NNomademy
Start free trial

Privacy Policy

Effective Date: 2026-08-18  ·  Last Updated: 2026-08-18

This Policy explains how Rihlix LLC (“Nomademy,” “we,” or “us”) handles personal information in the Nomademy web service. The service is intended only for adults located in the United States and its territories.

1. Information we handle

  • Account and consent: email address, display name, authentication identifiers, age attestation, accepted policy versions, and timestamps.
  • Study content: folder and note names, pasted text, uploaded PDF/TXT/Markdown files, scanned PDFs and JPEG/PNG/WebP notebook photos, reviewed OCR transcripts and line data, YouTube canonical watch URLs and video identifiers, captions, transcripts, or creator descriptions you paste or upload, parsed text and timestamp cues, transcript format, language, and provenance, prompts, generated study aids, review activity, and shares.
  • Preferences and operations: settings, feature entitlements, AI reservations, request identifiers, job status, and account-lifecycle requests.
  • Acquisition and product analytics: first landing path, referring hostname, campaign parameters, originating public-share identifier, page views, and selected product events such as starting signup or checkout. We do not use these values to make authorization or entitlement decisions.
  • Security and reliability data: IP-derived abuse hashes, timestamps, browser or device information present in service logs, error details, and audit events. We do not need to store the raw IP in the AI job ledger.
  • Support: messages and information you choose to send us.

Supabase Auth stores password verifiers; Nomademy does not receive your plaintext password. Subscription payments are processed by Stripe; Nomademy receives subscription status, billing-cycle, and customer identifiers but never your full payment-card number. The free trial requires no payment method. We do not use advertising cookies.

2. How we use information

  • provide authentication, storage, study, sharing, export, and deletion functions;
  • generate requested study aids and enforce feature, quota, rate, and concurrency limits;
  • process subscription status and enforce trial and billing state (payments handled by Stripe);
  • secure, troubleshoot, monitor, and improve the service;
  • respond to support, privacy, and security requests; and
  • comply with law and protect the rights and safety of users, providers, and the public.

3. Service providers and AI processing

We use these provider categories to operate the service:

  • Supabase: authentication, PostgreSQL database, private file storage, and Edge Functions.
  • Vercel: web hosting, delivery, operational logs, performance measurement, and privacy-focused web analytics.
  • Stripe: subscription checkout, payment processing, and billing management. Stripe handles your payment details under its own privacy policy.
  • Google Gemini: embeddings and text generation. Relevant prompts and excerpts of the material selected for a request are transmitted to the configured model endpoint.

We do not send an entire account to the AI provider when a smaller excerpt can satisfy a request. Provider handling is also governed by the contract and configuration attached to the environment. We may replace a provider only after reviewing the data flow and updating this Policy when the change is material.

Text recognition for scanned PDFs and notebook photos runs locally in your browser using model files served by Nomademy. Raw pages are not sent to the AI provider for OCR. After you review the result, the source PDF or metadata-stripped normalized notebook page images, approved transcript, and OCR metadata are stored in Nomademy’s private Supabase database and object storage so Nomademy can provide the source and delete or export it with your account. Approved OCR transcript text may later be processed like other study text, including sending relevant text or excerpts to Gemini for embeddings and study aids you request.

For a YouTube source, Nomademy stores the canonical watch URL and video identifier together with the caption, transcript, or creator-description text you supply. We parse that supplied text and may store timestamp cues, language, format, duration, and whether the text was pasted, uploaded, or copied from a shared Nomademy set. Nomademy does not fetch the YouTube watch page, use YouTube account authorization, or download, analyze, or send the video or audio to Gemini. Only the supplied and parsed text—not the video or audio—is processed like other study text, including sending relevant text or excerpts to Gemini for embeddings and study aids you request.

4. When information is disclosed

We disclose information to the providers above, when you direct us to share it, to comply with valid legal process, or to protect rights and safety. We may transfer information as part of a corporate transaction subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising.

5. Link sharing

A set marked “anyone with the link” is available to anyone who obtains its unguessable URL. A recipient can make a separate copy containing the reviewed source text. For a YouTube source, the copy also retains the canonical watch URL and video identifier, parsed transcript text, timestamp cues, language, duration, and copy provenance, but not the original private transcript upload. Copies do not include a source PDF, notebook page images, or private OCR metadata. Link-shared items are not automatically listed in a searchable community feed. Revoking the link stops future access to the original but does not delete copies already made and separately owned by other users.

6. Retention

We keep active account and study data while the account is open and as needed to provide the service. AI job, billing, and consent records are retained long enough to enforce limits, investigate abuse, and document policy acceptance. When deletion is requested, the workflow revokes sessions and removes active database rows and private objects, including stored source PDFs, normalized notebook pages, reviewed transcripts, OCR sidecars, original YouTube transcript uploads, canonical URL and video-identifier metadata, parsed text, and timestamp cues. Deleting an original does not delete separately owned copies that other users already made; limited job status, security, or legal records may be retained where necessary. Encrypted provider backups are isolated from ordinary use and expire according to the provider’s backup schedule. Support messages and operational logs may remain for a limited period needed for security and support.

7. Security

We use access controls, private object storage, Row Level Security, scoped service credentials, encrypted transport, request bounds, and authorization tests. No system is perfectly secure. Please report suspected unauthorized access to team@rihlix.com and do not include secrets or sensitive study material in the report.

8. Your choices and requests

Subject to applicable law, you may request access, a portable export, correction, or deletion. A portable account export includes your source database records and time-limited links to your private source files, including OCR source files and original YouTube transcript uploads. Settings expose the supported self-service workflows. If a job fails or you can no longer sign in, email team@rihlix.com from the account address. We may verify identity before acting and will explain if we cannot fulfill part of a request.

9. Adults only

Nomademy is not directed to children and does not knowingly permit anyone under 18 to use the service. If you believe a minor provided information, contact us so we can investigate and delete it where appropriate.

10. Changes and contact

We may update this Policy as the service changes. If a material change requires renewed consent, we will record acceptance before continued use. Questions or requests may be sent to team@rihlix.com.