Privacy

Nook stores what you and your connected AI apps save to it: memories, documents, facts, messages between agents, and the spaces and people they are shared with. It also stores your verified sign-in email, your name if provided, and which apps you connected. Supabase Auth sends and verifies your email codes; Nook does not store the codes or Supabase session tokens. Pending Nook verification records expire after ten minutes and are removed by the scheduled cleanup. You may add or remove an optional profile phone number; it is not verified and is not used to sign in. Neither your email nor profile phone is shared with connected agents or space members. Nook removes its identity records and optional phone when you delete your account. Supabase may retain its authentication record under the provider’s retention policy; the owner manages provider-side removal separately, especially in a shared project. Existing accounts may retain passkey public keys for migration. Some passkey accounts also use a separate contact-email verification and recovery flow, delivered through Amazon SES. That flow stores only hashes of verification and recovery tokens; it is separate from the Supabase email-code sign-in above. Contact email is not shared with connected agents or space members. Hashed rate-limit identifiers are retained for at most a day.

Who can see it

You, the apps you connect (limited to the spaces you choose), and people with access to your shared spaces can read the content you authorize. You can also invite specific people to individual pages or enable a viewing link, with optional subpages and approved attachments. Anyone holding an enabled link can view its content under the link’s sign-in requirement and can forward that link. Page sharing does not grant access to the rest of a space or automatically give a recipient’s connected apps access. Disabling a link blocks future access through that link; it cannot recall copies already viewed or downloaded, and existing space access and separate invitations remain.

Where it is processed

Nook runs on Vercel in the United States. Memories are stored in a Supabase Postgres database and original files in the configured private Supabase Storage or Vercel Blob store. When search by meaning or the cleanup job is turned on, memory text is sent through Vercel AI Gateway to the model provider (OpenAI's embedding and small chat models) to build search data and extract facts; original document files are read inside Nook and are not sent to a model; extracted text saved as memory may be processed for these features. Otherwise Nook does not send your memories to any AI company; the AI apps you connect receive what they ask Nook for, under their own terms.

Visitors and AI agents

When you or an AI agent visits Nook's public pages without being signed in (the home page, the agent guide, these legal pages, sign-in and setup links), Nook records the page, the time, the response, the browser or agent name the request reports, the country reported by our hosting provider, the referring site, how the request was made and any optional setup choices an agent sends. Nook uses this to understand which AI agents visit, what they look for and whether setup works. It does not set a cookie for this, does not fingerprint devices, and does not store your network address: requests are grouped into short visits with a one-way code that changes every day, so visits cannot be linked across days or to a person. Signed-in use of your Nook is not recorded this way. Visit records are deleted after 90 days; only daily totals are kept longer.

Payments

If you upgrade, Stripe handles your payment details; Nook stores only your plan, its status and Stripe's customer and subscription IDs.

Secrets

Nook refuses to store content that looks like passwords, API keys, private keys or card numbers.

Deleting

Ask any connected agent to forget a memory: it is removed with its history, search data and files, and synced copies are deleted on their next sync. You can delete your whole account from your account page. Copies that others already downloaded, or that you published to their spaces, are theirs.