Legal

Privacy Policy.

Last updated: 16 May 2026

This Privacy Policy explains how Onarvo Ltd ("we", "us", "our"), a company registered in England and Wales, handles information when you use Novenabeat (the "Service") at novenabeat.com.

In short: Novenabeat is a static, client-side web app. We don't ask you to sign up, log in, or provide any personal data to use it. The only data processing involved is anonymous, aggregated analytics and standard server logs.

1. What we collect

Anonymous usage analytics (consent-based). If you click "Allow analytics" on the cookie banner, we load Vercel Web Analytics and Vercel Speed Insights. These are cookieless and do not track individuals across sessions. They collect aggregated, anonymised data: page views, referrers, country (derived from IP), browser, device type, and Core Web Vitals performance metrics. Vercel computes a daily-rotating, in-memory hash from your IP address and user-agent string to deduplicate pageviews; raw IP addresses are not stored alongside the analytics records. If you click "Decline", these scripts are not loaded and no analytics data is sent. We store your choice locally in your browser (under the key nb-consent-v1) so we do not ask again on future visits; you can change this at any time via the "Cookie preferences" link in the footer.

Server logs. Like any web server, our hosting provider (Vercel) logs technical request data — IP address, timestamp, requested path, response status code, and user-agent — for security, fraud prevention, and debugging. These logs are retained in accordance with Vercel's standard policies.

Voluntary correspondence. If you email support@onarvo.com, we will receive and retain your email address and the contents of your message in order to respond.

Account data. If you create an account, we (via our authentication provider Clerk) collect and store your email address and, if you sign in with Google or Apple, a stable account identifier from that provider. We use this solely to authenticate you and provide the features you have signed up for.

Launch-list sign-ups. If you enter your email into the "Notify me when accounts launch" form, we store your email address together with limited technical context (timestamp, IP address, user-agent, and the page you came from) in our database. This is held solely so we can send you a single message when account features go live, and so we can recognise and rate-limit abusive sign-up attempts. Your email is never sold, never shared with third parties, and never used for marketing or newsletters. You can ask to be removed at any time by emailing support@onarvo.com.

2. What we do not collect

We do not collect, sell, or share with advertising networks: your name, account credentials, payment information, identifiers that fingerprint you across other websites, microphone or camera input, precise location (anything more specific than country), or the audio your browser produces.

3. Cookies and local storage

Novenabeat does not set any cookies on your browser. The third-party services we use (Vercel Web Analytics and Vercel Speed Insights) are cookieless by design. We use two items of browser localStorage, both of which stay on your device and are never transmitted to us:

nb-consent-v1 — remembers your analytics preference (treated as strictly necessary for the operation of the consent mechanism itself).
nb-sessions-v1 — stores any meditation sessions you save in the session builder (names, frequency queues, durations, mode). This data is held locally on your device only and we have no access to it.

You can clear either at any time by clearing your browser's site data for novenabeat.com, or by using the Cookie preferences link in the footer (for analytics consent) or the "×" delete control on each saved session.

4. Third-party services

Vercel — hosting, web analytics, speed insights, and serverless functions. Vercel acts as our data processor. See Vercel's Privacy Policy.
Upstash — Vercel Marketplace database used to store launch-list sign-ups. Upstash acts as our sub-processor. See Upstash's Privacy Policy.
Clerk — authentication and account management. When you create an account, Clerk processes your email address and, if you sign in with Google or Apple, the identifiers those providers share with us. Clerk acts as our data processor. See Clerk's Privacy Policy.
Google Fonts — typography is loaded from fonts.googleapis.com and fonts.gstatic.com. When your browser fetches the fonts, Google receives your IP address and standard HTTP request data. See Google's Privacy Policy.

5. Legal basis (UK GDPR / EU GDPR)

Consent (Article 6(1)(a)) — for loading Vercel Web Analytics and Vercel Speed Insights (captured via the cookie banner), and for adding you to the launch list (captured when you submit the "Notify me" form). You may withdraw consent at any time by clicking "Cookie preferences" in the footer (analytics) or by emailing support@onarvo.com (launch list).
Legitimate interest (Article 6(1)(f)) — server logs, operational security, and rate-limiting/abuse prevention on the launch-list endpoint, where our interest in running a reliable, secure Service does not override your rights and freedoms.
Contract (Article 6(1)(b)) — when you create an account, we process your email address and account identifiers to provide the service you have signed up for. This is the basis for any data we hold that is necessary to operate your account.

6. International transfers

Vercel and Google operate globally. Where personal data is transferred outside the United Kingdom or the European Economic Area, transfers are protected by appropriate safeguards, including the UK International Data Transfer Agreement and EU Standard Contractual Clauses, or by transfers to jurisdictions that benefit from an adequacy decision.

7. Retention

Anonymous analytics are retained for the period set by Vercel (typically up to 12 months). Server logs and any voluntary correspondence are retained for as long as is reasonably necessary for the purposes set out above, after which they are deleted or anonymised. Launch-list sign-ups are retained until you ask us to remove you, or until 30 days after we have sent the launch notification — whichever comes first — after which the record is deleted.

8. Your rights

If applicable data protection law (such as the UK GDPR or EU GDPR) gives you rights in relation to your personal data, those rights may include:

Access — request a copy of personal data we hold about you;
Rectification — request correction of inaccurate personal data;
Erasure — request deletion of personal data;
Restriction — request restriction of processing in certain circumstances;
Objection — object to processing carried out on the basis of legitimate interest;
Portability — request a portable copy of personal data;
Complaint — lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

In practice, because we do not collect personal data through the Service itself, these requests will usually apply only to email correspondence you have sent to support@onarvo.com.

9. Children

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can investigate and, where appropriate, delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above will reflect the most recent revision. Material changes will be highlighted on the Service where reasonably practicable.

11. Contact

Onarvo Ltd
Unit 30, The Mansley Centre, Timothys Bridge Road, Stratford-Upon-Avon, CV37 9NQ, United Kingdom
Email: support@onarvo.com

Onarvo Ltd · Registered in England and Wales · Company number 17040899 · Registered office: Unit 30, The Mansley Centre, Timothys Bridge Road, Stratford-Upon-Avon, CV37 9NQ, United Kingdom