Privacy Policy

Last updated: October 2026

This policy exists in German and English. The controlling company is a German sole proprietorship, and German law applies. In case of any discrepancy between the two versions, the German version is authoritative.

1. Controller

DoryAI
Georg Ortner
Rigaer Straße 47A
10247 Berlin, Germany
Email: georg@dory-ai.com

2. Overview

Nura Sleep is a platform for family sleep consulting. Parents use the mobile app to log their child’s sleep, feeding and activity data. Coaches use the web dashboard to support families. This privacy policy applies to the app, the dashboard and this website.

We do not sell personal data, we do not rent it out, and we do not use it for advertising. We pass data only to the providers named in section 6, and only for the purposes described there.

3. What data we collect

3.1 Account data

At registration: email address, name, gender (female, male or diverse — used only so that texts refer to you correctly), role (parent or coach). For coaches, additionally: preferred language and an optional free-text note about their practice or website, which we use to review the account before activating it. For parents, additionally: the child’s name, gender and date of birth.

3.2 Log data (events)

Parents record data about their child’s day: sleep times (night sleep, naps), meals (type, duration), activities and notes. An entry holds this data in a structured form. Its notes and descriptions are written from your words, but it does not hold your message itself (what you said or wrote, as you said or wrote it) or the AI’s replies, including follow-up questions. We keep your message and the AI’s replies in two other places (section 3.3): with the submission, which we delete once it has been processed and 30 days have passed since you made it, and in the record of what the AI saw and answered, which stays until your child’s data is deleted (section 7).

When you delete an entry in the app, undo an entry the AI saved, or the AI removes or merges an entry for you, we hide that entry from you and from your coach. We do not delete it. We keep it, with the notes your coach wrote on it (when the AI merges entries, the notes move to the entry it keeps), so that you can undo what the AI did and none of your coach’s notes is lost. It stays until your child’s data is deleted (section 7).

3.3 Voice recordings and typed entries

Parents can speak or type a log entry. For every entry we store the submission on our server: the audio file, its transcript, the text exactly as you spoke or typed it, and the AI’s reply to you, with the list of entries it saved, changed or removed. This is what makes an entry accepted and processed exactly once, even when your phone sends it more than once. It is also how the AI knows the last messages about this child from you and the other parent in your family, from today and yesterday, and what it answered, and how the app shows that history to both of you. The audio file is sent to our transcription provider for transcription (section 6). We delete the submission once it has been processed and 30 days have passed since you made it.

For every processed entry we also keep a record of what the AI saw and answered: the text or transcript, the context sent with it (section 6), and the answer, including any follow-up question. We use it to check and improve the quality of the automatic extraction (section 5, legitimate interest). This record stays until your child’s data is deleted (section 7).

3.4 Chat messages

Messages between parents and coaches are stored to enable the coaching communication. A message your phone has not been able to send yet is held encrypted on the device until it can (section 7).

If your coach has notifications turned on, sending a message may show a notification on her device with your name and the beginning of your message. It is delivered end-to-end encrypted through the push service of her browser or phone vendor (Apple, Google, Microsoft or Mozilla), which cannot read it.

When you accept your coach’s offer, we notify her of the order by email and, if she has push notifications turned on, by a web push on her device. Both show your name, your children’s first names, the offer you accepted (its name, length and price) and the time you ordered it.

3.5 Technical data

Device type (iOS/Android), error reports (technical data and a pseudonymous user ID, no names or email addresses), and push-notification tokens used to deliver notifications.

To operate and secure the service, our server logs record for each request your account’s identifier (a random ID, not your name or email address) and, when the request comes from the app, the app’s version (platform, build and installed update).

For coaches who turn on notifications in the dashboard, we also store the browser’s push subscription: an address at the browser vendor’s push service and two encryption keys, used to deliver these notifications. Turning notifications off deletes it. Signing out on that device, or the address expiring, does not remove it immediately — it stops working, and we delete it the next time we try to send and the push service tells us it is no longer valid. It is also deleted with your account.

3.6 Usage analytics and screen recording

To understand how the app and the dashboard are used, and to make them easier to use, we use the PostHog service.

• In the app, we see which screens you open and what you tap. When you tap, the text of the control is not sent, only a technical identifier. The screens themselves are also recorded, meaning a capture of what you see on your display. Text, input and images are always hidden in these recordings before they leave your device. We see no log entries, chat messages, names or photos in them, only how you move through the app. For analytics, the app stores a random identifier on your device.
• In the web app — the coach dashboard at coach.nura-sleep.app and families’ sign-up and account pages at my.nura-sleep.app — we record which pages you open and individual actions such as, in the dashboard, opening a family or sending a message, never their content. Screens are not recorded there. PostHog sets no cookies in the dashboard and stores nothing in your browser.

This data is linked to your pseudonymous user ID, the same one used for error reports, not to your name or email address. Device type, operating system and app version are also sent. Your IP address is not stored.

You can object to usage analytics at any time: in the app under Profile, in the Privacy section, or by email to the address in section 1. From then on, no usage data and no recordings are collected. You can keep using the app without any restriction.

3.7 The coach’s connected mailbox

A coach can connect her own mailbox to Nura Sleep (Gmail, Outlook or Microsoft 365, or any other provider through IMAP). Then the emails between her and the families on her board appear in each family’s record, and she can write to a family from there. Here is what Nura does with the mailbox. This matters for the families’ emails as much as for the coach’s own.

• What we read. Only emails with a family on her board: emails from or to an address she entered for a family member. With Gmail, we ask Google only for emails with these addresses. With Outlook and IMAP, we look at the header of each new email (from whom, to whom and when; with IMAP also the subject) to see whether it belongs to a family. Only then do we fetch its content and attachments. With Outlook and IMAP we see only that header of every other email; its content is never fetched and never stored. When she connects the mailbox, we also import her earlier emails with all her families’ addresses, as far as her provider’s search returns them. We do the same when she adds a family or a family’s address changes.
• What we store. For each such email: sender and recipients with names and addresses, subject, text and formatted text, date and attachments. An attachment over 25 MB is listed by name only; its content is not stored. Everyone on the email is included, also people in copy who are not part of the family. Emails the coach writes in Nura Sleep are stored the same way; they go out through her own mailbox, from her own address. We also keep her mailbox address and, for Gmail, the other addresses she may send from. All of this is in our database and file storage at Supabase in the EU (Germany; section 6). The coach sees these emails in the family’s record; parents do not see them in the app. If she has notifications on, a new email from a family can show a notification on her device with the sender’s name and the subject. It travels encrypted through the push service of her browser or phone (Apple, Google, Microsoft or Mozilla), which cannot read it.
• The credentials we hold. For Gmail we ask Google for two permissions: to read her emails and to send email from her address. For Gmail and Outlook: the access token the provider gave Nura when she agreed. For other providers: the app password or password she entered, and the server addresses. We store them encrypted. We use them only to read her emails, to send the ones she writes in Nura Sleep, and to file a copy of a sent email in her Sent folder. We never show them again and never write them to logs.
• Her provider is her processor, not ours. Google, Microsoft or her IMAP host handles her mail for her, as it did before Nura, under her agreement with them. There is no other company between her mailbox and Nura. For the copies we store, she stays responsible and we work on her behalf as her processor (Terms and Conditions for Coaches, section 8a).
• Disconnecting. When she disconnects the mailbox, we stop reading it at once and delete the credentials. With Gmail, we also cancel Nura’s access in her Google account at that moment. For Outlook and Microsoft 365, Microsoft gives us no way to do this, so she can remove Nura herself in her Microsoft account (Privacy, then “Apps and services”; for a work account at myapplications.microsoft.com); the token we deleted cannot be used anyway. With IMAP, she can delete the app password at her provider. Emails already filed to a family stay in that family’s record, like everything else in it.
• Deletion. A family’s emails and attachments are deleted with the family or its coaching (section 7). When a coach’s account is deleted, her mailbox connection with its credentials and the emails of her coachings are deleted too. Before we delete the account, we disconnect her mailbox the same way, so Nura’s access in her Google account is cancelled too; for Outlook, Microsoft 365 and IMAP, see “Disconnecting”.

Google user data. Nura Sleep’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use Gmail data only to show the coach her emails with her families in their records and to send the emails she writes in Nura Sleep. We pass it on only to the providers that run Nura Sleep for us (Supabase and Render, section 6) and, encrypted, to the push service of her device. Otherwise we pass it on only when security or the law requires it. We never use it for advertising and never use it to train AI models. Nobody at Nura reads it, unless the coach asks us to for a specific request, or security or the law requires it.

4. Purpose of processing

• Providing the coaching platform (performance of contract)
• Logging the child’s day for sleep coaching
• Communication between parents and coaches
• Showing a coach the emails she exchanges with her families in their records, and sending her emails from there (performance of contract with the coach)
• Improving the application and fixing errors (legitimate interest)
• Understanding how the app and the dashboard are used, to make them easier to use (legitimate interest)

5. Legal bases

• Art. 6(1)(b) GDPR — Performance of contract: the processing is necessary to provide our service.
• Art. 6(1)(f) GDPR — Legitimate interest: fixing errors, security and improving the application, including usage analytics (section 3.6).

For the emails from a coach’s mailbox (section 3.7), the coach is responsible: she decides to file them in the family’s record as part of her coaching contract with the family, and we process them only on her behalf (Terms and Conditions for Coaches, section 8a). Our own basis for offering her this feature is our contract with her (Art. 6(1)(b) GDPR).

Our legitimate interest in usage analytics is making the app easy to understand and use for parents, and the dashboard for coaches. Because content stays hidden in the analytics and you can object at any time, we have concluded that your interests do not override ours.

We weigh the record of the automatic extraction (section 3.3) separately, because it holds your words verbatim and is not deleted after a fixed period. Our interest is being able to look into an input that was misunderstood — without the record that is not possible. We keep it only for as long as your child’s data exists, use it solely internally to check and improve the automatic extraction, do not pass it on to third parties, and delete it if you ask us to (section 8).

6. Processors and third-party providers

We use the following providers, who process data on our behalf:

To deliver dashboard notifications to a coach’s device, we use the push service chosen by her browser or phone — provided by Apple, Google, Microsoft or Mozilla, depending on the device. These services see the encrypted notification and the subscription address, but not its content; they are not our processors, and may be located outside the EU.

Some of these providers are companies from the USA. Where one of them processes data in the USA, or reaches data stored in the EU from there, this is covered by the EU standard contractual clauses (Art. 46 GDPR) or by that company’s certification under the EU-US Data Privacy Framework. You can ask us for a copy of the clauses.

We send Groq the audio recording itself, for transcription only; it is not stored there permanently.

We send OpenRouter and the model providers behind it the text of your log entry exactly as you typed or spoke it. If names appear in it, they are sent too. Alongside it we send context so the AI can place the entry correctly: your child’s first name and whether to refer to the child as a girl, as a boy, or without a pronoun, your coach’s first name and, for a woman or a man, the pronoun to use, the current date and time, and your language setting. We also send what the AI needs to see your journal as you do: the entries for the day you are looking at and the days before and after it, and the entry you have open, each with its type, times, what is still missing and the words written in it. And we send the last messages about this child between your family and the AI, from today and yesterday: what you or the other parent said or wrote, how the AI answered, and which entries it saved, changed or removed. Before your coaching starts, while you practise logging, we also send which kinds of entries you have already logged (night sleep, nap, meal, activity, wind-down ritual or note) and which not yet.

We do not send the emails read from a coach’s mailbox to the AI services.

We do not send email addresses, other account data (except the first names and genders named above) or data from your coach’s dashboard to the AI services.

7. Data storage

All data is stored primarily in the EU (Germany). Voice recordings are automatically deleted after 30 days. Three things keep a recording beyond that, until your child’s data is deleted: you report that the AI misunderstood you on an entry; the speech recognition was unsure of the transcript; or you correct, by voice or by typing, something the AI entered on an entry that came from a recording. In the first and the last case every recording behind that entry is kept; in the second, the recording that was unsure. It is the only way we can look into what went wrong. We delete the submission of an entry, with its transcript, text and the AI’s reply (section 3.3) and, unless it is kept as described above, its audio file, once it has been processed and 30 days have passed since you made it. The entries themselves, including those you deleted, which we only hide (section 3.2), and the record of the automatic extraction (section 3.3) stay until your child’s data is deleted. Screen recordings (section 3.6) are automatically deleted after 90 days at most. Usage analytics data is kept for as long as your account exists and deleted together with it, or earlier on request. Account data is kept for as long as the account is in use and deleted on request. Your coach can also permanently delete your family, when you ask for deletion or when your coaching has ended (Terms of Use for Parents, clause 7.5). This deletes the same data as a deletion at your request, including usage analytics data and screen recordings.

Emails from a coach’s mailbox (section 3.7). We keep a family’s emails and attachments as long as the family’s coaching exists, and delete them with the coaching or the family, like the rest of its record. We never delete them earlier on our own. We keep the coach’s credentials until she disconnects the mailbox or her account is deleted.

The emails we send you about your coaching — your coach’s offer, the order confirmation and the notes on your next steps — are kept word for word in your family’s file, so your coach can read back what you received from us. They contain your first name, and for the order confirmation also the price and the period of your coaching. These copies are deleted when the coaching or your family is deleted.

On your phone. The app keeps data on the device itself, so that it opens instantly and stays usable without a connection: your journal, your child’s plan, the newest chat messages and your account details — and every entry and message that has not reached us yet, including the voice recording of an entry. The app stores this data encrypted (AES-256); the key stays on that one phone and is never carried over to another device or into a backup. A voice recording is deleted from the phone as soon as its entry has reached us.

Signing out deletes all of this data on the device — entries and messages not yet sent only after you have confirmed it, so that signing out cannot silently discard the entry you have just made. An entry the app has not been able to send for seven days is no longer retried; it stays visible in your journal until you delete it. When several parents sign in on a shared phone, the previous person’s data is deleted as soon as the next one signs in; their not-yet-sent entries are kept for them and removed after 30 days.

The app also keeps the photos it shows — your child’s and your coach’s — in its image cache, so that they appear without loading again. This cache is not part of the encrypted storage described above; signing out deletes it too.

8. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15) — what data we hold about you
• Rectification (Art. 16) — correction of inaccurate data
• Erasure (Art. 17) — deletion of your data
• Data portability (Art. 20) — export of your data in a common format
• Objection (Art. 21) — objection to certain processing, such as usage analytics (section 3.6)
• Complaint — you may contact your competent data protection authority at any time

9. Data security

We use technical and organisational measures to protect your data: encrypted transmission (TLS), an encrypted data store in the app on the phone (AES-256, section 7), encrypted storage of a coach’s mailbox credentials (section 3.7), database-level access control (Row Level Security), secure authentication, and hosting in the EU (Germany; section 7).

10. Children

Nura Sleep processes children’s data (name, gender, date of birth, daily log) only at the instruction and with the consent of a parent or legal guardian. Children do not use the app themselves.

11. This website (nura-sleep.app)

This website is a static page with no login. It is hosted by Render as a static site, which produces technically necessary server logs (e.g. IP address, timestamp, page requested) for security and error analysis (Art. 6(1)(f) GDPR). This website sets no cookies, uses no analytics or tracking tool and has no forms, and loads no fonts or other content from third parties — all fonts are served from this site. The link to the coach dashboard leads to coach.nura-sleep.app; sections 2 through 10 of this policy apply to the web app on both of its addresses (coach.nura-sleep.app and my.nura-sleep.app).

12. Contact

For privacy inquiries, please contact:

DoryAI · Georg Ortner
Email: georg@dory-ai.com