Privacy Policy
Last updated 29 September 2026 · Applies to the Nook mobile app and its servers
Draft for review. This describes what the software actually does today, written from the
code and database rather than from a template. It has not been reviewed by a lawyer. Have it
checked against Thailand's PDPA — and the GDPR if you will have users in the EU — before you rely
on it.
Nook is a private messenger. This page explains what we store, why, how long, and what we do
not do. Where a claim would be flattering but untrue, we have said the untrue-but-honest thing
instead.
What we collect
Your account
- A username and a password. The password is stored only as a bcrypt hash — we never keep the password itself.
- A display name, and optionally a short bio, a profile picture and a cover picture. The pictures are stored as uploads, like any other file you send.
- Optionally an email address or phone number, if you add one so you can recover access. You can use Nook without either. An email address is stored lower-cased, so one mailbox is one account.
- Your plan (free or Pro), when it expires, and where it came from — the store subscription itself is handled by Apple or Google under their own terms.
Your messages and files
- Message text, and the photos, videos and files you send, are stored on our servers so they can be delivered to the people you send them to. They are encrypted in transit and, on your phone, in an encrypted local database; the copy on our servers is not end-to-end encrypted, and a hidden room does not change that — it protects your messages from someone holding your unlocked phone, not from us or from anyone who could lawfully compel us.
- Before a video is sent, the app re-encodes it on your phone to at most 1080p. This happens on the device only; the copy it makes is temporary and deleted once the video is sent or cancelled, and the original in your photo library is not changed.
- Files are held in Google Cloud Storage and served through signed links that stop working after about an hour, so a link shared onward does not keep working.
- Voice messages are files like any other: stored on our servers, delivered through the same expiring links, and played by the app from memory. While you record, the app writes the recording to a temporary file on your phone and deletes it once the message is sent or discarded.
- Reactions, edits, read state and who is in which conversation.
- When you send one message to many chats at once, a record of that send: when, to how many chats, and how many of them read it. While any copy is still in a chat, a Nook Pro sender's text and a reference to its photo or video are kept with that record so they can edit or unsend it everywhere at once; they are removed when the last copy is gone, on unsend, or after 90 days at most. The record itself is deleted after 90 days.
- When a message answers a moment, a note of which moment it answered, so the reply can show what it was about.
Moments
- The text and the photo or video of a moment you share, when you shared it, when it expires, and the list of people it was shared with at that time. Only those people can see it, and only for as long as it lasts.
- There are no likes, comments, view counts or reshares, so there is nothing of that kind to store.
What you keep about your friends
- The name you give a friend, a private note, important dates, reminders and a keep-in-touch interval you set for them. These are yours alone: the friend is never shown any of it, and none of it is ever sent as a notification.
Reports
- If you report a moment or a person, we keep the report: what was reported, by whom, the reason and any note you add, and a copy of the reported content or profile as it was at that moment — so that it can still be reviewed after the original is changed or deleted. The person reported is not told who reported them, and no report is ever returned to the app.
Room PINs and backup codes
- A room's PIN is stored only as a hash (bcrypt applied to a value your device has already hashed). We cannot read it or recover it for you.
- Backup codes are stored as argon2id hashes alongside a short lookup value. The one time the plaintext codes exist is the moment they are shown to you.
- A recovery contact for PIN recovery, if you register one: an email address used only to send a reset code.
- If you turn on biometric unlock, a random token issued to that device, stored on our side only as a hash. It is not your PIN and nothing derived from your PIN is kept on the phone.
Devices and sessions
- A device identifier (a random id created when the app is installed), device type, the name you give a device, its OS version and app version, and when it was last active.
- The language the app is set to on each device, so a notification arrives in it.
- Sign-in tokens are stored only as hashes, so that signing out on one device can end that session.
- A Firebase Cloud Messaging token for each device, used to deliver notifications.
Keeping accounts safe
- Counts of failed sign-in attempts per username, and of failed PIN attempts, so repeated guessing can be slowed down.
- Daily counts of what you send, upload, broadcast and share, and of the verification codes we issue, so the plan limits and abuse limits can be applied.
- Invite codes you create — the QR itself and the short code in a shared link — and a record of which account scanned which code. This is how a friend connection is made.
What we do not do
- We do not sell your data, and we do not share it with data brokers.
- We do not collect your location.
- We do not put message text in a push notification. A notification tells you that something arrived, and at most who it is from — never what it says.
- We do not list your hidden rooms anywhere in the app or in any API response, and a hidden room's notifications are silent unless you turn them on from inside that room.
- We do not log message content, PINs or access tokens.
- We do not rank, recommend or count anything: there are no likes, no comments, no view counts and no algorithm deciding what you see.
How long we keep things
| What | How long |
|---|
| A message you delete for everyone | Hidden immediately; the stored row is purged after 7 days |
| A message you delete only for yourself | Hidden from you immediately; the other person keeps their copy |
| A message with a timer | Removed once its timer runs out after being read |
| A moment | Until you delete it, or until the timer you chose when sharing it runs out |
| A report you make | Until it is reviewed, then as a record of the decision |
| An uploaded file nothing refers to | Deleted within about 24 hours |
| Your account and its content | Until you delete it |
| A deleted account, before it is purged | 14 days, during which signing in restores it |
Who else is involved
- Google Firebase — Cloud Messaging delivers notifications to your device; Crashlytics receives crash reports so we can fix what breaks.
- Google Cloud — stores uploaded files and runs the servers.
- Mailjet — sends the emails that carry verification and recovery codes.
- ImprovMX — forwards mail sent to our support address to us.
These providers process data on our behalf. We do not give them your messages for their own use.
What you can do
- Delete a message for yourself or, if you sent it, for everyone.
- Set messages to disappear after being read.
- Mute a conversation, or turn a room's notifications off — each room keeps its own notification settings, quiet hours included.
- Block someone, and report a moment or a person.
- Delete a moment you shared.
- Sign out a device you no longer use.
- Delete your account from Settings → Delete account — your account and everything in
it goes. Messages you already sent stay in the other person's copy, attributed to a deleted
account, because a conversation is stored once and removing yours would empty theirs too.
To ask what we hold about you, write to
support@nookmsg.com. Deleting your account does not
need us at all — but be aware that for 14 days afterwards the data is still on our servers, in
case you sign back in. See deleting your account.
Children
Nook is not intended for children under 13, and we do not knowingly collect information from
them. If you believe a child has an account, write to us and we will remove it.
Changes
If this policy changes in a way that matters, we will say so in the app before the change takes
effect. The date at the top always reflects the current version.