NOVA Privacy Policy

Last updated: 2026-11-11

NOVA (the "Service") is Cosmic Dot's AI companion device and its companion app. This document explains what information the Service handles.

1. Accounts and information access

• The Dot Station app asks you to sign in with Google or Apple. Your account is what links your NOVA devices to you. When you sign in, the provider you chose sends us an account identifier issued for our app, your email address and whether it is verified, and your name if the provider shares it. With Apple, the email is a private relay address if you chose to hide yours. We store these. We never receive your Google or Apple password.
• When you sign in with Apple, we also keep an encrypted Apple authorization token. It is used only to withdraw the app's access at Apple when you delete your account.
• Optional Google features are separate from signing in and require additional Google authorization. When you connect Google, we receive and store your Google account identifier, email address, and granted permissions.
• You can delete your account at any time. See Deleting your account.
• We don't track your location in the background. Location features are optional, purpose-specific, and run only while you are using the companion app.
• We don't use advertising identifiers. There is no ad SDK.
• We don't access your contacts, photos, or health data.

2. What we collect and process

Device identifiers

The app keeps the device session token, your sign-in session token, any Wi-Fi passwords you let it remember and a random app-installation identifier in your phone's secure storage (FlutterSecureStorage). The device session token is deleted when you disconnect the device, and the sign-in session token when you sign out or delete your account. The installation identifier is not an advertising identifier.

Voice

After you say the wake word or press the button on the device, your speech is sent to the voice server and used for speech recognition and response generation. Conversation content is retained so that follow-up conversation has context.

• Nothing is transmitted before the wake word. Wake-word detection happens on the device and never leaves it.
• The app does not use your microphone. Audio goes from the device straight to the server.

Wi-Fi credentials

When you first set up the device, the app takes your Wi-Fi name and password and delivers them directly to the device over BLE.

• They are never sent to our servers.
• The app can remember the password on your phone so that you do not type it again for the same network. It is kept in your phone's secure storage (iOS Keychain / Android Keystore), only after the device has connected with it, for up to 8 networks.
• Remembered passwords belong to the phone, not to your account: signing out or deleting your account does not remove them, and on iPhone they can remain after the app is deleted. To remove one, choose that network during device setup and turn off "이 휴대폰에 비밀번호 기억하기" (remember the password on this phone) on the password step.
• The transfer is encrypted (DH key exchange, then AES).
• The device keeps these values only in its own storage (NVS).

Camera

Used only to read the QR code shown on the device screen. Captured images are never stored or transmitted, and are discarded the moment the code is recognized.

Agenda and proactive notifications

NOVA stores agenda and reminder content, scheduled time, delivery state, and an opaque delivery identifier so an item can be delivered once through an available channel. When notifications are enabled for an opted-in installation:

• notifications contain generic guidance and opaque routing data unless you separately enable content-bearing notifications for that installation;
• sensitive integration approval notifications remain generic, and their details require authenticated access in the app;
• full agenda detail is fetched only after the app authenticates its current device session;
• the backend stores the active Firebase registration token and a one-way token digest, bound to the app session and current device owner;
• disabling notifications, provider invalidation, session revocation, reclaim, or factory reset disables the installation and clears its token and digest;
• notification permission is requested only from the notification settings screen. The user can disable receipt and control generic in-app foreground presentation there.

A notification already displayed by iOS or Android cannot be remotely removed. After reclaim or factory reset, tapping such a notification cannot reveal the prior owner's detail because authorization is checked again.

Optional Google integrations

When you connect Google and enable the relevant permissions, NOVA processes Google Calendar event information, Gmail senders, subjects, dates and message snippets, and text from Google Drive files you select. To prepare an available action for your approval, we also process its proposed contents, such as email recipients, subject and body or Calendar event title and times. Gmail reading requires its additional permission; available actions depend on your permissions and the enabled service capabilities.

Google connection records, permissions and selected-file records are associated with your NOVA device and its current owner authorization. OAuth credentials and stored approval payloads are encrypted on our backend, which can decrypt them to provide the service. This is not anonymous storage.

Private-account results and responses may be held in the active conversation and sent to the configured AI response-generation or speech-synthesis providers to answer your request. These turns are excluded from our ordinary persistent conversation and memory capture; this does not mean that they never leave the service or that third-party providers retain no data.

Optional location context

If you choose to enable a location feature, the companion app may read your phone's location for one of these purposes:

Typing or saying a place name does not read your phone's location.

• Location is not stored in conversation memory or generic memory.
• The app does not collect location in the background.
• Saved and live uses have separate controls. OS permission alone does not enable them.
• Exact route origins are restricted to the location service and contracted place/route processors. They are not sent to speech recognition, the language model, speech synthesis, conversation history, general logs, or support exports.
• You can revoke a saved area or active live context in the app. Revocation invalidates the current consent generation and starts deletion, with an initial service target of 15 minutes.

3. Third-party processing

We use external AI service providers for speech recognition, response generation, and speech synthesis. Only the audio and text needed for that processing is passed to them.

For mobile notifications, the backend sends the notification payload and active registration token to Google Firebase Cloud Messaging. On iOS, Firebase uses Apple Push Notification service (APNs) to deliver it to the device. Apple and Google process this information under their respective service terms. Notifications are generic unless you separately enable content-bearing notifications for that installation. Sensitive integration approval notifications remain generic.

Google provides account authorization and the Calendar, Gmail and Drive APIs. Our Convex backend stores connection, permission and operation records and mediates authorized Google requests. Relevant content is also processed by the AI and speech providers described above. Google stores messages and Calendar changes made through its services under its own policies.

When you use an optional location feature, contracted weather, place, or route service providers receive only the fields needed for that request. A coarse area is used for weather. A precise origin may be used for a one-time route request. These providers are service processors and may not use the data for advertising or tracking.

4. Retention and deletion

Google integration approval requests have a five-minute authorization window. Stored request contents are removed when the request is completed, rejected, cancelled or processed as expired; expiration is not a guarantee that every related record is immediately deleted. Connection, selected-file, operation-status and security records can remain after disconnection.

Disconnecting Google invalidates service access and initiates provider-token revocation. It does not erase messages or events already stored in Google, or automatically erase every backend record. You can revoke a selected Drive file's grant in the app. For deletion of retained integration records, contact the address below.

• Conversation history is retained for as long as you use the Service.
• A pending proactive delivery expires 24 hours after its scheduled time. The current source does not define an approved maximum retention period for delivery history.
• Disconnecting the device in the app deletes the session token from your phone and disables its Push installation on the backend.
• Reclaim or factory reset cancels incomplete deliveries for the prior owner and prevents the new owner from reading prior agenda and notification detail.
• Revoking location consent, disconnecting, reclaiming, or resetting the device invalidates its saved and live location contexts and starts deletion.
• To have your data, conversation history, or retained delivery history deleted, contact us at the address below.

Deleting your account

You can delete your account in the Dot Station app under Settings → Account → Delete account. If you cannot use the app, you can request deletion by email; the steps are at setup.cosmic-dot.com/account-deletion.html. We delete the account within 10 days of confirming that the request comes from the account owner.

When an account is deleted:

• Every sign-in of that account ends at once, on every phone.
• For each NOVA registered to the account, we delete its memories and conversation history, disconnect its integrations, and return the device to its unregistered state. The device shows its setup QR code again and can be set up by whoever holds it.
• If you signed in with Apple, we withdraw the app's access at Apple.
• We then delete the account itself: the account identifier, email address, name and sign-in sessions.

Deletion starts immediately and normally finishes within minutes. If erasing a device's stored memories does not complete, the device is still reset. Those records can then remain on our servers, but neither you nor any later owner of the device can read them through the device or the app. Contact us at the address below to have them erased.

Some records are not deleted with the account. They are kept per device, not per account, for a limited time:

Compliance counts that carry no account or device identifier are kept as statistics. The Google integration records described above can also remain after disconnection. To ask for any of these records to be deleted earlier, contact us at the address below.

5. Children

The Service is not directed to children under the age of 14.

6. Contact

For access or deletion requests, or any other question, reach us at:

Contact: contact@cosmic-dot.com