Privacy Policy
Last updated 9 September 2026 · Applies to the Nook mobile app and its servers
Draft for review. This describes what the software actually does today, written from the
code and database rather than from a template. It has not been reviewed by a lawyer. Have it
checked against Thailand's PDPA — and the GDPR if you will have users in the EU — before you rely
on it.
Nook is a private messenger. This page explains what we store, why, how long, and what we do
not do. Where a claim would be flattering but untrue, we have said the untrue-but-honest thing
instead; the section on encryption is the one to read first.
What we collect
Your account
- A username and a password. The password is stored only as a bcrypt hash — we never keep the password itself.
- A display name, and optionally a short bio, a profile picture and a cover picture.
- Optionally an email address or phone number, if you add one so you can recover access. You can use Nook without either.
Your messages and files
- Message text, and the photos, videos and files you send, are stored on our servers so they can be delivered to the people you send them to.
- Files are held in Google Cloud Storage and served through short-lived signed links, so a link cannot be shared onward and keep working.
- Reactions, edits, read state and who is in which conversation.
Room PINs and backup codes
- A room's PIN is stored only as a hash (bcrypt applied to a value your device has already hashed). We cannot read it or recover it for you.
- Backup codes are stored as argon2id hashes alongside a short lookup value. The one time the plaintext codes exist is the moment they are shown to you.
Devices and sessions
- A device identifier, device type, the name you give a device, its OS version and app version, and when it was last active.
- Sign-in tokens are stored only as hashes, so that signing out on one device can end that session.
- A Firebase Cloud Messaging token for each device, used to deliver notifications.
Keeping accounts safe
- Counts of failed sign-in attempts per username, and of failed PIN attempts, so repeated guessing can be slowed down.
- Invite codes you create, and a record of which account scanned which code — this is how a friend connection is made.
Something we want to be plain about
Your messages are not end-to-end encrypted. They are encrypted in transit, and the copy on
your phone sits in an encrypted local database, but the copy on our servers is stored in a form we
could read. Nook's hidden rooms protect your messages from someone holding your unlocked phone.
They do not protect them from us, or from anyone who could lawfully compel us. If you need
protection from the operator of a service, Nook is not yet the right tool, and we would rather say
so here than let the word "private" imply otherwise.
What we do not do
- We do not show advertising, and we do not use advertising identifiers.
- We do not sell your data, and we do not share it with data brokers.
- We do not collect your location.
- We do not put message text in a push notification. A notification tells you that something arrived, and at most who it is from — never what it says.
- We do not list your hidden rooms anywhere in the app or in any API response, and a hidden room's notifications are silent unless you turn them on from inside that room.
- We do not log message content, PINs or access tokens.
How long we keep things
| What | How long |
|---|
| A message you delete for everyone | Hidden immediately; the stored row is purged after 7 days |
| A message you delete only for yourself | Hidden from you immediately; the other person keeps their copy |
| A message with a timer | Removed once its timer runs out after being read |
| An uploaded file nothing refers to | Deleted within about 24 hours |
| Your account and its content | Until you ask us to delete it |
Who else is involved
- Google Firebase — Cloud Messaging delivers notifications to your device; Crashlytics receives crash reports so we can fix what breaks.
- Google Cloud — stores uploaded files and runs the servers.
These providers process data on our behalf. We do not give them your messages for their own use.
What you can do
- Delete a message for yourself or, if you sent it, for everyone.
- Set messages to disappear after being read.
- Mute a conversation, or turn notifications off entirely.
- Block someone.
- Sign out a device you no longer use.
- Have your account deleted — including your rooms, chats and the messages you own — by
writing to us. There is no delete button in the app yet, so this is the route that works
today.
To ask what we hold about you, or to have it deleted, write to
support@nookmsg.com.
Children
Nook is not intended for children under 13, and we do not knowingly collect information from
them. If you believe a child has an account, write to us and we will remove it.
Changes
If this policy changes in a way that matters, we will say so in the app before the change takes
effect. The date at the top always reflects the current version.