Privacy Policy

1. Scope and controller

N5 Labs is operated by Noam Rahmani in Israel. For the personal information covered by this policy, Noam Rahmani trading as N5 Labs is the controller. Contact: support@n5labs.online. This policy covers n5labs.online and N5 Labs apps that link to it.

Our apps have different features and data flows. The sections below apply only when you use the relevant feature. An app specific privacy notice supplements this policy and remains applicable to that app. This policy does not replace a separate notice on another domain or authorize additional collection merely because a category is mentioned here.

Where an organization uses a separate N5 Labs business service to manage information about its members or customers, its own notice and our agreement with that organization also apply. Contact that organization for requests concerning information it controls.

2. Information and its sources

• Information you provide: support messages, contact details, preferences, study answers, progress, and content you choose to enter or upload. Avoid including information about other people unless you have authority to provide it.
• Accounts, where offered: account identifiers and profile details supplied by you or a sign in provider such as Apple or Google. A provider may supply your name and email address, including an Apple relay address. We do not receive your Apple or Google password.
• Purchases: transaction identifiers, purchased products, subscription status, trial eligibility and entitlement information supplied by Apple, RevenueCat or the checkout provider. Apple processes App Store payments; we do not receive your full payment card details from Apple.
• Usage and technical information: app or website interactions, pages visited, device and operating system information, app version, identifiers, connection information including IP address, diagnostics, and referring links or campaign information. Identifiers can be personal information even without a name.
• Feature content: selected photos, camera captures, ingredient text, barcodes, prompts, messages or audio when needed for a feature you use. Some features work locally; others send information to our service providers. A photo permission is not a statement that all processing stays on your device.
• Health, activity or location information: only relevant to apps offering those features and subject to applicable device permissions and legal requirements. The relevant app notice and permission request explain the requested access.

3. What information is needed

You generally choose whether to provide information; you are not ordinarily required by law to use our services or provide app content. A feature may not work without the information it needs. For example, a camera scan needs camera access, an online AI request needs its input, account synchronization needs an account identifier, and purchase restoration needs transaction information.

You may decline optional permissions or stop using an optional feature. Denying optional website analytics does not prevent browsing or purchasing. A device permission, acceptance of Terms, or reading this policy is not by itself consent to every use of personal information.

4. Purposes and legal grounds

• Deliver requested services: process feature inputs, maintain accounts, save or synchronize content where supported, manage purchases and restore access. Where the EU or UK GDPR applies, processing objectively necessary to provide your requested service is based on performance of our contract or steps you request before entering it.
• Operate and protect services: troubleshoot errors, prevent fraud and abuse, secure systems, answer support requests and establish or defend legal claims. Where applicable, we rely on legitimate interests in reliable services and protection of users and our business, subject to your rights and a balancing assessment.
• Meet legal duties: retain necessary transaction records and respond to lawful requests on the basis of the relevant legal obligation.
• Optional processing: where consent is required for analytics, tracking, sensitive information or another activity, that activity requires the appropriate consent. You may withdraw consent without affecting the lawfulness of processing before withdrawal. A contract or legitimate interest does not override a separate consent requirement.
• Under Israeli law, information requests are subject to applicable notice and consent requirements, including identification of the controller, purposes, recipients, whether provision is voluntary, consequences of refusal, and rights of access and correction.

5. Website analytics, cookies and your choices

The website uses PostHog for optional usage analytics, including visits, feature interactions, App Store link clicks and campaign attribution. This analytics service is configured with a US endpoint. Cookies or browser storage can maintain an analytics identifier after you choose to allow analytics.

Optional website analytics remains off until you select Allow analytics. Select Reject analytics to browse without it. Use the Privacy choices control to change your choice at any time. A Global Privacy Control signal disables this website's optional analytics even if a previous choice allowed it. Essential browser storage used to remember your choice or support a requested sign in is separate.

Website session recording and automatic interaction capture are disabled in the website analytics configuration. This website choice does not change permissions or analytics settings inside an installed mobile app. Clearing your browser storage may remove your saved choice.

6. Mobile analytics, advertising and session replay

Mobile apps may use analytics and diagnostics, including PostHog, to understand feature usage and purchases and investigate errors. App implementations differ. Where session replay is enabled, interaction sequences and screen content may be recorded; displayed text or images can be included depending on the app's masking configuration, and recordings may be associated with an app or account identifier. Do not assume that all diagnostic information is anonymous or that every displayed image is masked.

Apps offering advertising, including rewarded ads, use advertising partners to deliver and measure advertisements and prevent fraud. Depending on the app, configuration and your choices, processing can include device or advertising identifiers, IP address, ad views, clicks and approximate location inferred from connection information. Partner and consent details belong in the relevant app's advertising notice or consent interface.

Some apps use a mobile measurement partner to measure our own advertising campaigns: which campaign or ad led to an install, and whether in-app events followed, such as finishing onboarding, starting a purchase, or a subscription payment and its value. In Teoria this partner is Airbridge, operated by AB180 Inc. Processing can include the app's vendor identifier, the advertising identifier where you allow tracking, IP address, device and connection information, app events, and subscription events received from RevenueCat. Where you allow tracking, this information can be shared with the advertising platform that ran the campaign, such as TikTok, Meta or Apple, to attribute and optimize those campaigns. Where you do not allow tracking, the partner is configured not to share user level information with advertising platforms, and campaign results rely on aggregated reporting such as Apple's SKAdNetwork. Teoria does not start this measurement in app storefronts in the European Economic Area, the United Kingdom or Switzerland.

You can review tracking permissions under iOS Settings > Privacy & Security > Tracking and any privacy choices provided in the app. Refusing tracking permission does not necessarily stop contextual advertising or essential fraud prevention. Tracking or advertising consent required by law or Apple must be obtained separately; this policy is not that consent.

We do not sell health data. Our existing commitment not to sell personal information remains in place. Some privacy laws define sale or sharing more broadly than receiving money, including certain advertising disclosures. Those definitions and any applicable opt out rights apply regardless of the label given to a disclosure.

7. AI, photos, scans and cloud features

Online AI features send the input required to generate a result to an AI provider. Depending on the feature this may be a prompt, photo, extracted label text, barcode related product information, message or audio. Providers used in relevant services include Google Gemini; the provider and processing can differ by app and feature.

Account and cloud features can use Google Firebase for authentication and storage. For example, a scanner offering saved cloud history may store account information, scan details and results rather than keeping all content exclusively on your device. The relevant app notice supplies additional detail.

The fact that content is sent to an AI service does not establish that it is immediately deleted or excluded from that provider's retention, safety review or model improvement practices. Those details depend on the service and contractual configuration. Contact us with the app and feature name for the applicable provider information. Do not upload identity documents, intimate images, other people's private information or unnecessary identifying details about children.

Review the feature notice before transmitting content. Where specific consent is required for sharing personal information with an AI provider, it must be obtained before transmission. Withdrawing consent prevents future consent based use; it does not automatically retrieve copies already sent or delete cloud history. Submit a deletion request for that information.

8. Recipients and service providers

• Apple: App Store transactions, platform services and sign in where used. Apple also processes information for its own purposes under its privacy notice: https://www.apple.com/legal/privacy/
• RevenueCat: purchase validation, subscription management and entitlement information in apps using it: https://www.revenuecat.com/privacy/
• PostHog: analytics and diagnostics in services using it: https://posthog.com/privacy
• Airbridge (AB180 Inc.): mobile measurement and attribution of our advertising campaigns in apps using it, such as Teoria: https://www.airbridge.io/en/privacy-policy
• Google services: Firebase authentication or cloud storage and Gemini AI processing where used. Service specific and contractual terms govern those services: https://firebase.google.com/support/privacy and https://policies.google.com/privacy
• Netlify: website delivery and hosting, including connection and server information: https://www.netlify.com/privacy/
• Web checkout: the provider and seller identified at checkout and on your receipt process the information needed for that transaction. Where Paddle is identified, it acts as merchant of record under its applicable terms: https://www.paddle.com/legal/privacy
• Other recipients: relevant advertising and content providers identified for the app; advisers or authorities when legally required or necessary to protect rights and security; and a successor in a business transfer subject to applicable privacy requirements. We remain responsible for our own obligations when engaging a service provider.

9. International processing

N5 Labs operates from Israel. Hosting, analytics, AI and other providers may process information in other countries, including the United States. Data protection rules may differ from those in your country.

Where applicable law restricts an international transfer, a valid transfer mechanism is required, such as an applicable adequacy decision or approved contractual safeguards with any required supplementary measures. Use of a provider or a link to its privacy policy does not itself establish a lawful transfer. Contact support@n5labs.online for information about the destinations and safeguards relevant to your app or to request a copy of applicable safeguards, subject to appropriate redactions.

10. Retention, deletion and security

Retention depends on the category and purpose. Account and cloud content is retained for the relevant account service and handling deletion requests. Support records are retained for resolving the issue and necessary follow up. Purchase records may need to remain for entitlement restoration, accounting, disputes and legal obligations. Diagnostics and analytics must be limited to the period needed for their operational purpose. Provider retention may differ from storage on your device.

A deletion request can be subject to lawful exceptions, including required financial records, security investigations or preservation for a specific legal claim. Where an exception applies, the retained information remains limited to that purpose. Backup copies may remain until their normal overwrite cycle and must not be restored to active use for unrelated purposes.

Deleting an app does not necessarily delete cloud accounts, provider records or device backups, and does not cancel a subscription. Use account deletion where available and contact us if it is unavailable or fails. Content stored only on your device may need to be deleted using the app, iOS storage settings, or your backup provider.

We use reasonable technical and organizational security measures appropriate to the information and service. No system is completely secure. Report suspected privacy or security incidents to support@n5labs.online; do not send passwords or full payment card details.

11. Privacy rights and requests

Email support@n5labs.online with the app name and your request. Include only the information reasonably necessary to locate the relevant records, such as an account email or app user identifier if available. We may need proportionate identity verification; do not send government identification unless specifically necessary and requested through a suitable channel.

Rights depend on the law and the processing. They may include access, correction, deletion, a portable copy of certain information, restriction, withdrawal of consent, and objection. Under Israeli privacy law, you have rights of access and correction subject to its conditions. Where the EU or UK GDPR applies, you may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time.

Where applicable US state privacy laws cover the processing, additional rights can include opting out of sale, sharing, targeted advertising or specified profiling, using an authorized agent, and appealing a denied request. We will explain any applicable refusal and appeal route. We do not discriminate against you for exercising protected rights.

We respond within the period required by applicable law and explain any permitted extension. You may complain to the Israeli Privacy Protection Authority, the UK Information Commissioner's Office, your EEA supervisory authority or another competent regulator. You do not need to contact us first to exercise a regulatory complaint right.

12. Children and family features

An App Store age rating is a content rating, not a substitute for privacy consent or a determination that a child can enter a contract. Parents and guardians should supervise use and purchases appropriate to a child's age.

For story or family features, adults should use fictional names or nicknames and avoid uploading identifying information about a child that is unnecessary for the feature. A reference to children in a product does not waive protections for their data.

Where a service is directed to children under 13, or we have actual knowledge that we are collecting their personal information, applicable children's privacy requirements apply, including verifiable parental consent where required. Other countries may set different ages and protections. A general statement in these Terms or this policy cannot replace that process. Contact us if a child has supplied information without required authorization so we can investigate, restrict processing and arrange appropriate deletion.

13. Updates and contact

Updated September 24, 2026 to describe mobile advertising measurement (section 6) and name Airbridge as a service provider (section 8). The previous revision, published September 8, 2026, clarified our disclosures and website privacy choices. This revision does not authorize retroactive expansion of the purposes for information already collected. Material changes will be communicated as required, and any new use requiring consent needs that consent before it begins.

Privacy requests and questions: Noam Rahmani, N5 Labs, Israel. Email support@n5labs.online. Please identify the app or website feature so we can provide the relevant information.