Noxa Privacy Policy

Effective Date: September 4, 2026
Last Updated: September 4, 2026

1. Introduction

Noxa is a digital wellbeing and productivity app designed to help people reduce distractions, manage app and website access, set intentional usage limits, and complete focus sessions.

This Privacy Policy explains how Deepak Kolli, operating Noxa ("Noxa," "we," "us," or "our") collects, uses, stores, and shares information when you use the Noxa mobile app, website, and related digital wellbeing and productivity services (collectively, the "Service").

Noxa is based in Massachusetts, United States.

We designed Noxa to minimize the amount of personal information we collect. In particular, privacy-sensitive Apple Screen Time selections, tokens, and enforcement state are intended to remain on your device unless we clearly disclose otherwise and have a lawful, platform-compliant reason to process them.

If you have questions about this Privacy Policy, contact us at privacy@lycheecorp.com.

2. Information We Collect

The information we collect depends on how you use Noxa.

A. Account Information

If you create a Noxa account, we may collect:

• your email address;
• a unique account identifier;
• authentication and session information; and
• the date your account was created.

Noxa uses Supabase Auth to provide account authentication.

If you use Sign in with Apple, Apple may provide Noxa with your name and email address, or with a private relay email address if you choose to hide your email.

B. Subscription Information

Subscriptions purchased on iOS are processed by Apple through the App Store.

Noxa currently uses StoreKit to verify subscription access on-device. Noxa may access limited entitlement information necessary to determine whether you have access to paid Noxa features.

Noxa does not currently upload or store Apple subscription transaction identifiers in Supabase.

Noxa does not receive or store your full payment card number or complete payment credentials.

C. Focus Activity and Noxa Usage Data

To provide focus-session history, statistics, and account features, Noxa may store information generated through your use of Noxa itself, such as:

• when a focus session starts;
• the planned duration of a focus session;
• the actual duration of a focus session;
• whether a session was completed successfully, ended early, or otherwise interrupted;
• the platform used;
• when the session record was created; and
• internal identifiers needed to associate the focus-session record with your Noxa account.

Noxa's current backend may contain fields for the number of apps or websites blocked during a session, but those fields are not currently populated and Noxa does not currently collect those counts as part of the Service.

This information concerns your activity within Noxa. It should not be confused with a complete history of everything you do on your device.

D. Website Blocklist Information

If you manually add websites or domains to your Noxa blocklist, Noxa stores the domain selections through our backend infrastructure, including Supabase, so that supported website-blocking settings can be associated with your account and synchronized.

Noxa may also maintain device-local information needed to apply website restrictions through Apple's Screen Time frameworks. Privacy-sensitive Screen Time web-domain tokens and enforcement state remain device-local as described below.

A website blocklist is not the same as browsing history. Noxa stores the domains you choose to block, but does not use your blocklist to create a record of websites you actually visit.

E. Apple Screen Time and Family Controls Data

Noxa uses Apple technologies including Family Controls, Managed Settings, and Device Activity to provide blocking and usage-limit features.

Apple's Screen Time APIs are designed to protect user privacy. In Noxa's current architecture, privacy-sensitive Screen Time information remains local to your device, including:

• FamilyActivitySelection data;
• application tokens;
• category tokens;
• Screen Time web-domain tokens where applicable;
• shielding and blocking state;
• Device Activity monitoring state; and
• active Screen Time schedules or enforcement state.

Noxa does not upload raw per-app Screen Time history to our servers as part of the current Service.

Noxa also does not use Screen Time information for advertising, advertising measurement, or data-broker purposes.

F. Technical and Security Information

When you communicate with Noxa's backend services, Noxa and its service providers may process limited technical information necessary to provide and secure the Service, such as:

• IP address;
• request timestamps;
• app version;
• operating system or device type;
• authentication and security events; and
• server error or diagnostic information.

We use this information for security, fraud prevention, troubleshooting, reliability, and service operation.

Noxa does not currently use third-party advertising or product-analytics SDKs. If that changes, we will update this Privacy Policy and any required App Store privacy disclosures before collecting additional information where required.

G. Communications With Us

If you contact support, send us feedback, make a privacy request, or otherwise communicate with us, we may collect:

• your email address or other contact information;
• the contents of your message;
• files or screenshots you choose to send; and
• information needed to respond to your request.

3. Information Noxa Does Not Intend to Collect

Unless a future feature is introduced with a separate, clear disclosure, Noxa does not intend to collect:

• the contents of your text messages or emails;
• your photographs or photo library;
• your contacts;
• microphone recordings;
• precise location information;
• your camera content;
• the contents of other apps;
• your complete browsing history;
• your full payment-card information; or
• raw, server-stored per-app Screen Time history.

If Noxa's practices change, we will update this Privacy Policy before the new collection begins where required.

4. How We Use Information

We may use information described in this Privacy Policy to:

• create, authenticate, and manage your Noxa account;
• provide focus sessions, focus history, and statistics;
• maintain supported account and app functionality;
• determine whether you have access to paid Noxa features;
• provide customer support;
• respond to privacy and legal requests;
• secure accounts and prevent fraud or abuse;
• diagnose errors and improve reliability;
• comply with legal obligations;
• enforce our Terms of Use; and
• protect the rights, safety, and integrity of Noxa, our users, and others.

We do not use Screen Time data for advertising or advertising measurement.

5. Legal Bases for Processing

If data-protection law in your jurisdiction requires us to identify a legal basis, we rely on one or more of the following, depending on the context.

Performance of a Contract

We process information when necessary to provide the Service you request, such as account authentication, subscription access, and focus-session history.

Legitimate Interests

We may process limited information for legitimate interests such as:

• securing the Service;
• preventing abuse;
• debugging and improving reliability; and
• responding to support requests.

We do not rely on legitimate interests where your rights and interests override ours.

Consent

Where required, we rely on your consent for particular processing activities or permissions. You can withdraw consent where applicable, although doing so may affect features that depend on that permission.

Legal Obligations

We may process or retain information when required to comply with applicable law, regulation, legal process, or valid government request.

6. How We Share Information

We do not sell your personal information.

We may share limited information in the following circumstances.

A. Service Providers

We use third-party providers to operate Noxa.

Supabase

Noxa uses Supabase for authentication, database hosting, and backend infrastructure. Supabase may process account information, focus-session information, synchronized website-domain blocklist information, technical information, and security information on our behalf as necessary to provide those services.

Apple

Apple provides services and technologies used by Noxa, including:

• the App Store;
• StoreKit and In-App Purchase;
• Sign in with Apple;
• Family Controls;
• Managed Settings; and
• Device Activity.

Apple's handling of information through its services is governed by Apple's own terms and privacy policies.

B. Legal and Safety Reasons

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with law, regulation, court order, or valid legal process;
• enforce our agreements;
• protect against fraud, abuse, or security threats; or
• protect the rights, property, or safety of Noxa, our users, or others.

C. Business Transfers

If Noxa or its business is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.

7. No Sale, Advertising, or Cross-App Tracking

Noxa does not sell personal information.

At launch, Noxa does not:

• use third-party advertising networks;
• use Screen Time information for advertising;
• share personal information for cross-context behavioral advertising; or
• track users across unrelated apps or websites for advertising purposes.

If this changes, we will update our disclosures and obtain any permissions required by law or Apple before engaging in the new activity.

8. On-Device Data

Some Noxa information is intentionally stored locally on your device rather than in the cloud.

This may include:

• Screen Time selections and tokens;
• current blocking or shielding state;
• active focus-session state needed by app extensions;
• certain usage-limit configuration; and
• cached configuration used to make blocking reliable.

Website domain selections that you add to Noxa's blocklist may be synchronized through Supabase as described in Section 2.D, while privacy-sensitive Apple Screen Time tokens and enforcement state remain device-local.

Local information is designed to persist between app sessions where necessary for Noxa to function.

Local information may be removed if you delete Noxa, clear relevant device data, delete your Noxa account through the app where applicable, or if iOS removes the data.

Some cloud-backed information may remain until separately deleted under this Privacy Policy.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, meeting legal obligations, resolving disputes, and protecting the Service.

Our current retention approach is:

• Account data: retained while your Noxa account is active. When you delete your account, account data is deleted or de-identified unless retention is required or permitted by law.
• Focus-session history: retained while your Noxa account is active unless you delete your account.
• Support, privacy, and legal communications: generally retained for up to 12 months after the request or matter is resolved, unless longer retention is reasonably necessary for an ongoing dispute, security issue, fraud investigation, or legal obligation.
• Security and server logs: retained according to the applicable retention period of our infrastructure providers and only for as long as reasonably necessary for security, troubleshooting, fraud prevention, or legal purposes.
• Backups: deleted or overwritten through the normal backup cycle of our infrastructure providers. Deleted information may remain in backups until those backups are automatically overwritten or expire.

Where possible, we delete or de-identify information when it is no longer needed.

10. Account Deletion

You can initiate deletion of your Noxa account from within the app at:

Account → Delete Account

When your account is deleted, we will delete or de-identify personal information associated with the account unless we are required or permitted by law to retain specific information.

Deleting your Noxa account does not necessarily cancel an active App Store subscription. App Store subscriptions are managed by Apple. Noxa provides access to Apple's subscription-management interface so you can manage or cancel your subscription.

Deletion of cloud data may take a limited amount of time to propagate through active systems and backups.

You may also contact privacy@lycheecorp.com for help with a privacy or deletion request.

11. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information, including the right to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion;
• request a copy or portability of certain information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• appeal or complain to a data-protection authority where applicable.

To submit a request, contact privacy@lycheecorp.com.

We may need to verify your identity before completing a request. We will not discriminate against you for exercising privacy rights protected by applicable law.

California and Other U.S. State Privacy Rights

Where applicable, residents of certain U.S. states may have additional rights concerning access, correction, deletion, portability, and the sale or sharing of personal information.

Noxa does not sell personal information or share personal information for cross-context behavioral advertising as described in this Policy.

European Economic Area, United Kingdom, and Switzerland

Where applicable, you may have rights under European data-protection laws, including access, rectification, erasure, restriction, objection, portability, and the right to complain to your local supervisory authority.

If personal information is transferred internationally, we and our service providers will use legally recognized safeguards where required.

12. International Data Transfers

Noxa and its service providers may process information in countries other than the country where you live.

Those countries may have different data-protection laws.

Where required, we use appropriate safeguards for international transfers, such as contractual protections or other transfer mechanisms recognized by applicable law.

13. Security

We use reasonable administrative, technical, and organizational safeguards intended to protect personal information.

These measures may include:

• encrypted network connections;
• authenticated access;
• database Row Level Security;
• restricted privileged credentials;
• access controls; and
• separation between device-local Screen Time information and cloud-stored account data.

However, no electronic transmission, service, or storage system can be guaranteed to be completely secure.

14. Children and Minors

Noxa is intended for users age 13 and older and is not directed to children under 13.

If you are below the age at which you may legally consent to the processing of personal information in your jurisdiction, you may use Noxa only with any consent required from a parent or legal guardian.

Noxa is not currently intended to operate as a parental-control service for managing another person's device.

If we learn that we collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including when Noxa introduces new features or changes how information is processed.

If a new feature would require us to collect or process new categories of personal information, we will update this Privacy Policy and provide any notices or choices required by applicable law before the new processing begins where required.

When we make material changes, we will update the "Last Updated" date and provide additional notice where required by law.

Your continued use of Noxa after an updated policy becomes effective is subject to applicable law and any consent requirements.

16. Contact Us

Deepak Kolli
Operating Noxa
Massachusetts, United States

Privacy: privacy@lycheecorp.com
Support: support@lycheecorp.com
Legal: legal@lycheecorp.com
General: hello@lycheecorp.com
Website: https://noxaapp.com

For privacy-related requests, use the privacy email above.