What's actually private, and what isn't.
Most apps say "we respect your privacy" and stop there. Here is the whole picture: what leaves your device, who receives it, what we keep, and where the honest limits are. No marketing words you can't check.
What leaves your device, per action.
An AI that runs in your browser still has to send some things to answer you. Here is exactly what, and to whom, for each thing NOLO can do.
If you never turn on sync and never use a tool, the only thing that ever leaves your device is the message you send to get an answer.
What NOLO's own servers store.
We do keep a little, and we'd rather tell you exactly what than pretend it's zero. It's pseudonymous: tied to your anonymous ID, never to a name, email or raw IP, and never the content of your chats.
Per-message usage record
We store a daily counter per anonymous ID: credits consumed, images generated, and your plan. This is how daily limits and billing work. We never store the text of your messages or the answers. An automated job deletes the old rows every night.
Your IP only ever reaches our database as a salted one-way hash, and that bucket is deleted within a week. The honest footnote: our host, Vercel, does log the IP of every request to any website, ours included. That is unavoidable for anything hosted on the internet, and we would rather write it here than let "we never store your IP" quietly do more work than it should.
Where the limits actually are.
Anyone can claim "fully private". These are the places where NOLO is not, stated plainly so you can decide for yourself.
Your history is on your device, but it is not encrypted at rest
Chats are stored in your browser's local storage in plain form. That keeps them off our servers, but it also means anyone with access to your unlocked device could open them. If that matters to you, use a device passcode and clear NOLO when you're done.
Drive sync is encrypted, but it is not true end-to-end
When you turn on sync, your chats are encrypted before they reach your Google Drive. But the key is derived from your Google account identifier, not from a password only you know, so it's strong obfuscation rather than zero-knowledge encryption. Treat it as "much better than plain", not "mathematically impossible for anyone".
Image generation uses a third-party, proprietary model
The chat models are open-weights and we name them. Image generation is the exception: it runs on fal.ai's proprietary model. The prompt still goes through our server without your identity, but it's fair to know that one capability isn't open-weights, and that your browser then loads the finished image from fal's CDN, which is one of the few moments a third party sees your IP.
We do run analytics. Cookieless, but real
NOLO uses Vercel Web Analytics and Speed Insights on the site and in the app: page visited, referrer, rough country, device type, load timings. No cookies, no visitor ID, nothing that follows you to another site, and never a word of what you type. An earlier version of this page said "no analytics". That was wrong, and this is the correction rather than a quiet deletion.
A handful of third parties do see your IP
Your messages never reach a provider with your IP attached, because our server stands in the middle for that. But your browser loads typefaces from Google Fonts, feature libraries from a public CDN, generated images from fal's CDN, and four live widgets refresh themselves directly. Each of those sees an IP address. The privacy policy lists every one and exactly when it happens.
Check it yourself in two minutes.
You don't have to take our word for any of this. The browser already gives you the tools to watch what NOLO does.
Open the network panel
In NOLO, press F12 and open the Network tab, then send a message. Your message goes to NOLO's own API and nowhere else. No ad networks, no third-party profilers, no advertising SDKs. What you will see: Google Fonts, a library CDN, and NOLO's own cookieless analytics, all listed above and in the privacy policy.
Clear the storage
In the same panel, open Application → Storage and clear it. Your chats vanish, because that's the only place they live. There's no server copy to delete.
Check what was sent
Click any request to /api/chat and read the payload. There's no email, no name, no login token, just your anonymous ID and the message you chose to send.
Name the model
Ask NOLO which model is answering. It will tell you, the chat models are open-weights, so you can look up exactly what's running and judge it for yourself. See the comparison.
Straight answers.
No, and we won't claim it. We keep pseudonymous daily counters (your anonymous ID, credits used, your plan) for 30 days so limits and billing work, and our host logs every request including your IP, as every host does. We never log the content of your messages and never write your IP to our database in readable form. "No content logs, no identity" is accurate; "zero logs" would be a lie.
No. Sync stores an encrypted blob in your own Google Drive app folder. We don't hold the data and don't have a copy. The honest caveat is that the encryption key is derived from your Google identifier rather than a private password, so it's strong protection but not zero-knowledge end-to-end.
No, and they don't keep them either. Fireworks stores nothing for the open models NOLO runs, that's its default. Groq would be entitled to hold data for 30 days for abuse monitoring, so we switched Zero Data Retention on at account level and it stores nothing at all. The one exception, and we'd rather name it than average it away, is fal: the image provider does collect the prompts sent to it. None of them can tie any of it to a person anyway, because there is no account and no IP of yours for them to tie it to. Provider by provider, it's all in the privacy policy.
To enforce daily limits, process payments and stop abuse, the bare minimum to run a service without an account. It's pseudonymous and short-lived, and you can see precisely what it is above.
Not the privacy model. The Android app is the same web app running inside a secure Android container, so there is still no account and your chats still live on your device. Two things are different: Google Play handles the download and gives us aggregate install and crash statistics under its own policy, and if you subscribe inside the app, Google Play Billing takes the payment. In that case we receive only a purchase token and a product ID, not your name, email or payment method, and you cancel or request a refund through Google Play rather than through us.
Not across the web, and not as a person. There are no advertising SDKs, no attribution SDKs, no third-party trackers and no cookies for tracking. What exists is cookieless page analytics on our own domain, described in the limits above, and pseudonymous usage counters so daily limits work. Nothing profiles you, nothing follows you elsewhere, and nothing is sold.
Every single company, by name, with what each one receives and keeps, is listed in section 7 of the privacy policy. If that list ever changes, that page changes. It is meant to be complete at all times, not aspirational.
Private by design. Honest about the rest.
Open it, watch the network, read the payload. Then decide.