NerveWindow — Privacy Policy

Effective Date: 2026-04-19 · Last Updated: 2026-05-22

1. Overview

This Privacy Policy describes how CWDS OÜ (“NerveWindow,” “we,” “us,” or “our”) handles personal data in connection with:

• the NerveWindow mobile application and NerveWindow Pro features (the “Application” or “App”);
• the NerveWindow and related websites, including alexzah.com and any subdomain or product page (the “Websites”);
• purchases, emails, support requests, and other interactions connected to the above (together, the “Service”).

We are the data controller for the personal data we handle in connection with the Service. You can contact us at the address in Section 16.

2. Information We Process

We process different categories of data in different contexts. This Section separates them by surface (App vs. Websites).

2.1 Inside the Application (on-device, minimal)

The Application is designed to operate without sending your in-app content to us. We receive the following limited categories of data from, or on behalf of, App users:

• Purchase and license data: order reference, product purchased, price paid, purchase date, platform store identifier (where the purchase was made via a platform store), and a device-generated identifier used for license activation and restore. If the purchase was made through one of our Websites, this also includes your email address.
• Support and bug-report data (only if you choose to send it): your name (optional), your email address, the contents of your message, the Application version, the operating-system version, and any information you voluntarily include.
• Operational network requests (see Section 7): license activation/restore calls, optional updates you initiate, and webpage fetches from URLs you intentionally open from within the Application.

2.2 On the Websites, Account Flow, and Current V2/Account App Pages

When you visit a Website, read a sales page, open a marketing email, begin a checkout or account-flow page, or use a current V2/account app page, we and our processors may receive:

• Device and usage data: IP address, browser type, operating system, referring URL, pages visited, time on page, scroll depth, clicks, and similar analytics signals.
• Cookies and similar technologies set by us and by third-party analytics and advertising providers. See Section 6.
• Session recordings and heatmaps (via Microsoft Clarity) that record page interactions such as clicks, taps, scrolls, and page layout. Where input fields exist on current account app pages, they are masked from Clarity recordings.
• Advertising attribution signals (via Meta Pixel, Google Tag Manager, and Google Analytics 4) that allow us to measure page views, button clicks, checkout events, and which ad or link led to a visit.
• Email activity (via our email marketing provider) — open, click, and delivery signals for emails we send you.
• Checkout and payment data collected by our payment processor, Stripe, Inc., when you purchase. We receive the transaction outcome and an associated buyer email, but we do not store your full payment-card details.

2.3 Communications You Send Us

If you contact us by email, via a support form, or by replying to a marketing email, we receive the contents of that communication and your email address. We use this to respond and keep a record of the conversation.

3. Information We Do Not Process

We want to be explicit about what we do not collect, because the brand promise of the Application depends on it.

We do not collect, store on our servers, or transmit to any third party:

• your state check-in answers or scores;
• your session history or the routines you chose;
• any notes you enter in the Application;
• any continuous biometric, audio, video, or location signal from your device;
• any microphone, contact, or location data — the Application does not request these permissions;
• device advertising identifiers (IDFA on iOS, AAID on Android) for advertising or cross-app tracking.

We do not:

• sell your personal data to any third party;
• train any machine-learning model on your in-app content — there is no machine-learning model in the Application that would need to be trained.

For currently live sales pages, account-flow pages, and current V2/account app pages, third-party browser tools can still record page views, button clicks, and, for Clarity, masked session recordings as described in Section 6. Those tools are separate from our server-side storage of your personal app content.

6. Third-Party Tracking and Analytics

Currently live sales pages, checkout and account-flow pages, and current V2/account app pages use the third-party browser tools listed below. This tracking applies to the new account-flow customer journey starting 2026-05-22. Legacy buyers’ original direct-app experience is unchanged; the frozen legacy app pages are not retroactively changed by this disclosure.

These tools may collect page views, button clicks, checkout or conversion events, referring URL, UTM/campaign parameters, browser and device data, approximate location derived from IP address, cookie identifiers, and, for Microsoft Clarity, session recordings and heatmaps. Free-text fields on current account app pages are masked where they exist.

6.1 Tools Currently in Use

6.1.1 Server-Side Conversion Measurement (Meta Conversions API)

In addition to the browser-based Meta Pixel, after a successful purchase we send a small server-to-server message to Meta’s Conversions API (CAPI) so that Meta can measure ad effectiveness even when browsers block tracking pixels.

This server message contains: the event type, order amount, currency, and product identifiers; SHA-256-hashed versions of your email address, first and last name, city, region, postal code, and country, plus an internal customer reference — sent on the basis of our legitimate interest in measuring our own advertising (hashing means Meta receives a scrambled fingerprint it can only match against data it already holds; we never send these details in plain text). Only if you accepted marketing cookies, the message additionally includes your IP address, your browser user-agent, and the _fbp/_fbc cookie values Meta set in your browser.

The banner is shown to visitors from the EU/EEA, the United Kingdom, Switzerland, and California; elsewhere, these tools may run by default where local law permits, and you can still limit them through your browser or platform settings.

You can object at any time to our processing based on legitimate interest — see Section 11 for your rights, including the right to object.

The same event_id is attached to both the browser pixel event and the server-side event so that Meta deduplicates them and counts the purchase only once.

Before purchase, if you have accepted marketing cookies, we also send server-side copies of key funnel events (page view, add-to-cart, checkout started) to Meta and TikTok so measurement keeps working when browsers block pixels. These events carry an anonymous first-party visitor ID (stored on your device as nw_ext_id for up to 1 year), your IP address, and your browser user-agent — but not your name or email. If you decline marketing cookies, these events are not sent and the ID is not used.

6.1.2 TikTok Pixel + Events API

We use TikTok advertising tools to measure which TikTok ads lead to visits and purchases. With your marketing consent, the TikTok pixel records page views and purchase-funnel events in your browser. After a purchase, we also send a server-to-server event to TikTok containing the order details, a SHA-256-hashed version of your email address, and an internal visitor reference — sent on the basis of our legitimate interest in measuring our own advertising; we never send your email in plain text. Only if you accepted marketing cookies, this server event additionally includes your IP address, your browser user-agent, and — where present — the TikTok click ID (ttclid) and _ttp cookie value from the ad you clicked. Provider: TikTok Technology Limited (Ireland) / TikTok Inc. (US); transfers are covered by Standard Contractual Clauses.

6.1.3 X (Twitter) Ads Pixel

We use X advertising tools to measure which X (Twitter) ads lead to visits and purchases. With your marketing consent, the X pixel records page views and purchase-funnel events in your browser; if you decline marketing cookies, the pixel does not run. We may also send server-side conversion events to X containing order details, a SHA-256-hashed version of your email address, and — where present — the X click ID (twclid) from the ad you clicked; we never send your email in plain text. Provider: X Corp. (United States); transfers are covered by Standard Contractual Clauses.

6.1.4 Google Ads

We use Google Ads conversion measurement to know which Google ad led to a purchase. When you arrive from a Google ad, the click ID (gclid/gbraid/wbraid) is stored in your browser for up to 90 days. On purchase, we report the order value (and any later refund adjustments) to Google, and — only with your marketing consent — a SHA-256-hashed version of your email address (“Enhanced Conversions”) so Google can attribute the sale to the ad more accurately. We also send Google Consent Mode signals reflecting your banner choices, so Google’s tags behave according to your consent.

6.2 Cookies

The Websites use:

• Strictly necessary cookies for checkout, session, and security — these do not require consent;
• Analytics and advertising cookies for the tools listed above — these are set only after you give consent via the consent banner, where consent is required by applicable law;
• Preference cookies to remember your choices.

You can clear cookies at any time through your browser settings, and you can change your consent choices at any time through the consent banner or the Cookie settings link on the Websites.

6.2.1 Key Cookies and Stored Identifiers

Key cookies and stored identifiers: nervewindow_cookie_consent_v1 — your consent choices, stored in your browser’s local storage (12 months); _fbp, _fbc — Meta attribution (3 months); _ttp / ttclid — TikTok attribution (13 months); _ga, _ga_* — Google Analytics (up to 24 months); gclid/gbraid/wbraid — Google click IDs in localStorage (90 days); twclid — X (Twitter) click ID captured with our first-party attribution records; nw_ext_id — anonymous visitor ID for server-side measurement (12 months); Clarity cookies (_clck, _clsk) — session analytics (up to 12 months); Stripe cookies (__stripe_mid, __stripe_sid) — fraud prevention during checkout (strictly necessary). Exact names and durations may vary slightly by tool version.

6.3 Do Not Track

We currently do not respond to “Do Not Track” browser signals because there is no consensus on how to interpret them. We do honour the Global Privacy Control (GPC) signal where applicable law requires it.

Our own attribution records. When you land on our pages from an ad, we record the ad-click reference from the URL (such as fbclid, gclid, ttclid, or twclid) and campaign tags together with your order in our own systems (including Stripe order metadata). We do this on the basis of our legitimate interest in knowing which advertising pays for itself. Before you give marketing consent, this information stays in our systems only — it is not sent to any advertising platform. We also keep a record of pages visited on our own sites, linked to a random identifier (not your name or email), for up to 180 days, so we can understand which ads and pages lead to purchases.

7. Network Access and When Data Leaves Your Device

Separate from core on-device operation, the Application may make limited network requests when one of the following happens:

• you make a purchase, restore a purchase, or verify a license;
• you initiate or accept an Application update or content update through the platform store;
• you choose to send us a support or bug-report message;
• you tap a link inside the Application that opens a page on the Websites or on a third-party site;
• you take any action that obviously requires a network call (for example, purchase restoration).

Information that you intentionally submit through these flows, and the minimum metadata required to complete them, may be transmitted for that specific purpose. These operational requests do not convert the Application into a cloud service and do not transmit your state check-ins, session history, or notes for any analytic purpose.

8. Third-Party Service Providers

We use a small set of named third parties to run the Service. Each of them has its own privacy policy, and each processes personal data only on our instructions, under a data-processing agreement or a Controller-to-Controller arrangement as appropriate.

We do not share personal data with third parties for any purpose other than those described in this Policy, or as required by law.

9. International Data Transfers

Several of the providers above are located in the United States or operate globally. When we transfer personal data of EU/EEA, UK, or Swiss residents outside those regions, we rely on the following safeguards, as appropriate:

• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where appropriate by additional technical and organisational measures;
• the EU-US Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified;
• Article 49 derogations where applicable, for specific operations (such as processing necessary for the performance of a contract you request).

You may request a copy of the safeguards in place for a specific provider by contacting us at the address in Section 16.

10. Legal Basis for Processing (EU/EEA/UK)

When the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following lawful bases:

• Performance of a contract — to process your purchase, deliver the Service, operate license activation and restore, respond to support requests you initiate, and handle refunds under the 30-day guarantee described in our Terms.
• Legitimate interests — to secure the Service, prevent abuse and fraud, investigate and resolve bugs, measure the aggregate performance of our Websites and marketing, and improve the product. Where we rely on this basis we balance our interests against your rights, and you may object at any time.
• Consent — for non-essential cookies, session recordings, advertising tags, and any optional marketing emails beyond what is necessary to deliver a purchase. You can withdraw consent at any time through the consent banner, your browser, or the unsubscribe link.
• Compliance with legal obligations — for tax, accounting, consumer-protection, and regulatory record-keeping.

11. Your Rights

11.1 Rights Under GDPR / UK GDPR

If you are in the EU, EEA, UK, or Switzerland, you have the right, subject to the conditions and limits in the applicable law, to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data (“right to be forgotten”), where one of the grounds in Article 17 GDPR applies;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• request data portability in a structured, commonly used, machine-readable format, where the processing is based on consent or contract;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority. If you are in Estonia, that authority is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) — aki.ee. You can also contact the authority in the EU member state where you live or work.

To exercise any of these rights, contact us at the address in Section 16. We will respond within one month, or within two months for complex or numerous requests, as permitted by law.

11.2 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the right to:

• know what personal information we collect and how it is used and shared;
• request deletion of personal information we have collected;
• correct inaccurate personal information;
• opt out of sale or sharing — We do not sell your personal information for money. We do use advertising cookies and pixels (Meta, TikTok, X, Google) that California law may treat as “sharing” personal information for cross-context behavioural advertising. If you are in California, we show you a consent banner before any of these tools run — declining (or never accepting) is your opt-out. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out. You will not be discriminated against for opting out;
• be free from discrimination for exercising your privacy rights.

11.3 Rights in Other Jurisdictions

Residents of other regions may have additional rights under applicable local law. We honour any non-waivable statutory right you have where you live.

12. Data Retention

We retain personal data only for as long as we need it for the purpose for which it was collected, and for periods required by applicable law. Indicative retention windows:

When retention periods expire, we delete or anonymise the data.

13. Security

We apply technical and organisational measures appropriate to the sensitivity of the data we handle, including:

• transport encryption (HTTPS) on the Websites and for all server-to-server calls;
• sandboxed on-device storage for Application content, protected by the operating system;
• access controls on administrative systems;
• least-privilege access to third-party processors;
• prompt review of security advisories affecting our stack.

No security measure is perfect. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority as required by law, and we will notify affected users where applicable law so requires.

14. Children’s Privacy

The Service is intended for adults. As stated in our Terms of Use, you must be at least 18 years old to use the Service. We do not knowingly collect personal data from anyone under 18. If we learn that we have received personal data of a minor, we will delete it promptly.

If you believe a minor has submitted personal data to us, please contact us at the address in Section 16 so that we can take appropriate action.

15. Changes to This Privacy Policy

We may update this Policy to reflect changes in the Service, applicable law, or our practices. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, give additional notice inside the Application, on our Websites, or by email.

If we materially expand collection beyond the page-level, click, conversion, and masked session analytics described in Section 6, we will update this Policy, update the relevant in-app or website disclosures, and where required by applicable law, obtain your consent before the change takes effect for you.

16. Contact

For privacy questions, data-subject requests, or complaints:

CWDS OÜ
Attention: Privacy
Kotkapoja tn 2a-10, Kristiine, 10615 Tallinn, Harju maakond, Estonia
Email: alex@alexzah.com
Support: alex@alexzah.com

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your local data-protection supervisory authority. If you are in Estonia, that is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) — aki.ee.

© 2026 CWDS OÜ. All rights reserved.