This is the complete policy linked from Nomon. The app carries a shorter version under Settings → Privacy policy with the same promises.
Nomon keeps its journal and derived data in private files inside the app's container on your
device (Application Support/BaselineJournal). Those files contain:
Separately, iOS app settings on the same device store the optional first name you gave Nomon, onboarding and body-area choices, your cloud-analysis choice and other app preferences, and small, identifier-free on-device beta counters and dates. The counters are never transmitted and are visible only through the beta readout in Settings.
The container is covered by iPhone device encryption and your device passcode. It is included in an encrypted iPhone backup if you make one, and in iCloud Backup if you enable that for Nomon. Those are Apple features under your control.
We do not claim your words never leave your device. If you turn on cloud analysis, relevant entries can leave it, including earlier entries verbatim. Section 3 explains which data, when, and to whom.
Cloud analysis is off until you turn it on. The first-run screen names OpenRouter before you choose, and you can change that choice at any time in Settings → Cloud analysis. If the relay is unavailable or disabled, Nomon uses its on-device fallback and sends nothing to a model.
When cloud analysis is on, saving an entry, opening the app, or an iOS-scheduled background refresh can trigger a request. Nomon may rebuild a Today, Myself, or dimension reading when the material it uses has changed. In each case:
In this release, Qwen-family models write cloud guidance and refinements. A Kimi-family model cross-checks bounded dimension claims against the dated quotes they rely on. OpenRouter dynamically selects an eligible zero-data-retention endpoint for those models; Nomon does not select a fixed underlying hosting company.
What is sent: while you write, the entry in progress, structured fields taken from it, and — once you have at least two earlier entries — a dated excerpt of up to 140 characters from each of your two most recent entries. When a reading spans several days, the full verbatim text of the earlier entries that reading stands on is sent with each entry's date. A dimension reading can use up to five dated verbatim slices for a dimension.
What is not sent: your name, profile record, hardware or advertising identifiers, unrelated entries, your IP address as an identity, or anything from Apple Health. Like any internet service, the gateway receives network connection metadata, but Nomon does not use it to identify you or store it in a user profile.
Identification: the relay receives a random per-install token to enforce a daily request cap. It is not linked to you or sent to OpenRouter. The relay stores only a one-way hash of that token with bounded daily counters, not the token or journal text.
Retention and training: Nomon never uses your entries to train, tune, or evaluate anything. For every request, the relay asks OpenRouter to deny data collection and requires a zero-data-retention provider endpoint. If none is available, the request fails and Nomon uses its on-device fallback. OpenRouter and the selected model provider still process the request under their own policies. Nomon routes requests only through OpenRouter and model-provider endpoints that provide the same or stronger no-collection and no-retention protection described here. See OpenRouter's privacy policy. If you do not want a third party to process your words, leave cloud analysis off.
When cloud analysis is off: Nomon makes no network request for analysis. Nothing is queued, and nothing is sent later.
One other network access: Nomon fetches the relay's small public readiness/configuration document shortly after launch. It lets the cloud channel be switched off remotely. That request carries no entry text, install token, or identifier of you.
Export journal in Settings writes a plain-JSON file containing your profile, saved entries, memory, dates, and journal-derived fields, then hands it to the iOS share sheet. It contains no provider key, relay token, app preferences, beta counters, or logs.
Delete journal data removes your saved entries and memory, local profile and first name, locally derived samples/readings, recent illustration choices derived from the journal, and the current relay install token. Nomon reports success only after those local deletions finish. It has no stored server copy of your journal to restore.
That action does not reset your cloud-analysis choice, language/theme/voice/reminder preferences, completed-onboarding state, or identifier-free on-device beta counters. Those are install-wide app settings rather than journal content; deleting the app removes them. The relay's one-way hash of the old install token and its current UTC-day request count contain no journal text and are removed when a later relay request cleans prior-day quota rows. A new relay request from this installation uses a new, unrelated token.
Nomon is intended for people aged 14 and over, and you confirm this during first run. It is not directed at anyone under 14, and Nomon does not knowingly collect data from anyone under 14. If you believe someone under 14 has used Nomon on your device, using Delete journal data in Settings or deleting the app removes the journal data.
Nomon is a journal, not a medical device. It does not diagnose, treat, or give medical advice, and it does not replace a clinician. If something hurts in a way that worries you, or does not settle, speak to a professional — nothing in this app is a reason to wait.
If this policy changes materially, Nomon's Settings screen will carry the changed text before it takes effect for you. Because there is no account, we cannot email you; the app is the channel.
Questions about this policy: dwenxin1@gmail.com