Data Handling, Privacy & Material Controls

Factual, plain-language disclosure of how your thoughts, conversations, and behavioral reflections are stored, processed by cloud inference, and controlled by you.

Effective Date: October 18, 2026•Region: United States (AWS us-east-1)

Service Boundaries & Integrity Principles

Clear, honest boundaries regarding the nature of NoHabits.AI and what we do not claim.

Pilot Disclosures

•

No Medical or Clinical Claims: NoHabits.AI is a behavioral self-reflection and habit understanding tool. It does NOT provide medical advice, diagnosis, or clinical psychiatric therapy. It is not a licensed healthcare provider or medical device.

•

No Synthetic Privacy Certifications: NoHabits.AI does not claim or hold medical privacy certifications (e.g., HIPAA compliance) or commercial security audit certifications (e.g., SOC2, ISO 27001). We enforce strict database-level Row-Level Security, but make no synthetic compliance claims.

•

Pre-Launch Pilot Status: NoHabits.AI is in active pre-launch pilot engineering. No real-user clinical trials, customer-validation studies, or efficacy claims have been completed to date.

•

Academic Research Independence: Founder Brian T. Stitt's academic thesis research is governed separately under academic review and institutional oversight. Academic research permissions do NOT constitute or imply commercial product-user research permissions.

Actual Data Processors & Infrastructure

We disclose the specific commercial processors handling your records, rather than relying on vague third-party generalities.

2 Processors

Factual Retention Notice: NoHabits makes no artificial “zero-retention” claims. Personal Behavioral Intelligence requires durable storage to maintain your saved NoHabitat library, relate current thoughts to past attempts, and revise understanding when you report real-world outcomes. Your data is stored durably under your explicit owner identity until you choose to delete or withdraw it.

Supabase Inc.

AWS US East (N. Virginia, us-east-1)

Operational RoleHosted PostgreSQL Database, Authentication (GoTrue), and Object Storage

Data Categories Stored

User credentials and session tokens (via Supabase Auth)
Captured thoughts and behavioral items (captured_nos table)
Chat conversations and message history (conversations, messages tables)
Personal Behavioral Intelligence states (pbi_situations, pbi_versions, pbi_evidence, pbi_commands, pbi_interactions tables)
Retained episodic summaries (episodes, episode_messages tables)
Uploaded reference documents and images (reference_sources table and sources storage bucket)
Admission receipts and turn quotas (chat_request_receipts table)

Retention PolicyData persists durably until explicitly deleted by you via item deletion, conversation deletion, or account deletion. NoHabits makes no misleading 'zero-retention' claims, as continuity and revising understanding over time require durable storage.

AI Model Training PolicySupabase acts strictly as a data processor hosting our dedicated PostgreSQL database and storage buckets. Supabase does not use customer data to train artificial intelligence models.

Groq Inc.

US Cloud Data Centers

Operational RoleCloud Model Inference Processor (Llama 3.3 70B Versatile)

Data Categories Transmitted

User prompt text and conversational turns during active chat generation
Relevant situation context and attributed evidence for Personal Behavioral Intelligence
Source message excerpts during asynchronous Episode extraction

Retention PolicyModel inference is stateless. Under Groq's API data policy, prompt and completion payloads are not retained for model training. Ephemeral in-memory processing occurs to generate completions, and transient diagnostic logs are maintained strictly for service reliability and abuse mitigation per Groq's enterprise terms.

AI Model Training PolicyZero model training on customer API inputs. Prompts and completions sent via Groq Cloud API are never used to train or fine-tune models.

Material Controls: Withdrawal, Deletion & Export

We clearly distinguish withdrawing evidence, deleting a saved item, deleting a conversation, and deleting an entire account so you retain granular agency.

5 Controls

Withdrawing Evidence

POST /api/experience/withdraw

Stop a retained experience from influencing future retrieval while preserving conversation history.

What is removed:The experience is immediately excluded from future retrieval queries and similarity search. Its source messages will never generate new experiences.

What is kept:The historical record in the database is retained with an explicit withdrawn_at timestamp for transparency and auditability. The original chat messages remain in your conversation.

How to executeOpen the Experience Inspector dialog from the chat menu, locate the experience, and click 'Withdraw from future use'.

Deleting a Saved Item (No)

DELETE /api/nos/[id]

Permanently delete a captured thought and its associated PBI understanding.

What is removed:The captured thought (captured_nos row) and its linked PBI situation, versions, dispositions, and assistance records are permanently deleted via database cascade.

What is kept:If a conversation was linked to the item, the conversation thread and its messages are retained unless you choose to delete the conversation separately.

How to executeNavigate to the saved item in NoHabitat or view it in the detail view, and click 'Delete permanently'.

Deleting a Conversation

DELETE /api/conversations/[id]

Permanently remove a chat thread and all its messages.

What is removed:The conversation record and all messages within it are permanently deleted from the database. Attached reference sources are unlinked. Dependent episode evidence links are marked invalidated.

What is kept:The original captured No item in NoHabitat remains completely intact, allowing you to start a fresh conversation whenever you choose.

How to executeOpen the conversation, click the options menu or conversation header, and select 'Delete conversation'.

Deleting an Account & Complete Data Erasure

POST /api/account (action: 'delete_account')

Execute a full cascading purge of all your data across all database tables and storage buckets.

What is removed:All captured Nos, conversations, messages, PBI understanding records, retained experiences, uploaded files in storage, and admission receipts are permanently deleted. Your authentication session is revoked.

What is kept:Zero personal data is kept. Your device session is returned to an unauthenticated signed-out state.

How to executeNavigate to /account, scroll to 'Delete Account & Purge All Data', and confirm the permanent deletion.

Exporting Your Data

GET /api/account?action=export

Download a complete, offline JSON archive of all data associated with your account.

What is removed:Nothing is removed. This is a read-only export operation.

What is kept:All existing data remains intact on your account.

How to executeNavigate to /account and click 'Export All Data (JSON)'.

Support & Privacy Contact Path

Reach out directly for data requests, account deletion assistance, or privacy inquiries.

Working Contact

Product Support & Privacy Requestssupport@nohabits.aiResponse expectation: Within 2 business days during the pilot period.

Founder Directbrian@nohabits.aiDirect escalated contact for architecture, privacy, or competition verification.

Manage your data directly: You can download an offline archive of all your thoughts and conversations, or execute a complete account purge immediately from the Account & Continuity page.