nosce.
Cross-border Personal Information Rules
This is a separate notice for overseas provision of personal information. Nosce is not currently hosted entirely in mainland China: core requests, database, and product analytics involve the United States and Japan.
Pre-launch legal draft: the registered sole-proprietor details and privacy email must be completed, and a personal-information impact assessment, lawful cross-border mechanism, and lawyer review must be completed before production use.
1. Why overseas processing is needed
Nosce uses Vercel for web and server functions, Supabase for authentication and database, and PostHog for limited analytics. Vercel and PostHog use US infrastructure and the Supabase project is in Tokyo. Network requests, account data, and product data of mainland-China users are therefore processed overseas.
Because this notice itself is hosted by Vercel, the IP address, browser request headers, and access time needed to deliver the page pass through Vercel when you first open Nosce, before any checkbox. That page visit alone does not create a Supabase account or send conversation content to an AI provider, and PostHog is not initialized before consent. Close the page if you cannot accept this minimum overseas network processing for initial page delivery.
Vercel and Supabase are necessary for current account and core service operation. Without cross-border consent Nosce cannot send a code, establish an account, or provide the core service under this architecture. PostHog is used for product analytics and limited to pseudonymous identity and non-content events.
2. Overseas recipient: Vercel Inc.
Name: Vercel Inc. Location: United States; current server-function region iad1 (Washington, D.C.), with edge nodes potentially handling network delivery elsewhere. Contact: privacy@vercel.com Purpose and method: web hosting, edge delivery, server-function execution, API routing, security, and diagnosis through continuous HTTPS transfer and automated processing. Categories: IP, browser and headers, cookies or session data, access time, and account data, user input, relevant context, and generated output needed for login, account, conversation, retrieval, export, and deletion functions. Retention: under Nosce configuration and Vercel's effective service, log, and backup terms.
3. Overseas recipient: Supabase Inc.
Name: Supabase Inc. Location: Tokyo, Japan ap-northeast-1 is the current project data region; the provider and subprocessors may provide operations and support in other overseas locations under their agreement. Contact: privacy@supabase.io Purpose and method: email-code authentication, account management, PostgreSQL storage, backup, row-level access control, and queries through encrypted continuous transfer and storage. Categories: login email, account ID and times, session and authentication data, profile, agreement records, conversations and derived understandings, portraits, reflections, memory index, and other account product data. Retention: online data normally until deletion or cancellation; backups and security records follow the project plan and applicable rotation cycles.
4. Overseas recipient: PostHog Inc.
Name: PostHog Inc. Location: US Cloud (Virginia, United States). Contact: privacy@posthog.com Purpose and method: understand sign-in, feature use, success or failure, and flows for diagnosis and product improvement through browser SDK and HTTPS manually defined events. Categories: pseudonymous Supabase user ID, PostHog browser ID, IP and browser network data, language, feature or screen, result, and limited counts or booleans without content. Autocapture, automatic page views, page leave, and session recording are disabled; email, profile text, and conversation text are not intentionally sent. Retention: under the actual PostHog project setting; the operator must verify and publish a concrete period before production.
5. Transfer path and possible effects
A typical path is: your device sends a request to Vercel in the United States; Vercel reads or writes the Supabase database in Tokyo; for AI inference, Vercel sends minimum necessary context to DeepSeek in mainland China or to Kimi after a qualifying failure; for semantic indexing it sends text to Alibaba Cloud Model Studio. Results return through Vercel and may be stored in Supabase.
Overseas law, regulatory demands, subprocessors, network latency, and security conditions may make control and remedies harder. Encryption, server secrets, row isolation, minimization, contract terms, and rights assistance reduce but do not eliminate risk.
6. Exercising rights
Contact rui@nosce.life to request access, copy, correction, completion, or deletion of overseas data, an explanation, or withdrawal of future consent. After identity verification Nosce handles requests in its own systems and forwards or assists requests to Vercel, Supabase, or PostHog where needed. You may also contact the providers directly at the addresses above.
Withdrawal does not affect earlier lawful processing. Current core architecture depends on Vercel and Supabase, so account service cannot continue after withdrawal. Account cancellation withdraws future consent and initiates online deletion.
7. Separate consent and pre-launch conditions
Nosce records cross-border consent only when you separately check this notice. Material changes to recipient, purpose, method, category, or location are disclosed and accepted again where required.
A user's checkbox does not by itself satisfy every cross-border legal duty. Before production, the operator must complete and retain a personal-information protection impact assessment and, based on actual data volume and sensitive-data processing, complete any applicable standard-contract filing, certification, security assessment, or exemption analysis. Until then this remains a development draft.