Privacy Policy

Nil, hosted by NØNOS. Effective date: 19 October 2026

This policy explains what personal data Nil, hosted by NØNOS, processes, why, for how long, and what rights you have. It covers the sign-up page at https://nil.nonos.app, every workspace at an address such as https://yourteam.nil.nonos.app, and these pages at https://nonos.app.

In short

• You sign in with an Ethereum wallet. We don't ask for an email address, a password or a phone number.
• Docs and private tasks are encrypted in your browser, and we can't read them. Everything else in a workspace is stored in readable form on our server. We don't look at it, but we could.
• Nil loads nothing from other sites and has no analytics or trackers. The sign-up page and these pages set no cookies. A workspace sets one cookie to keep you signed in.
• Our web server keeps no access log. Our software uses IP addresses in memory for rate limits and doesn't write them to disk.
• Backups are encrypted and kept for 30 days.
• We don't sell data, show ads or build profiles.

1. Who is responsible

eK NONOS, an individual based in Italy, is the controller for the processing in this policy, except for workspace content (see section 2).

Contact for anything about your data: ops@nonos.app. Mail to that address is forwarded by Cloudflare Email Routing to the operator's own mailbox.

We have not appointed a data protection officer.

2. Our two roles

For the sign-up page, our records of workspaces, billing, logs, alerts, security, emails to us and these pages, we decide why and how data is processed. For those, we are the controller.

What a team puts into its workspace is the team's decision. The workspace owner, or the organisation the owner acts for, is the controller of that data. We process it on their behalf as a processor under Article 28 GDPR. Section 15 of our Terms of Service is the processing agreement.

If you are a member or a guest of a workspace and have a question about its content, ask its admins first. We will help them answer.

3. Signing up

When you sign up on nil.nonos.app, we process:

• the address you choose for your workspace;
• your wallet address, and your signature of the sign-up message. We check the signature and don't keep it;
• the setup code we give you, until the workspace is set up;
• your IP address, in memory only, to limit sign-ups per network. It is never written to disk.

If your sign-up waits for approval, we keep the address you asked for, your wallet address and the setup code until we approve or reject the request, and for 7 days at most.

For each workspace, our control plane keeps its address, the owner's wallet address, its state, app version and resource plan, when it was created, suspended or scheduled for deletion, how much disk it uses, whether its setup was finished, and when its data last changed. That last one comes from the time stamps of its database files, not from their contents. It also keeps a history of what we did with the workspace, such as backups and upgrades. It keeps nothing about your members or your tasks.

We process this to provide the service you sign up for (Article 6(1)(b) GDPR). We apply the limits in our legitimate interest in keeping the service available and free of abuse (Article 6(1)(f)).

We keep the record for as long as the workspace exists. When a workspace is erased, we remove the owner's wallet address and keep only the workspace's address, for 90 days, so nobody else can take it.

4. Wallets and signing in

Inside a workspace, your wallet address is your account. To sign in, your wallet signs a message the server wrote. The server checks the signature and doesn't keep it. If your wallet is a smart-contract wallet, the server asks the Ethereum node whether the wallet accepts the signature (see section 9).

The workspace stores the wallet addresses linked to your account, the names you give them, and when you were last seen. You and the admins can see your wallet addresses. Other members see the name you picked. The one exception is the wallet that signed your encryption keys: members see its address next to your key fingerprint, so they can check your key.

Some signatures are kept, because their purpose is to be checked later: the signature that publishes your encryption keys, and your signature on a signed vote, together with your wallet address and your choice. People who apply for a bounty on a public bounty board leave their wallet address, a name and a short pitch.

A sign-in session is a random token. The workspace stores only a hash of it, so a copy of the database can't be used to sign in.

We process this on the team's behalf, as part of the workspace.

5. Workspace content

Encrypted in your browser

We can't read these. The server stores them only in encrypted form:

• docs: their titles, text and saved versions;
• private tasks: their title, notes, checklist, comments and attached files, file names and types included;
• the ballots of encrypted votes, and who cast an anonymous vote;
• your encryption keys, which the server holds only locked to your wallets and passkeys.

Your wallet's private key and recovery phrase never leave your wallet.

Stored in readable form

These are stored as written, in your workspace's own storage on our server:

• team tasks, their comments and their history, and files attached to them, with their names;
• the size of every file, encrypted ones included;
• goals, projects and labels;
• time entries, reminders and their notes;
• notifications, the activity history and the sign-in history;
• the member list, with names, roles and linked wallet addresses;
• the names of your passkeys, when each was added and last used, and whether you downloaded a recovery kit, but never the kit itself;
• for members who joined through the token-holder door, which account each wallet's NOX last counted for, kept until 3 days after it last counted;
• bounty amounts and payment records, Nil Pro invoices, and signed votes with each voter's wallet and choice;
• for private tasks: that they exist, who created them, who they are assigned to, their status, dates, project and labels;
• for docs: who can read each one, who changed it and when.

What that means

We don't look at workspace data. Our control software never opens a workspace's database or files. It handles them only as an encrypted backup stream or as file names. But we run the server and hold the backup keys, so we are technically able to read the readable part, and a court could order us to hand it over. Docs and private tasks would only ever be handed over encrypted.

That protection depends on your browser running Nil's published code. Anyone can check what a workspace sends against a public release, byte for byte, as docs/verify-a-server.md in the source code explains.

We process workspace content on behalf of the team (Article 28 GDPR), and the team decides how long it stays. Admins can have finished tasks, comments and history erased automatically after a set time. Some things are always erased on a schedule: deleted tasks after 30 days in the trash, read notifications after 90 days, and expired sessions and invite links. Before each upgrade, a copy of the workspace's database is kept on the server for up to 7 days, in case the upgrade has to be undone.

6. Cookies and browser storage

The sign-up page at nil.nonos.app sets no cookies.

A workspace sets one cookie when you sign in. It is called __Host-nonos and holds a random session token, so the workspace knows it is you. It is HttpOnly, Secure and SameSite=Lax, and it lasts 30 days or until you sign out. It is strictly necessary for signing in, so it needs no consent.

The app also keeps some data in your browser's local storage: display settings such as filters and list views, which wallet you chose, and records that let your browser check teammates' keys and notice an older version of a doc, task or comment. Session storage holds one value that stops the app from reloading in a loop. A service worker keeps a copy of the app's own files, never your tasks, so the app opens quickly. This data stays on your device and makes the app work. We don't use it to track you.

These pages at nonos.app set no cookies and use no browser storage.

Your wallet extension or wallet app makes its own network requests, which Nil doesn't control.

The legal basis is the contract (Article 6(1)(b) GDPR), and storing this on your device is strictly necessary for the service you asked for.

7. IP addresses, logs and alerts

Our web server, Caddy, sees the IP address of every request, as any web server does. It keeps no access log.

The sign-up page and the workspaces use your IP address, in memory only, for rate limits and to check that a sign-in is finished from the same network that started it. Our software doesn't write it to disk. The counters are cleared when their time window ends.

These are the logs we keep:

• The control plane's log records events, such as a workspace being created, backed up or upgraded. It names workspaces by their address and wallets only by a keyed hash, never by the wallet address itself. It never records IP addresses. It keeps at most five files of 10 MB, plus the same again in its container log.
• Each workspace's app log records times and events. It never records request contents, cookies or headers, and it doesn't record IP addresses. It keeps at most three files of 10 MB per workspace.
• Caddy's own log of its operation, such as certificate renewals and errors, keeps at most five files of 10 MB.
• The server's system journal records logins to the server itself and other system events, which can include IP addresses. It keeps at most 14 days. Addresses that keep failing to log in to the server over SSH are blocked for an hour, and for up to a week if they return.

Apart from the system journal, these logs are limited by size, not by time. Old lines are overwritten as new ones arrive.

When something needs attention, such as a failed backup or a workspace that keeps restarting, our control plane sends an alert to our private Telegram group through a Telegram bot. Alerts contain workspace names and event types, never wallet addresses or workspace content.

We process IP addresses, logs and alerts in our legitimate interest in running the service securely and fixing faults (Article 6(1)(f) GDPR).

8. Backups

Every night we back up each workspace and our control plane's own records. Backups are encrypted on the server before they are stored, with public keys only. The secret keys that can open them are kept offline, never on the server.

The encrypted backups are stored on our own server at Cherry Servers in Lithuania, under random workspace identifiers rather than names. Each backup is kept for 30 days and then deleted.

We may later add an encrypted copy in another location. If we do, we will update this policy first.

A backup holds what the workspace holds. The readable data in section 5 is readable to us in a backup too. Docs and private tasks stay encrypted. The backup of our control plane holds the records in section 3, owners' wallet addresses included.

We keep backups so we can restore the service after a failure: for workspace content on the team's behalf, and for our own records in our legitimate interest (Article 6(1)(f) GDPR).

9. Ethereum lookups and payments

Some features depend on the Ethereum blockchain: Nil Pro payments, bounty payments and private payouts, votes weighted by tokens, the token-holder door, staking discounts, Zero-State Pass perks, and signing in with a smart-contract wallet. For these, the server asks an Ethereum node about particular wallet addresses and transactions. When you move a private payout, the server passes the transaction you signed on to the node.

We use Alchemy and Infura as Ethereum nodes. They see which addresses and transactions the server looks up, and the server's IP address. They don't see yours.

To check the nodes' answers, our verifier also follows the chain through public beacon chain services from PublicNode and ChainSafe (Lodestar). They learn only that a light client is following the chain, never what Nil looks up.

Payments on Ethereum are public, like any transaction. Anyone can see the paying wallet, the amount and the time. The amounts that different workspaces are asked to pay are shuffled, so the chain doesn't show which payments came from the same workspace. We can't change or delete anything on the blockchain.

For Nil Pro, we process payment records to provide the service and to keep our accounts (Article 6(1)(b) and (c) GDPR). For team features such as votes and the token-holder door, we make these lookups on the team's behalf.

10. AI and tools you connect

Hosted workspaces send nothing to an AI provider. Built-in AI is switched off, and a workspace has no network route to reach an AI service.

You can connect your own AI assistant, a script or an external agent to a workspace with an access key, or add a calendar feed link to a calendar app. These fetch data from the workspace. Your own assistant sees what you can see. An agent sees the team tasks an admin allows it to see. Neither can read docs or the words of private tasks. A calendar feed lists the open tasks assigned to you that have a due date. Whatever these tools fetch goes to that service and its provider, under their terms. Connecting them is your choice or your team's, and we are not part of it.

11. Email to us

If you write to ops@nonos.app, Cloudflare Email Routing forwards your message to the operator's own mailbox. We process your email address and what you write, to answer you. The legal basis is the contract (Article 6(1)(b) GDPR) or our legitimate interest in answering (Article 6(1)(f)). We keep your email as long as we need to deal with your request, and longer only where the law requires it.

12. These pages and DNS

These pages at nonos.app are served by Cloudflare Pages. Cloudflare processes your IP address and the details of your request to deliver them, as any web host does. The pages set no cookies, run no scripts and load nothing from other sites. We process this in our legitimate interest in publishing these pages (Article 6(1)(f) GDPR).

Cloudflare also answers DNS lookups for nonos.app and nil.nonos.app. Traffic to the sign-up page and to workspaces doesn't pass through Cloudflare. It goes straight to our server.

13. Who receives data

• Cherry Servers (UAB Cherry Servers, Lithuania) provides our dedicated server in Lithuania. The sign-up page, our control plane, every workspace and the encrypted backups are on it.
• Alchemy and Infura (United States) provide Ethereum node access, as section 9 describes.
• PublicNode and ChainSafe provide public beacon chain data to our verifier. They receive no personal data from us.
• Cloudflare (United States) runs DNS for our domains, serves these pages, and forwards email sent to ops@nonos.app.
• Let's Encrypt (United States), with ZeroSSL as a fallback, issues our TLS certificates. They receive the domain names the certificates are for, not data about visitors.
• Telegram receives our operational alerts in a private group, through a Telegram bot. Alerts contain workspace names and event types, never wallet addresses or workspace content.
• Public authorities, but only where the law obliges us.

We have no other recipients. We don't share data with advertisers or data brokers.

14. Transfers outside the EU

Our server and our backups are in Lithuania. Some of our providers are based outside the EU: Alchemy, Infura, Cloudflare and Let's Encrypt are in the United States, and Telegram is outside the EU as well.

Where personal data goes to one of them, we rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission's standard contractual clauses. You can ask us about these safeguards, and for a copy, at ops@nonos.app.

15. How long we keep data

• IP addresses used for limits stay in memory only and are cleared when their time window ends.
• A sign-up that waits for approval is kept until we decide, and for 7 days at most.
• A setup code is kept until the workspace is set up.
• A workspace whose setup isn't finished within 30 days is removed, without a backup.
• We don't pause or delete workspaces for being idle.
• Our record of a workspace is kept while the workspace exists. After it is erased, only its address is kept, for 90 days.
• Workspace content is kept as long as the team keeps it, within its own retention settings, until the workspace is erased.
• A workspace you ask us to delete is erased 14 days after your request, unless you change your mind.
• Copies of a database taken before an upgrade are kept for up to 7 days.
• Backups are kept for 30 days.
• The session cookie lasts 30 days, or until you sign out.
• Logs are kept as section 7 describes. The system journal keeps 14 days.
• Emails are kept as long as we need them for your request.

16. What is public

Some things are public by design:

• payments on Ethereum;
• your workspace's address, since the sign-up page tells anyone whether an address is taken;
• without signing in, anyone can see a workspace's name, whether its token-holder door is open and its minimum, its public proof key, its public bounty board, anything shared through a share link they hold, and the tasks in any calendar feed link they hold.

17. Your rights

Under the GDPR you have the right to:

• get a copy of your personal data and information about how we use it (Article 15);
• have wrong data corrected (Article 16);
• have data erased (Article 17);
• have processing restricted (Article 18);
• receive your data in a machine-readable format (Article 20);
• object to processing that is based on our legitimate interests (Article 21).

To use them, write to ops@nonos.app. Your account is a wallet, so we may ask you to sign a short message with that wallet to show that the request is yours. Signing is free. We answer within one month.

There are some limits. We can't change or delete what is on the Ethereum blockchain. We can't decrypt docs or private tasks, so we can't hand you their contents, but you can open and export them yourself. For data inside a workspace, the team is the controller: ask its admins first, and we will help them. Much of it you can see, correct and export yourself in the app.

18. Complaints

You can complain to the Garante per la protezione dei dati personali, Italy's data protection authority, at garanteprivacy.it. You can also complain to the data protection authority of your own EU country, where you live or work, or where you think the problem happened.

19. No selling, no ads, no profiling

We don't sell personal data, show ads or build profiles. We don't use your data for automated decisions that have legal or similarly significant effects on you. Some things happen automatically, such as rate limits at sign-up and removing a workspace whose setup was never finished. Rules a team sets for itself, such as the token-holder door, run automatically too.

20. Do you have to give us data?

You need a wallet to sign up and to sign in. Without a wallet address we can't create an account for you. What you put into a workspace beyond that is up to you and your team.

21. Security

• Each workspace runs in its own container, with its own storage and network, and has no route to the internet or to other workspaces.
• Docs and private tasks are encrypted in the browser with keys the server never has.
• Session and access tokens are stored only as hashes.
• Deleted rows are overwritten in the database file.
• Backups are encrypted with public keys. The keys that open them are kept offline.
• The server has no swap, so what is in memory isn't written to disk that way.
• No part of Nil's own code has had an independent security audit. We say so plainly so that you can decide what to store.

To report a security problem, follow SECURITY.md in the source code.

22. Children

The service isn't meant for children. You must be 18 or older to sign up (Terms, section 2).

23. Changes to this policy

We may update this policy. We publish every new version on this page with a new effective date. If we add a new provider that receives personal data, we list it here at least 30 days before it starts.