Privacy Policy

Who we are

Norma (“we,” “us,” or “our”) operates the website iamnorma.com and the Norma AI nutrition companion service. We are the data controller responsible for your personal information collected through this service. Questions about this policy can be directed to hello@iamnorma.com.

What we collect

When you create an account, we collect your email address and password (stored as a secure hash). During onboarding, you may provide additional information including your GLP-1 medication name and stage, weight and goals, dietary preferences and restrictions, cooking habits, schedule type, and exercise information. This information is entirely voluntary and can be deleted at any time.

We also store the messages you exchange with Norma and structured signals extracted from those conversations, such as mood indicators, behavioral patterns, and upcoming events you mention. We collect basic usage data such as session dates and activity streaks to provide personalized guidance.

How we use your data

Your data is used exclusively to provide the Norma service: generating personalized AI responses, maintaining conversation continuity across sessions, improving the relevance of Norma's guidance over time, and sending you service-related emails. We do not use your data for advertising, sell it to third parties, or share it for any purpose unrelated to providing this service.

How AI uses your data

Your profile and recent conversation history are sent to our configured AI provider, such as OpenAI or Google Gemini, to generate personalized responses. This data is used solely to provide contextually relevant nutrition guidance. We configure provider APIs to avoid application-level response storage where supported and do not intentionally opt conversation data into model training. Providers may retain limited request logs for security, abuse monitoring, or legal obligations under their own API data policies.

Email communications

By creating an account, you agree to receive service-related emails from Norma. These include account verification, password reset, re-engagement messages, and weekly activity summaries. These emails are necessary to deliver the service you signed up for.

You may opt out of non-essential service emails (such as weekly summaries and re-engagement messages) at any time by clicking the unsubscribe link included in each email or by contacting us at hello@iamnorma.com. Transactional emails (account verification, password reset) cannot be disabled as they are essential to the service.

Third-party service providers

We share your data with the following trusted service providers solely to operate the Norma service:

• Supabase — database and authentication hosting
• OpenAI / Google Gemini — AI response generation (conversation context sent per request)
• Resend — transactional and service email delivery
• Vercel — application hosting and infrastructure
• Google Analytics 4 — usage analytics on public pages (see Cookies section)

Each provider is bound by their own privacy policies and data processing agreements. We do not permit these providers to use your data for their own marketing or unrelated purposes.

Cookies and analytics

We use the following types of cookies and tracking technologies:

• Essential cookies: Authentication session cookies required to keep you logged in. These cannot be disabled without breaking the service.
• Analytics cookies: We use Google Analytics 4 to understand how visitors interact with our public marketing, blog, and account-access pages (page views, referral sources, and conversion events). Google Analytics is not loaded on authenticated product areas such as chat, onboarding, profile, or admin pages, and we do not send chat messages, medication details, or weight fields to Google Analytics. You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on.

Data storage and security

Your data is stored securely in our database hosted by Supabase. All connections are encrypted in transit using TLS and encrypted at rest. Access to your data is restricted by row-level security policies — only you can access your own records. Our administrative access to user data is limited to what is strictly necessary to operate and maintain the service.

Data retention and deletion

Conversation sessions and daily activity logs are kept in a rolling seven-day window. A daily automated cleanup permanently deletes those records once they are more than seven days old. Your profile preferences, account metadata, email delivery history, feedback, and a small set of extracted longer-term context — such as patterns, triggers, wins, and events — remain while your account is active so Norma can provide continuity. You can delete your account and all associated application data at any time from the Settings panel. Account deletion is permanent.

Payment information

Norma is a 100% free community service. There are no subscription fees, paid tiers, in-app purchases, or payment requirements of any kind. We do not collect, process, or store any credit card numbers, banking details, or financial billing information.

Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate data through your profile settings.
• Deletion: Delete your account and all associated data at any time from Settings.
• Portability: Request an export of your data in a structured format.
• Objection: Opt out of non-essential email communications at any time.

To exercise any of these rights, contact us at hello@iamnorma.com. We will respond within 30 days.

International data transfers

Norma is operated from the United States. If you access the service from outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate. By using Norma, you consent to this transfer. We ensure that any such transfers are made in accordance with applicable data protection laws.

Children's privacy

Norma is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will delete that information promptly.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Continued use of Norma after changes are posted constitutes your acceptance of the updated policy.

Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at hello@iamnorma.com. We are committed to resolving any privacy concerns promptly.