Closed beta waitlist: We collect your email to contact you about the Nowdo closed beta, store it with Resend, and use Cloudflare Turnstile to prevent automated signups. To leave the list, contact coallaoh@cortiq.so. Joining does not create an app account.

Privacy Policy

Effective date: 2026-09-04. Version: 9.

This Policy explains what data NowDo.AI (the "Service") collects, why, and what your rights are. By signing in, you agree to the data practices described here.

1. Who handles your data

The Service is operated by Cortiq Co., Ltd., the data controller, whose full details are under § 10. It uses a small set of third-party sub-processors, each under signed terms, to run the Service: Supabase (authentication, database and storage), Anthropic (the AI model provider), Vercel and Cloudflare (web hosting and delivery), Sentry (error monitoring), Plausible (a cookieless public-page count), Resend (transactional and newsletter email), Paddle (payments for the Pro plan on the web) and RevenueCat (validating Pro purchases made in the iPhone app). Each one sees only the data it needs for its job, and Sentry receives PII-stripped reports (see § 2).

The full, dated list of sub-processors, with each provider's purpose, the data it handles, and its region, is kept on the sub-processors page. That page is the maintained source of truth; we update it before a new sub-processor goes live.

Your data is stored in the United States (Supabase's US region). Where you are in the EU or UK, transfers of your personal data to the United States rely on the Standard Contractual Clauses in our agreements with the relevant sub-processors (Supabase and Anthropic both offer SCC-backed terms). We don't sell your data, we don't share it with advertisers, and we don't use it to train AI models.

2. What we collect

Account data

• Email address (for sign-in).
• Password hash (handled by Supabase Auth; we never see your plaintext password).

Content data

• Tasks, memos, and the columns / cell values you fill in.
• Chat history with the AI assistant, across every conversation thread.
• Memory entries the AI keeps to steer its replies.
• Inbound captures: emails forwarded to your capture address and tasks captured through Siri, the share sheet or the webhook. Emails you have not yet approved are still held for you to review, so they are part of your data.
• User settings, view configurations, and column preferences.

Optional integration data

• Google Calendar busy times, if you connect your calendar (the OAuth token is stored encrypted and used only to fetch your busy ranges).

Operational metadata

• IP address and request timestamps held by Supabase / Vercel / Cloudflare for security and abuse prevention.
• Diagnostic timing marks ("how long did the app take to load") kept in your browser only.
• Error reports sent to Sentry when the app crashes: stack trace, URL path (no query string), app version, browser/OS, and your account user-id. PII (emails, OAuth tokens, row / memo / chat content) is stripped client-side before the report is sent.

3. What we don't collect

• We don't run third-party advertising trackers.
• We don't profile you, fingerprint your device, or track you across sites.
• We run one privacy-first, cookieless page-count on the public pages only (see § 4). It measures how many people visit the marketing, sign-in and docs pages. It sets no cookies, records no personal data, and never loads inside the signed-in app. We run no other product-usage analytics SDK (Google Analytics, Mixpanel and the like). Sentry (covered in § 2) is error monitoring, not analytics. It sees crashes, not feature use.
• We don't collect device-identifier data beyond what's inherent to serving HTTPS traffic.
• We don't collect your voice. Voice capture in the iPhone app is transcribed on your device. No audio is uploaded, none reaches us or anyone else, and no recording is stored.

4. Cookies and the page-count

The Service uses essential cookies only: the session cookie that keeps you signed in, and the auth refresh cookie managed by Supabase. No advertising or cross-site tracking cookies.

The public pages (the landing page, sign-in and the docs) run Plausible Analytics for a simple page-count. Plausible is cookieless by design. It sets no cookies, uses no persistent identifier, and anonymises your IP address, so it cannot follow you across sites or sessions. It runs on the public pages only, never inside the signed-in app, and it collects no personal data. Plausible processes this data in the European Union.

Because the Service sets only essential cookies and the page-count is cookieless, no consent banner is required in the EU under current guidance.

5. AI processing

AI features are off until you allow them. The app asks for your permission in-app the first time you use one, and names what is sent and to whom. You can decline and keep using everything else, and you can turn AI off again in Settings → AI.

When you use AI features (chat, row enrichment, brain-dump):

• Your prompt, the relevant row / memo content and column context, and (if memory features are on) your personal-context notes are sent to an AI provider for processing. This is Anthropic, in the United States, and nowhere else. There is no other provider to choose.
• Data is sent only when you use an AI feature. The request runs on our own Anthropic account, whether you are on the free allowance or on Pro.
• Anthropic's commercial terms apply. Anthropic does not train its models on this content, but you should not paste secrets (credentials, social-security numbers, etc.) into AI prompts.
• The model's response is stored alongside your chat history in your account.

Voice capture is the one AI-adjacent feature that sends nothing: your iPhone turns speech into text by itself. The text you then approve is treated exactly like a typed capture, so it goes to Anthropic under the terms above.

5b. Operator access

A small allowlist of operators (currently the founder) can read account-level data through an internal admin surface for the purposes of: (a) responding to bug reports and support requests, (b) sending project-update newsletters to subscribers, (c) investigating abuse, and (d) contacting users who have opted in to product research, to ask how they use the Service. That last one is off unless you turn it on in Settings → Notifications, it is separate from the project-updates newsletter, and it is never used to sell you anything. Every operator action (viewing the user list, opening a user's detail page, fetching the newsletter audience, drafting a newsletter, or overriding a newsletter opt-in) is recorded in an append-only audit log with the operator's email, the action, the target user (if any), and the timestamp. Operators cannot impersonate or sign in as you. They read data through service-role queries against the database. The audit log is the disclosure surface. Request a copy of operator access to your account at the contact address below.

6. Your rights

You can:

• Access your data. Go to Settings → Account → Export my data to download a JSON file with your rows, memos, all your chat threads, your memory entries, your inbound captures, your Google Calendar busy times, your settings, and your enrichment overrides. The file holds the data itself, never the access tokens that gate it.
• Delete your account at Settings → Account → Delete account. Your account enters a 30-day soft-delete window. Signing back in within those 30 days cancels the deletion. After 30 days the account and all associated data are permanently removed.
• Correct your data by editing the cell or memo directly. For account-level data (email), contact us.
• Object to processing by stopping use of the Service and deleting your account.

If you're in the EU or UK you have additional statutory rights (portability, and the right to lodge a complaint with a supervisory authority). Contact us to exercise them.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we hold about you, to delete it, to correct it, and to opt out of its sale or sharing. You exercise the know and delete rights through the same controls as everyone else: Export my data and Delete account in Settings → Account.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We do not exchange it for money and we do not share it for cross-context behavioural advertising. Because there is no sale or sharing, no "Do Not Sell or Share My Personal Information" link is required, and we do not provide one.

We will not discriminate against you for exercising any of these rights.

7. Children

The Service is not directed at children under 13 (or under 16 in the EU). Don't create an account for or upload data about anyone under that age.

8. Data retention

• Active accounts: data is kept until you delete it or your account.
• Soft-deleted accounts: 30 days after deletion was requested.
• Server logs: rolling 30 days at the hosting providers, used for security investigation.

9. Changes to this Policy

We may update this Policy. If a change is material, you'll be asked to accept the new version on next sign-in. Continued use means you agree to the updated Policy.

10. Contact

Privacy questions, requests, or complaints: contact@cortiq.so. Business users can request a Data Processing Agreement (DPA) at the same address.

The data controller is:

Cortiq Co., Ltd. (코르티크 주식회사) 2F J4, 91 Baumoe-ro, Seocho-gu, Seoul, Republic of Korea Representative: Seong Joon Oh (오성준) Business Registration No. 516-88-03683 Mail-Order Sales Registration No. 제2026-서울서초-2081호 Tel: +82-70-8065-2031 Email: contact@cortiq.so

This is an early-access draft and is not a substitute for advice from a qualified lawyer in your jurisdiction.