Privacy Policy

Version 1.1 · Effective October 2026 · Replaces the version dated September 16, 2026

We built Novbay to hold your team's procedures and run records, not to collect data about you. We collect what we need to run the service, we use it only for that, and we never sell it.

---

1. Who we are and what this covers

"Novbay," "we," and "us" mean Novbay, the maker of the Novbay apps: Opus, Charta, Manus, Materia, and Plugins (the app lives at novbay.com/app). You can reach us anytime at support@novbay.com.

This policy covers novbay.com, the Novbay app, and emails we send you. It works together with our Terms, Security page, Data Retention Policy, and Your Data Rights.

Whose data is it? Your team's workspace content belongs to your team. The workspace Owner decides who's in the workspace and what's kept. We store and process that content for your team so Novbay can work. Your own account details (your email and name) are yours, and you can always ask us about them directly.

2. What we collect

When you sign in

• Your email address.
• Your name. If you continue with Google, Google shares your name, email, and (if you have one) profile picture with us. We never get your Google password.
• A sign-in session, so you stay signed in.

When you use Novbay with your team

• Your team (workspace) name, the people in it, their roles, and pending invites, including the name and email of anyone you invite.
• Procedures, sections, steps, revisions, and change requests.
• Run records: each step's result, the signer's name, the time, and any notes, readings, unit serial numbers, and photos added during a run.
• Workspace settings such as procedure types, operator roles, time zone, and station names.
• Short-lived "someone is editing this" markers, so two people don't edit the same procedure at once.

When you pay

• Stripe handles checkout. We receive and keep your Stripe customer ID, subscription ID, plan, number of storage packs, and payment status (for example, active or past due). We never receive or store your card number. Stripe may also collect a billing address to work out sales tax.

When you contact us

• Whatever you include in your email or the contact form, such as your name, email, and message.

Automatically, to keep things running

• Our hosting and database providers keep basic technical logs, such as IP address, browser type, the pages or actions requested, and error details. We use them only for security and fixing problems.

What we don't collect: we don't run advertising, we don't use third-party analytics or tracking pixels, and we don't buy data about you from anyone.

Please don't put sensitive information in Novbay. That includes health information, government ID numbers, financial account numbers, or export-controlled or classified technical data. Novbay isn't built or certified for it (see our Security page).

3. How we use it

We use your information only to:

• Run Novbay: sign you in, sync your team's workspace across devices, show who signed each step, and make PDF records.
• Apply your plan: enforce procedure, people, and storage limits, and process subscriptions.
• Email you about the service: sign-in links, team invites, and important account or billing notices. We don't send marketing email unless you ask for it.
• Help you: answer support questions and fix problems.
• Keep Novbay safe: prevent abuse, investigate security issues, and follow the law.
• Improve Novbay: understand what's working, using our own records and your feedback. We don't sell or rent your data, and we don't use your team's content to train AI models.

4. Who we share it with

We do not sell your personal information, and we don't share it for advertising.

We share information only:

• With the people in your workspace. Teammates can see the workspace's procedures and records, and the names of the people in it.
• With our sub-processors (listed below), only so they can provide their part of the service.
• When the law requires it, for example a valid subpoena or court order. Unless the law prevents us, we'll try to tell you first.
• To protect people, if we believe in good faith that sharing is needed to prevent harm or fraud.
• If Novbay changes hands, for example if it becomes a company or is sold. Your information would move with the service and stay covered by this policy, and we'd tell you before anything changed.

Sub-processors

If we add or replace a sub-processor, we'll update this list before the change takes effect.

5. Where your data is stored

Your workspace data is stored in the United States (our Supabase database is in the US East region). Our providers may process some information in other countries under their own safeguards. If you use Novbay from outside the US, your information will be handled in the US.

6. Cookies and device storage

We don't use advertising or tracking cookies. Novbay uses your browser's storage only for things the app needs to work:

• Sign-in session: keeps you signed in.
• Your working copy: Novbay keeps a copy of your workspace (procedures, runs, and settings) on your device. That way it loads quickly and you don't lose progress if your connection drops for a moment during a run. This copy is cleared from the device when you sign out.
• Preferences: your theme (light, dark, or match device) and similar settings.

If you use a shared or lab computer, sign out when you're done. Clearing your browser's site data also removes everything Novbay stored on that device. Stripe's checkout page may set its own cookies for fraud prevention. Those are covered by Stripe's privacy policy.

7. How long we keep it

In short: we keep your workspace while it exists. Once you delete something, it's removed from our live systems within 30 days. Billing records are kept as long as tax and accounting law requires. The full timelines, and what happens when you cancel, downgrade, or delete, are in our Data Retention Policy.

8. Your rights and choices

Wherever you live, you can ask us to:

• See the personal information we have about you, and get a copy.
• Correct it if it's wrong.
• Delete it, or delete your account.
• Export your team's data (workspace Owners).
• Opt out of any non-essential email.

We'll never treat you differently for using these rights. How to do each one, and how long it takes, is on Your Data Rights. Some state laws (such as California's) give residents specific rights. We honor the requests above for everyone, whether or not a specific law applies.

If you're in a workspace, some content belongs to your team rather than to you personally (for example, a run record you signed). For those, we may work with your workspace Owner on your request. See Your Data Rights for details.

9. Security

We use encryption in transit and at rest, a separate walled-off space for each workspace in the database, and role-based permissions. Payments go through Stripe. No system is perfectly secure, but we work hard to protect your data and we'll tell you promptly if a problem affects you. Details are on our Security page.

10. Children and young users

Novbay is open to people of any age. That includes college teams, school clubs, robotics teams, and shops with young apprentices. We take extra care with children under 13, as required by the U.S. Children's Online Privacy Protection Act (COPPA).

How a child under 13 can use Novbay

• A child under 13 can't sign up on their own. They can use Novbay only after a parent, guardian, teacher, or club or team advisor adds them to a workspace and agrees, on their behalf, to this policy and our Terms.
• When an adult adds someone under 13, they confirm in the invite that they're that child's parent or guardian, or that they're a teacher or advisor with the parent's permission to use Novbay for the team's activity.
• If we learn that a child under 13 is using Novbay without that consent, we'll remove their account and personal information.

We collect as little as possible from children

• Only what Novbay needs: a first and last name (shown on the steps they sign) and an email address used to sign in. That email can be one the parent or advisor controls.
• Their sign-offs, notes, readings, and photos they add during runs. These are part of the team's records.
• Adults should not use children's photos of faces or other identifying details in steps or runs unless it's truly needed.
• We never use a child's information for advertising or marketing, never sell or share it beyond the sub-processors who run Novbay, and never ask a child for more information than an activity needs.

What parents, guardians, and advisors can do

• See the information we have about the child.
• Correct it.
• Delete it, including the child's account, and stop further collection.

Email support@novbay.com with "Child account" in the subject line. We'll confirm the request comes from the parent, guardian, or the adult who added the child (see Your Data Rights), then act within 7 days. Deleting a child's account removes their sign-in and profile. If a parent asks, we'll also replace the child's name on team records with "Removed user."

Users 13 to 17 can sign up themselves, but we encourage them to use Novbay with a parent, teacher, or advisor's knowledge.

11. Changes to this policy

When we change this policy, we'll update the version number and effective date at the top. If a change matters, such as collecting something new or adding a sub-processor, we'll tell workspace Owners by email or in the app before it takes effect. Earlier versions are available on request.

Version history

• 1.1 (October 2026): Full rewrite. Added the sub-processor list, device storage details, retention and data rights, and the section on children and young users (COPPA).
• 1.0 (September 16, 2026): First short policy.

12. Contact us

Questions, requests, or concerns: support@novbay.com. We usually reply within one business day.

---

This policy is written in plain English to be clear. It isn't legal advice.