Privacy, plainly.

We designed nokeep so that the most interesting data — what you ask and what the models answer — never exists on our side. This page can be short because there is very little to disclose.

Your conversations live in your browser's session storage and nowhere else. When you close the tab, they're gone. We do not store, read, moderate, or train on the content of your conversations, images, or videos. Requests are proxied to zero-retention inference providers in memory and are not written to disk.

Like any web service, our servers momentarily see your IP address to deliver a response, and we enforce anonymous, in-memory rate limits by IP to prevent abuse. These counters hold no conversation content, are never written to disk, and evaporate on restart. We do not run analytics trackers, advertising pixels, or fingerprinting.

The free tier requires no account — there is nothing to sign up for. Paid plans work through anonymous account tokens: a random identifier, no email, no name, no phone. Card payments are handled by a payment processor, which necessarily sees your card details. What we store against your token is the processor's subscription reference (without it we cannot tell whether your plan is still active), that subscription's status and renewal date, and a ledger of credits granted and spent. Never your name, your email, or anything about your card.

Prompts are forwarded — stripped of your IP and any identifying headers — to zero-retention inference infrastructure. Providers process requests in memory and are contractually bound not to store or train on them. Chat, image generation and image editing all run on the private tier, where the request is never handed to an outside vendor at all. Most of those models are open-weight; the frontier chat model and the image editor are proprietary, meaning their weights are not published — but private tier is about where your prompt goes, and on that they are identical. Video is the real exception: a proprietary model on the anonymized tier, meaning the upstream vendor does process the prompt, without knowing whose it is. If that distinction matters to you, do not use video.

Web search is off unless you switch it on, and the switch is remembered per browser. When it is on, the search runs from our infrastructure rather than your browser, so the search engine sees a request from us and never your IP address or anything about your device. It does, however, receive the text of the query itself — that is what a search is. Nothing else from the conversation is sent, and results come back through the same boundary. If a question is one you would not type into a search engine, leave the toggle off.

If we received a legal demand for a user's conversations, we could not comply in substance: no conversations exist to produce, and no identity links a request to a person. We can only produce what we hold, and we hold almost nothing — that's the design.

If this policy changes in any way that weakens the above, we will say so loudly on the site — not bury it in a diff.