Privacy Policy

The controller of your personal data is [Operator legal name — complete before publication], [Operator postal address — complete before publication] (the “operator”, “we” or “us”). For privacy questions and requests, write to [Privacy email — complete before publication].

Data protection officer or representative: [add their contact details if the operator has appointed one, or remove this paragraph].

Words such as “Service”, “Content”, “Host” and “Guest” have the meaning given in the Terms of Service.

Your account

• Your email address and display name.
• Your password, stored only as a salted scrypt hash. The password itself is never stored.
• A random avatar seed that Nook uses to draw your generated avatar. You don’t upload a photo.
• Your settings: theme, language, time zone, time format, first day of the week, notification preferences, default camera and microphone behavior, privacy preferences and mascot preferences.

In preview mode, a shared sample account is available to everyone. Its data may be reset at any time.

Sign-in sessions

When you sign in, your browser receives a random session token in an httpOnly cookie. We store only a SHA-256 hash of that token, together with your browser’s user agent, a pseudonymized form of your IP address (a keyed HMAC hash — the address itself is not stored) and when the session was created, last used and will expire.

Meetings

• Title, description, type, schedule, time zone and recurrence.
• Access settings and the invite key used in invite links.
• Members, their roles and their RSVP answers.
• Whether the meeting was created on the website or through messaging service.
• An audit log of changes: who made each change, through which channel and what changed.

Calls

• Participation records: display name, role, and when you joined, left or waited in the waiting room. Guests are recognized by a random guest cookie and don’t need an account.
• Chat messages, reactions and raised hands. They are stored as part of the meeting’s history.

messaging service (optional)

• Linking code: a one-time code you confirm in the bot. Only a hash of it is stored, and it is valid for 10 minutes.
• Link details: your messaging service user ID, chat ID, username, first name and language code.
• Short-lived conversation state while you go through a multi-step flow in the bot, such as creating a meeting.
• The IDs of updates the bot has already processed, so nothing is handled twice.
• Bot console transcript: when the operator hasn’t set up messaging service, a built-in bot console runs the same bot inside Nook and stores your conversation with it.

Notifications and contacts

• In-app notifications about your meetings, such as invitations, changes and reminders.
• Your contacts: other Nook users you add, with optional notes and favorites.

Contact form

Your name, email address, topic and message, a pseudonymized form of your IP address, and your user ID if you were signed in.

Diagnostics (only with your consent)

If you turn on diagnostics, the app sends anonymous call-quality summaries: connection quality, number of reconnects, browser family and a call-length range. They contain no names, email addresses or IDs. Diagnostics are off by default.

Security and abuse prevention

Rate limiting uses short-lived counters keyed by a pseudonymized IP address or your account ID.

Cookies and storage in your browser

The Cookie Policy lists every cookie and storage key Nook uses.

Server logs

The Nook database never stores raw IP addresses. The servers and network services that host the Service may keep their own logs: [describe what hosting, proxy and server logs record and for how long — complete before publication].

Simulated participants

The names and avatars of simulated participants in simulation meetings are generated by Nook. They are fictional and are not data about real people.

• To run your account and keep you signed in.
• To run meetings and calls: connect you, show who is there, deliver chat and reactions, and apply the host’s settings and controls.
• To send notifications in the app and, if you linked messaging service and turned them on, through the bot.
• To run the messaging service bot and the bot console.
• To keep the Service secure: sessions, rate limiting, the audit log of meeting changes and handling abuse reports.
• To answer messages you send through the contact form.
• To understand and improve call quality, only if you turned diagnostics on.
• To remember your preferences.

Nook contains no advertising and no third-party analytics, and your data is not used to build advertising profiles.

Where the law requires a legal basis for using personal data, we rely on these:

• Contract — to provide what you asked for: your account and sessions, meetings, calls, chat, notifications and, if you set it up, the messaging service link.
• Legitimate interests — to keep the Service secure and working (pseudonymized IP addresses, rate limiting, the audit log), to answer contact messages and to run preview mode.
• Consent — for optional preference storage and diagnostics. You can withdraw consent at any time in Cookie settings.
• Legal obligation — where the law requires us to keep or disclose data.

• Other participants and members. People in the same meeting see your display name, avatar, role, chat messages and reactions. Members see the meeting’s details and RSVP answers. Whether your email address is shown to other participants depends on your privacy settings.
• The media server. Audio, video and screen sharing are sent through the LiveKit media server that the operator has configured — either self-hosted or LiveKit Cloud. Media is encrypted in transit between your browser and that server (WebRTC DTLS-SRTP), and the server processes it to route it to other participants. Nook does not provide end-to-end encryption. If no media server is configured, no audio or video is transmitted at all. Media server used here: [name the media server provider and where it runs — complete before publication].
• messaging service. If you use the bot, your messages to it and its replies travel through messaging service’s servers, under messaging service’s terms (opens in a new tab) and privacy policy (opens in a new tab).
• Hosting and infrastructure providers. [list the hosting, database and backup providers and their locations — complete before publication].
• Authorities. When the law requires us to disclose data.

Where your data is stored and processed: [describe the locations and the safeguards used for transfers to other countries — complete before publication].

If you use the messaging service bot, messaging service handles those messages under its own policies and may process them in other countries.

• Account and settings — until you delete your account.
• Sessions — until you sign out or revoke the session, and no longer than 30 days without use.
• messaging service linking codes — valid for 10 minutes.
• messaging service link — until you unlink it or delete your account.
• Bot conversation state — short-lived; it lasts only while a multi-step flow is in progress.
• Processed bot update IDs — deleted after 7 days.
• Bot console transcript — until you clear it or delete your account.
• Meetings, call records and chat messages — kept as the meeting’s history until the meeting’s organizer deletes their account, or as the operator decides: [state the operator’s retention period for meeting history, if any].
• Diagnostics — deleted after 30 days.
• Rate-limit counters — kept only for the current limit window.
• Contact form messages — [retention period — complete before publication].
• Backups and server logs — [retention periods — complete before publication].

When you delete your account, the meetings you organized are deleted with it, including their call records and chat history; members of upcoming ones are notified first. In meetings organized by other people, your name in call records and chat messages is replaced with “Deleted user”, and the messages themselves stay in that meeting’s history.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict some uses of it, and to withdraw consent. Many of these are built into the product:

• Download your data as a JSON file in Settings → Privacy & data.
• Delete your account in Settings → Privacy & data. This signs out all your sessions, removes your messaging service link, deletes the meetings you organized together with their call history and chat (members of upcoming ones are notified), deletes your contacts, notifications and settings, and replaces your name with “Deleted user” in call records and chat messages of meetings organized by others.
• Correct your details in your profile and settings.
• Review and revoke sessions in Settings → Security.
• Manage notification preferences in each connected service.
• Block contact requests in your privacy settings.
• Change cookie and diagnostics choices in Cookie settings.

For anything else, write to [Privacy email — complete before publication]. We may need to confirm your identity before acting on a request. The Privacy and data help article walks through these tools step by step.

You may also have the right to complain to a data protection authority: [name the competent supervisory authority, if any — complete before publication].

The Service is not intended for anyone younger than [minimum age — complete before publication]. If you believe a child has given us personal data, write to [Privacy email — complete before publication].

• Passwords are stored only as salted scrypt hashes.
• Session tokens live in httpOnly cookies, and only their hashes are stored.
• IP addresses are pseudonymized with a keyed hash before they are stored.
• A Content Security Policy and other security headers protect pages; when the Service runs over HTTPS, cookies are marked Secure and browsers are told to always use HTTPS.
• Rate limiting slows down password guessing and abuse.
• messaging service webhooks are checked against a shared secret, and LiveKit webhooks must be signed.
• Permissions are checked on the server for every action, such as editing a meeting or moderating a call.
• Media is encrypted in transit between your browser and the media server.

No system is perfectly secure, and Nook holds no security certifications. To report a vulnerability, see Security or write to [Security email — complete before publication].

We will update this policy when the Service or the way it is run changes. The date at the top shows when it last changed. If a change significantly affects you, we will announce it in the Service before it takes effect.

Privacy questions and requests: [Privacy email — complete before publication]. Everything else: [Contact email — complete before publication] or the contact form. Postal address: [Operator legal name — complete before publication], [Operator postal address — complete before publication].