About your data
Privacy policy
Find out which data Nook uses, why, for how long and how to exercise your rights. Message encryption does not hide all the data needed to provide the service.
Phone number and online access Sign in with a phone number for chats, photos, videos and invitation-only groups. Availability of the app and new features depends on the store, channel and installed version. Notes stay personal; their text is sent only when you choose to share it.
1. Who processes the data
The data controller is Kreluna Software, the trading name of the sole proprietorship GADDUCCI ANDREA. For information, support or requests about your data: krelunaid@gmail.com. Nook is the project name.
Nook is provided by Kreluna Software, the trading name of the sole proprietorship GADDUCCI ANDREA. Business address: Via Dante Alighieri 3, 51016 Montecatini Terme (PT), Italy. VAT number: 02114130475. Business register REA: PT-622714. Certified email (PEC): gadducci.andrea@pec.it. Business telephone: +39 351 429 0127. Support and complaints: krelunaid@gmail.com.
Minimum age
To use Nook, you must be at least 13, or the higher minimum age required in your country. If you are under 18, read the Terms and Privacy Notice with a parent or guardian. Nook does not offer parent-managed accounts for people below the minimum age. The notice and declaration when creating a profile are not documentary age verification or verified parental consent. To report an account that does not meet the requirement, contact support.
The service's minimum age and capacity to consent are different. For consent-based processing where GDPR Article 8 applies, Italy's threshold is 14 and other countries may differ. Reading this page with a parent is not itself verified parental consent. SMS verification does not prove age.
2. Data and purposes
| Data | Use and destination |
|---|---|
| Local mode | Personal notes, favourites, the archive, saved messages and local settings remain in the app’s data on the device. A personal note has no recipients. Saved profiles with names and photos stay on the device, separate by account and space. Private-space profiles are stored in its encrypted archive. Transferring the chat key does not transfer these templates, the board or reminders. Applying a template to a group makes a copy: editing or deleting it does not automatically update groups. |
| Phone number and online access | When you request a code, your phone number with country code, the request, its outcome and any session data are processed to register and authenticate your account, even if the code cannot be sent. Your number is not included in your public Nook profile. |
| Online profile | Account ID, username, display name, public key and creation date. Other signed-in users can view the profile to find a contact and start a conversation. We also retain the version of the Terms accepted and Privacy Notice acknowledged, and the date of that choice, to document access to sharing features. In updated versions we record the account ID, document revision, language, server time, and the declaration of acceptance of the Terms and acknowledgement of the Privacy notice. The revision is associated with document paths and fingerprints. The receipt evidences the links offered and your declaration, not actual reading. It does not add IP or device identifiers or track page openings. Receipts are deleted with the account. |
| Optional profile photo | You can choose a photo from your gallery. The app reduces it to a JPEG of up to 512 × 512 pixels, up to 256 KiB, and stores it in private server storage without a public URL. Each load requires authentication: access is available to the owner, contacts in an unblocked conversation, and users authorized by an exact profile search through a temporary permission. The photo does not use chat end-to-end encryption and does not reveal whether a private space exists. |
| Online messages and attachments | Online features provide for encrypting text and attachments on the device before sending. The server stores encrypted content and the data needed for delivery. The recipient can read the content and keep a copy. In groups, content is encrypted separately for each accepted member. Invitees do not receive messages until they accept. |
| Conversation metadata | Participant, conversation, message and sender IDs, dates and read receipts. Content encryption does not hide all this service data. For groups, the service also stores the group name and photo, membership, roles, invitations, and the name and label of the chosen profile. These metadata, including the group photo, are readable by the service and are not covered by content encryption. The personal name, label and photo chosen for a group are also sent to the service when you confirm group creation, joining or saving the group profile. They are visible to authorized members and readable by the service, separate from the main profile and message encryption. |
| Blocks and reports | Blocks and reports record the IDs of the reporter, the person concerned and the conversation, the reason and the date; a specific message report includes the message ID. Nook moderators receive a notification in the private safety inbox. Only if you explicitly choose to share it do they also receive up to 4,000 characters of the selected text. Entire chats, photos and videos are not attached automatically. The notification does not reveal use of the private space or send passwords or keys. Submission to the internal system and the alert in the security mailbox are technical steps: they do not mean continuous monitoring or guarantee an immediate response. Nook reports are not an emergency channel. |
| Support | Email address, request content and any attachments you choose to send, to respond and handle the issue. |
| Restoring a one-time Apple purchase | To restore an Apple purchase after account deletion, Nook keeps a private record of the original transaction ID and Apple environment, associated StoreKit token, the associated account ID, retained after account deletion and updated upon reassignment, pseudonymized phone-number fingerprint (HMAC), purchase status, and verification and reassignment dates. This HMAC uses a key separate from the trial register. The record contains no plain-text phone number, messages, or chat keys. |
| Google Play purchases and recovery | To verify a Google Play purchase, Nook keeps a private server record containing the purchase token and its hash, account and association identifiers, product, environment, state, purchase acknowledgement, quantity, order identifier and dates. The state is rechecked with Google, including to update access after refunds or revocations; updates are not guaranteed to be instant or available offline. |
| Technical data | Network services receive IP addresses, approximate city and country inferred from the IP, technical client information (user-agent), requests, dates, response and error codes, and response times. This data is used to deliver and protect the service, detect abuse and diagnose operational problems. Providers retain it in their operational and security logs. |
In addition to data you enter, we receive information from other participants, group administrators, people submitting reports and stores verifying purchases. The information shared depends on the feature and the choices of the person using it.
For registration and SMS verification, chat delivery and synchronisation, groups, purchases and restoration, we process the data necessary for the requested service on the basis of the contract (GDPR Article 6(1)(b)). This also covers support and optional features you choose to use, limited to the data necessary for that request. Security, abuse handling and preventing repeated free trials pursue legitimate interests (Article 6(1)(f)), to be balanced against your rights; you may object. Legal obligations apply only where relevant (Article 6(1)(c)). A phone permission alone is not GDPR consent. You need a verified number for online access; photos, location and notifications remain optional.
3. Private space and phone permissions
Documents
To attach a document, choose Document and select a file in the system picker, then check the preview and confirm sending. The app uses temporary copies without changing the original. In online chats, the file and its name are end-to-end encrypted; in personal notes, they stay local. You can explicitly choose to open or export a received document: copies saved or opened outside Nook are handled by the app or service you choose. Previews and exports can create temporary copies on the device.
Current location
Sharing your location is optional. Choose Current location: Nook requests location permission while you use the app and obtains a single point, shown in a preview before confirmation. It does not follow your movements or use location in the background. In online chats, the coordinates and map link are sent as end-to-end encrypted text. Opening the link is a separate choice and sends the coordinates to Google Maps or the map app handling it, under its privacy policy. If you report that message and explicitly choose to include its text, Nook moderators also receive the coordinates contained in the selected text.
Personal wallpapers
You can keep Nook’s original background, choose an included wallpaper or select your own photo using the system picker. The photo is processed on the device and stays in the app’s local data; in a private space, it is stored in that space’s encrypted archive. The wallpaper is not uploaded to the server or sent to chat participants. It does not change profile or group photos. The original in the gallery and any backup copies remain separate.
The private space is protected by a key derived from the passphrase chosen on your phone. This passphrase and the archive key stay on your phone. The device key for online messages and session tokens are stored using the system’s secure storage tools.
Regular conversations do not receive the same local encryption as the private archive. Attachment previews are temporarily decrypted for display. Originals remain in the gallery and any phone backups.
Media selection uses the system gallery; permissions are managed in your phone settings. This version does not import your contacts; approximate data inferred from IP addresses is described above. The app has no integrated advertising or behavioral analytics SDKs. No advertising profiling or automated decisions with legal effects are planned. For local reminders only: Reminder alerts are local and optional. The system receives only an opaque identifier, a due time and generic text, without a note, name, chat or private-space indicator. A local index encrypted with a device key keeps identifiers, due times and minimal technical data to maintain generic alerts when private space is locked. No push tokens are registered and no notes or due times are sent to a notification server. Permissions are requested when you enable the bell; Android may also require permission for exact alarms. A notification can reveal use of Nook. Sound, display and timing depend on system settings. Up to 60 future active alerts are allowed per account on the device across regular and private spaces.
Nook does not promise absolute anonymity, invisibility, screenshot prevention, equivalence to other messaging protocols or certified security. Nook’s cryptographic system has not undergone an independent audit. This information describes product limits and does not exclude mandatory rights provided by law. Chats that are private when the package is created stay hidden on the new device. Their archive and private password do not transfer: open them on the original device. Update both devices and create a NOOK-ID2 package first: old NOOK-ID1 packages cannot be imported. Without the original device or a compatible package, the key cannot be recovered.
Apple and Google Play purchases are verified by the server before account access is granted. Stripe is inactive. The records and recovery conditions for both stores are described on this page.
4. Recipients, infrastructure and transfers
The Nook server is configured on Supabase in the Paris region, European Union, for authentication, database, synchronization and storage of encrypted attachments. This refers to the project’s region: it does not mean that every provider’s operational activity takes place exclusively in the EU.
Twilio Verify handles sending and verifying SMS sign-in codes. It processes the recipient’s number and data needed for verification; mobile operators take part in delivery. Nook chats are not sent to Twilio as SMS.
Providers and subprocessors may process data outside the European Economic Area. The database's European region does not describe every processing location. For providers' public documentation, see the Supabase DPA, its subprocessor list and the Twilio privacy documentation. Contact the controller to find out the recipients, countries and safeguards applicable to your data, or to request a copy of available safeguards.
Support requests pass through the email services used by the sender and the support mailbox. Communications to authorities take place when required by law. Content encryption does not hide all service metadata.
5. Retention and deletion
Local data stays in the app’s container until removed by the available features or the system. Uninstalling may lose the only copy of your keys and private space; do not use it as a recovery attempt.
In updated versions with this feature enabled, online photos and videos expire 48 hours after actual sending, using server time, even if unread. The server blocks access and automatic cleanup removes the encrypted files; failures are retried. Incomplete uploads and orphan files in the new system are cleaned up after 24 hours. Text, captions and message metadata remain under the chat and account rules. Documents (up to 25 MiB) do not have this expiry. This change does not retroactively delete older attachments. Copies already saved to the gallery remain on the phone. “Delete for me” and “Delete chat” act on the device and do not delete copies on the server or the recipient’s phone. Recipient copies and gallery originals are managed separately.
File expiry does not automatically delete every item of metadata. The technical media register retains account, chat and message identifiers, path, size, encrypted-file fingerprint and dates after file removal; it currently has no separate automatic expiry. It does not contain the readable photo or video content.
The trial registry is active: deleting an account does not entitle the same verified phone number to another 30-day free trial. We retain a pseudonymized fingerprint of the number (HMAC) and the first trial start date for as long as Nook offers the 30-day trial, without storing the number in plain text in this registry.
To request deletion of your account or data retained by the controller, write to krelunaid@gmail.com. Options available for your account are in the Account tab. Proportionate information may be needed to verify that the request comes from the account holder. The 30-day free trial is available once per verified phone number. To prevent it from restarting after account deletion, we retain a pseudonymised fingerprint of the number (HMAC) and the original trial start date for as long as Nook offers this 30-day trial. This register contains neither the plain-text number nor messages and is not deleted with the account. For errors, reassigned numbers or data requests, contact Nook support.
When you replace or remove a photo, the previous photo can no longer be accessed through the service and its deletion from storage is requested. Files left behind following an error are cleaned up before the account is permanently deleted. This does not delete gallery originals, copies already viewed, or any backups.
The recovery record survives account deletion and is retained while the purchased access to the service remains recoverable, even if the free-trial offer ends. It is used to check purchase ownership and status; it does not recover lost messages or keys.
After deleting your previous account, you can request restoration using the same verified phone number associated with the original purchase and an authentic Apple purchase that is still valid. Nook checks the proof of purchase and its status with Apple before granting access to the new account. A refunded or revoked purchase does not qualify for restoration. If the checks fail, contact support.
Deleting the account removes its associated purchase data from Nook, including the purchase token. A separate private recovery record remains, containing the token hash, previous account and association identifiers, a pseudonymized fingerprint of the verified phone number (HMAC), state and dates. The HMAC key is separate from the free-trial key. This record contains no original token, plain-text phone number, messages or chat keys and has no automatic expiry. Contact support for information or data requests.
To recover a Google Play purchase after deleting the account, sign in with the same verified phone number associated with the original purchase and choose Restore purchases using the relevant Google Play account. Nook checks the valid purchase and its association with Google again. The previous Nook account must have been deleted and there must be no conflicting purchases or attempts. A refunded or revoked purchase does not grant access. Recovery does not restore messages or keys.
Support requests and reports are retained to handle the case, investigate abuse and protect rights where necessary; they currently have no uniform automatic retention period. Removing account identifiers does not necessarily anonymise a report's text. Log and backup retention and copies depend on providers' services: immediate deletion of every copy is not guaranteed. You may request clarification or an assessment of erasure of your data.
Request deletion of your Nook account
6. Your rights
Where the GDPR provides, you may request access, rectification, erasure, restriction and portability and object to processing based on legitimate interests. You may withdraw any consent without affecting earlier processing. Send requests to the controller: the ordinary GDPR deadline is one month; complexity or the number of requests may allow two further months, with reasons communicated within the first month. Requests are normally free. Identity checks must be proportionate: do not send passwords, SMS codes or private keys. You may also complain to the Italian Data Protection Authority or the competent authority.
This notice does not limit mandatory rights under the law applicable to your case. In the UK, the UK GDPR and the right to complain to the ICO may apply; in Switzerland, the FADP and the option to contact the FDPIC, with access requests normally answered within 30 days. Other countries may provide different rights and deadlines. Write to the controller stating the relevant country, without sending unrequested documents.
7. This website and updates
These pages contain no forms, application cookies, advertising tools or analytics scripts. The website is hosted on Cloudflare, through its static page hosting service. To deliver and protect pages, Cloudflare processes technical connection data, including IP addresses and traffic information. For its activities, see the Cloudflare Privacy Policy. We do not use audience analytics on this website. External links open at your choice and have their own privacy notices. The date above identifies this revision; it does not retroactively change earlier texts or choices. Substantial changes in processing require appropriate information, rather than blanket consent to every update.
Message notifications
When message alerts are available and enabled, Nook registers a device token and technical installation and session identifiers on the server. A device-specific list permits alerts for regular chats and groups; private conversations are excluded. Apple APNs or Google FCM receive the token, opaque identifiers and generic text, without names, message content or a private-space indicator. Delivery and display depend on the system and service availability. An alert already sent to the system cannot always be recalled. A notification can show that you use Nook. You can disable alerts in the app or phone settings.
Notification registration expires 30 days after its last renewal; the app may renew it when active again. The service also removes it on revocation, account deletion or an invalid token. Queued notifications have a useful lifetime of 5 minutes and their records are deleted after 7 days. These periods do not describe Apple or Google's own possible logs.