Privacy policy

1. In short

NumeroDan works out numbers from your name and your date of birth. For that we need three things: your name, your date of birth, your email. We keep your data in Europe, with our database provider Supabase in Frankfurt. The text for your day is written by AI. That is Anthropic, in the USA. We send them your name, your numbers and a little about your interests. We do not send your email address or your date of birth. You can export or delete your data at any time. Both are buttons in Settings. We sell nothing. We advertise nothing. We do not follow you around the web.

This version is dated 16 October 2026. The previous version was dated 13 October 2026.

2. Who we are

The controller of your data is APM Consulting, Anita Pavlin Močnik s.p. (sole trader), Celovška cesta 136, 1000 Ljubljana, Slovenia, registration number 9966498000, tax number 67347371. NumeroDan is the name of the service the controller provides.

You can write to us at info@numerodan.com.

We do not have a data protection officer. We believe a service this small does not need one (Article 37).

3. What we keep about you

When you open an account, we keep:

your email: you sign in with it, and we send your mail to it;
your full birth name: its letters give part of your numbers;
your date of birth: it gives the other part;
your gender: so the wording is grammatically right;
your language and letter system: these are app settings;
what defines you now and what interests you: so the text fits you better.

We also keep things that appear as you use the app:

your calculated numbers: life path, expression, soul urge and others;
the text the AI writes for your day, and a monthly text if you have one;
thumbs up and down under the sections from when the app still had that option. We no longer collect new ones;
the dates you opened the app;
a record of when you confirmed your age, the terms, this policy and email, and of your cookie choice on the banner;
a record of when the error screen or the slow-preparation screen appears for your day (only the reason, and for slow preparation how long it took, not the content);
an invitation record, if your account came from an invitation link: the invitation code, the time of the click and the time you opened your account. The code tells us who invited you. Only we see the record. In statistics we only see how many accounts came from invitations.
your answer to “How did you hear about NumeroDan?”: your choice, and the text you write if you pick “Other”. If you skip the question, we only note that;
a quality check of the text for your day: the labels of our rules, and sometimes a single word from the text that a rule flagged. Such a word can be a name;
the AI's usage while it prepares your text: which model, how much text it read and wrote, how long it took and whether it worked;
a record when preparing your text fails, with the reason;
a record that your morning message was sent;
the times of your first-time setup steps;
a record of when and how the language of your profile changes;
sign-in data: when you sign in, how (with your email or with Google) and your IP address at sign-in. With Google sign-in, also the name and profile picture Google sends us.

The consent log is a new part of the app. We have to check whether it really runs in our database before we publish this policy. Until we confirm that, we do not state it here as a fact.

If you subscribe to the paid version, we also keep:

your plan, billing period and subscription status;
dates: when your trial starts and ends, and until when your subscription runs;
the last four digits of your card. We do not have the full card number;
amounts and payment references at Stripe, and a record of a refund if you ask for one;
your answers during the trial, when you leave and when you ask for a refund, for example what stopped you. They can include text you write and an amount you name;
the notices Stripe sends us about your payment: the type of event, amount, currency, subscription status and reason for cancelling;
a record that a trial was used. It is a code worked out from your email address, not the address itself. With it, the same email address cannot get a trial twice.

Two things we keep from older versions of the app, although we do not use them:

your family status, if you used NumeroDan before July 2026. We stopped asking then. We do not use it. It goes when you delete your account;
an old description of you, once written by the AI. Nothing in today's app displays it. It goes when you delete your account.

If you came from the old version of the app, your gender and a few other fields hold placeholder values. We ask you to confirm them. It does not block your use of the app.

We do not keep your address, phone, contacts or photos. We do not read your messages. We do not connect to social networks.

Why we may keep this: without it we cannot provide the service. That is the contract basis (Article 6(1)(b) GDPR).

4. What stays in your browser

Some data also sits in your browser. That makes the app faster, and it keeps working when your connection is poor. There you have your name, date of birth, gender, what interests you, your Circle and the text for your day. Your cookie choice and your sign-in data are there too. There is also a draft while you set up the app, the guidance you pick on the “Today” page and a random device number (section 10). When we measure where visits come from, the browser also remembers what it has already sent about that.

Signing out in Settings clears your personal data from this device. Three settings of this browser stay: appearance, tone and your cookie choice. A short technical note about members we are still deleting stays too (see section 9).

If you leave the app any other way than the Sign out button in Settings, nothing is cleared. Closing the tab is not enough. On a shared or borrowed device, always sign out in Settings.

We use cookies only to make the app work: one for language, one or two for your sign-in, and one for an invitation. The sign-in cookie appears as soon as you request a sign-in link, even if you never click it. The invitation cookie is set when you click an invitation link. It holds the invitation code and the time of the click. When you open your account, the cookie tells us that the account came from an invitation. This lets us give you the benefit the invitation brings. Then we delete the cookie. If you never create an account, it expires on its own after 400 days. Your cookie choice is stored in the browser, not in a cookie. If the consent log is live in our database (see section 3), we also write it there, so our server knows it too. We have no advertising cookies. On our domain there are no third-party cookies. The sign-in check against bots runs in a Cloudflare frame, and the payment page belongs to Stripe. Their own rules apply there.

5. The people in your Circle

Read this section before you add anyone. You can enter up to ten people in your Circle. For each you enter a full birth name, date of birth, gender and relationship. From that we work out their numbers and your dynamic with them.

You are the one who enters this data. We hold it for you. Only you see it. Other users do not see it. You see it on your other devices too, once you sign in.

Why we may keep this. You entered these people because they are part of your everyday life. We keep their data so that we can tell you how the day is between the two of you. That is our legitimate interest (Article 6(1)(f) GDPR). Contract does not apply here, because the contract is with you, not with them. We cannot obtain their consent, because we have no way to reach them. So we set ourselves limits, and we list them here. What we keep about them: full birth name, date of birth, gender, the type of relationship, and the numbers we work out from that. Nothing else. We do not have their address, phone number or email. What we do with it: short texts appear next to their numbers. Those texts are written in advance and tied to the numbers. They are not written by AI. Only you see them. What we do not do: we do not show them to other users, we do not send them anything, we do not sell their data, and we do not buy anything about them elsewhere.

What leaves the app: when we prepare your daily text, a Circle member's name and the type of relationship go to our AI provider. A short description of their nature and their day goes with it, in words. Their date of birth does not go. We do not have their email at all. At most five adult members go there, in the order you entered them. If you have more, the rest never reach the model at all. Section 7 sets this out in detail.

We ask you to be fair about this. Add people who are fine with it. Before you add someone, consider whether they would want us holding this. If someone is not fine with it, remove them from your Circle. The app does not ask you this with a checkbox. We ask you here, in words.

Removing a member: use the button on that person's page. It disappears from your device at once. We delete it from the database when the app is connected and you are signed in. If that does not work at the time, we remember that it has to be deleted and try again the next time you open the app.

If someone added you to their Circle and you do not want that, write to us at info@numerodan.com. We answer within one month. Two things then happen. The first we do ourselves: we delete your data from our database. The second we ask of the user who entered you: to remove you inside the app on their device. Why both: a copy of your data also sits in their app, and that copy can be written back into our database the next time they open it. You also have the right to object under the law (Article 21 GDPR). When you object, we delete your data. We do not ask for a reason.

6. Children

Only a person aged 18 or over may open an account. You confirm this with a checkbox when you sign up. We do not verify your age. We take your word for it.

You may add a child to your Circle. You are responsible for that data.

For children under 15 there is one difference: we do not send their data to our AI provider. That limit is built into the program, not just written on paper. If a date of birth is unclear, the program treats the person as a child.

We show the map for a child too. The matching map's texts are written by relationship type; where there is no text for a child, a neutral sentence is used instead. The descriptions of their numbers are the same as for adults. The numbers follow the same rules as for an adult. There is no separate children's account; an adult opens the account.

7. Who we trust with your data

We run no servers of our own. So we use other companies' services. Each one gets only what it needs for its job.

Supabase database and sign-in. Servers in Frankfurt, in Europe. It holds everything in section 3. Their terms say data on their disk is encrypted.
Anthropic (Claude) writes the text for your day. Based in the USA. We send: your name, your gender, your numbers, what defines you now and what interests you. For at most five adult members of your Circle we also send their name, the type of relationship, and a short description in words of their nature and their day. We do not send: your email, your date of birth, Circle members' dates of birth, or anything about children under 15. Their commercial terms say this data is not used to train their models by default.
Resend sends the mail. Based in the USA. It holds your email, your name and the full text of the message sent. Internal alerts to the owner also go through Resend. We send them when the nightly text preparation fails for someone. We also send them when the app shows you that today's content is not available or is slow to prepare. They also go on a new registration, and when an account is deleted or deactivated. If you subscribe, they also go when a subscription starts, is cancelled or ends, and on a refund request. The refund request alert holds your email address, so the owner can find your payment at Stripe. The other alerts hold neither your name nor your email.
Sentry tells us when something breaks in the app. Based in the USA. It gets the error message, the page address and browser details. Session replay is off. Performance tracing is off. It also gets a quality measurement of the text: the labels of our own rules, and sometimes a single word our spellcheck did not recognise. Very rarely such a word could be a name.
Vercel runs the app. Based in the USA. Its server logs hold your IP address and browser details.
Stripe handles payments, if you subscribe. Based in the USA. It gets your email, your language and the internal identifier of your account. You type your card number on Stripe's payment page. We never see it. From Stripe we only get the last four digits, the payment status and the amounts. Stripe keeps payment records and invoices under its own rules and the law.
Cloudflare (Turnstile) checks on the sign-in page that a person, not a bot, is asking to sign in. Based in the USA. It gets your IP address and browser details. Most people see nothing. A small box appears only when Cloudflare is not sure. The legal basis for this is still in legal review.
Google (sign-in) sign-in, if you sign in with Google. Based in the USA. You sign in at Google. Google sends us your email, your name and your profile picture. Google also learns that you use NumeroDan.

We sell data to no one. We lend it to no one for advertising.

8. Where your data travels

The database is in Europe, in Frankfurt. The providers in section 7 based in the United States are Anthropic, Resend, Sentry, Vercel, Stripe, Cloudflare and Google.

What goes there: your name and your numbers (Anthropic), your email and the text of the mail (Resend), error messages (Sentry) and technical logs (Vercel). If you subscribe, payment data goes to Stripe. At sign-in, your IP address goes to Cloudflare. If you sign in with Google, the sign-in happens at Google.

The basis for every transfer outside Europe is still in legal review. So this section is not finished.

9. What stays on your device

See section 4. Two more details that are only fair to state. If you add someone to your Circle, their name and their date of birth sit in your browser too. That is another person's data on your device. Handle it with care.

When you remove a member, a short technical note stays in the browser. It holds no name and no date. It does hold two internal identifiers: yours and that member's. This note deliberately survives sign-out, because otherwise a deleted member comes back. There are at most fifty such notes. They disappear once the deletion succeeds.

10. Measuring use

We measure two things. The difference matters.

First: whether the app is any use to anyone. Visits before sign-in are measured with a random number your browser makes. We measure the setup and sign-in steps the same way, and opening and using our tools, with clicks on their buttons. Before sign-in these records are not tied to your name. After sign-in we add your account to them. We also record the day you open the “Today” page, and when the text for your day was not ready in advance. Those two records are tied to your account. We measure all of this even if you do not choose “Accept all” on the banner. The basis is our legitimate interest (Article 6(1)(f)): without it we do not know whether the app actually helps anyone.

Second: what you do inside the app, and where you came from. Which pages you open, which section you expand and which guidance you pick. Also what you do in your Circle and in Settings, and when you sign out or start deleting your account. On the home page, we note which part you look at. We also note where sign-in or a session goes wrong, and which buttons you press on the payment screen. Measuring our mail, described below, belongs here too. We also note the label of the link you came through (for example an Instagram post or an ad), the name of the website or app you came from, and the page you land on – not the full address. When you create an account, we link this to it; if you already have one, we delete that record. We measure that only if you choose “Accept all” on the banner. You can change that choice in Settings at any time. Withdrawing is as easy as giving. An invitation code is something else. Sections 3 and 4 explain it.

We use no third-party analytics tools for this measurement. We measure ourselves, in our own database. What goes to Google is in section 11.

In our mail we measure whether a message was opened and whether a link in it was clicked. This applies to the morning message and the welcome. If you subscribe, it also applies to the trial reminder and the end-of-trial message, but there we only measure clicks. We measure this only if you choose “Accept all” on the banner. Your latest choice counts, on any device. You can change it in Settings at any time. This also applies to messages already sent. The measurement is not exact: some mail programs and protections load images or open links by themselves. Apple's Mail Privacy Protection, for example, loads images as soon as a message arrives. If you forward a message, the opens and clicks of the person who gets it are recorded as yours.

11. Mail

We send you these kinds of mail:

the sign-in message with a code: each time you sign in with your email. This cannot be turned off;
a welcome: once, when you open your account;
the morning message with the text for your day: only if you choose it;
a warning before your account is deleted, once we turn on automatic deletion (section 12);
if you subscribe, messages about your subscription: a welcome when your trial starts, a reminder before it ends, a message when it ends, on cancelling and on a refund;
a notice to founding members when the paid version starts.

You can stop the morning message at any time. The unsubscribe link is at the bottom of the morning message and the welcome. Other messages do not have it, the sign-in message with a code for example. One click is enough. We record the unsubscribe with the date and time.

If you choose “Accept all”, the measuring image and the button in a message carry your internal identifier (a long string of letters and digits). The trial reminder and the end-of-trial message have no image; only their button carries it. The unsubscribe link always carries your identifier, because without it unsubscribing would not work. The link to Settings in the footer does not carry it. The identifier holds neither your email nor your name. Anyone your mail passes through can see it, your mail program for example, or Google's image proxy.

We send no promotional mail.

12. How long we keep things

Your profile and your numbers: as long as you have an account.
Your Circle: until you delete it, otherwise as long as you have an account.
The text for your day: as long as you have an account.
Old text from a previous version of the app: as long as you have an account.
The old description of you and the old family status (section 3): as long as you have an account.
Usage measurement: as long as you have an account. Visits before sign-in have no limit.
A record of a failed text preparation: as long as you have an account.
The record of your consents: no limit. See section 14.
Copies of tables from the old app: until we delete them by hand after the move to the new database. There is no automatic limit for this.
Server logs: at the provider, a short time, under their rules.
A record of the error screen while your day is being prepared (section 3): as long as you have an account.
The invitation record (section 3): as long as you have an account. When you delete your account, it stays with no link to you and no limit (section 14).
Your subscription, payment records and your answers about payment (section 3): as long as you have an account.
Stripe's notices about payments: no limit. When you delete your account, they stay with no link to you (section 14).
The record that a trial was used: no limit, even after you delete your account. That way the same email address cannot get a trial twice.
Payment data at Stripe: under Stripe's rules and the law. How long the law requires is still in legal review.
Your answer to “How did you hear about NumeroDan?”: as long as you have an account.
Quality checks of the text and the AI's usage (section 3): as long as you have an account. When you delete your account, they stay with no link to you and no limit.
The record of language changes and your setup step times: as long as you have an account.
Sign-in data: at most as long as you have an account.

When you delete your account yourself, in Settings, we delete it immediately. This cannot be undone. Every night an automatic cleanup also runs. What we plan for inactive accounts is explained below.

If you do not open the app for a long time

We plan to delete an account ourselves if nobody opens it for two years in a row. With it we will delete everything attached to it, including your Circle. One month before that we will send a warning by email. That warning will arrive even if you have daily messages turned off. It is not an advert, it is a notice about your account. If you come back and open the app during that month, the period will start again. What will count as opening: signing in and opening the app. Opening our email will not count. In many mail programs images load by themselves, even if you never read the message. Until we turn this on, we do not delete your account ourselves.

If an account is never opened even once, we will delete it after one year. We do not do this ourselves yet.

Payment does not affect these periods. We measure the periods by use, not by payment.

13. Your rights

You have every right under the GDPR. In plain words:

Access. You can ask what we hold about you.
Export. The “Export all your data (JSON)” button in Settings.
Correction. You fix your name, date and gender yourself in the app.
Deletion. The “Delete account and all data” button in Settings.
Restriction and objection. Write to us.
Withdrawing consent. For mail: the unsubscribe link at the bottom of the morning message. For usage measurement: the switch in Settings. The switch also stops measuring our mail.
Portability. The export is a JSON file you get immediately.

The export contains your profile, your Circle, your daily and monthly texts, your ratings, your onboarding progress and your visit days. It also contains your app use and your path through the app, and the record of your consents. The invitation record and your answer to “How did you hear about NumeroDan?” are included too. If you subscribe, it also holds your subscription, your answers about payment and the record of a used trial. It also holds records of how your text was prepared and the record of language changes. Your sign-in account data, without IP addresses, and data from the old version of the app are included too. If you want anything else we hold about you, write to us. We send it within one month. That applies to every request.

14. What happens when you delete your account

When you press the button, this is what happens. At once, not in thirty days.

We delete: your account, your profile, your numbers, your Circle, your daily and monthly texts and your ratings. We also delete your visit days, the measurement of your app use and your onboarding progress. With them go the records of failed text preparation and your answer to “How did you hear about NumeroDan?”. The record of language changes and your sign-in data go too. If you subscribe, we also delete your subscription and your answers about payment. Before that, we cancel at Stripe any subscription that is still running.

What stays, with no link to you: the record of visits and of your path through the app. If the consent log is live in our database (see section 3), the record of your consents stays too. We strip your email and the link to your account from both. An identifier made from your email with a secret key stays in the consent record. We cannot read that identifier back into your email ourselves, because that needs a key we keep separately. We cannot technically remove the identifier either, because the consent record is locked against any change at all. That lock is exactly why we can trust the record as evidence. The invitation record also stays with no link to you: the invitation code, the time of the click and the time you opened your account. Quality checks of the text stay the same way. They can hold a word a rule flagged. The AI's usage and Stripe's notices about payments stay too. The record that a trial was used stays too. It is worked out from your email address, so the same address cannot get a trial twice.

What we cannot reach: the copy on your device, which signing out in Settings clears (section 4); records at our mail provider, server logs, records at our AI provider and events in Sentry. Nor data at Stripe (your customer record and invoices), at Cloudflare or at Google. Those are deleted on their schedule, not ours.

15. Security

All connections are encrypted (HTTPS). The database is with Supabase in Frankfurt; their terms say their disk is encrypted. Every row in the database is locked to its owner. Only the owner reaches the usage statistics, through a named allowlist. Those statistics are sums only: they show no names and no dates of birth.

What we do not have today: we do not additionally encrypt individual fields in the database. It is decided that we add this after the move to the new database. Until that is done, we do not promise it to you.

16. If there is a breach

If someone reaches data they should not:

we notify the Information Commissioner within 72 hours;
if the risk to you is high, we also notify you by email;
we say what happened, what it concerns and what you should do.

17. AI and decision-making

The text for your day is written by a language model. The numbers are worked out by the program, by rules of arithmetic. The model only puts them into words.

We make no automated decisions about you. Nothing the app writes has a legal or similar effect. NumeroDan is not advice: not medical, not financial, not legal.

There is more on this in the terms of use, clauses 2 and 3.

Among the interests you can pick “Health + body”. That is a choice of topic, not information about your health. That choice goes into the instruction we give the model. Whether that is a special category of data is still in legal review.

18. What we do not do

We do not sell data.
We do not advertise, and we allow no advertising in the app.
We do not follow you across other websites.
We use no third-party cookies on our site.
We buy no data from anywhere.
We do not link your account to social networks.
We do not store your contacts, messages or photos.
We do not store your precise position (GPS). Your country can be seen from your IP address: our hosting provider sees it, and when you open or delete an account the country also goes into the owner's alert (section 7).

19. Changes to this policy

We will change this policy. The app is still being built. With every change we put a new date at the top. If a change matters, we tell you in the app. If you get our mail, we tell you by email too. Here you always see only the current version, with its date at the top.

We will never quietly widen what we do with data we already hold.

20. Contact and complaints

Questions about privacy go to info@numerodan.com.

We answer within one month, usually sooner.

Complaint: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, Ljubljana, gp.ip@ip-rs.si; in another EU country, to that country's supervisory authority.