Legal

Privacy Policy

Last updated 12 October 2026

1. Who we are and what this covers

NAV LAB (“NAV LAB”, “we”, “us” or “our”) is an independent software studio. This Privacy Policy applies to all of our apps — currently Noota, Tempus, Risen, Mona, Visty and Folda — on every Apple device, to their websites, and to navlab.app (together, the “Services”). Our apps are provided by the developer identified as the seller of the apps on the Apple App Store, who operates NAV LAB from Vietnam and is the controller of your personal data under this Privacy Policy.

This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it and what rights you have. The parts that apply to every app come first; Section 12 then describes each app in detail, because our apps work in different ways: some keep everything on your device, others store your content on our servers or use AI services to process it.

Some of our apps’ websites also publish an app-specific privacy policy. If one of them ever differs from this policy, this policy applies.

You can contact us about privacy at any time at admin@navlab.app.

2. The short version

No ads, no data sales. We do not show ads in our apps, we do not sell your personal data and we do not share it for targeted advertising.
No tracking across other companies’ apps. We do not use your device’s advertising identifier (IDFA) and we do not track you across apps and websites owned by other companies.
No AI training on your content. We do not use your content to train AI models, and we only use AI services under terms that do not allow them to train on it either.
On your device where we can. Wherever an app can do its work on your device, it does. When content has to leave your device — to sync it, or because an AI feature needs a server — Section 12 says so, app by app.
Payments stay with Apple. Purchases are processed by Apple. We never see your payment card details.

3. Personal data we collect

What we collect depends on the app you use; see Section 12 for each one. Across our apps, it falls into the following categories.

Content you create

The notes, plans, alarms, expenses, business cards, documents and other content you create or import in our apps. Depending on the app, this content stays on your device, is synced through your own iCloud account (which we cannot access), or is stored on our servers so that it can be synced through your account with us.

Your content may include personal data about other people — for example the voices of meeting participants recorded in Noota, the details printed on business cards scanned in Visty, or an identity document scanned in Folda. Please only record, scan or import information about other people when you are allowed to.

Account information

Most of our apps have no accounts. Noota and Visty offer one, so that your content can be synced and restored: with Sign in with Apple or Google Sign-In we receive your email address (with Sign in with Apple, this may be a private relay address), your name if you choose to share it, and an account identifier. Noota, and Visty where offered, can also create a guest account with a random identifier and no email address.

Purchase information

Purchases are processed by Apple, and we never receive your payment card details. For the apps that sell subscriptions or other purchases, RevenueCat, our subscription management provider, gives us information about your purchases, such as the product purchased, transaction identifiers, purchase and expiration dates, renewal status and the country of your App Store account. In some apps, RevenueCat also receives Apple’s privacy-preserving attribution data (AdServices), which only indicates whether the app was installed from one of our Apple Search Ads campaigns.

Usage, device and diagnostic data

Our apps use Google Firebase services — such as Analytics, Crashlytics, Remote Config and Cloud Messaging — to understand how the app is used, fix crashes, configure features and deliver the notifications you allow; Section 12 lists the services each app uses. This includes events such as the screens and features used, paywall and purchase steps, the app version, device model, operating system version, language, approximate location derived from your IP address (country or region), crash reports and Firebase identifiers, plus a few onboarding choices described for each app in Section 12. Analytics events describe how features are used and are not designed to contain the content you create; occasionally, a crash or error report can include a fragment of the data involved in the error. We do not use this data for advertising.

Our servers and the servers of our AI providers receive technical information with each request, such as your IP address, the time of the request and the app version, which we use to run and secure the Services and to limit abuse.

Communications

If you contact us, we receive your email address and the content of your message, along with any details you choose to include. Some apps pre-fill support emails with technical information, such as the app version and device model, which you can see and remove before sending.

Our websites

navlab.app does not use cookies, analytics or advertising trackers, and sets nothing in your browser. It is hosted by Cloudflare, which processes technical data such as your IP address to deliver the website and protect it against abuse. Our apps’ own websites are described in their own pages.

4. How we use personal data and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) requires a legal basis for each purpose; we indicate it for each one. Where other laws apply, we rely on the equivalent legal bases under those laws.

To provide the Services: run the features you use, store and sync your content where an app does so, generate the AI results you request, manage your account where there is one, and provide support. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
To manage purchases: verify your access to paid features and keep purchase records. Legal bases: performance of our contract with you, and compliance with our legal obligations, such as accounting and tax obligations (Art. 6(1)(c) GDPR).
To understand and improve the Services: analytics, crash reports and testing of new features. Legal basis: our legitimate interest in understanding how our apps are used and improving them (Art. 6(1)(f) GDPR).
To keep the Services secure: prevent fraud and abuse, fix problems and enforce our Terms of Use. Legal basis: our legitimate interest in protecting the Services, our users and ourselves (Art. 6(1)(f) GDPR).
To send you the notifications you have enabled. Legal basis: your consent, given through your device’s notification permission, which you can withdraw at any time in your device settings (Art. 6(1)(a) GDPR).
To comply with the law: respond to lawful requests from authorities and establish, exercise or defend legal claims. Legal bases: compliance with our legal obligations, and our legitimate interest in protecting our rights.

Where we rely on our legitimate interests, you can object at any time (see Section 11). We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. AI processing

Several of our apps use artificial intelligence. Each app tries the most private option available first, except Tempus, which currently starts with Apple Private Cloud Compute (see Section 12):

On your device. Apple’s on-device models (Apple Intelligence, Vision and speech recognition) process your content without it leaving your device.
Apple Private Cloud Compute. On supported devices running iOS, iPadOS or macOS 27 or later, some requests go directly from your device to Apple’s Private Cloud Compute. According to Apple, this data is used only to fulfill the request, without being stored or made accessible to Apple.
Our servers and AI providers. When neither is available or neither can do the job, some apps send the content needed for that request to our servers, which ask an AI provider to process it and return the result.

The AI providers we use are Google (the Gemini API, used by Noota, Tempus, Mona and Visty) and OpenAI (the OpenAI API, used by Tempus only when a request to Gemini fails or returns no usable answer). We use them under their paid API terms, under which they process the content as our service provider, do not use it to train or improve their models, and may keep it for a limited period solely to detect abuse and comply with legal obligations. Exactly what each app sends, and when, is described in Section 12.

Speech. When you dictate in an app, your speech is converted to text by Apple’s speech recognition. Where your device does not support doing this on the device, Apple may process the audio on its servers under Apple’s Privacy Policy.

Turning what you give an app into a result is the purpose of these features, so this processing is necessary to provide them. If you do not want certain content to be processed by AI, do not use the AI features on it.

6. Device permissions

Our apps ask for access to parts of your device only for the features that need them, and only when you first use those features. You can change any permission at any time in your device’s Settings; the related feature then stops working, and the rest of the app continues to work.

Camera: to scan documents, business cards, receipts and QR codes, and to verify Risen’s wake-up missions. Camera images are processed on your device; Section 12 says when a photo is stored.
Microphone and speech recognition: for recording (Noota), voice notes (Visty) and dictation.
Calendars and reminders: in Tempus, to plan your day around your existing events and reminders.
Screen Time: in Tempus, to block the apps and websites you choose during a focus session. Apple’s Screen Time framework does not let us see which apps you use.
Location: only while you use the app — in Risen, approximately (about 3 km), to show the local weather; in Visty, if you choose to record where you met someone.
Contacts: in Visty, to save cards to your contacts, check for duplicates and import the contacts you choose.
Motion and fitness: in Risen, for the steps and shake missions and to check that you are still up.
Photos: to save images to your library (add-only) or to import images you pick.
Face ID: in Folda, to lock the app. Face ID is handled entirely by Apple; we never receive your biometric data.
Notifications and alarms: for the reminders and alarms you set.

We share personal data only in the following cases:

Service providers that process data on our behalf and under our instructions:
- hosting and infrastructure: Hetzner (servers for Noota and Visty), Cloudflare (servers, file storage and website hosting) and Vercel (the Noota and Tempus websites);
- AI: Google (Gemini API), OpenAI (OpenAI API) and Apple (Private Cloud Compute), as described in Section 5;
- app services: Google (Firebase) and RevenueCat (subscription management);
- error monitoring (Sentry), an email delivery provider for Visty, and the network proxy provider Noota uses to retrieve YouTube transcripts.
Apple and Google services you use: when you sign in with Apple or Google, sync with iCloud, make a purchase on the App Store, receive push notifications or use Siri, Spotlight or Apple’s translation, Apple or Google receives the data needed for that service and processes it under its own terms and privacy policy.
Other people, when you choose: when you share or export your content, or publish something on purpose — for example a Visty card page (see Section 12).
Legal reasons: when required by law or by a valid request from public authorities, or when necessary to protect the rights, safety or property of our users, the public or ourselves, including to prevent fraud and abuse.
Business transfers: if we are involved in a reorganization, merger, acquisition or sale of assets, your data may be transferred as part of that transaction and will remain protected by this Privacy Policy. We will inform you before your data becomes subject to a different privacy policy.

We do not sell your personal data and we do not share it for cross-context behavioral advertising. Access to your content on our systems is limited to people we authorize, and only when needed to provide support, maintain security, investigate abuse or comply with the law.

8. International transfers

We and our service providers process personal data in several countries, including Vietnam, the United States and member states of the European Union, which may be outside your country of residence. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that does not offer an adequate level of protection, we rely on appropriate safeguards, such as the standard contractual clauses adopted by the European Commission that are included in our service providers’ data processing terms, or the provider’s certification under the EU-U.S. Data Privacy Framework. You can contact us for more information about these safeguards.

9. How long we keep personal data

Content on your device or in your iCloud account: until you delete it, delete the app, or delete the app’s data from iCloud. We never hold a copy.
Content on our servers (Noota and Visty): for as long as your account exists, unless you delete it sooner. Section 12 gives each app’s specific periods, for example for deleted items and inactive guest accounts.
Requests to our AI servers (Tempus and Mona): these servers do not keep the content you send in any database. They keep short-lived counters, linked to your IP address and deleted after about an hour, to limit abuse. Our hosting provider keeps technical request logs for a limited period, and when a request fails, the error log may include part of the content involved.
Backups: where we keep database backups for disaster recovery, they are kept for a limited period and then deleted on a rolling basis. Deleted data may remain in a backup until that backup expires.
Purchase records: for as long as necessary to meet our legal and accounting obligations. Apple and RevenueCat keep their own records of your purchases under their own policies.
Analytics and crash data: kept by Google Firebase according to the retention settings of those services.
Correspondence: for as long as necessary to handle your request and for a reasonable period afterwards.

We may keep certain data longer when the law requires it or when it is necessary to establish, exercise or defend legal claims.

10. Security

We protect your data with measures such as encryption in transit (HTTPS/TLS), access controls, private file storage that can only be accessed through authorized links, and storage of sign-in tokens in your device’s Keychain. Content synced through iCloud is protected by Apple. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to security incidents. Where the law requires it, we will notify you and the competent authorities of a personal data breach.

11. Your rights

Depending on where you live — for example under the EU or UK GDPR, the Brazilian LGPD, the privacy laws of U.S. states such as California, or the personal data protection laws of Vietnam — you may have the right to:

access the personal data we hold about you and obtain a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict certain processing, or object to it, including processing based on our legitimate interests;
receive the data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another provider (data portability);
withdraw your consent at any time where processing is based on consent, without affecting processing carried out before the withdrawal;
lodge a complaint with a data protection authority, in particular in your country of residence.

California and other U.S. states: we do not sell your personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your privacy rights.

How to exercise your rights

In the apps. Each app lets you view, edit and delete your content. Apps with accounts let you delete your account and its content in Settings; Section 12 explains how for each app. Deleting an app or your account does not cancel a subscription; cancel it in your Apple Account settings.
By email. For any other request — including deleting analytics or purchase data associated with your installation, or if you can no longer use an app — email us at admin@navlab.app, if possible from the email address linked to your account. We may ask for information to verify your identity. We respond within one month, which may be extended by two further months for complex requests where the law allows it.

12. App-by-app details

Noota

Account: a guest account with a random identifier, or Sign in with Apple or Google Sign-In.
Where your content is stored: to sync and back up your notes, Noota stores your notes and the content you add on our servers, including audio recordings and imported files up to the size limits shown in the app. Larger audio files stay only on your device, and only their transcript is sent to us.
Transcription: speech is converted to text on your device, by Apple’s speech recognition or by speech models that run locally (downloaded from Hugging Face, without any of your content). Your recordings are never sent to an AI provider for transcription.
AI: summaries, titles, action items, quizzes, flashcards and answers are generated by Google’s Gemini models through our servers. We send the text of your note, imported PDFs and page images, your questions in Ask with the relevant parts of the note, and any custom instructions. Your audio is never sent to Gemini. On supported devices, summaries may instead be created with Apple Private Cloud Compute. YouTube transcripts are retrieved by our servers through a network proxy provider, using only the video’s identifier.
Service providers: Hetzner, Cloudflare, Vercel, Google (Gemini, Firebase Analytics, Crashlytics, Remote Config, Cloud Messaging and In-App Messaging), RevenueCat, Sentry and the YouTube proxy provider.
Deleting your data: delete notes at any time, or go to Settings → Delete Account to delete your account and all your content from our active systems. Guest accounts that stay inactive for a long time may be deleted.
More detail: Noota’s own privacy policy describes the same practices in greater depth.

Tempus

Account: none.
Where your content is stored: your tasks, with their notes, checklists, repeats and completion history, are stored on your device and, if iCloud sync is on (it is by default), in your private iCloud database, which we cannot access. Your habits are your repeating tasks, and focus sessions are not kept once they end. Your Apple Watch receives today’s and tomorrow’s tasks directly from your iPhone. Your planning profile from onboarding is stored in your device’s Keychain and is not synced.
Calendars and reminders: with your permission, Tempus reads, on your device, the calendars and reminder lists you choose, to show them beside your plans and plan around them. It never changes your events, and it can mark reminders as completed.
AI: Tempus drafts plans with Apple Intelligence on Private Cloud Compute where it is available, on iOS, iPadOS or macOS 27 or later. Otherwise — for example on iOS 26 — it sends the request to our server, which asks Google’s Gemini models or, if that request fails, OpenAI’s models to draft the plan. Depending on the feature, the request contains:
- in Tempus AI: what you typed, dictated or picked, your language and region, the date and the app version;
- for your first plan, RePlan, filling a gap, Suggest with AI and the prompt suggestions prepared when you open Tempus AI: your planning profile (the first name you gave, your lifestyle, wake and sleep times, work hours, routines, main goal, energy pattern, focus span, the focus challenges you selected and your notes) and the titles, times and lengths of the tasks, events and reminders on the day being planned; for your first plan, also the notes of that day’s events and reminders; and for some suggestions made outside your timeline, the titles, times and lengths of all the tasks saved in Tempus.
Our server does not store this content; see Section 9.
Screen Time: focus sessions block the apps and websites you choose through Apple’s Screen Time framework, which does not reveal to us which apps you use.
Analytics: Firebase Analytics also records your onboarding answers as preset options (the lifestyle, goal, energy pattern, focus length, challenges and habits you pick), the wake, sleep and work times used in planning requests, and whether you subscribe. If you describe your lifestyle in your own words, those words can be included in events about planning requests handled by our server.
Service providers: Cloudflare, Vercel, Google (Gemini, Firebase Analytics, Crashlytics, Remote Config and Cloud Messaging), OpenAI and RevenueCat.
Deleting your data: Settings → Data & Privacy → Clear Data deletes your tasks, their history and your planning profile on your device and, with iCloud sync on, in iCloud. To make sure nothing stays in iCloud, also delete Tempus’s data in Settings → [your name] → iCloud → Manage Storage on your device.
More detail: Tempus’s own privacy policy describes the same practices in greater depth, request by request.

Risen

Account: none.
Where your data is stored: your alarms, wake-up history and onboarding answers are stored on your device and, if iCloud sync is on (it is by default), in your private iCloud database, which we cannot access. Imported alarm sounds and your weather location stay only on your device.
Camera missions: the QR, photo, squat, push-up and dance missions use your camera, and everything is processed on your device with Apple’s Vision framework and on-device model. Photos are held in memory only to check the mission and are never saved or uploaded, and no video is recorded.
Weather: if you allow location access, Risen uses your approximate location (about 3 km) while you use the app to show the local weather through Apple WeatherKit. Searching for a city uses Apple Maps.
Analytics: Firebase Analytics receives events about onboarding (including the wake-up time and wake-up goal you choose), alarms and missions (such as durations and streaks, with alarm identifiers in hashed form) and your plan.
Service providers: Google (Firebase Analytics, Crashlytics and Remote Config), RevenueCat and Apple (iCloud, WeatherKit, Maps).
Deleting your data: Clear All Data, in the iCloud Sync settings, deletes your alarms, history and onboarding answers on your device and in iCloud. Deleting the app removes the rest.

Mona

Account: none, and no connection to your bank.
Where your data is stored: your transactions, budgets, accounts, categories and AI chat history are stored on your device and, if iCloud sync is on (it is by default; you can turn it off in Settings), in your private iCloud database, which we cannot access.
Understanding what you type: when you describe an expense by typing, dictating or using Siri, Mona first tries Apple’s on-device model and, on supported devices, Private Cloud Compute. If they are unavailable or cannot handle the request — and always for transfers between accounts and for text read from a receipt — Mona sends the text to our server together with your language, base currency, the current time and the names of your accounts and categories. Our server asks Google’s Gemini models to turn it into transactions and returns the result. Our server does not store this content; see Section 9.
Receipts: a receipt photo is read on your device and is not kept. Only the text read from it is sent, as described above.
Analytics: Firebase Analytics events do not include amounts.
Service providers: Cloudflare, Google (Gemini, Firebase Analytics, Crashlytics, Remote Config, Cloud Messaging and App Check).
Purchases: Mona has no purchases.
Deleting your data: Settings → Erase All Data deletes your transactions, categories, budgets, accounts and chat history. To make sure the iCloud copy is removed too, keep iCloud sync on while you erase, or delete Mona’s data in Settings → [your name] → iCloud → Manage Storage. You can export your data as CSV at any time.

Visty

Account: Sign in with Apple or Google Sign-In, or a guest account where offered.
Where your content is stored: the cards you scan, their photos, the text read from them and the notes, tags, events and voice-note text you add are stored on our servers so they can sync across your devices, and a copy is kept on your device.
Information about other people: the cards you scan contain the details of the people on them, such as names, job titles, companies, phone numbers, email and postal addresses, websites and social profiles. You can also record when and where you met someone, including the location if you allow it. You are responsible for having a lawful reason to keep this information, and for informing people where the law requires it.
Reading cards: text is read on your device with Apple’s Vision framework. Fields are sorted with Apple’s on-device model where available; otherwise, only the text is sent to our server, which asks Google’s Gemini models to sort it. Card photos are never sent to Gemini. Voice notes are transcribed on your device, and only their text is saved.
Shared card pages: if you share your own card, it is published at a link that anyone who has it can open. The page shows the details on that card and is hidden from search engines. People who open it can save your contact and send you their own name and contact details, with their consent. When someone opens the page, their IP address and browser information are used to limit abuse and to keep link previews out of the counts; the IP address is kept only in hashed form, for a few hours, and is never stored with the page or a reply. We count views and contact downloads to show you your link’s statistics. We may email you, at most once an hour, when someone replies: the email can include the latest visitor’s name, never their contact details, and has a link to stop these emails. You can turn the link off at any time.
Integrations you set up: if you create an API key, add a webhook or connect Zapier, your card data can be read by, or is sent to, the destination you configure.
Using Visty on a computer: if you answer the in-app question about how you would use Visty on a computer, we keep your answers, and whether you want to hear when a computer version is ready, until you delete your account.
Caller ID: if you turn on Caller ID, Visty adds the people on your cards to a read-only list in your device’s contacts, which other apps with access to your contacts may be able to read.
Analytics: Firebase Analytics also receives your Visty account identifier.
Service providers: Hetzner, Cloudflare, Google (Gemini, Firebase Analytics, Crashlytics, Remote Config, Google Sign-In), RevenueCat, Sentry and an email delivery provider.
Deleting your data: deleted cards are permanently removed after 30 days. Settings → Delete Account deletes your account, your cards and their photos; replies you sent to other people’s card pages stay with them. Guest accounts that hold no cards and have been inactive for 90 days are deleted.
Age: Visty is intended for people aged 16 and over.
More detail: Visty’s own privacy policy describes the same practices in greater depth.

Folda

Account: none.
Where your documents are stored: only on your device. Scanning, text recognition, search, naming and summaries happen on your device; your documents are never uploaded to us or to any AI service.
Backup: if you turn on automatic backup, Folda saves PDF copies of your documents to a folder you choose — for example in iCloud Drive or another storage provider — under that provider’s terms.
Upgrading from DocScan: if you used DocScan, Folda imports your documents. The original DocScan files remain in the app’s storage on your device until you delete the app.
Until the update: until Folda reaches your device, the app you get from the App Store is DocScan. DocScan keeps your documents on your device, collects no analytics and verifies your purchases directly with Apple. Its Translate feature opens the text you choose in Google Translate, which processes it under Google’s Privacy Policy.
Spotlight: Folda adds your documents’ names and text to Spotlight on your device so that you can search them from your Home Screen. This index never leaves your device, and it is switched off while App Lock is on.
App Lock: Face ID is handled entirely by Apple, and Folda never receives your biometric data.
Analytics and crash reports: Folda uses Google Firebase Analytics and Crashlytics. They receive events about how the app is used, such as the screens you open, the features you use and your purchases, together with your device model, operating system and app version, an approximate location derived from your IP address, crash reports and Firebase identifiers. Folda uses the edition of Firebase Analytics that cannot access your device’s advertising identifier, with ad personalization signals turned off, and never sends your documents, their names, their text or their summaries to Firebase.
Service providers: Google (Firebase Analytics and Crashlytics) and RevenueCat.
Deleting your data: deleted documents move to Recently Deleted for 30 days and are then permanently deleted; you can also delete them immediately. Deleting the app removes all of Folda’s data from your device. Copies in your backup folder stay there until you delete them.

13. Children

Our Services are not intended for children under 13 (under 16 for Visty), and we do not knowingly collect personal data from them. If you are under 18, or under the age of legal majority where you live, you may use our Services only with the permission of a parent or legal guardian. Where local law requires the consent of a parent or guardian for a minor to use online services or for the processing of a minor’s personal data, you may use our Services only with that consent. If you believe that a child under 13 has given us personal data, please contact us and we will delete it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we release a new app or change how an app works. We will publish the new version on this page and change the “Last updated” date. If the changes are significant, we will notify you in the app or by other appropriate means before they take effect.

15. Language

This Privacy Policy is written in English and may be translated into other languages. If there is any inconsistency between a translation and the English version, the English version prevails, to the extent permitted by applicable law.

16. Contact us

For any question about this Privacy Policy, or to exercise your rights, write to admin@navlab.app. For help with an app, write to support@navlab.app or to the support address shown in that app.