Privacy Policy
// effective 2026-10-28 · version 71. Who runs NOX
NOX is operated by an individual maintainer ("we", "us", "operator") on hardware they control. There is no parent corporation. By using a NOX instance you are interacting with that operator. If you are using a third-party-run instance, that operator — not us — is your data controller for any data you submit there. Contact: [email protected].
2. What we need to run NOX (always on)
- Your account: username, display name, profile (avatar, banner, bio, status; your profile is not end-to-end encrypted), a salted hash of your password (never the password), your two-factor settings and passkeys, and, only if you add them, a recovery email and phone number (stored encrypted).
- What you post where nothing is end-to-end encrypted: messages in public servers and in servers that have not turned on encryption, DMs that have not become encrypted, uploads there (images, files, voice notes), reactions, polls and similar content are stored on our servers in readable form. These are not end-to-end encrypted.
- Direct messages and group DMs are end-to-end encrypted: the text and the files you send are encrypted on your device, and our servers store only ciphertext, without the keys to read it. A DM becomes encrypted once everyone in it uses an up-to-date NOX app; an encrypted conversation shows a lock. Messages sent in a conversation before it became encrypted stay readable by us. New members of a group DM can't read messages sent before they joined. A group DM can have up to 25 members. Your keys stay on your devices; a backup of them is protected by your password, your recovery phrase or a passkey, so anyone who knows your password can also unlock it. Encrypted files are not scanned by us.
- Encrypted servers: the owner of a private server can turn on "Encrypted server". Every text channel of that server is then end-to-end encrypted in the same way, including threads and the text chat of voice channels. Messages sent there before encryption was turned on stay readable by us, and new members can't see messages from before they joined. An encrypted server has at most 100 members unless NOX raises that server's limit (to at most 200). It can't be listed in server discovery, guest accounts can't join it, and bots, webhooks, AI replies, polls, AutoMod and server search are off in it. Encryption keeps messages from NOX, its database and its staff; it does not keep them from the server's owner, its admins or anyone else who can view a channel. NOX's servers still decide who is a member and who can view each channel, so a compromised NOX server could add someone; every change to who holds a channel's keys is shown in that channel.
- Turning a server's encryption off: encryption can be turned off for a server by its owner, or by NOX (for example to fix a fault or to meet a legal requirement). This affects future messages only: new messages in that server are then stored in readable form, like any server without encryption. Messages already sent encrypted stay encrypted, and NOX has no keys to read them; only members' devices can. Every member is shown a notice in the app saying encryption was turned off and by whom (the owner or NOX); it is never silent. Your app keeps its own record of which servers were encrypted, so it warns you and asks before sending even if our servers report the change without a recorded switch-off. The owner can turn encryption on again. One-on-one and group DMs have no off switch.
- Metadata we can always see, even for end-to-end encrypted conversations:
- who you message and when, and the approximate size and timing of messages
- your servers, roles, friends and blocks, who is in each group DM and server, and changes to that membership
- in encrypted conversations: reactions, pins, reply links, edits and deletions as events, thread titles, channel names and topics, and whom you @mention in an encrypted server
- when you are online, and when you join or leave voice channels
- call records: who called whom, when, how long, the outcome, and each participant's platform and app version
- Calls are end-to-end encrypted: voice, video and screen share are encrypted on your device, and NOX's call servers and relays pass them on without the keys to decrypt them. We do not record call audio, video or screens. We still see who is in a call and for how long.
- Deleted messages: when a readable message is deleted, a copy with its edit history and attachment details is kept in an archive only the service owner can read, for safety and legal requests. It is erased when its author deletes their account. For an end-to-end encrypted message the archive holds only ciphertext.
- Devices and security: a list of the devices that use your account (app type, operating system, browser, device model, app version, first and last seen) and the notification tokens they register. For devices you mark as trusted we keep a shortened IP address (the first part only), the country and the browser. We may keep a sign-in history with the same shortened IP, country and browser to detect account takeover.
- Network data: our servers see your IP address on every connection (and Cloudflare does when you load uploaded images). We use full IP addresses only for short-lived abuse limits, which expire within the limit window. Our logs keep only a shortened IP.
- In-app statistics: we count messages sent, characters typed, time in voice and time online for profile stats, levels and the optional activity heatmap. The heatmap is hidden from others unless you turn it on, but it is counted either way.
3. Optional: Help improve NOX (off unless you turn it on)
If you turn it on, the app sends us:
- Crash reports: the error and its stack, app version, platform, device type and a scrubbed list of recent app events. Never message text, passwords or tokens. On desktop this includes crash dumps, which are snapshots of program memory that may incidentally contain text that was on screen.
- Usage analytics: which screens you open (ids, codes and tokens are removed from links), screen size and language. This goes to our own self-hosted analytics, with no cookies and no account ID. The analytics server sees your IP address to count unique visits.
- Call diagnostics: connection states, codecs, counters and timings when a call ends or has trouble. Never IP addresses, call audio or video.
These reports are not linked to your account. Before they leave your device, account, session, call and conversation identifiers are removed or replaced with placeholders that only mean something inside that one report. Our server also removes your account ID if one slips through. We do not try to link them back to you.
Your choice is saved to your account and applies on all your devices. You can change it at any time. If it is off and the app crashes, we may ask whether to send that one report; sending it does not turn anything on. Your device's own crash sharing (Apple's "Share with App Developers", Android's usage & diagnostics) is controlled in your device settings, not by NOX.
4. Things you start yourself
- Reports: when you report a message or a profile, a copy of the reported content, and for a message up to 5 messages before and after it with any attachments, is shared with NOX's moderators so they can act on it. For an end-to-end encrypted message (in a DM, a group DM or an encrypted server) this happens only if you choose to share the message when you report it: your app then sends that message, its files and the messages around it, decrypted, with a cryptographic proof that lets us check they were really sent in that conversation, so moderators can open them. If you do not share, the report reaches us without any message content, and our moderators otherwise see no content of encrypted conversations. Reports are how we moderate them; server moderators can still delete messages and remove members.
- Bug reports and debug reports you send: your description, the screen you were on, recent app events, device and screen size, and a screenshot if you add one. These are linked to your account so we can reply.
- AI summaries ("Catch me up") and AI bots use your own (or the bot owner's) API key and send the recent channel messages, with names, to that AI provider (OpenAI or Anthropic). They never read end-to-end encrypted messages, and AI replies are off in encrypted servers.
5. Who else sees data
We do not sell or share your data for advertising. These services process data for us, or because you asked:
- Cloudflare: provides our DNS, and delivers uploaded images from our media host, where it scans them for known child sexual abuse material. It sees the IP address of anyone loading those images.
- Apple, Google and your browser's push service: to deliver notifications. For an end-to-end encrypted DM or group DM a notification says only that you have a new message from that person, and for an encrypted server only that there is a new message in a named channel; neither includes message text. Notifications for other DMs, @mentions and bot messages include the sender's name and the start of the message (up to 140 characters). Call notifications include the caller's name and picture.
- Cloudflare Turnstile / Google reCAPTCHA: on sign-up and some sign-ins, to stop bots. They receive your IP address.
- Resend (email) and Twilio (SMS): to send codes and the notices you choose.
- KLIPY: for GIF search. We send only your search words. GIFs then load from KLIPY, which sees your IP address.
- YouTube: embedded videos and thumbnails load from YouTube.
- GitHub: desktop update checks.
- Google Drive: the operator's own Google Drive holds the monthly archive of older logs, diagnostics and database backups (section 6).
- AI providers: only when you use your own key, as above.
- We may disclose data when the law requires it.
6. How long we keep data
We do not delete data on an automatic schedule. Apart from the short-lived abuse-limit records and notification tokens below, data is removed only by hand. Instead:
- Your account, profile, content, device list and statistics are kept while your account exists, until you delete them or delete your account.
- Crash reports, diagnostics and debug reports (crash reports and diagnostics only if you turned them on, and not linked to your account) and server logs stay on our server for 30 days. Once a month, anything older is copied to an archive in the operator's Google Drive, checked, and then removed from our server. The archive is reviewed by hand, and nothing in it is deleted automatically.
- Short-lived abuse-limit records expire on their own within minutes to hours.
- Notification tokens are removed when they stop working, when you sign out, or when you delete your account.
- Security, safety and moderation records (bans, timeouts, audit logs, message reports and any sign-in history) are kept as long as needed for safety, security and legal reasons. We review them periodically.
- Call records and bug reports you sent are kept while your account exists. If you delete your account they stay only without your identity (section 7). Debug reports you sent follow the 30-day archive rule above.
- Backups of our database are made on our server and move to the same monthly archive in Google Drive once they are more than a week old, where they are reviewed by hand. Data you deleted can remain in a backup until that backup is deleted by hand.
7. Your choices and deleting your account
You can turn Help improve NOX on or off, hide your heatmap, control who can DM you and send friend requests, block people, remove trusted devices and delete individual messages.
When you block someone you can also delete your 1:1 chat history with them. You can delete a group chat, or have NOX remove quiet group chats after 7 days. Both only take the chat off your own devices and end your own membership: the other people keep their copies, and NOX keeps the stored messages as it does for any chat.
You can delete your account in the app (Settings → My Account → Delete Account) or by following nox-chat.com/delete-account. When you do, NOX:
- replaces the text of your readable messages and DMs with "[deleted]" and then removes them with your account; end-to-end encrypted messages, which we hold only as ciphertext, are removed with your account;
- removes your profile, your server memberships and roles, your notification settings, your statistics and activity heatmap, your poll votes and event responses, your reactions in DMs, your device list, your trusted devices, your encryption keys and key backup, and your notification tokens;
- erases your entries in the deleted-message archive;
- deletes uploaded files that no one else uses;
- removes your identity from the call records, bug reports and debug reports we keep: your account ID is cleared from call records (as caller and as participant) and from reports you sent. The rest stays without saying who you were.
We keep only the security, safety and moderation records listed in section 6, those de-identified call records and reports, and anything already in a backup or in the monthly archive until it is deleted by hand. Diagnostic reports are not linked to your account in the first place.
You can also ask us for a copy of your data, a correction or deletion at [email protected].
8. Cookies and local storage
We use one sign-in cookie, and local storage on your device for settings, caches, your encryption keys and your local search index (encrypted DMs are searched only on your device; encrypted servers have no search). We use no tracking or advertising cookies. Our analytics use no cookies.
Protection of what the app stores on your device. The app's per-account data on your device (its caches, your profile, drafts, favourites and saved accounts, and the search index of your encrypted DMs) is encrypted under a key the app creates when you sign in. When you sign out, the app deletes that key before anything else, so the data left on the device can no longer be opened; like any deleted data, the key's bytes can stay in the browser's storage files until the browser compacts them. Your message encryption keys are kept separately, also encrypted on the device. This protects data left behind on the disk, a copied browser profile or a device backup. It does not protect against malware, a malicious browser extension or someone using your device while you are signed in, because the app itself can use the key then.
9. Website (nox-chat.com)
The website counts page views with our self-hosted, cookieless analytics. It is skipped if your browser sends Do Not Track, and it never records link parameters. No third-party trackers.
10. Children
NOX is not directed at children under 13. If we learn that a user under 13 has created an account, we will delete it. In the EU/UK and other jurisdictions where the digital age of consent is 16, NOX is not directed at users under 16 without verifiable parental consent. We do not tolerate child sexual abuse or exploitation: such content is removed, the accounts are banned, and we report it to the authorities where the law requires.
11. Your rights (GDPR / UK GDPR)
If you are in the EU, EEA, UK, or another jurisdiction with similar rights, you may:
- Access the personal data we hold about you
- Rectify inaccurate data — most fields are editable in
Settings → My Account / Profile - Erase your account (section 7)
- Restrict or object to processing
- Port your data — request an export of your messages and profile
- Withdraw consent at any time (without affecting prior lawful processing), for example by turning off Help improve NOX
- Lodge a complaint with your local data-protection authority
To exercise these rights, contact the operator at the address in section 14. We will respond within 30 days.
12. California rights (CCPA / CPRA)
If you are a California resident: you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising (and never have). Submit requests via the contact in section 14.
13. International users
NOX servers are physically located with the operator. Using NOX from outside that country means your data is transferred to and processed there. Where required (e.g. EU users), we rely on appropriate safeguards for cross-border transfer.
14. Contact
Privacy questions, data-subject access / deletion requests, CCPA and GDPR correspondence, safety reports and any other communication about this policy can be sent to:
In-app DMs are also available as an alternative channel. We aim to respond to verifiable requests within 30 days.
15. Changes to this policy
We may update this policy as NOX evolves. The "effective" date and version number above will move forward on every change. Material changes (anything that meaningfully changes what we collect, who sees it, or what you can do about it) will trigger an in-app notice. Continued use after the effective date constitutes acceptance.