Privacy policy

Effective 6 October 2026 · Noma is in free beta

1. Who we are
2. What we collect and why
3. Content from other services
4. Who processes data for us
5. Why we're allowed to
6. How long we keep it
7. Deleting your data
8. Your rights
9. Age limits
10. Security
11. Changes
12. Contact and grievances

1. Who we are

Noma (the desktop app for Windows and macOS, the Android and iPhone apps, and this website) is run by the Noma team ("we", "us"). We decide how your personal data is used, so we are its controller (the "Data Fiduciary" under India's Digital Personal Data Protection Act). Questions, requests and complaints: the Feedback form on our website.

2. What we collect and why

Noma on your PC

The desktop app works without an account. It watches the coding agents you connect (such as Claude Code, Codex or Cursor) on your own computer and shows you their requests. Your settings, approvals, focus timer, reading list and positions, tasks and agent chat history are stored on your PC and are not sent to us. What you type to an AI agent goes from your PC to that agent's own provider under their terms, not through Noma's servers.

Your account

You need a free account to link your phone or to use Builders. You can sign in with an email link, Google or GitHub. We store, with our database provider Supabase:

• your email address and how you signed in;
• your display name and profile picture (taken from Google or GitHub if you sign in with them; you can change them);
• if you add them: a short bio, what you're building, interests, and a phone number (only visible to you).

We use this to sign you in, show your name and picture to the people you chat with in Builders, and contact you about your account. Sign-in emails are sent through Resend.

Phone and PC

When you pair your phone with your PC, they exchange keys directly (by QR code). After that, everything between them (agent requests, your answers, prompts, replies, usage numbers) is end to end encrypted and passes through Noma's relay, which runs on Cloudflare. The relay can't read the content. It does see what any server needs to deliver a message: your account and device ids, your IP address, when messages are sent and how big they are. It does not keep a history of your messages. Your pairings are stored on your devices.

Builders (chat with other builders)

Builders is for adults (18+) only. When you look for someone, Noma's matching service pairs you with another builder. The chat itself goes directly between your two devices, end to end encrypted, and is relayed through Cloudflare's servers (TURN) so your chat partner does not see your IP address. Noma does not store your chat messages.

What we do keep:

• who you matched with, how many times and how long you chatted, so we can match you well and avoid repeats;
• the vibes you send and receive;
• the name, picture and "building" text you chose to show, which your match sees during the chat;
• reports. When you report someone, you choose a reason, can add details, and the report includes up to the last 50 messages of that chat so we can check what happened. Reports are read by us to keep Builders safe and can lead to a ban.

GitHub for git

If you connect GitHub in the desktop app (Settings → GitHub), GitHub gives your PC an access token with the repo and workflow scopes so your agents can push and pull. The token is stored in your operating system's keychain on your PC and is never sent to Noma's servers. Git talks to GitHub directly. You can disconnect in the app, and revoke the token at any time at github.com/settings/applications.

Feedback form (this website)

When you send feedback we store your email address (to reply), your message, its type, the page you sent it from, your browser's user agent, and a salted hash of your IP address (only to limit how many messages one person can send per day; the IP itself is not stored). We keep feedback for 12 months and then delete it automatically. If a "verify you're human" check is shown, it is Cloudflare Turnstile.

This website and downloads

The site uses no analytics and no cookies. It remembers your light or dark choice in your browser only. We count downloads per platform (just a number for Windows, macOS, Android and iPhone, nothing about you). The site is hosted on Cloudflare, which processes your IP address to deliver pages and protect against attacks. Fonts are loaded from Google Fonts. PC installers download from GitHub Releases.

Crash reports

When crash reporting is turned on in a release, the desktop app sends error reports to Sentry: the error, the app version, your operating system and a stack trace. Your home folder is removed from file paths and messages before sending, and no IP address or user details are attached.

3. Content from other services

Some break activities load content straight from other services. Those requests go from your device to them, so they see your IP address and their own privacy policies apply:

• News: headlines from Google News RSS and the publishers' own sites. To pick your country's news, Noma asks ipwho.is for the country of your IP address. You can turn this off with Personalize news by location in Settings. Site icons are fetched through Google's favicon service.
• Games: from Poki. Poki's privacy policy and cookies apply while you play.
• Books: free books from Project Gutenberg, found through Gutendex.
• Updates: the desktop app checks GitHub Releases for new versions; the Android app checks this website.

4. Who processes data for us

We use these providers to run Noma. They process data on our behalf, or (for content you open) under their own policies:

Some of them process data outside your country, including in the United States. Where the law requires it, we rely on their standard safeguards, such as the EU Standard Contractual Clauses. We don't sell or rent personal data, and we don't share it for advertising.

5. Why we're allowed to

• To provide what you asked for (your account, pairing, Builders, replying to feedback): performance of our agreement with you.
• To keep Noma safe and working (reports and bans, rate limits, abuse prevention, crash reports): our legitimate interests, which we balance against yours.
• Optional features (personalized news, GitHub for git, Builders): your choice to turn them on, which you can withdraw at any time by turning them off.
• When the law requires it, for example to answer a valid legal request.

6. How long we keep it

7. Deleting your data

• In the app: open Settings and choose Delete my account. This deletes your account, profile and the data linked to it on our servers. Reports others filed about you may be kept while needed for safety.
• By message: write to us through the Feedback form on our website, using the email you signed up with.
• On your devices: uninstall Noma. On the PC you can also disconnect GitHub first, and revoke its access at github.com/settings/applications.
• Feedback: email us and we'll delete your messages earlier than 12 months.

8. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we have about you and give you a copy (access and portability);
• correct it if it's wrong or incomplete;
• delete it;
• stop or limit using it, or object to uses based on legitimate interests;
• withdraw consent you gave, at any time (this doesn't affect what we did before).

If you are in the EU, the UK or similar places (GDPR), you can also complain to your data protection authority. If you are in India (Digital Personal Data Protection Act, 2023), you can ask for a summary of your data and who it was shared with, correction and erasure, nominate someone to act for you, and raise a grievance with us; if you're not satisfied with our answer, you can complain to the Data Protection Board of India.

Send requests through the Feedback form on our website. We may ask you to confirm it's really you, and we aim to reply within 30 days.

9. Age limits

Noma is not meant for children under 13, and Builders is only for people 18 and over. If you are under 18, use Noma only with your parent's or guardian's permission, and don't use Builders. If we learn that a child under 13 has given us personal data, or that someone under 18 is using Builders, we will delete the data or close the account. Tell us at the Feedback form on our website if you think this has happened.

10. Security

Phone and PC messages and Builders chats are end to end encrypted. Connections to our servers use HTTPS. Account data is protected by row-level access rules so each person can only read their own private data. Tokens on your PC are kept in your operating system's keychain. No system is perfectly secure; if something goes wrong that affects you, we'll tell you and the authorities as the law requires.

11. Changes

Noma is new and this policy will change as it grows. We'll update the date at the top, and for important changes we'll tell you in the app or by email before they apply.

12. Contact and grievances

The Noma team · Feedback form
This form is also our grievance officer contact under India's DPDP Act.