1. Overview
Nomava is a travel calendar and planning service operated by RizTech (collectively, “Nomava,” “we,” “us,” or “our”). This Privacy Policy applies to the Nomava web and mobile applications and related services (the “Service”).
We process information only as described here, at your direction, or where the law requires or permits it. If you use Nomava on behalf of another person, only add their information when you have permission to do so.
2. Information we collect
The information we process depends on the features you use:
- Account and profile data: name, email address, account identifiers, authentication records, preferences, and profile details you choose to provide. Passwords are stored in protected, hashed form rather than readable text.
- Travel and calendar data: trips, dates, calendar entries, destinations, routes, stops, favorite places, notes, day configurations, links, and other itinerary details.
- Expense and planning data: expenses, budgets, amounts, categories, currencies, and the custom labels you create for payment methods. Nomava’s payment-method feature is intended for labels such as “cash” or “travel card”; do not enter full card numbers, bank credentials, or security codes.
- Lists and organization data: packing lists, inventory, meal plans, shopping lists, and related notes or quantities.
- Location data: approximate or precise device location only when you choose a feature that requests it and grant device or browser permission. Saved places and itinerary locations may also reveal where you are, were, or plan to be.
- Support and feedback: messages, attachments, survey answers, feature requests, and other information you send when asking for help or giving feedback.
- Device and technical data: IP address, browser and device type, operating system, app version, language, time zone, session and security events, diagnostics, crash information, and basic usage events needed to operate, secure, and improve the Service.
We receive most information directly from you. We may also receive limited information from your device, from an authentication provider you choose, or from a connected feature you deliberately use. We do not intentionally collect special-category or highly sensitive personal data; please avoid placing it in free-text notes unless necessary for your own planning.
If you choose Sign in with Apple in the iOS app, we use your Apple-provided account identifier, verified email address and optional name to create or connect your Nomava account. Hide My Email gives us a private relay address instead of your personal address. Provider credentials needed to validate access and revoke authorization are protected on our server and removed through account deletion. Apple sign-in does not give us your Apple password or purchase access by itself.
3. How we use information
We use information to:
- create and secure your account, authenticate you, and remember your settings;
- provide calendars, trips, routes, places, budgets, expenses, lists, and other planning features;
- sync your information across supported devices and maintain operational backups;
- answer support requests, receive feedback, and communicate important service or policy notices;
- diagnose failures, prevent abuse, protect accounts, and maintain reliability;
- understand feature performance in an aggregated or de-identified way and improve Nomava; and
- comply with legal obligations and enforce our Terms and Conditions.
We do not use the contents of your personal travel plans, expenses, or lists for third-party advertising.
4. Legal bases
Where data-protection law requires a legal basis, we rely on: performance of our contract with you to provide the Service; our legitimate interests in securing, maintaining, and improving Nomava; your consent for optional permissions such as device location or optional communications; and compliance with legal obligations. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
5. Service providers and limited sharing
Nomava does not sell or rent personal data. Nomava and RizTech do not share personal travel data with third parties for advertising or for those parties’ independent use.
Narrowly scoped service providers and integrations may process only the data needed to operate a requested feature. Depending on the Service configuration and the features you use, these may support:
- cloud hosting, databases, storage, synchronization, and backups;
- account authentication, security, and fraud prevention;
- maps, place search, geocoding, routing, and weather information;
- transactional email and customer support; and
- push-notification delivery.
We require providers acting for us to handle data only for the services they perform and to protect it appropriately. Their own terms and privacy notices may apply when you directly interact with or connect an independent third-party service.
We may also disclose information when reasonably necessary to comply with law or valid legal process, protect users or the Service, investigate fraud or security issues, or complete a corporate transaction such as a merger or acquisition. In a transaction, data remains subject to applicable law and the commitments in this policy unless you are notified otherwise.
6. Optional location and connected features
Location permission is optional. You can deny or revoke it in your browser or device settings, although location-aware features may then be unavailable. Saving or searching for a place does not necessarily require access to your live device location.
When you request mapping, routing, place-search, or weather features, the minimum relevant query—such as coordinates, a place name, route endpoints, date, language, or IP-derived region—may be sent to the provider supplying that result. Do not submit a private location to such a feature unless you are comfortable with this necessary processing. We do not authorize these providers to use your personal travel data for their own advertising.
7. Sync, backups, retention, and deletion
Account data and content you save may be stored on our systems so it can sync across supported devices. Operational backups are maintained to restore the Service after an incident; they are access-restricted and expire or are overwritten on a rotating schedule.
We retain account information and user content while your account is active to provide the Service.
Request account deletion
In the Nomava iOS or Android app, open Profile → Delete account. Verify ownership using your existing password or an email code, review the consequences and confirm. You do not need Pro.
If you cannot use the app, you can request deletion of your Nomava account and its associated data by email. You do not need to install the app or sign in to the website.
Request account deletion by email
Email support@nomava.app with the subject “Nomava account deletion request” and your Nomava account email. Our team will verify ownership before locking the account and processing deletion. Never send your password or verification codes. For an existing request, include its reference to ask for status or provide information.
For requests received by email, Support sends a private confirmation link and a six-digit code to your established account email. The link and code expire after 3 hours. On the confirmation page, enter either your existing Nomava password or the emailed code and explicitly confirm. Opening the link alone does not lock or delete the account. Until you confirm, the account remains usable; afterward, the request enters our normal staff review and deletion process. Ask Support for a new link if it expires. If you did not request deletion, do not confirm and contact Support.
Accepted verified requests immediately lock normal sign-in and syncing; our team performs physical deletion. We will permanently delete your account and all associated user data within a maximum of 30 days from the date we receive your request. This includes data in our databases, uploaded files, support records, logs, caches, and backups, and copies held by service providers on our behalf. We physically delete this data rather than only deactivating the account or anonymizing its records. We will confirm completion by email. Account deletion does not cancel Apple or Google subscriptions; manage recurring billing in the purchasing store.
If a law requires us to retain a particular record, we retain only that record for the legally required period, restrict its use to that obligation, and explain the exception to you. We delete it when the requirement ends. We do not retain account data for optional security, dispute-resolution, or other business purposes after account deletion.
Deleting the app or signing out does not delete your account. Copies you have exported, downloaded, or stored separately on your own devices or personal backups remain under your control; delete those copies yourself if you no longer want them.
8. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including access controls, protected authentication credentials, HTTPS encryption for connections to Nomava’s production web app and API, logging, and restricted backup access. No system is completely secure. Keep your credentials confidential, use a unique password, and contact us promptly if you suspect unauthorized account activity.
9. International processing
Nomava and its providers may process information in countries other than the one where you live. Privacy laws may differ in those locations. Where required, we use recognized safeguards for international transfers, such as adequacy decisions, contractual protections, or another lawful transfer mechanism.
10. Your rights and choices
For example, you can ask for a copy of your data, ask us to correct it or request deletion. You can also contact the relevant privacy authority. The rights available depend on where you live.
Depending on where you live, you may have the right to access, correct, export, delete, restrict, or object to certain processing of your personal data; withdraw consent; opt out of certain uses; or appeal a decision about a privacy request. You may also have the right to complain to your local data-protection authority.
You can update some information in the Service and control location and notification permissions through your device or browser. To make another request, email support@nomava.app. We may need to verify your identity. Account-deletion requests and related records follow the deletion policy above. Authorized agents may submit requests where local law permits, subject to proof of authority. We will not discriminate against you for exercising a privacy right.
Nomava does not sell personal data and does not use personal data for cross-context behavioral advertising, so there is no sale or advertising share to opt out of.
11. Children
Nomava does not impose a minimum age of its own. Children and young people may use the Service only where permitted by applicable law. Where parental or guardian authorization or consent to processing personal data is legally required, it must be obtained before use. If you believe a child is using Nomava without required authorization or consent, contact support@nomava.app so we can investigate and take appropriate action, including deleting the data where required.
12. Changes and contact
We may update this policy as Nomava changes or the law requires. We will post the revised policy with a new effective date and, when a change is material, provide additional notice through the Service or by another appropriate method.
For questions, privacy requests, or concerns, contact the Nomava privacy team at support@nomava.app. Nomava is operated by RizTech.