, stress, productivity, training, and any free-text notes you write.

Health and wellness data. Supplements and (if you choose to log them) medications you take, including whether you took them on a given day. This is sensitive health data, and we treat it accordingly. Medications are stored separately from supplements and are subject to additional access restrictions.

Wearable data. If you connect a wearable, we import metrics such as sleep duration and stages, sleep efficiency, heart-rate variability (HRV), resting heart rate, steps, active energy, respiratory rate, and blood-oxygen (SpO₂). See section 4 for how Apple Health and Google Health Connect data is handled.

Derived data. Your daily performance scores, score breakdowns, zones, supplement correlations, streaks, levels, and other insights the app calculates from the data above.

Device & technical data. A push-notification token (if you enable notifications), app version, and basic diagnostic information needed to operate the service and fix problems.

You can use most of the app while providing only the minimum data. Wearable connection, medication logging, notifications, and the weekly email are all optional.

3. How we use your data

We use your data only to:

Calculate your personal performance score and zones, measured against your own rolling baseline — never against other people.

Surface trends and supplement correlations that are personal to you.

Send the reminders and milestone notifications you opt into.

Send the weekly performance email, if you keep it enabled.

Maintain, secure, troubleshoot, and improve the app.

Comply with legal obligations and enforce our terms.

We do not use your data to build advertising profiles, and we do not sell or rent your personal information to anyone.

4. Apple Health & Google Health Connect

If you connect a wearable, nustate reads health and fitness data through Apple HealthKit (iOS) or Google Health Connect (Android), only for the data types you explicitly grant. Specifically:

We use Health data solely to power your in-app performance scoring, trends, and insights.

We never use Apple Health or Google Health Connect data for advertising or marketing, and we never sell it.

We never share or transfer your Health data to third parties, except the infrastructure providers in section 5 that process it on our behalf to operate the app, or where you direct us to, or where required by law.

We do not use Health Connect data to derive non-health insights, and we honour the Health Connect Permissions policy and Apple HealthKit guidelines.

You can revoke Health permissions at any time from your device settings (iOS Health app / Android Health Connect), or by disconnecting the wearable in nustate. Revoking stops future syncs; previously imported data can be deleted via the controls in section 8.

5. Who we share data with

We don’t sell your data. We share it only with service providers who process it on our behalf, under contract, to run the app:

Supabase — secure cloud database and authentication. Stores your account, check-ins, scores, and wearable data with row-level security so each user can only access their own records.

Expo — delivers push notifications (via Apple APNs and Google FCM) if you enable them.

Resend — sends transactional and weekly summary emails if you keep email enabled.

Each provider receives only the data needed for its function and is bound to protect it. We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer (in which case this policy continues to apply).

6. Why we’re allowed to use your data

Where data-protection law (such as the EU/UK GDPR or the UAE Personal Data Protection Law) applies, we rely on these legal bases:

Performing our contract with you — to provide the core app features you sign up for.

Your consent — for optional features like wearable health-data access, notifications, and marketing-style emails. You can withdraw consent at any time.

Our legitimate interests — to keep the app secure, prevent abuse, and improve the service, balanced against your rights.

Legal obligation — where we must retain or disclose data to comply with the law.

7. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we permanently delete your personal data and associated records (check-ins, scores, supplement logs, wearable data, and gamification state) shortly afterwards, except where we must retain limited information to meet a legal obligation. Backups are purged on a rolling schedule.

8. Your choices and rights

You are in control of your data. At any time you can:

Access & export — download a copy of your data as a JSON export from within the app.

Correct — edit your profile and preferences in the app’s settings.

Delete — permanently delete your account and all associated data from the app’s settings. This cascades across all your records and cannot be undone.

Withdraw consent — disconnect your wearable, turn off notifications, or unsubscribe from the weekly email.

Object or restrict — where the law gives you these rights, ask us to limit how we process your data.

To exercise any right that isn’t self-service, email support@nustate.ae. We’ll respond within the timeframe required by applicable law. You also have the right to complain to your local data- protection authority.

9. How we protect your data

We use industry-standard safeguards: encryption in transit (HTTPS), row-level security so users can only reach their own data, access-controlled administrative tooling with a full audit trail, and strict separation of the keys that can read raw data. No system is perfectly secure, but we work to protect your information and to limit who can access it.

10. International transfers

Your data may be processed in countries other than where you live, including by the service providers listed in section 5. Where it is, we rely on appropriate safeguards (such as standard contractual clauses) to protect it to a comparable standard.

11. Children

nustate is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the app evolves. When we make material changes, we’ll update the “Last updated” date above and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.

13. Contact us

Questions, requests, or concerns about your privacy? Email support@nustate.ae. We read every message.