Knowledge base / Privacy

Identity and login

There is no account, no email and no password. There is a key, and everything else follows from how well you look after it.

Keys, not accounts

Your identity is a Nostr keypair. The public half (an npub) is what the service knows you by; the private half (an nsec) stays on your device and signs on your behalf.

Your nym — the display name you picked — is decoration. The four characters after it are derived from your public key, and they are the part that actually distinguishes one alice from another.

Ways to sign in

• Generate one. The default on a fresh install.
• Paste an nsec. Brings an existing identity — from Nymchat or any other Nostr app — with its credits and its Nymbot history.
• A browser extension (NIP-07). The key stays in the extension and never reaches the page; the app asks it to sign.
• A remote signer (NIP-46), if you keep your key on another device.

Signing in with the same key on a second device gives you the same account. Nothing has to be migrated, because nothing lives anywhere but the key.

Remote signer

If your key lives in a signer app, choose I already have one, then Use a remote signer. Paste the bunker:// link your signer shows, or tap Show a code instead and scan the code (or paste its link) in the signer. The code uses wss://relay.primal.net unless you change the relay first, and Nymbot waits up to five minutes for the signer, with a Cancel button.

The key never reaches Nymbot. Each time Nymbot signs or decrypts, it asks the signer, and Waiting for your signer… appears when an answer takes more than a second. A signer can ask you to approve the request on its own web page; Nymbot shows a button for it and opens it only when you tap it, and only if it is an https page. Nymbot accepts answers only from the signer you paired with, checks every signature it returns, and does not trust a code scan that does not echo the connection secret back.

Identity then shows Signed in with: Remote signer. There is no nsec to back up here, so keep your key backed up in the signer. Your post-quantum recovery code still lives on the device, and you should save it as usual. Disconnect signer… signs this device out and wipes it, but it does not delete your synced copy, which comes back when you sign in again with the same signer. Anonymous mode still uses its own throwaway key, never the signer.

Identity encryption

Optional, and off until you turn it on from the Identity sheet. With it on, the secrets Nymbot keeps on the device are encrypted, so they cannot be read out of the device's storage without unlocking:

• your private key, or your remote signer connection, and its post-quantum root,
• the Anonymous Mode throwaway key and its vouchers,
• your repository and connector tokens,
• the keys to chats you shared by link,
• and, in the Android and iOS app, the keys used to upload pictures.

Nymbot then opens on an unlock screen, and nothing loads, syncs or sends until you unlock it. A wrong passphrase changes nothing.

What it protects is the copy on the device, against someone who gets hold of the device or its storage. It does not change what is sent or what the server sees, and it is not a backup.

Passphrase, passkey or biometrics

You choose how it unlocks, separately on each device:

• A passphrase of at least four characters. Offered everywhere.
• A passkey, in the web app. It can live on the device, in a password manager or on a security key, but it has to support the WebAuthn PRF extension, which is what lets a passkey produce an encryption key. One that does not is refused with nothing changed, and you can use a passphrase instead.
• Biometrics: a fingerprint, your face, or Windows Hello. In the web app this uses the device's own authenticator, and it is not offered on Apple devices, where a passkey already is Face ID or Touch ID. In the Android and iOS app it is offered when the device has a fingerprint or face set up.

The web app offers only a passphrase in a browser without passkey support. The Android and iOS app offers a passphrase or biometrics.

The same sheet changes the passphrase, switches to another method or turns encryption off, each after confirming the current method. Whatever unlocks it stays on the device: no passphrase, passkey or salt is synced, so each device is set up on its own.

What syncs between your devices

Your settings travel between the devices you sign in on inside a record that is end-to-end encrypted with your own key, so the server stores a sealed copy it cannot read. That includes your workspaces, bots, memory, saved prompts, schedules and folders, and your repository and connector tokens, so a chat that uses them works on a new device without setting them up again.

When a token was changed on two devices, the newer change wins, so disconnecting a repository on one device clears its token on the others. Removing a connector removes it everywhere.

What stays on each device is how you unlock identity encryption, and anything in a ghost chat.

Deleting your account

Delete account data and wipe device, in Settings under Account and in Identity, asks once and then deletes your account. Before the key is gone it asks the server, signed with that key, to delete what it keeps for this account: the sealed copy of your chats and settings that sync keeps, your Nymbot conversation history, background tasks, schedules and pull request watches, the links you shared, your credit balance with its ledger, purchase, invoice and voucher records, and everything the API holds for it: every API key, which stops working at once, the query history, usage records, a saved auto top-up wallet, video jobs and any charges still owed. Then it destroys everything the app keeps on this device: your key, every conversation, your repository and connector tokens, stored documents and cached files. It shows Account data deleted when it is done, and the app starts again from the beginning.

Before the server data is deleted, the app stores a small marker signed by your key: its public key, a time, an event id and the signature, nothing else, kept for 90 days. Every other device signed in to the same key checks for it when it opens, comes back to the foreground, before it syncs, and every few minutes, and wipes itself instead of uploading your data again.

It cannot delete anything already on public Nostr relays, or key backups you saved to iCloud or Google Drive. Your remaining Nymbot credits are deleted with the account and cannot be restored; use Move my whole balance first to keep them.

It is not a logout and it cannot be undone. If you have backed up your nsec you can come back to the same key later, starting with no chats; if you have not, that identity is gone.