Privacy Policy

What Nod collects, why it needs it, who handles it, how long it's kept, and how to delete it.

Last updated 31 October 2026. Nod is run by Muhammad Rashid.

Who runs Nod

Nod is an AI assistant for iPhone. It reads the email, calendars and GitHub activity you connect, tells you what matters, and drafts replies. Nothing is sent until you approve it.

Nod is run by Muhammad Rashid, who is responsible for your data as its controller. "We" in this policy means Nod. The policy covers the app, the service behind it and this website.

Some connections aren't open to everyone yet. Connecting Google directly is limited to invited people until Google finishes its review, and WhatsApp and Instagram are waiting on Meta's approval. They're covered here so you know what happens when they open.

What we collect

Your account: Your sign-in details, email address and name, what you tell Nod about yourself, your time zone and settings, and when you agreed to AI processing and natural voice.
Connected accounts: Messages, senders, recipients, subjects and summaries from the mailboxes and chats you connect, the drafts Nod writes for you, and encrypted credentials for those accounts.
Calendar: Your calendars and events, read when Nod needs them. Events Nod creates for you stay in your calendar.
GitHub: Your notifications, repositories, commits, issues, pull requests and CI results, read when you ask. What Nod reads stays in that chat.
Chats: What you say or type to Nod, including what you ask it to find, and its replies.
Your voice: Nod turns speech into text on your iPhone where the device supports it. Otherwise Apple's speech service does. We receive the text, not the audio.
Your plan: Which plan you're on, when it renews, and Apple's reference for your subscription. Apple takes payment, so we never see your card or Apple Pay details.
Device and usage: Your device's notification token, and counts of how much you use the assistant and natural voice, to apply your plan's limits.
Technical data: Your IP address, which we store only in hashed form to limit repeated sign-in attempts, and server logs of each request, such as the time, the address asked for and the app version. The logs don't contain message text.

Messages you connect include other people's names, addresses and words. We handle those the same way as yours, and only to run Nod for you.

We don't ask for your contacts, location, photos or health data, and we don't use analytics or advertising tools.

How we use it

Only to run Nod for you: to sort your messages, summarise them, answer your questions, write drafts, send what you approve, and notify you about urgent messages and, unless you turn it off, with a morning briefing. We do not sell your data or use it for advertising, and we don't track you across other companies' apps or websites.

If you're in the EEA, the UK or Switzerland, these are our legal bases:

Running Nod and your plan: Contract: we need this to give you the service you asked for.
Sending your data to Anthropic: Your consent, given in the app before anything is sent.
Natural voice: Your consent, given separately.
Security and stopping abuse: Legitimate interests: protecting you and the service.
Legal requests: Legal obligation.

Nod's AI decides which messages look urgent and which need a reply. That only changes how they're sorted for you. It makes no decision with a legal or similarly significant effect on you.

AI processing

Your messages, calendar details, GitHub data and requests, along with your name, time zone and what you tell Nod about yourself, are sent to Anthropic, which runs the Claude AI models that power Nod, so it can sort messages and answer you. You are asked to agree to this in the app before anything is sent.

Anthropic's commercial terms do not allow it to train its models on this data. It deletes it within 30 days, or keeps it for up to 2 years if its safety systems flag a message, with a safety score for up to 7 years.

Natural voice is a separate choice, off until you turn it on. When it's on, the words Nod says aloud, which can include details from your messages, are sent to Microsoft's Azure speech service to create the audio. Microsoft doesn't store that text or audio. It's an AI voice, not a human one. Turned off, your iPhone's own voice is used instead.

Google user data

Nod's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect Google, Nod reads your Gmail messages and your calendars, sends a reply only after you approve it, and adds a calendar event only after you approve it. We use this data only to provide those features to you. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models. We transfer it only to Anthropic to provide those features, to Microsoft to read Nod's replies aloud if you turn on natural voice, as needed for security, or to comply with the law. No person reads it unless you ask us to, or it is needed for security or by law.

You can end Nod's access at any time by disconnecting in the app, or from your Google Account.

How long we keep it

Messages: Deleted automatically after 90 days, or sooner if you disconnect the account.
Chats and drafts: Deleted automatically after 90 days, counted from a chat's last use, because they can quote your messages.
Passwords and access tokens: Until you disconnect the account.
Sign-in codes: Expire after 10 minutes.
Hashed IP addresses: Deleted within a few days.
Server logs: Kept only as long as they're useful for fixing problems.
Backups: Deleted on a rolling schedule within 30 days.
Everything else: Until you delete your account.

Deleting your account doesn't cancel a subscription, because Apple manages that. Cancel it in your Apple Account's subscription settings.

Your choices and rights

Disconnect an account. Open the You tab and swipe it away. This ends Nod's access and removes that account's messages and drafts from Nod. Your chats stay until they're deleted after 90 days, or until you delete your account.
Withdraw consent. You can withdraw your consent to AI processing at any time by deleting your account. Natural voice can be turned off under You, then Voice and briefing.
Delete everything. Open the You tab, then "Security, legal and account", then Delete account. This removes your data from our servers straight away and ends Nod's access at Google, GitHub and Apple. Backups are deleted on a rolling schedule within 30 days.
Change your iPhone's settings. You can turn off the microphone, speech recognition and notifications in Settings.
Get a copy or correct something. Contact us to ask for a copy of your data, or to correct it.

Depending on where you live, you may also have the right to access your data, correct or delete it, receive a portable copy, limit or object to how it's used, and complain to your local data protection authority. Privacy laws in some US states give similar rights. We don't sell or share personal information, and we won't treat you differently for using your rights.

To use any of these rights, contact us. We'll reply within one month, and we may ask you to confirm the request comes from your account.

Where your data is processed

Your data may be processed outside your country, including in the United States, by the companies named above. Where the law requires a safeguard for these transfers, we rely on the data protection terms those companies provide, such as standard contractual clauses.

Security

Data travels over encrypted connections. Message text, subjects and summaries, your chats and drafts, what you tell Nod about yourself, and the credentials for your accounts are encrypted at rest. Who sent each message and when stays readable to our server, so messages can be sorted. If you sign in with a password, we store only a one-way hash of it, and the same goes for what keeps you signed in. You can add two-factor under You, then "Security, legal and account", then Security.

The server holds the key, because Nod has to read your messages to help you, so this isn't end-to-end encryption. Each person's data is kept separate from everyone else's. Text in emails and other messages is treated as untrusted, and it can never approve or send anything by itself.

No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires. Read how Nod looks after your messages.

Children

Nod is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, contact us and we'll delete it.

This website

This website has no cookies, analytics or advertising. Vercel hosts it and Google Fonts serves its typeface, so those companies see your IP address when you visit.

Changes

If this policy changes, we will update the date above, and tell you in the app if the change is significant.

Contact

Email contact@codewithmuh.com with any privacy question or request. If you can't open the app, email us from your account's address and we'll delete your account for you.