Privacy Policy

Last Updated: September 30th, 2026

There is no account, no email address and no phone number. There is a key you generate on your own device, and a balance attached to its public half. Everything we hold is keyed to that public key, and it is all listed below.

Nymbot is an AI assistant, which means one thing is unavoidably different from a messenger: to answer your question, the service has to read it. We would rather say that plainly than bury it.

What the service processes

When you send a message, it is encrypted on your device and can only be opened by the Nymbot service, which opens it in order to generate a reply. The reply is encrypted back to you the same way. Relays and any network in between carry ciphertext only.

While generating a reply, your message and the recent turns of that conversation are passed to the model that answers it. Where that model is operated by a third party, your message text reaches that provider under their terms. Which model handles a message depends on the tier and the model you have selected — see the models documentation.

We do not use your messages to train models, and we do not sell them.

What we store

• A credit balance, keyed to your public key, and the ledger entries that move it.
• An ordered list of message ids per conversation, so a reply can be given the thread as context. The messages themselves are encrypted.
• Encrypted archived copies of the exchange, readable only by the keys involved.
• Short-lived operational records — rate limits, turn de-duplication keys, invoice claims — which exist to stop double charges and abuse.
• Usage records, for 90 days. For each reply, generation or API request: the time, the kind of task, the model, token counts, the cost, how long it took, which app it came from, whether it used git or web search, and whether it succeeded. Never the prompt or the reply. Rows older than 90 days are deleted.
• Charges you owe, if a request cost more than the balance could cover. They stay on your key until a top-up pays them.
• A push registration, briefly, if you turn on reply notifications: on iOS the device token Apple issued, in the web app the browser's push subscription, together with an opaque chat id made on your device and a generic line such as “Your reply is ready”. It is kept only until that one reply is finished, then deleted after a single notification is sent. On iOS it goes through Apple. In the web app it goes through your browser's push service (on Chrome that is Google's), with the payload encrypted so the push service cannot read it. On Android the app checks for finished work by itself from time to time, which involves no third party and can be a few minutes late; you can instead pick a UnifiedPush distributor such as ntfy for instant notifications, in which case that distributor receives an encrypted notification it cannot read. Anonymous chats never register for push: you are notified about them only while the app is open. See reply notifications.
• Background runs, only if you turn them on: when a long task you asked for carries on while your app is closed, the server keeps the task's saved state and the settings its next step needs, including repository and connector tokens, sealed with a key only the server holds. That copy is deleted when the task ends and always within 6 hours. Each step's reply is published to relays encrypted to you and kept for 24 hours after the task's 6-hour window, so your devices can collect it. A push registration for the one notification about the task is kept, sealed, for the same time. See background runs.
• Scheduled prompts, only for schedules you set to run on the server: the prompt, its title, when it repeats, which chat it answers in, the model, the credit limits you set and a push registration, sealed with a key only the server holds, which reads the prompt when it runs it. It is kept until you delete the schedule, turn the option off, clear your history or wipe the app, and at the latest until its permission ends after 90 days. With “Notify me instead of running” only the due time and the push registration are kept. See scheduled prompts.

We cannot read your conversation titles: those are generated on your device and only ever leave it encrypted to your own key, for your other devices. We do not store your private key, and we cannot recover it. We do not store the access token for a connected git repository; it is held on your device and passed with each request. The one exception is a background run you turned on, which keeps the tokens it needs sealed until it ends, for at most 6 hours.

If you use the API

The developer API keeps a little more, all keyed to your public key. See what the API can see for the detail.

• API keys, as a hash of the key, never the key itself, with the name you gave it, a short hint of its first and last characters, its spending cap, reset period and expiry, and when it was made and last used. Only the newest 50 revoked keys are kept.
• Query history, for 90 days: for each request the time, model, kind, token counts, cost, balance, key and whether it succeeded. Prompts and replies are not stored.
• An automatic top-up wallet, if you connect one: the Nostr Wallet Connect string encrypted at rest, the threshold and amount you set, and the time, amount or error of the last top-up.
• Video jobs, for 24 hours: the model, status, price and a link to the finished video.
• Lightning payment hashes for requests paid per call, for 7 days, and refund tokens, stored only as a hash, for 30 days. Neither is linked to a key.

Deleting your data

Delete account data and wipe device, in Settings under Account, asks the server to delete the sealed copy of your settings, your Nymbot conversation history, the links you shared, your API keys, which stop working at once, your query history, your usage records, your saved wallet connection, your video jobs, your server schedules and any background run still waiting to carry on, your credit balance, any charges you still owe, your purchase, invoice and voucher records, and the shared links you made. For 90 days it keeps a small marker signed by your key (its public key, a time and a signature) so your other devices wipe themselves instead of uploading your data again. Two more things stay because the service cannot work safely without them, and neither names your key: a one-way record of each paid invoice and each spent voucher, so the same payment cannot be credited twice, and a daily counter of free replies per network address.

Chatting without your name on it

Because the balance and the thread are keyed to your public key, the service can tell that a particular key is using it. Anonymous mode exists for people who do not want that: it moves the conversation onto a throwaway key generated on your device, and moves credits across as blind vouchers we sign without being able to see, so our own records cannot link the two.

What that does not hide is set out honestly in the documentation. Most importantly, relays and our infrastructure still see the network connection your device makes. Use Tor or a VPN if your IP address matters to you.

Payments

Credits are bought over the Bitcoin Lightning Network. An invoice carries no identity, and we do not ask for a name, an address or a card. We keep the record needed to credit the payment once and not twice.

App stores

If you use Nymbot on Android or iOS, Google or Apple may record telemetry about the app through their operating systems — when it is opened and closed, how long it is used, crash logs, your device model — and may link that to your Google or Apple account. This is a limitation of mobile operating systems and applies to every app on your device. Read Apple's and Google's own policies if that matters to you, or use the web app instead.

The website

The Nymbot website does not attempt to link your visit to your identity or build a profile of you. We use Cloudflare to serve it, and Cloudflare keeps HTTP request logs for the Nymbot domains for up to 7 days.

Get in touch

If you would like more information, have suggestions about how Nymbot can better protect your privacy, or just want to say hello, please send an email to [email protected].