back to home

privacy at nuuko

what is stored, where, and who can read it. in plain words.

last updated: 21 october 2026

the short version

your pages live on your device. the people you write about are never real names unless you type one, and nothing here reads your contacts. you can export everything, delete anyone, or delete everything, at any time, for free.

without an account

every page, every person and every setting is stored in your browser (IndexedDB and localStorage) on this device only. if you clear your browser data, or lose the device, the pages are gone, so export now and then. the export is a plain file you own.

the optional PIN lock in settings encrypts what is on this device with a key made from your PIN. nuuko never sees the PIN.

with an account, and sync on

your pages are still kept on your device first. when sync is on, the text of each page is encrypted in your browser with AES-256-GCM before they are sent, and stored encrypted.

what the server holds about a page, unencrypted: when it was written, its mood word, which of your people it was filed under (as a random id, never the name you gave them), and a word count. these are what sorting and the shelf need.

what the server holds about your account: your email address, your name, and the link to your google profile picture. each time your sign in is refreshed, it also keeps the IP address that asked, next to a hashed copy of the sign in token, which works for 7 days. once a token has run out, it and its IP address are deleted within a day. deleting your account removes all of this with your pages.

what the server never receives: the name or handle you gave a person, the opening sentence, or anything typed into a page.

the honest part about the key. if you sign in with google, the key that encrypts your pages is created for you and kept on our server, so that you never have to remember a passphrase. that means your pages are encrypted at rest, and it also means we hold a key that could decrypt them. we do not, and nothing in the product does. we are building the version where the key is wrapped under a passphrase only you know, and this page will change when it ships. until then we would rather say it plainly than say "end to end".

the people you write about

a person in nuuko is a handle you chose, an initial or a nickname, a colour, and the pages you filed under it. that is all. nuuko never reads your contacts, never suggests a person, and never infers who someone is from what you wrote.

because pages are about other people, you should know our position on their rights. under the GDPR, writing privately about the people in your life is your own household activity and is exempt. nuuko provides the means, and so holds this position under article 14(5)(b): we hold no identifying data about the people you write about, only a handle you chose, and we do not and cannot contact them. we would not be able to tell that a handle refers to any real person.

deleting a person removes them from the shelf and keeps every page you wrote. deleting a page deletes it. if sync is on, the server also keeps a small record of the page's id and the time you deleted it, so your other devices drop the page too. the id is a number made from the moment you started the page, and the record holds nothing you wrote.

the circle

the circle is invite only. what you share into a circle is a copy of your moment page, made only when you press share, encrypted in your browser with a key that is generated on your device and travels only inside the invite link. the server stores the encrypted copy and never sees the key. a private page can never become shared by changing a setting.

if you need someone now

nuuko is a journal, and nobody here reads your pages. it can help to tell someone you trust. you can also talk to someone now, for free:

if you're in danger now, call your local emergency number.

when you save a page, your device checks it against a short list of phrases about hurting yourself or not wanting to be alive. if one is there, you see these lines in place of the usual filing moment. nuuko never brings that page back to you on its own, not on home, the person page or patterns, and it can't be sealed. it stays in your book for you to open. the check runs on your device only. nothing about it is sent, counted or synced, and nobody is told. if sync is on, the page itself syncs encrypted like any other page, and the check's result stays on your device and in your own export.

what we count

page views, through vercel web analytics, which uses no cookies and no cross-site tracking.

we also count a few moments inside the app, each once per device: a first page, a first page filed under a person, a second person added, a return the next day, still writing a week and a month after the first page, an export taken, a page sealed to open later and that page opened on its day, a look back card shown on home and that card opened, and, if you answer the one question on the nuuko plus page, which of its three answers you picked.

if you arrived through a link posted under a video, those counts carry that video's tag, which is the same for everyone who tapped it, and only the day, never the time. a video is only read once at least five devices share its tag.

if you arrived through a link on a shelf card someone shared, those counts carry the tag "card", which is the same for everyone who tapped one. it says a card brought you, never whose card.

we also keep tally marks per day, with no video tag and no time. on the write page, how many times each question was shown, how many times it was swapped for another, and how many times it was hidden so someone could just write. a question is named by its number in our list of 200, "video" for a question that came from a video, or "other" for anything else, and never by what you wrote. we also tally which kind of relation a person was filed under, once per person: family, a friend, a partner, someone you like, an ex, work or school, or someone else, and never who the person is. each phone counts a question once, so a tally of five is five phones. a tally is only read once it reaches five.

none of it carries any text, any handle, an account id, a device id, an IP address, or anything else that identifies you. if you would rather not be counted, the browser setting "do not track" and the "global privacy control" setting are respected, and none of the counts above are sent. the page views are the exception: vercel web analytics does not look at those settings.

every count passes through vercel, whose standard request logs keep the IP address and browser for a short time. we don't copy them into the counts.

what we do not do

what you can do

where it runs

the site is served by vercel and the database is supabase, both in the united states. every connection is https. sign in with google gives nuuko your email address, your name and the link to your profile picture. nuuko does not receive anything else from your google account.