Privacy policy
Last updated
This policy explains what personal data Nohead collects when you use the website, web app, API, CLI, SDKs and MCP server, why, how long we keep it, and how to use your rights. We collect as little as we can: no analytics, no advertising and no tracking cookies.
Who is responsible
The controller of the personal data described here is Nohead. Write to hello@nohead.io with any question or request.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: your email address and the name you set | Signing you in, showing who made a change, sending sign-in codes and invitations | Contract |
| Memberships and invitations: the organizations you belong to, your role, and the email addresses you invite | Giving people access to the organizations and projects they were invited to | Contract; for invitees, the inviting organization’s legitimate interest |
| History: which account or API key made each change, and when | Revision history and the activity log, which customers rely on to see and undo changes | Contract; legitimate interest in an accurate record |
| Sign-in codes and sessions, stored as one-way hashes | Signing you in and keeping you signed in | Contract |
| Request logs: time, path (without query string), status, browser user agent, internal account and project IDs; our hosting provider’s logs also record IP addresses | Running the service, investigating errors and abuse, security | Legitimate interest |
| Rate limiting: IP and email addresses, held for minutes | Stopping password-guessing and abuse | Legitimate interest |
| Error reports: the error, the page or endpoint, browser and internal IDs, without IP addresses, cookies, headers or request bodies | Finding and fixing bugs | Legitimate interest |
| Email delivery: whether our emails to you were delivered, bounced or marked as spam | Not emailing addresses that bounce or complained | Legitimate interest |
| Billing: the organization’s Stripe customer and subscription references (card details go to Stripe, never to us) | Paid plans, once available | Contract; legal obligations for tax records |
| Messages you send us | Answering you | Legitimate interest |
“Contract” means we need the data to provide the service you signed up for. Where we rely on legitimate interest, you can object (see your rights). We do not sell personal data, use it for advertising, or make decisions about you by automated means alone.
The website
This website sets no cookies and runs no analytics. Our hosting provider keeps short-lived request logs, including IP addresses, to deliver and secure the site.
Cookies and browser storage
The web app sets two cookies you need to use it and one that remembers a preference. None of them tracks you, so there is no consent banner.
__Host-nohead_session: keeps you signed in. It is set when you sign in and lasts 30 days, until you go a week without using the app, or until you sign out.__Host-nohead_device: protects your sign-in. It ties each sign-in code to the browser that asked for it, and remembers that you have signed in from this browser, so nobody else can lock you out. It is set when you ask for a code and lasts a year.sidebar_state: whether the sidebar is open or closed, for 7 days.
The web app also keeps your theme and the last project you opened in your browser’s local storage, and where you were headed before signing in in its session storage. They never leave your browser.
Data our customers store
Organizations decide what goes into their projects. If they store personal data in records or files, the organization is the controller of that data and we process it only on its behalf, under our terms. If your data is in someone’s project, ask them first; we will pass requests on where we can. A data processing agreement is available on request.
Who we share it with
We use a small set of providers to host and run the service, listed with what each handles on the subprocessors page. They process personal data only on our instructions. We also disclose data when the law requires it, and only as much as it requires.
Where it is stored
The service runs in the United States, so personal data is transferred there. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in our agreement with the provider.
How long we keep it
| Data | Kept for |
|---|---|
| Account | Until you delete it on your account page, or ask us to |
| Sign-in codes | 10 minutes, deleted within the hour |
| Sessions | 30 days, or until you sign out |
| Invitations | Until accepted or revoked; they expire after 14 days |
| Rate-limit counters | Minutes |
| Request logs | Up to 30 days |
| Error reports | Up to 90 days |
| Revision history and activity log | As long as your organization’s plan keeps them (see pricing), and for 30 days after a downgrade as long as the previous plan did; records always keep their first and latest 10 revisions |
| Webhook delivery history | 30 days |
| Deleted organizations, projects, records and files | 30 days in which they can be restored, then permanently deleted |
| Backups | Up to 30 days, after which deleted data is gone from them too |
| Email delivery status | Until the suppression is lifted or you ask |
| Emails we send | 45 days at our email provider (content and delivery) |
| Billing records | As long as tax law requires |
Your rights
You can ask us to:
- give you a copy of your personal data (access and portability);
- correct it (you can change your name on your account page);
- delete it (erasure);
- restrict how we use it, or stop using it where you object.
You can delete your account yourself on your account page in the app, confirming it with a code we email you. For anything else, email hello@nohead.io from the address you sign in with; we answer within one month.
When an account is deleted, we remove its email address and name, end its sessions and memberships, revoke the invitations it sent, and remove the address from invitations sent to it. Changes it made stay in its organizations’ history as “Deleted user”. Organizations it was the only member of are deleted with it. While it is the only owner of an organization with other members, make someone else an owner or delete the organization first. Copies in logs, error reports and backups expire on the schedule above. Signing in with the same address later starts a new account.
If you are unhappy with how we handle your data, tell us, and you can also complain to Datatilsynet (the Danish Data Protection Agency) or the data protection authority where you live or work.
Security
Data is encrypted in transit and at rest. Sign-in codes, sessions and API keys are stored only as hashes, every project is isolated from every other, and access to production is limited to the people who run the service.
Children
Nohead is a tool for businesses and developers and is not meant for anyone under 16.
Changes to this policy
We update this page when what we collect or how we use it changes, and announce material changes by email. The date at the top shows the latest version.