Privacy Policy

Last updated: July 16, 2026

NokoChat is built to know as little about you as possible. No ads, no analytics, no trackers, no third-party SDKs watching what you do. This page describes everything the app and our servers touch.

Your chats stay on your device

Conversations are stored locally on your device, encrypted at rest (hardware-backed keys where your device supports it). We do not sync, store, or read your chat history on our servers.

To generate an AI reply, the messages of the active conversation and the active character/persona description are transmitted over an encrypted connection to our API and relayed to our AI inference provider (OpenRouter, routed to the model's compute provider) for the duration of the request. These requests are used to produce the reply and meter usage — we do not retain conversation transcripts server-side.

What we store server-side

• Account: your nickname, passkey public keys (we never see private keys), optional avatar image, account creation date, and tier/badges.
• Sessions: sign-in session records (device platform label, timestamps) so you can review and revoke devices.
• Usage metering: daily/monthly token and cost counters used to enforce your plan's allowance. Counters, not content.
• Billing: subscription/credit purchase verification records from Google Play or the App Store (store tokens and product ids — never your card details, which the stores keep to themselves).
• Explore submissions: characters you publish to the marketplace, which are public by design.
• Reports: if you report an AI reply or a marketplace character, the reported content and your reason are stored for moderation review.

What we never collect

• No email address, phone number, or real name — sign-up is a nickname plus a passkey.
• No analytics, telemetry, crash reporters, ad identifiers, or tracking of any kind.
• No server-side chat history.
• No location data or contacts.

Security

All traffic uses TLS with certificate pinning. Sensitive local data (chats, session tokens, characters) is encrypted at rest with keys held in your device's secure hardware (Android Keystore / Secure Enclave) where available. Authentication is passkey-only — there is no password to leak.

Retention & deletion

Administrative audit records are kept for 90 days. Usage counters persist while your account exists. You can delete your account at any time in the app (Settings → Account → Delete account) — this permanently removes your account, passkeys, uploaded characters, and associated server data. See account deletion for details, including how to request deletion without the app installed.

Children

NokoChat is not directed at children and is rated accordingly in the app stores. Do not use NokoChat if you are under the minimum age shown in your store's listing.

Changes & contact

We'll update this page when practices change and note the date above. Questions: support@noko.chat.