Privacy Policy

By creating an account for the Service or using the Service, users are deemed to have agreed to this Privacy Policy and the Terms of Service. Users who do not agree may not use the Service.

The Service is provided for Japan, primarily for individuals residing in Japan and corporations in Japan. Its primary display language, commercial transaction design, governing law, and support are oriented to Japan, and it is not intentionally targeted at (directed at) residents or markets outside Japan, including the EEA and the UK. The fact that the Service can be accessed from outside Japan does not mean that the Company provides the Service to, or directs it at, such regions.

NoraPocket (the "Service") collects the following information.

• Account information (email address). Note: passwords are stored in hashed form and are not retained in plain text
• Uploaded files (images, PDF, Word, Excel, audio)
• Data that users enter or select for AI processing (text, chat content, file content, images, PDFs, audio transcriptions, records, templates, data required for Skill execution, structured data, analysis results)
• Usage logs (access date and time, operation history)

• Providing and improving the Service
• AI-based structured extraction, transcription, analysis, suggestions, chat responses, and Skill execution
• Customer support

Only if you have explicitly permitted it, this app reads the following from Apple Health (HealthKit): weight, sleep, calories consumed, protein, water, caffeine, step count, workouts, calories burned, heart rate, resting heart rate, heart rate variability, respiratory rate, blood oxygen, maximal oxygen uptake (VO2 max), body fat percentage, exercise time, stand time, flights climbed, walking + running distance, walking average heart rate, BMI, lean body mass, carbohydrates, fat, sleeping wrist temperature, workout effort, and sleep stages (core, deep, REM, awake). Health data constitutes special care-required personal information under the Act on the Protection of Personal Information (APPI), and its acquisition, use, and cross-border provision are each premised on the corresponding explicit consent.

Linked items are stored not as time series of raw samples but as aggregated daily values (for sleep stages, nightly totals) in your account records on the servers of the Company (NoraPocket) (they are not stored only on your device). This app does not write to Apple Health.

Whether stored health data is used by AI features is governed solely by the separate "AI Data Sharing" setting and, where the selected AI provider requires additional consent, that consent. Only where all required consents have been given, health data may be sent for AI analysis to Anthropic, PBC (United States, directly or via Vercel AI Gateway) or OpenAI (United States, via Cloudflare AI Gateway, directly, or via Vercel AI Gateway), and, if you request audio output, the generated Japanese and English text may be sent to OpenAI (United States) via Cloudflare AI Gateway, directly, or via Vercel AI Gateway (cross-border provision to third parties). Without the required consents, health data is only stored as NoraPocket account records and is not sent to these third-party AI services. Turning the Apple Health integration or individual items on or off does not by itself change the AI consent settings.

Turning individual items on or off is a preference for which items will be imported on this device going forward, and is not itself a withdrawal of consent to the Apple Health integration. To stop all future imports from this device, turn off "Connect Health". To stop imports for the entire account, it must be turned off on every device you use. Turning it off does not delete stored records, and their AI use continues to be governed by the AI consent settings.

When an item or the integration as a whole is enabled for the first time on this device, data is imported from up to the past 30 days. If you turn it off and then resume within the same sign-in period, regular imports do not import the days during which it was off, and on the day of resumption the daily values for that entire day are imported. If you explicitly run "Re-import Past 30 Days", data for up to the past 30 days, including periods that were previously off, is re-read for the items that are on at the time of execution and stored in your account records. Signing out resets the item settings on this device, and if you sign in again and connect, data is imported from up to the past 30 days as an initial setup.

Even when "Sleep Stages" is off, the same sleepAnalysis data may be read to produce the daily "Sleep" values, but in that case no sleep stage breakdown is generated or stored. This app does not acquire highly sensitive data or data that is clinical or dependent on medical devices, such as sexual activity, menstrual cycle, state of mind, mental health questionnaires, medications, blood pressure, blood glucose, and electrocardiograms, or scores and assessments for which the HealthKit read API is not available. NoraPocket does not use health data for advertising, sale to third parties, or training NoraPocket's own AI models. Retention and use conditions by external AI services are governed by the consent screen for each AI provider shown before use.

The Service entrusts data processing to the following external services as service providers. In each case, data is shared only to the extent necessary to provide the Service, and is not sold or resold to third parties.

• Anthropic, PBC (United States) — Claude API (directly or via Vercel AI Gateway). When Skill execution goes through Vercel AI Gateway, Vercel AI Gateway relays the inputs and responses. Used for structured extraction from files, Nora chat, analysis and suggestions, automatic Type generation, and Skill execution. The data sent consists of the text, chat content, file content, images, PDFs, audio transcription results, records, templates, and data required for Skill execution that users enter or select in AI features. In the iOS app, the user's permission is obtained within the app before this data is sent to Anthropic (including Vercel where relaying occurs). Data sent via the API is not used for model training (based on the API terms of use). Normally, Anthropic API inputs and outputs are deleted within 30 days. However, they may be retained longer due to features with longer retention periods, individual agreements, usage policy compliance, legal obligations, and the like. Anthropic API data retention policy Anthropic Privacy Policy
• OpenAI, L.L.C. (United States) — Used for text generation, speech synthesis, OpenAI-path image generation, and transcription. Data is sent to OpenAI through Cloudflare AI Gateway, directly, or via Vercel AI Gateway. For speech synthesis, the script of the audio to be generated is sent. Additional consent for OpenAI is obtained before use.
• Groq, Inc. (United States) — Whisper API via Cloudflare AI Gateway (whisper-large-v3). Used to transcribe uploaded audio files. The data sent is the audio file itself (up to 25MB) and, optionally, a language hint. In the iOS app, the user's permission is obtained within the app before audio is sent to Groq. Under Groq Services Agreement §4.2 (Inputs and Outputs), Groq does not use API inputs and outputs (Inputs / Outputs) for model training or fine-tuning unless the Company explicitly permits or instructs it to do so. The Company has not granted Groq permission for training use. §11.5 provides that Customer Data will be deleted within 30 days upon termination of the agreement. Groq Services Agreement / Groq Privacy Policy
• Supabase, Inc. (US corporation / stored in the Tokyo region) — Authentication and database (storage of structured data). Data is stored encrypted in the Tokyo region (ap-northeast-1). Supabase itself does not use user data for AI model training purposes.
• Cloudflare, Inc. (United States) — R2 object storage. Stores, in encrypted form, the files uploaded by users (images, PDFs, Word, Excel, audio, etc.) and intermediate output files from AI processing. If Cloudflare Durable Objects are used in the future, P2 agent_run_events bodies, P3 chat bodies and turn state, P4 gadget storage, connection information for external services, the temporary execution state of an agent run (the identifiers, status, and result of one attempt), and the results of chat sub-agents will also be included as user data under the same storage, export, and deletion terms. Stored objects are not used for AI model training purposes. In addition, Cloudflare AI Gateway relays inference requests to OpenAI, Groq, and Google. Under the Company's Gateway configuration (log collection OFF), the content of relayed requests is not stored at Cloudflare. Cloudflare Privacy Policy
• Google LLC (United States) — Google Sheets API, Google Drive API, and Google Analytics (Google tag). The Google Sheets API and Google Drive API are used, only where the user has explicitly authorized the integration, to create, read, and write spreadsheets and to access files created by the app. Access tokens are stored encrypted, and users can disconnect the integration at any time. Google Analytics is used via www.googletagmanager.com / www.google-analytics.com to analyze site usage of pocket.norabit.dev, such as page views and traffic sources. Identifiers such as cookies may be used, but not for ad delivery, sale to third parties, or AI model training purposes. Google data obtained by the Service is never used for the purpose of model training by Google, Anthropic, or any other external LLM. For image generation and editing, prompts and reference images are sent to Google using the Gemini API paid tier through Cloudflare AI Gateway, directly, or via Vercel AI Gateway. Under the paid-tier terms, sent content is not used for product improvement. Google Privacy Policy
• Vercel, Inc. (United States) — Application hosting and delivery, and processing of access logs. On routes that use Vercel AI Gateway, it relays inputs to and responses from Anthropic, OpenAI, and Google. When Anthropic is used via this route, the setting that selects only AI providers' zero data retention (ZDR) is not enabled. Data sent is not used for model training. Vercel has published a default policy of deleting inputs and responses after relaying is complete. This is separate from retention on the providers' side. Vercel AI Gateway data protection policy
• Sentry (United States) — Error monitoring. Collects technical debugging information when application errors occur. Personally identifying information is limited to the minimum. Information collected by Sentry is not used for AI model training purposes.
• Stripe, Inc. (United States) — Payment processing and billing management for paid plans purchased via the web. Credit card information is not stored on the Company's servers and is processed by Stripe in compliance with PCI DSS. The Company receives from Stripe only the minimum necessary information, such as payment success or failure, subscription status, and email address. Information processed by Stripe is not used for AI model training purposes. Stripe Privacy Policy
• Apple Inc. (United States) — When App Store In-App Purchase is used via the iOS app, Apple performs payment processing and billing management. Through Apple App Store Server Notifications V2, the Company receives only the minimum necessary information, such as payment success or failure, subscription status, and transaction ID. Credit card information, Apple IDs, and the like are not stored on the Company's servers. Apple Privacy Policy
• PostHog, Inc. (United States) — Usage event analytics and feature flag evaluation in the web app. The destination is us.i.posthog.com (United States). The data sent includes the following: user ID (UUID issued by Supabase), email address after login, organization ID, page views (`$pageview`), automatically captured click and form submission events, and contextual information such as `env` / `app`. For persistence, browser localStorage and cookies (under the PostHog domain, for the purpose of retaining identifiers) are used. It is not used for ad delivery, sale to third parties, or AI model training purposes. The Service also loads PostHog measurement on some legal pages (/terms, /privacy, etc.). PostHog Privacy Policy

The Service uses the above external services as service providers, and in each case shares data only to the extent necessary to provide the Service. The Company entrusts processing to each service provider after contractually imposing security and privacy protection obligations equivalent to or higher than the level of protection the Company itself complies with, and does so as an exception to provision to third parties (entrustment) under the amended Act on the Protection of Personal Information (APPI) (effective April 2022). No sale or resale to third parties is carried out whatsoever.

Cross-border transfer: Because the above service providers include US corporations, user data is transferred outside Japan (mainly to the United States). The Company uses Anthropic (United States), OpenAI (United States), Groq (United States), Vercel (United States), Sentry (United States), Stripe (United States), Apple (United States / when iOS IAP applies), PostHog (United States), Cloudflare (US corporation / the R2 region setting is Auto; includes relaying of inference requests by AI Gateway; includes chat bodies and turn state, agent_run_events bodies, and gadget storage to be stored in Durable Objects in the future), Google (United States), and Supabase (a US corporation, but the storage region is Tokyo, ap-northeast-1) as service providers.

Personal information protection system in the destination country (United States): The United States has no single comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; instead, personal information is governed by sector-specific federal laws such as HIPAA (healthcare) / GLBA (finance) and by state laws (such as California's CCPA / CPRA). For details, please refer to the materials of the Personal Information Protection Commission (PPC), "Survey on Systems, etc. for the Protection of Personal Information in Foreign Countries".

Measures for protection at the destination: In its service agreements with each service provider, the Company imposes obligations such as prohibition of use for other purposes, confidentiality, security control measures, restrictions on subcontracting, and return or deletion of data upon termination of the agreement. Through these measures, the Company endeavors to ensure protection equivalent to or higher than the level of protection the Company itself complies with. Please use the Service after consenting to this cross-border transfer.

• Data export (performed by users themselves using the in-service download feature and the bulk account data export feature (JSON format) for authenticated users. The Company in principle does not provide individual data retrieval support)
• Account deletion (including deletion of all data; accepted via the settings screen or by contacting support@norabit.dev)
• Withdrawal of consent to AI Data Sharing (in the iOS app, it can be withdrawn from the settings screen)
• Withdrawal of consent to data processing (carried out by account deletion)

Account deletion and the withdrawal of various consents are accepted via the settings screen or through inquiries.

The Service does not target the EEA or the UK. However, where the Company is required to respond under applicable laws, it will respond to rights such as access, rectification, erasure, restriction of processing, and data portability under local laws. To exercise these rights, please contact support@norabit.dev.

The Service uses the following cookies and similar technologies.

• Authentication cookies (required): maintain the login state. Deleted when the session ends.
• Analytics cookies and localStorage (PostHog): cookies and localStorage under the PostHog domain are used in the web app and on some legal pages for usage event analytics, page view measurement, and feature flag evaluation. They are used for the purpose of retaining identifiers and are not used for ad delivery. For details, please see the PostHog item in Section 5 of this Policy.
• Analytics cookies (Google Analytics): Google Analytics cookies and the like may be used to analyze site usage of pocket.norabit.dev, such as page views and traffic sources. They are not used for ad delivery. For details, please see the Google item in Section 5 of this Policy.
• No cookies or trackers are used whatsoever for the purpose of delivering advertising for third parties.

This Policy may be revised as necessary. The revised Policy takes effect when it is posted on this page.

• Operator: NoraBit LLC
• Address: Osaka Ekimae Dai-2 Building 12-12, 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka 530-0001
• Representative: Reo Kan, Representative Member
• Contact: support@norabit.dev