Privacy Policy

1. Who we are

The Service is operated by the Nobami Team, which is the controller (for GDPR purposes) and the personal information processor (for PIPA purposes) responsible for your personal information.

You can contact us, including our data protection officer and Chief Privacy Officer, at projectteamforyou@gmail.com.

2. Information we collect

2.1 Account information. If you create an account, we collect your email address, the display name you choose (optional), and your password. Passwords are stored only as a salted one-way hash (argon2id); we never store or see your password in plain text.

2.2 Documents and content. By default, files you open or create are processed and stored only on your device (for example, in your browser's IndexedDB storage). If you sign in and turn on cloud sync, or create a share link, we store the document content, title, file type, version history and sharing settings on our servers so that we can sync and share them for you.

2.3 AI requests. When you use an AI feature, the instruction you type and the content you choose to include (for example, the selected text or the current document) are sent to the AI provider you selected:

• Nobami Cloud (default): your request is sent to our API server and forwarded to Anthropic, PBC (Claude models) for text, or to OpenAI, L.L.C. for image generation. We process the request to return the response and do not keep the content of your prompts or responses after the request is completed, except as described in Section 7.
• Bring your own key (BYOK): if you enter your own API key for Anthropic, OpenAI, Google (Gemini) or OpenRouter, your browser sends requests directly to that provider. These requests do not pass through our servers, and the provider processes them under its own terms and privacy policy as your service provider.
• Local AI: if you connect a local model (for example, Ollama, LM Studio, llama.cpp or vLLM running on your own computer or network), your requests never leave the environment you control.

2.4 API keys. API keys you enter for BYOK providers are stored only on your device (in your browser's local storage or the app's local storage). They are never sent to Nobami's servers.

2.5 Technical and log data. When your device communicates with our API, our servers automatically record technical information such as IP address, browser and device type, operating system, request time, the endpoint requested, response status and error details. We use this to operate the Service, prevent abuse, enforce rate limits and keep the Service secure. We do not use third-party advertising trackers or cross-site analytics cookies.

2.6 Communications. If you email us, we receive your email address and the contents of your message and any attachments.

2.7 Payment information. If we offer paid plans and you subscribe, payments are handled by a third-party payment processor. We receive only limited information such as your plan, transaction ID, payment status and the last digits of your card; we do not receive or store full card numbers.

We do not knowingly collect sensitive information (such as health data, biometric data or information about political opinions) and we ask you not to send it to us. Documents you sync may contain any information you choose to put in them; we process that content only to provide the Service to you.

3. How we use information

We use personal information only for the following purposes:

• to provide, operate and maintain the Service, including account authentication, cloud sync, version history and share links;
• to process AI requests you make through Nobami Cloud and return the results;
• to apply free-tier usage limits and prevent fraud, spam, abuse and security incidents;
• to respond to your requests, questions and support messages;
• to send you service-related notices, such as security alerts and changes to our terms or this policy;
• to process payments and manage subscriptions, if you choose a paid plan;
• to diagnose problems and improve the reliability and performance of the Service using aggregated or de-identified technical data; and
• to comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, we do not use your documents or AI prompts to train AI models, and we do not use your personal information for targeted advertising.

4. Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract – to create and manage your account, sync and share your documents and provide the features you request;
• Legitimate interests – to secure the Service, prevent abuse, enforce rate limits and improve reliability, where these interests are not overridden by your rights;
• Consent – where you choose optional features such as sending content to an AI provider, or where we ask for your consent; you may withdraw consent at any time without affecting the lawfulness of earlier processing;
• Legal obligation – where we must keep or disclose information to comply with the law.

5. Sharing and outsourcing of processing

We share personal information only with the service providers (processors) that help us run the Service, under contracts that require them to protect it and use it only on our instructions. We currently entrust processing to the following companies:

• Cloudflare, Inc. – content delivery and hosting of the website and web application, network security;
• Railway Corporation – hosting of our API servers and database (account data, synced documents, logs);
• Anthropic, PBC – processing of AI text requests made through Nobami Cloud;
• OpenAI, L.L.C. – processing of AI image generation requests made through Nobami Cloud;
• GitHub, Inc. – distribution of Windows app downloads (GitHub may log download requests under its own policy);
• Google LLC (Google Play) – distribution of the Android app (under Google's own policy).

If we add or change an outsourcing provider, we will update this list. We may also disclose information (a) when required by law, court order or a lawful request from public authorities; (b) to protect the rights, property or safety of Nobami, our users or the public; or (c) in connection with a merger, acquisition or sale of assets, in which case we will notify you in advance as required by law.

When you use BYOK or Local AI providers, you share content directly with those providers; we are not a party to that transfer.

6. International transfers

Our service providers may process personal information outside your country, including in the United States and other countries where they operate data centers. Details of overseas transfers are as follows:

• Recipients and countries: Cloudflare, Inc. (United States and its global network), Railway Corporation (United States), Anthropic, PBC (United States), OpenAI, L.L.C. (United States);
• Items transferred: account information, synced document content, AI request content (Nobami Cloud only), and technical log data, as applicable to each provider;
• Timing and method: transmitted over encrypted networks (TLS) when you use the relevant feature;
• Purpose and retention: as described in Sections 3 and 7 for each provider's role.

Where the GDPR applies, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK Addendum) for these transfers. Where PIPA applies, the transfer is necessary to perform the contract with you and is disclosed in this policy. If you do not want your information transferred overseas, you can use the Service without an account, without cloud sync and with a Local AI provider, in which case no personal information is transferred to us or our processors.

7. Retention and destruction

We keep personal information only as long as necessary for the purposes described above:

• Account information: until you delete your account; then deleted within 30 days;
• Synced documents and version history: until you delete them or your account; deleted items are permanently removed within 30 days, and from backups within 35 days;
• Share links: until you revoke them or delete the document;
• Nobami Cloud AI requests: the content is not stored after the response is delivered; usage metadata (such as time, token counts and an anonymized identifier) is kept for up to 90 days for rate limiting and abuse prevention;
• Server logs: up to 90 days, unless needed longer to investigate a security incident;
• Support emails: up to 3 years after the matter is closed.

Where the law requires us to keep information longer, we keep it separately for the required period only. For example, under Korean law: records of contracts or withdrawal of subscription, and records of payment and supply of goods, 5 years; records of consumer complaints or dispute handling, 3 years (Act on Consumer Protection in Electronic Commerce); and website access logs, 3 months (Protection of Communications Secrets Act).

Destruction procedure and method. When the retention period expires or the purpose of processing is achieved, we destroy the personal information without delay. Electronic files are deleted using technical methods that make them impossible to restore, and any printed records are shredded or incinerated.

8. Your rights

Depending on where you live, you have some or all of the following rights regarding your personal information:

• to access and receive a copy of your personal information;
• to correct inaccurate or incomplete information;
• to delete your information (you can delete documents and your account at any time in the app);
• to restrict or suspend processing, and to object to processing based on legitimate interests;
• to data portability: you can export your documents at any time in standard formats such as DOCX, XLSX, PPTX, HWPX and PDF;
• to withdraw consent at any time; and
• to lodge a complaint with a data protection supervisory authority.

California residents (CCPA). You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that require a right to limit. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request on your behalf.

Users in Korea (PIPA). You (or your legal representative or a person you have authorized) may request access to, correction or deletion of, or suspension of processing of your personal information, and may withdraw consent, at any time. If you request correction or deletion, we will not use or provide the information until the correction or deletion is complete. If you need help with an infringement of your personal information, you can also contact: the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the KISA Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr, 1301), or the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

How to exercise your rights. Email projectteamforyou@gmail.com from the address linked to your account, or use the in-app account settings. We may need to verify your identity before acting on a request. We will respond without undue delay and within the period required by law (for example, within 10 days under PIPA, one month under the GDPR and 45 days under the CCPA, which may be extended where permitted).

9. Cookies and local storage

The Service does not use advertising cookies or third-party tracking cookies. We use your browser's local storage technologies, which are strictly necessary for the features you use:

• IndexedDB – to store your documents, recent files and autosave versions on your device;
• localStorage – to remember your settings (such as language, theme and AI provider), your sign-in token if you are logged in, and BYOK API keys you enter;
• Service worker cache – to make the app load quickly and work offline.

This information stays on your device and is not used to track you across websites. You can remove it at any time by signing out, deleting documents in the app, or clearing site data in your browser settings (for example, in Chrome: Settings > Privacy and security > Site data). Clearing site data will permanently delete documents that are stored only on your device, so export anything you want to keep first.

10. Children

The Service is not directed to children. You must be at least 14 years old to create an account in Korea, at least 16 years old in the EEA and the UK (or the lower age set by your country's law), and at least 13 years old elsewhere. If you are under the applicable age, you may use the Service only with the consent of your parent or legal guardian. If we learn that we collected personal information from a child without the required consent, we will delete it promptly. Parents or guardians may contact us at projectteamforyou@gmail.com.

11. Security

We take administrative, technical and physical measures to protect personal information, including:

• encryption of data in transit (HTTPS/TLS with HSTS) and encryption at rest provided by our hosting providers;
• one-way hashing of passwords with argon2id and signed, expiring authentication tokens;
• a strict Content Security Policy, input validation and parameterized database queries;
• access to personal information limited to the minimum number of people who need it, with access logging;
• rate limiting, monitoring and regular dependency security audits; and
• an internal management plan for protecting personal information and incident response procedures.

No method of transmission or storage is completely secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by law. To report a security vulnerability, please email projectteamforyou@gmail.com.

12. Chief Privacy Officer

We have designated a Chief Privacy Officer (data protection officer) who is responsible for personal information processing and for handling complaints and requests:

• Chief Privacy Officer: Nobami Team, Privacy Lead
• Department in charge: Nobami Team Privacy Office
• Email: projectteamforyou@gmail.com

You can contact the Chief Privacy Officer about any privacy questions, complaints or requests for remedies. We will respond promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date and, at least 7 days before it takes effect, announce the change on the website or in the app. For material changes that affect your rights, we will give at least 30 days' notice and, where required by law, ask for your consent or notify you by email.

14. Contact us

If you have any questions about this Privacy Policy or our data practices, contact the Nobami Team at projectteamforyou@gmail.com.