Privacy policy

This policy covers the nonex website, app and API. nonex ("we" or "us") decides how your data is used and is responsible for it (the "controller").

For anything about your data or this policy, write to support@nonex.ai.

• We collect only what we need to run nonex. An email address is optional, and we never ask for identity documents.
• Your chats are encrypted on our servers with a key for your account, and our admin tools do not show them.
• Your chats go to our own model only, never to another AI company, and are never used to train a model.
• We do not sell your data, show ads or use third-party trackers.
• The servers that run the model are rented, and their operators can technically access them while your session runs.
• You can export or delete your data, or delete your whole account, at any time. Deleted data stays only in encrypted backups, for up to 37 days, and in billing and audit records that keep no email, username or chats.

• Account: your email address, or a username if you sign up without one; your password, stored only as a hash; two-factor settings; your language and other settings, including a session schedule and its time zone if you set one. To create your account, keep it secure and contact you about it.
• Chats: your messages and images, the model's answers and reasoning, chat titles, sources from web search, summaries of long chats, and your custom instructions and response style. To provide the chat and keep your history.
• Balance and payments: your hours, plan, balance history, top-up reference, and records of payments and credits, such as amounts, coins and transaction IDs. To sell and account for hours and to meet accounting duties.
• Sessions and usage: when sessions start and end, the minutes billed, and technical data about requests without their content, such as timing, token counts and errors. To run and bill sessions, keep nonex fast and fair, and fix problems.
• Sign-ins and security: the IP address and browser of each sign-in, a random device ID, and counts of sign-ups per network. To keep accounts secure, show your signed-in devices, and stop bots, fraud and abuse of invite rewards.
• API keys: a hash of each key, its name, scopes and last use, and daily request counts. Never the content of requests.
• Notifications: your notification settings, a log of which notices went out, and, if you turn push on, that browser's push address. To send the notices you chose.
• Invites and partners: who invited whom, rewards and, for partners, the payout address you give us. To run the invite and partner programs.
• Support: what you send us by email or on Telegram. To answer you.

You need an account to use the app; without it we cannot provide nonex. What you put in your chats is up to you. If it includes sensitive information, for example about health or other people, we process it only to give you the answers you ask for.

Where a law such as the EU or UK GDPR or Brazil's LGPD asks for a legal basis, we rely on:

• Our contract with you: your account, chats, sessions, payments and support.
• Our legitimate interests in keeping nonex secure, in stopping fraud and abuse, and in counting site visits without identifying anyone: sign-in records, the device ID, abuse counters and site statistics. You can object to these.
• Legal obligations: accounting records, and requests from authorities that the law requires us to answer.
• Your consent: push notifications, which you can turn off at any time.

We make no decisions about you based only on automated processing that have legal or similarly significant effects. Automated checks can hold a payment or flag an invite for a person to review.

Chats, chat titles, images, sources, chat summaries and custom instructions are encrypted at rest with AES-256-GCM, with a separate key for each account. This protects stored copies, such as our database and its backups. The keys are kept on our servers, which decrypt your content to show it to you and to run the model.

Our admin tools show accounts and billing, never chat content, and every admin action is recorded. We do not read your chats unless you send them to us yourself or the law requires us to.

Our logs record IDs, states and numbers, never what you write. API requests and answers pass through without being stored. A chat answer that is still being written is also held in memory for up to 2 hours, then only in your encrypted chat.

Traffic between you and us, and between our servers and the servers that run the model, is encrypted in transit, and we check each of those servers by its own certificate before it receives anything.

The model runs on servers we rent by the hour from independent providers, in different countries. While your session runs, your messages, images and custom instructions, and the model's answers, are processed in the memory of one of these servers. A server can serve several customers' sessions at once; our software keeps them apart.

The operators of these servers control the hardware and can technically access its memory and disk while it runs. We give them no account details, the servers keep no chat history or request logs, and we shut them down when they are not needed. We cannot control what an operator does with hardware it controls, so we do not promise that no one outside nonex can ever see your content.

The model can search the web on its own when an answer needs current information or a page you linked, or when you ask it to. Its search terms go from our own search service to public search engines, without your account, email or IP address. Pages it opens are fetched by our servers, so websites see our servers, not you.

The model is told to keep your personal details and text you pasted out of search terms unless you ask it to search for them, but nothing checks a search term before it is sent, so it can contain words from your chat. Search engines and websites handle what they receive under their own policies. Sources the model used are saved with the chat, encrypted.

If you pay by arrangement with us, we see what you send us to arrange it, such as your Telegram account, and the payment itself. We keep the payer only in coded form, to stop invite rewards from being claimed twice.

We keep the records of every payment with your balance history.

We share data only with these kinds of recipients, and only what each one needs:

• Hosting providers that run our servers, database, file storage and backups. Our database runs in the European Union, and we encrypt images before they are stored.
• Providers of the rented servers that run the model, as described above.
• An email delivery service, for the emails we send to accounts that have an email address.
• The push services of browser makers (Apple, Google, Mozilla and Microsoft), which deliver notifications in encrypted form if you turn push on. Notifications never contain chat content.
• Public search engines and websites, which receive the model's search terms and page requests from our servers.
• Have I Been Pwned, which we ask whether a new password appears in known data leaks by sending only the first 5 characters of its hash. Your password itself never leaves our servers.
• Telegram, if you contact us there, under its own privacy policy.
• Courts, police and other authorities, when the law requires us to and after we check that the request is lawful.
• Whoever takes over nonex, who must keep to this policy.

We never sell personal data, share it for advertising, or send your chats to another AI company. You can ask us for the names of the providers we use.

Our database runs in the European Union, but some of our providers are based in other countries, including the United States, and the servers that run the model can be in any country, including ones whose laws protect data less than yours. Sending your messages to them is needed to give you the service you ask for. Where the law asks for a basis or safeguards for such a transfer, we rely on what it allows, such as the transfer being necessary for our contract with you, or contractual safeguards with the provider.

What you store with us, such as your account details, settings, chats, images and custom instructions, stays until you delete it or your account.

When you delete it, it is gone from our systems, except in two places:

• Encrypted backups, which keep deleted data for up to 37 days. Then it is gone from them too.
• Billing and audit records, which our accounting ledger cannot delete. They stay after you delete your account, with amounts, times and IDs only, never your email, username or chats.

Some data is deleted sooner:

• Images you attach but never send: after 24 hours.
• Sign-in records (IP address and browser): when that device is signed out.
• Usage metrics without content, kept under a code instead of your account: after 90 days.
• Notification log: after 30 days.
• Emails waiting to be sent: once sent, or after 2 days if they cannot be.
• Support messages: once we no longer need them to answer you.

Laws such as the GDPR and the LGPD give you these rights, and we honor them for every user where we can:

• See and get a copy of your data. Export in Settings downloads your account, chats, settings, balance history, sessions and API key details as a file; for anything else, write to us.
• Have wrong data corrected.
• Delete a chat at any time, or your whole account in Settings. Deleting the account ends any session, deletes your chats, images, sign-ins and API keys, destroys your account's encryption key and removes your email or username. After that, your data remains only in encrypted backups, for up to 37 days, and in the billing and audit records our accounting ledger cannot delete, which keep no email, username or chats. Hours left in the account are lost.
• Object to processing based on our legitimate interests, ask us to restrict processing, or take your data to another service.
• Withdraw consent at any time, for example by turning push notifications off.
• Complain to a data protection authority, such as the one where you live or work: in the European Union your national authority, in the United Kingdom the ICO, in Brazil the ANPD, in Ukraine the Parliament Commissioner for Human Rights. You can also come to us first.

To use a right, write to support@nonex.ai. We answer within one month, or sooner where your law requires. We may need to confirm that a request comes from the account holder; for an account without an email, that is only possible in the app, so use Settings there.

The app uses only the cookies it needs: to keep you signed in and secure; to remember your language, theme and time zone; a random device ID, used only to spot abuse of invite rewards; and, if you open an invite link, one that remembers the invite for 60 days. It uses no advertising or analytics cookies.

This website sets no cookies and does not count visits.

We protect data with encryption at rest and in transit, a separate key for each account, two-factor sign-in for our admins, the least access each part of nonex needs, and a record of every admin action. No system is perfectly secure.

If a security incident puts personal data at risk, we act to contain it, notify the data protection authorities where the law requires, and tell the people affected without undue delay when it is likely to put their rights at high risk, in the app or by email if the account has one.

To report a vulnerability or a suspected incident, write to support@nonex.ai.

nonex is only for people aged 18 or over. We do not knowingly collect data about anyone younger. If you believe a minor has an account, tell us and we will close it and delete its data as this policy describes.

We update this policy when what we collect or how we use it changes, and show the date of the last change at the top. If a change is significant, we tell you in the app, or by email if your account has one, before it takes effect.