Nosce Privacy Policy

1. Operator and scope

Personal-information processor: Nosce operator (registered sole-proprietor name to be configured) Unified social credit code: Unified social credit code to be configured Address: Registered operator address to be configured Privacy email: rui@nosce.life

This policy covers the Nosce web service and services that expressly link to it. Nosce is currently intended only for mainland-China users aged 18 or older. Until the operator details above are complete, this is a development draft rather than production legal text.

2. Information processed

Account and authentication: login email, Supabase account ID, account creation and last-sign-in times, email-confirmation time, session and security state, used for registration, email-code sign-in, session continuity, and account security.

Profile you provide: nickname, gender, age band, and biography. Every field may be skipped. Nosce does not require a portrait, exact birthday, region, or time zone.

Core content: text you enter, conversations, corrections, feedback, reflections, understandings, portraits, memory summaries, source relationships, and AI output. Free expression may contain mental-state, medical, intimate, family, religious, financial, or other sensitive information.

Operations and product analytics: IP address, browser and device data, request time, feature or screen, success or failure state, error category, language, model and token usage, plus counts or boolean metadata without conversation text. PostHog is enabled only after you submit consent to the current versions and receives manually defined events tied to a pseudonymous account ID. Nosce disables PostHog autocapture, automatic page views, page leave, and session recording, and does not intentionally send login email, profile text, or conversation text to PostHog.

Local storage and cookies: login session, locale and theme, local product data or cache, and the PostHog browser identifier for authentication, preferences, local features, and limited analytics.

3. Purposes and methods

We process information to establish and maintain accounts; send and verify email codes; generate replies; save and retrieve relevant history; form inspectable and correctable understandings, portraits, and reflections; provide export, deletion, and cancellation; understand feature reliability; prevent abuse; diagnose failures; protect security; and meet legal duties.

Nosce uses automated models but does not make medical, employment, credit, insurance, admissions, or other decisions with legal or similarly significant effects about you. Nosce does not sell personal information, use it for targeted advertising, or train a Nosce-owned model on identifiable user content.

4. Sensitive personal information

Because the core service permits free expression about real experiences, content may be sensitive personal information. The specific purposes are to respond to the current expression, maintain continuity, retrieve relevant history, and form self-understanding that you can inspect, correct, and delete.

Disclosure or misuse can cause privacy, reputational, discrimination, property, or emotional harm. Nosce reduces risk through separate consent, minimum-necessary transfer, server authentication, row-level isolation, transport encryption, secret isolation, correctable output, and deletion. You may omit any detail. Without consent to this processing, Nosce cannot provide the core long-term conversation service.

5. Providers and actual data flow

Vercel Inc. hosts the site, edge network, and server functions. The current server-function region is iad1 in the United States. Requests, IP, headers, session information, and feature inputs and outputs pass through Vercel infrastructure as needed.

Supabase Inc. provides email authentication, PostgreSQL, and account-scoped access control. The current Nosce project is in Tokyo, Japan (ap-northeast-1), where email, account profile, acceptance records, and core product data are stored.

PostHog Inc. provides US-cloud product analytics and receives a pseudonymous account ID, IP/browser network information, and limited manually sent feature events and metadata. Autocapture and session recording are disabled.

Hangzhou DeepSeek Artificial Intelligence Co., Ltd. provides primary generative-AI inference and receives the system prompt, current input, necessary recent turns, relevant history, user-authored profile, and working understandings needed for the request.

Beijing Moonshot AI Technology Co., Ltd. (Kimi) is used only as disaster-recovery inference when DeepSeek has an infrastructure failure that satisfies program rules, and receives content necessary for that same request.

Alibaba Cloud Model Studio (DashScope) uses text-embedding-v4 to create memory-retrieval vectors and receives text segments that need semantic indexing. Its continued use, region, and plan must remain aligned with console configuration.

This list reflects code and production configuration reviewed on August 28, 2026. Material provider, region, or purpose changes are disclosed before new processing and accepted again when required.

6. Provider use of model data

Nosce does not train its own model on identifiable input or output. This does not mean every external model provider makes the same promise.

DeepSeek's current public terms permit minimal use of input and output under encryption, strict de-identification, and irreversible identification safeguards to provide, maintain, develop, or improve its service, with an “Improve the model for everyone” opt-out. Code alone does not prove that the production API account has disabled it, so Nosce does not promise that DeepSeek never uses API input or output for service or model improvement.

Kimi's public API security notice says API input and output are not used to train or improve models and are not retained for training. Alibaba Cloud states that pay-as-you-go Model Studio API data is not used for training, but call data is stored where law requires. These statements depend on current provider terms and the actual account plan.

7. Cross-border processing

Because Vercel is in the United States, the Supabase database is in Tokyo, and PostHog uses US Cloud, personal information from mainland-China users is provided overseas. Recipient names, contacts, purposes, methods, categories, and rights procedures appear in the Cross-border Personal Information Rules, accepted separately at sign-in.

Before production, the operator must also complete a personal-information protection impact assessment and any applicable standard-contract filing, certification, security assessment, or exemption analysis. A checkbox alone does not replace those legal duties.

8. Retention and deletion

Account and core product data are normally retained until you delete the relevant data or cancel the account. Cancellation deletes account and product data from the online business database. Provider-managed backups, disaster-recovery copies, and security logs that cannot be deleted item by item immediately stop being used for ordinary business and expire or are anonymized under the applicable rotation cycle. Nosce does not invent a fixed “30 days” before those cycles have been verified for each production plan.

Pseudonymous events already sent to PostHog are not automatically deleted when a Supabase account is cancelled. Contact rui@nosce.life for linked deletion; after identity verification the operator must process it in PostHog. The operator must verify and publish the concrete PostHog event-retention period before production.

Nosce may retain minimal agreement evidence after cancellation—versions, acceptance time, cancellation time, and a reference that does not directly identify you, without email or content—for up to three years to prove agreement formation or handle disputes.

9. Your rights

In Settings you can edit profile data, export a complete copy including email, account times, profile, acceptance records, and product data, delete product data, or cancel the account. Contact rui@nosce.life for access, copy, correction, completion, deletion, restriction, explanation, or assistance exercising rights with an overseas recipient.

Cancelling the account withdraws future consent to sensitive processing and overseas provision. Withdrawal does not affect processing completed before it. Because current core architecture depends on overseas hosting and database services, Nosce cannot continue the account and core service after cross-border consent is withdrawn.

10. Security and incidents

Nosce uses HTTPS/TLS, server authentication, row-level access controls, secret isolation, least privilege, and database backups. Only personnel or processors who need access to run the service may process data within authorized scope.

No internet service can promise absolute security. If an incident may harm your rights, Nosce will take remedial measures and notify you as required, using in-product notice, email, or another appropriate method.

11. Updates

The current version and effective date appear on the page. Editorial changes that do not reduce rights may take effect through page notice. Material changes to purpose, method, category, retention, provider, region, sensitive processing, or cross-border processing are highlighted and accepted again where required.

12. Contact

Send privacy requests, complaints, provider-deletion requests, or AI-output reports to rui@nosce.life. Nosce verifies identity and responds within the period required by law. You may also complain to the competent cyberspace or market-regulation authority.

If another-language version conflicts with the Chinese version, the Chinese version controls.