Updated November 1, 2026
Northeum Privacy Policy
Morris Digital Ventures LLC operates Northeum. This policy covers the Northeum website and app, including the current invitation-only beta. It explains what we process, why, the providers involved, and your choices. Features described here are available only where enabled; this policy does not announce a public launch.
For health-related information and rights, read our Consumer Health Data Privacy Policy.
Information we process
Account and profile details; onboarding answers; workout, readiness, pain and mobility entries; nutrition, meal and hydration entries; body measurements and check-ins; photos you choose to upload; friend, message, report and sharing activity; suggestions; and technical records needed for security and reliability.
Information sources
Most information comes from what you enter or upload. We also generate coaching responses, plan history, achievement and activity records from your use of the app. Connections to our services produce technical information such as IP addresses, request times, browser or device details, and error records. Other members may provide messages, connections or reports involving your account.
Why it is used
To provide personalized coaching, save your activity, operate safety and privacy controls, troubleshoot problems, prevent misuse, and improve Northeum.
Sharing and visibility
Health, body, workout, nutrition and photo information is private unless a specific feature clearly asks you to share something. Service providers used to host, secure and operate Northeum may process information on our behalf. We do not sell your personal information. Advertising is not currently enabled. We do not use your health information for advertising.
Personal information and service providers
Account-linked activity, health entries and photographs are personal information, even when they are used only to improve the app. Supabase provides account authentication, databases and file storage; Render hosts our application server; Cloudflare supports delivery and private photo backups; and Resend delivers service emails. These providers process the information needed to perform their services. Email delivery may also pass through our Cloudflare forwarding service to our Proton inbox. Some app scripts are delivered by jsDelivr; loading those resources sends normal connection information, such as your IP address and browser details, to that delivery service.
AI coaching and photo analysis
AI features use OpenAI. Coaching, check-ins, plan generation and meal-photo analysis ask for permission before each request is sent. You can decline and continue using saved plans and other non-AI features. Plan imports and Social submissions have their own processing disclosures. Depending on the feature you choose, requests may include your coach conversation, relevant saved fitness and nutrition context, custom plans, or a meal photo you submit for an estimate. Automated safety screening may also process uploaded photos and Social text. Do not include information you do not want processed for that feature. AI results can be wrong; review plans and photo estimates before relying on or saving them.
OpenAI states that API data is not used to train its models by default. This does not mean zero retention: provider abuse-monitoring records may be retained for up to 30 days, with exceptions for safety or legal requirements. Some features also have temporary processing or caching retention. Northeum's saved conversations and plans are separate from provider retention. See OpenAI's API data controls.
Optional contact matching
If you choose contact matching, you can select specific device contacts or enter an email address or phone number. Their identifiers are hashed on your device and sent to Northeum to look for members who enabled discovery. Hashes are still personal information, not anonymous data. Northeum does not save your uploaded address book; matching uses our server and database. Your saved friend connections and messages remain associated with your account.
Instructional videos and exports
Third-party instructional videos open on the video provider's website when you select their link; Northeum does not automatically load an embedded third-party player. The provider's privacy policy applies there. If you choose to export or share a recap or other content to another app, that service receives the content you choose to share and applies its own policies.
Optional weather and device storage
If you use weather, ZIP-code lookup uses a Northeum-hosted location table on your device; the ZIP you enter is not sent to a separate lookup service. Forecast requests send coordinates rounded to one decimal place (a broad nearby area) to the National Weather Service. Location access requires your device permission; you can enter a ZIP code instead. The selected forecast area is saved on this device until you choose Forget location or clear app/browser data. Weather providers receive network information, such as your IP address, when your device connects. Your browser also stores sign-in state and app preferences needed to operate Northeum.
Optional usage analytics and ratings
If you opt in, we record daily counts of page visits and selected actions, linked to your account, to show aggregate usage to the Northeum administrator. Analytics do not include your messages, photos, health measurements, or precise location. Use Usage privacy settings in the app to decline or turn this off; opting out deletes your usage history. Private beta ratings and optional comments are submitted separately and visible to the administrator, not posted as public app-store reviews.
Coach-guided plan imports
When you confirm the plan-processing disclosure and submit a custom plan, your text or attachment and relevant saved allergies, restrictions, and exercise limitations are sent to OpenAI for your coach to review. Northeum saves the conversation and extracted plan privately so you can continue later. The original attachment is processed in memory and is not kept in Northeum's file storage. Do not upload another person's private information or material you lack permission to share. Plan imports do not activate or replace a plan without your confirmation.
Social photo screening
When you submit Social content after the screening disclosure, photos, captions and comments may be sent to OpenAI for automated safety checks. Flagged or reported content may be reviewed by an authorized Northeum moderator.
Your choices
You control optional photos and community sharing. You may stop using Northeum at any time. You can permanently delete your account and associated data from your own Profile page. If you cannot sign in, use our account deletion instructions. Social media files are removed through background cleanup. After removal, cached photos may remain briefly available while delivery caches update, and browsers may retain previously loaded copies. Deletion cannot erase copies someone already downloaded, saved or shared outside Northeum. Private photo backups are stored with Cloudflare for disaster recovery and are scheduled to expire eight days after each backup is created; removal follows the provider’s cleanup cycle. Deleted photos are excluded from future backups once removed from live storage. Recovery must preserve subsequent account and photo deletions. Other service backups and security records may remain subject to their retention cycles.
How long information is kept
Saved profile, health and fitness entries, plans, conversations and content are kept to provide your account and history until you remove them using available controls or delete your account. Optional usage history is deleted when you turn analytics off. Account deletion does not instantly erase recovery copies, provider logs, support correspondence or copies already shared outside Northeum.
- Database recovery: Supabase's current Pro plan provides a rolling seven-day daily-backup window. Actual removal follows its backup lifecycle. Database backups contain database records, not the photo files themselves.
- Photo recovery: our separate private Cloudflare backups have an eight-day expiration rule. Expiration and physical removal are not simultaneous.
- Application logs: Render's current Hobby workspace makes application logs available for seven days. This is not a guarantee that all provider security or billing records are erased after seven days.
- Service email: Resend publishes 30-day email and log retention for standard plans, plus seven-day backups. Copies delivered to recipients and our support inbox have separate lifetimes.
- AI requests: OpenAI's retention and exceptions are described above; disabling response storage is not zero retention.
- Support and safety records: correspondence, moderation reports, security records and minimal deletion/cleanup records may be retained to resolve requests, investigate abuse, meet legal obligations or prevent deleted data from returning during recovery. These records do not currently have a single automatic deletion deadline. Contact us to request review or deletion where applicable.
- Recovery testing: restricted restored database copies used for recovery verification have a separate lifecycle and are not automatically removed when the original backup expires. Deletion requests must also be accounted for in those copies.
Network providers may retain their own connection and security records. We cannot promise a fixed deletion deadline for National Weather Service or jsDelivr records. See the National Weather Service privacy notice and jsDelivr privacy policy. These services do not receive your saved coaching or health records from the weather or script-loading features.
Access, correction and privacy requests
You can edit available profile fields, choose what to share, decline AI requests, turn off optional analytics, forget your weather location, and manage device permissions. To request a copy of your information, correction of information you cannot edit, deletion, or review of a privacy decision, email admin@getnortheum.com. We may verify account ownership before acting. Depending on your location, you may also have rights to restrict or object to processing, withdraw consent, receive portable data, appeal a decision, or complain to your privacy regulator. Withdrawing consent does not undo earlier processing. We handle requests according to applicable law and explain any lawful limits.
Security and processing locations
We use access controls, protected connections and private storage to limit access to personal information. No service can guarantee absolute security. Northeum is operated from the United States; our providers and their authorized subprocessors may process information in the United States and other countries. Local data-protection rules may differ. Processing is limited to providing requested services, your choices, security and other legally permitted purposes; applicable transfer safeguards and additional disclosures depend on where the service is offered.
Age and availability
The current beta is for invited adults aged 18 or older. Northeum is not directed to children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. The initial public launch is planned for adults in the United States. App-store country restrictions will be configured before release; this notice alone does not restrict website access.
Policy updates
We will update the date on this page when the policy changes and provide notice of material changes through the app or another appropriate channel. We will request additional permission where required before using information for a new purpose.
Safety and contact
Do not enter emergency information. For an account or privacy concern, contact Morris Digital Ventures LLC at admin@getnortheum.com. Do not email passwords, verification codes or health records.