Privacy Policy

Nemorya is a private place to keep the documents, bills, warranties, leases and deadlines that matter in your life. Because people save genuinely personal material here, this policy explains plainly what we collect, what we do with it, and what we deliberately do not do.

This policy applies to the Nemorya web application and the Nemorya API, including the optional connected financial-account features that let Nemorya discover recurring payments and services. If you do not agree with it, please do not upload documents to Nemorya or connect a financial account.

Nemorya is operated personally as a sole proprietorship based in Delaware, United States. It is not an LLC or a corporation. The operator is the party responsible for the information described in this policy, and can be reached at support@getnemorya.com.

Nemorya only holds information you choose to give it. That falls into a few groups, described below.

When you create an account we store your name, email address and a one-way hash of your password. If you sign in with a Google account, we store the identity details that sign-in returns to us (such as your name, email address and profile image URL) so we can recognise you on your next visit.

We also store account preferences such as your theme choice, notification settings and time zone.

When you capture or upload a document, photo or screenshot, we store the file itself with our object storage provider, along with metadata such as the original filename, file type, size and the date you saved it.

Uploaded documents are private to your account by default. Nemorya does not publish your documents, does not make them searchable to other people, and does not include them in any public index. Every request for a document is checked against the account that is signed in.

You decide what to upload. We recommend thinking carefully before saving highly sensitive material (for example medical records, government identifiers or financial account credentials), because you remain responsible for that decision.

To make a document useful, Nemorya uses AI models to read it and derive structured information such as a title, a short summary, a document type, key fields, dates, amounts, reference numbers and suggested reminders. The content of the document you uploaded is sent to the AI provider that performs that analysis.

We aim to send only what is needed for the feature you asked for. Analysis happens when you save a document or ask Nemorya to re-analyse it.

AI-derived information is a convenience, not a guarantee. Values may be incomplete or wrong, which is why you can correct them — and your corrections take priority over anything the AI produced.

Search runs on our own servers against a normalised index built from your own documents. Sentence-like queries the rules cannot interpret may be sent to an AI provider for interpretation of the query text only — your document content is not included in that request.

Ask Nemorya answers from your own saved information. When you ask a question, Nemorya first retrieves the small set of your documents that appear relevant, then sends only the question, a short structured summary of those documents and a limited number of relevant text excerpts to the AI provider that generates the answer.

We do not send your whole vault to an AI provider, and Ask Nemorya does not have access to any other person's documents.

If you create a reminder, we store its title, notes, due date and time, your time zone, the alerts you chose and a link to the related document where applicable. We also store a record of alerts we have already delivered so you are not notified twice.

If you enable browser notifications we store the push subscription your browser issues (an endpoint URL and encryption keys), which is what lets us deliver an alert to that specific browser. If you enable email reminders we use your account email address to send them. A notification tells you which reminder is due; it is not a copy of the document.

If you choose to connect a financial account, Nemorya uses Plaid to facilitate the connection. With your authorization, Nemorya may receive information associated with the accounts you connect, including account information, transaction history, transaction descriptions, merchants, amounts, dates, and information about recurring transactions or recurring services.

Nemorya uses this information to identify recurring outgoing payments and services and suggest items you may want to track as Bills & Services, due dates, and reminders. You decide whether to connect a financial account and which detected items you want to track.

Nemorya does not use Plaid to initiate payments, transfer money, automatically pay bills, provide investment advice, or make financial decisions on your behalf.

Plaid handles the connection between your financial institution and Nemorya. Your use of Plaid may also be subject to Plaid's privacy practices.

Our servers keep operational logs that can include timestamps, requested endpoints, response codes, error details and a browser user-agent string. These logs help us keep the service working and investigate problems.

We use this information to run and improve Nemorya. We do not build advertising profiles from it.

Nemorya uses cookies for authentication. Session and token cookies are set as http-only cookies so that page scripts cannot read them.

We also use your browser's local storage and session storage for small conveniences such as your theme preference, your recent searches and whether the intro animation has already played in this tab. That data stays on your device and can be cleared through your browser at any time.

If you consent to analytics, Nemorya uses a product analytics provider, HeyCatch, to understand how the site and the app are used — for example which pages are visited and which features are opened. HeyCatch is built on PostHog technology and stores an identifier in your browser's cookies and storage. Analytics events describe actions, not content: we do not send document text, extracted fields, search terms, reminder details, financial transactions or file names to an analytics provider.

If you consent to advertising measurement, Nemorya uses the Meta Pixel on its public marketing pages — the homepage and the shared demo pages, pricing, sign-in and sign-up, contact and these legal pages — to measure which campaigns bring people to the site. The pixel reports the page address and the standard information your browser sends, and Meta may combine that with information it already holds about you, including for advertising.

The pixel does not run on the signed-in application. It is deliberately excluded from every /app page — your vault, documents, search, Ask Nemorya, reminders, bills and settings — and it is also suppressed on any public page whose address carries a parameter we do not expressly allow, so that nothing from a link you were sent can leak into a marketing tracker.

You choose. On your first visit Nemorya asks, and until you answer, neither the analytics provider nor the Meta Pixel is loaded at all — no script, no cookie, no identifier, nothing queued to be sent later. Essential cookies are not part of the choice, because without them you cannot sign in or stay signed in.

You can accept everything, reject everything optional, or accept the two categories independently: analytics without advertising, or advertising without analytics. Nothing optional is pre-selected, and continuing to browse is not treated as agreement. Rejecting changes nothing about what Nemorya does for you — the site, sign-up, pricing and the whole application work the same.

You can change your mind whenever you like, from “Privacy choices” in the footer of every public page or in Settings. Withdrawing consent stops any further optional processing immediately and clears the related identifiers we can reach on your device — the analytics profile stored in your browser, and the Meta Pixel's own cookies. We will not pretend to do more than that: a page view already reported to Meta cannot be retrieved by us, and for that you need Meta's own ad settings in your Facebook or Instagram account.

If your browser sends a Global Privacy Control or Do Not Track signal, Nemorya treats that as a decision to refuse optional analytics and advertising. The signal wins: the chooser cannot be used to turn tracking back on while it is present.

We keep a small record of what you chose and when, so we can show that your choice was actually recorded. You can also always email support@getnemorya.com and we will deal with it.

The signed-in application is not an advertising surface. We do not place advertising on it, and we do not share document content, extracted information, financial data or reminder details with analytics or advertising providers.

We use the information described above to:

• create and secure your account and keep you signed in
• store, display and organise the documents you save
• produce summaries, extracted fields, categories and reminder suggestions for your documents
• answer your questions in Ask Nemorya from your own saved information
• identify recurring bills, subscriptions, and services from financial-account transaction information when you choose to connect an account
• deliver the reminders and notifications you asked for
• respond to support requests you send us
• diagnose failures, prevent abuse and keep the service reliable

We do not sell your personal documents or their contents to advertisers, data brokers or any other third party.

Nemorya offers a free plan and paid Pro and Pro Plus subscriptions. Payments are processed by Stripe. You enter your card details on Stripe's own checkout and billing pages, and Nemorya never sees or stores your full card number, expiry date or security code.

What Nemorya does receive and store is the information needed to run your subscription: your Stripe customer and subscription identifiers, which plan and billing period you are on, the price your subscription is attached to, its status and renewal or cancellation dates, and a record of in-app plan changes. We may also see the last four digits and brand of the card, the billing country and invoice amounts as reported by Stripe.

Stripe processes this information as its own controller for payment and fraud-prevention purposes, under its own privacy policy.

Nemorya relies on a small number of providers to operate. They receive only what they need to perform their function:

• AI providers — receive document content for analysis, and question plus retrieved context for Ask Nemorya
• Object and file storage providers — store the files you upload
• Email providers — send transactional and reminder email such as password resets, email verification and due-date alerts
• Hosting and database infrastructure — run the application and store your account data, metadata and reminders
• Financial data connectivity providers — Plaid facilitates connections to financial institutions and provides authorized account and transaction information needed for connected-account features
• Payment provider — Stripe processes subscription payments and card details; Nemorya receives subscription and invoice metadata but never your full card details
• Analytics provider — HeyCatch receives product usage events (pages viewed, features opened), never document, financial or search content
• Advertising measurement — Meta receives page-view signals from Nemorya's public marketing pages only, never from the signed-in application

We do not authorise these providers to use your documents for their own unrelated purposes. Analytics and advertising providers never receive your documents, extracted information, financial data or reminder content.

We keep your account information, documents and reminders for as long as your account exists, so that Nemorya can show them back to you.

When you delete a document it disappears from your vault immediately and is excluded from search, Ask Nemorya and exports. For a limited period the record is retained in a deleted state before its stored file is removed, and copies may persist briefly in backups or provider caches before they age out. The AI-derived summary and extracted fields live on the document record, so they go with it; reminders you created from that document are no longer linked to a live document, and you can delete them yourself at any time.

You can delete your whole account yourself from Settings. Deleting an account removes your documents, extracted information, reminders, conversations and connected-account data from the live service, subject to limited backup retention and any records we must keep for legal or accounting reasons — Stripe invoice records, for example, are retained by Stripe as required of a payment processor.

Connected financial data is retained while needed to provide Nemorya's connected-account and Bills & Services features. If you disconnect a financial institution, Nemorya ends the connection with Plaid and deletes the stored transactions and detected recurring streams for that institution. Bills & Services you chose to track stay as your own records, because they are yours to keep or delete.

Operational logs are kept for a limited period for troubleshooting. We have not set a single fixed retention period for every category of data, and we would rather say so than publish a number we do not actually enforce.

We take practical steps to protect your account: passwords are stored as one-way hashes, authentication uses http-only cookies, requests are transmitted over HTTPS, and every document, reminder and conversation request is checked against the signed-in account before anything is returned.

You can also turn on App Lock, a second passcode in front of your vault. The passcode is stored only as an Argon2id hash combined with a server-side secret, so it cannot be read back or recovered — if you forget it there is no way for us to tell you what it was. Repeated wrong attempts lock out further tries for a short period, and the lock re-engages after the inactivity period you choose. App Lock is enforced on the server, not just hidden in the interface: while your vault is locked, the API refuses requests for your documents outright.

No online service can promise perfect security, and we make no such promise. We hold no security certifications and we do not claim compliance with any specific certification or audit programme. Please use a strong, unique password and sign out on shared devices.

You can view, rename, recategorise, correct and delete the documents you save at any time. You can edit AI-derived fields, and your corrections take priority over AI values. You can turn reminder notifications on or off, and revoke browser notification permission through your browser.

You can download a copy of your data yourself from Settings. The export is a ZIP containing your account details, documents, extracted fields, reminders, categories and bills; passwords, tokens and payment details are never included. You can also delete your entire account yourself from Settings.

Depending on where you live, you may have additional rights over your personal information, such as requesting access to it, correcting it, or asking us to delete it. We respond to requests from anyone who asks, wherever they live, rather than only where a law compels it. Email support@getnemorya.com and we will handle it.

You can choose whether to connect a financial institution, and you can disconnect one at any time from Bills & Services.

For analytics and advertising specifically, use “Privacy choices” in the footer or in Settings — see “Cookies, local storage and analytics” above.

Nemorya honours Global Privacy Control, which in some US states counts as an opt-out of the sale or sharing of personal information. Whether any additional, separate opt-out mechanism is legally required of Nemorya depends on which laws apply to it, and that is a question for our legal review rather than something we will assert here.

Nemorya is intended for adults and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has created an account or uploaded documents, contact us and we will remove the account and its contents.

As Nemorya grows — for example when mobile apps launch — we may update this policy. When we make a material change we will update the date on this page and, where appropriate, tell you inside the product.