Privacy Policy

This Policy explains how Rihlix LLC (“Nomademy,” “we,” or “us”) handles personal information in the Nomademy web service. The service is intended only for adults located in the United States and its territories.

1. Information we handle

• Account and consent: email address, display name, authentication identifiers, age attestation, accepted policy versions, and timestamps.
• Study content: folder and note names, pasted text, uploaded PDF/TXT/Markdown files, prompts, generated study aids, review activity, and shares.
• Preferences and operations: settings, feature entitlements, AI reservations, request identifiers, job status, and account-lifecycle requests.
• Security and reliability data: IP-derived abuse hashes, timestamps, browser or device information present in service logs, error details, and audit events. We do not need to store the raw IP in the AI job ledger.
• Support: messages and information you choose to send us.

Supabase Auth stores password verifiers; Nomademy does not receive your plaintext password. Subscription payments are processed by Stripe; Nomademy receives subscription status, billing-cycle, and customer identifiers but never your full payment-card number. The free trial requires no payment method. We do not use advertising cookies.

2. How we use information

• provide authentication, storage, study, sharing, export, and deletion functions;
• generate requested study aids and enforce feature, quota, rate, and concurrency limits;
• process subscription status and enforce trial and billing state (payments handled by Stripe);
• secure, troubleshoot, monitor, and improve the service;
• respond to support, privacy, and security requests; and
• comply with law and protect the rights and safety of users, providers, and the public.

3. Service providers and AI processing

We use these provider categories to operate the service:

• Supabase: authentication, PostgreSQL database, private file storage, and Edge Functions.
• Vercel: web hosting, delivery, and operational logs.
• Stripe: subscription checkout, payment processing, and billing management. Stripe handles your payment details under its own privacy policy.
• Google Gemini: embeddings and text generation. Relevant prompts and excerpts of the material selected for a request are transmitted to the configured model endpoint.

We do not send an entire account to the AI provider when a smaller excerpt can satisfy a request. Provider handling is also governed by the contract and configuration attached to the environment. We may replace a provider only after reviewing the data flow and updating this Policy when the change is material.

4. When information is disclosed

We disclose information to the providers above, when you direct us to share it, to comply with valid legal process, or to protect rights and safety. We may transfer information as part of a corporate transaction subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising.

5. Link sharing

A set marked “anyone with the link” is available to anyone who obtains its unguessable URL. A recipient can make a separate copy. Link-shared items are not automatically listed in a searchable community feed. Revoking the link stops future access to the original but does not delete copies already made by other users.

6. Retention

We keep active account and study data while the account is open and as needed to provide the service. AI job, billing, and consent records are retained long enough to enforce limits, investigate abuse, and document policy acceptance. When deletion is requested, the workflow revokes sessions and removes active database rows and private objects; limited job status, security, or legal records may be retained where necessary. Encrypted provider backups are isolated from ordinary use and expire according to the provider’s backup schedule. Support messages and operational logs may remain for a limited period needed for security and support.

7. Security

We use access controls, private object storage, Row Level Security, scoped service credentials, encrypted transport, request bounds, and authorization tests. No system is perfectly secure. Please report suspected unauthorized access to team@rihlix.com and do not include secrets or sensitive study material in the report.

8. Your choices and requests

Subject to applicable law, you may request access, a portable export, correction, or deletion. Settings expose the supported self-service workflows. If a job fails or you can no longer sign in, email team@rihlix.com from the account address. We may verify identity before acting and will explain if we cannot fulfill part of a request.

9. Adults only

Nomademy is not directed to children and does not knowingly permit anyone under 18 to use the service. If you believe a minor provided information, contact us so we can investigate and delete it where appropriate.

10. Changes and contact

We may update this Policy as the service changes. If a material change requires renewed consent, we will record acceptance before continued use. Questions or requests may be sent to team@rihlix.com.