Privacy and safety

• Your conversations, facts, promises and questions are stored in Nirvaana's database. They are not deleted when a conversation ends, which is the point.
• The app reads them as you. The rule is enforced in the database, not in the app's code, so a bug in a page cannot leak somebody else's rows.
• Nirvaana asks Anthropic's models to write its replies, so the words in your conversation go to a model to be answered. That is how it works, and it is worth knowing. A few things go without a message: each week a world's facts and rules are sent so the model can write the world's description, and some checks run when a fact is filed. The Privacy policy lists them.
• Only addresses on the list, or on a company's approved domain, can sign in at all. An address gets onto the list when it signs up. Take an address off the list and that account stops working on its next page load.
• Signing in also takes a second code, for everyone: from an app on your phone, or emailed to you. Like the list, the rule is held in the database as well as the app: a sign-in that has not given the code cannot read a single row.

• A private fact cannot be moved into a shared world behind your back. Sharing needs your yes, and the card asks you before it happens.
• What Nirvaana keeps about you is never repeated to another user, never proposed to a group on its own, and never used as leverage.
• Nirvaana never asks you for secrets. It does not want your passwords, and it should never draw something out of you that you did not choose to say.

We record that things happened, never what was in them. An event carries an identifier, a type and an outcome. It cannot carry a sentence: anything longer than a short code word is dropped before it is sent, and email addresses are dropped too. Page views carry the page's path and what the analytics script sends by default, such as your browser, operating system, device, screen size, language, time zone and how long you stayed.

Screen recording is off. You can turn analytics off in Settings, under Privacy, and it never runs for anyone under 18.

• Direct messages are read by the two of you and nobody else. They never reach a model, except the words you ask Nirvaana in a chat, or an AI tool you connected, to send as one, which are part of that chat. They are not in Download my world. If either of you deletes your account, the whole conversation goes, for both of you.
• A Slack export you upload is deleted once its channels are read, or a few hours after the import goes quiet, and what was read from it after about seven days. The channels you pick are read by Anthropic's model to draft worlds; nothing is made until you press Create.
• A GitHub repo connected to a world sends merged pull requests, issues and releases. Their titles and the start of their descriptions go to the model, and anything it keeps waits for the owner's approval.

The Privacy policy has the detail for each.

Every reply takes real work to run. So there are hard limits, checked before anything runs, not after:

• A limit on how much one account can use in a day, and in a calendar month.
• A limit across everybody, per day, so one problem cannot drain the whole thing.
• A limit on one answer: how long it can run, and how many steps it can take.
• A limit on how fast you can send messages, and on how long one message can be.
• A switch that stops all of it at once, if something is going wrong.

You will know a cap was reached because Nirvaana tells you plainly:

• Your day's limit: “That's today's chat here.” It says when chat is back, in your own time, and what still works until then.
• Your month's limit: “That's this month's chat here. It's back on the 1st.”
• “Nirvaana is paused right now.” — everything is paused for a while. Nothing is lost.
• “One moment. Let's take that a little slower.” — too many messages too fast. Wait a few seconds.
• “That's more than I can read at once. Could you send it in smaller pieces?” — the message was too long. Break it up.

The messages never quote a number, on purpose. Pacing it is our job, not something you should have to ration yourself against.

Anywhere it can act for you, it asks first and waits for you to say yes in that same conversation, and your yes covers only the thing it asked about.

It will not get around anyone's lock. If a door is yours to open, it asks you to open it. If a door is somebody else's, it stops and says exactly where it stopped.

It is not meant to be your only person to talk to. When somebody you know has already solved the thing, it should say so and suggest you call them. If you are carrying something heavy, it will be warm about it and point you toward real people and real help. If you or someone else may be hurt, it names real help first: emergency services, a crisis line, a doctor, someone nearby.

This page explains how privacy works in practice. The Privacy notice and the Terms are the formal versions. If the two ever disagree, those are the ones that count, and the disagreement is a mistake worth telling us about.

Write to hello@nirvaana.ai and say what you saw on screen; a person answers. Download my world and Delete my account are in Settings. Download my world does not yet hold everything (the Privacy policy lists what it leaves out); ask, and we send the rest.