Privacy Policy

1. How noHuman Team processes data

noHuman Team runs as a native application on macOS or Windows. Each noHuman is a process on your computer. Workspace files and configuration stay on your machine. If you enable mobile access, the phone can display conversations and send messages through an end-to-end encrypted relay. You should compare the security fingerprints shown on both devices before approving a pairing.

AI-powered features send requests from your machine to the provider you connect. You can use a Claude or ChatGPT subscription, or an API key for providers such as Anthropic, OpenAI, Google, OpenRouter, DeepSeek, Mistral, Groq, or AWS Bedrock. noHuman Team stores connected AI accounts on your computer with owner-only file permissions. For gateway-managed Claude and ChatGPT connections, noHumans use stand-in credentials and the local gateway adds authentication for allowed provider hosts. Native sign-ins and fallback paths can store real credentials in worker files. Workers use your operating-system permissions; separate folders do not provide a filesystem sandbox. We do not route, intercept, store, or have access to your AI traffic. Requests travel from your machine to your chosen provider.

Please note that noHuman Team uses your subscription through an automated agent. Requests made by your noHumans count against your plan's usage limits, and your use of a provider through noHuman Team is subject to that provider's terms.

2. Data we collect

2.1 License activation data

When you activate noHuman Team, we collect:

• Your license key
• The email address the key was issued to (the one you entered when claiming a free key, or used at checkout)
• A machine fingerprint (a hash — not your hostname or IP)

This data is sent to our activation server (hub.nohuman.team) and used to validate your license and enforce the activation limit for your plan. The desktop also checks the extension catalog and fetches the public model list from models.dev. Optional mobile access is described below.

2.2 Optional mobile access

If you choose to use the mobile app, your phone connects to noHuman Hub for sign-in, pairing and relay requests. Hub uses Supabase Auth to process your email and session on the server. Hub stores your account ID, linked-computer name, public encryption keys, approval and connection timestamps, and short-lived encrypted message envelopes and file chunks. It does not receive private encryption keys or plaintext relay messages. Compare the fingerprints on both devices before approval to protect against a substituted pairing key. Messages and file access expire after 24 hours; our daily cleanup removes expired encrypted files. The app stores its session and encryption key in secure device storage and keeps appearance, language and selected-team preferences on your phone.

Voice input uses your phone's on-device speech recognition. The app does not upload a voice recording to Hub or your computer. Dictated words stay in your draft until you send them. You choose the language, and offline recognition depends on your phone's installed language support. Camera access serves pairing QR scanning. You choose files through the system picker before the app encrypts them for transfer.

On Android, the QR scanner uses Google's ML Kit. Images and decoded QR contents stay on your phone. The SDK sends Google an installation-scoped identifier, device and app information, and SDK usage and performance metrics for diagnostics and improvement. It does not use the advertising ID. The iOS scanner uses Apple's on-device Vision framework. Google's ML Kit privacy terms explain its metrics processing.

If you choose Report a reply, the app shows the exact excerpt and asks you to confirm sharing it with Cardamon. Hub receives that excerpt in readable form, the reason you choose, your account ID and optional conversation identifiers. We use reports for safety review and to address abusive or misleading output. We do not send a full chat history or attachments with a report. Reports expire after 90 days and our daily cleanup removes them, within 91 days of submission. Deleting your mobile account also removes its reports.

2.3 Payment information

Payment processing is handled by Paddle.com Market Limited ("Paddle"), our Merchant of Record. We do not collect or store your credit card numbers, bank account details, or other payment credentials. Paddle collects and processes payment information in accordance with their own Privacy Policy. We receive from Paddle: transaction IDs, subscription status, and billing country for our records.

2.4 Website analytics

Our website (nohuman.team) may collect basic technical information such as browser type, device type, and pages visited through privacy-friendly analytics. We do not use tracking cookies, pixel trackers, or cross-site tracking. The noHuman Team desktop app collects no analytics or telemetry. The mobile app's Android QR scanner sends the SDK metrics described in section 2.2.

3. How we use your data

We use the data we collect to:

• Validate and manage license activations
• Authenticate and connect your phone to your computer if you enable mobile access
• Email you about noHuman Team — new releases, security fixes, and notice before the free period ends — when you claimed a free key or bought a licence. Every such email carries a one-click unsubscribe; unsubscribing never affects your key.
• Process purchases via Paddle
• Provide customer support
• Improve the website and Service

We do not:

• Decrypt content sent through the mobile relay. A safety report includes only the excerpt you choose to share.
• Route or intercept your AI API traffic
• Use any of your data for training AI models
• Sell your personal data to third parties
• Send marketing emails beyond the product updates described above, or share your email with anyone else

4. Third-party services

We use the following third-party services:

* Claude and ChatGPT support subscription sign-in. The wider provider catalog uses credentials you supply. Each provider's terms apply, and noHuman Team does not route AI traffic through our infrastructure.

5. Cookies and local storage

Our website uses no tracking cookies. We may use essential cookies for basic website functionality. The desktop stores its team data locally. If you enable mobile access, the app stores an account session and encryption key in secure device storage and the Hub briefly stores encrypted messages.

6. Data retention

• License activation records: Retained for as long as your license is active. Upon request, we will delete your records within 30 days.
• Billing records: Transaction records may be retained for up to 7 years as required for tax and legal compliance.
• Local data: NoHuman state, provider credentials, and workspace files are stored on your computer. Your phone can also hold displayed conversation content while you use the mobile app. We cannot access or delete your local files for you.
• Mobile relay: Encrypted message envelopes expire after 24 hours. Pairing codes expire after 10 minutes. Account and linked-computer metadata remain until deleted or the account is removed.
• Safety reports: Reports expire after 90 days; our daily cleanup removes records within 91 days of submission. Deleting your mobile account also deletes its reports.

7. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to certain processing of your personal data

To exercise any of these rights, contact us at support@cardamon.org. We will respond within 30 days.

To delete mobile sign-in and its associated data, open the mobile app menu and choose Delete mobile account, or use our account deletion request page. We remove mobile account and pairing records, relay ciphertext and submitted safety reports. A file upload already in progress can leave encrypted bytes until the next cleanup, within 48 hours. Mobile-account deletion does not delete local desktop teams or files, cancel a desktop subscription, or erase license and billing records we must retain.

For EU/EEA residents (GDPR): Our legal basis for processing personal data includes performance of a contract (license activation), legitimate interests (preventing fraud), and your consent for product-update emails, which you can withdraw at any time via the unsubscribe link. You have the right to lodge a complaint with your local data protection authority.

For California residents (CCPA): We do not sell your personal information. You have the right to know what personal information we collect and to request its deletion.

8. Data security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS/HTTPS) and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. International data transfers

License activation data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these countries. We ensure that appropriate safeguards are in place for international transfers.

10. Children's privacy

noHuman Team is intended for use by individuals who are at least 13 years old. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where practicable, provide notice through email or the noHuman Team dashboard. Your continued use of noHuman Team after any changes means you accept the revised policy.

12. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, you can contact us at:

• Email: support@cardamon.org
• Address: Cardamon Inc, Boca Raton, Florida, United States