Version 1.8 · in force · 23 September 2026
A product that exists so other people’s data does not leak has to hold itself to the same rule. Plain language first; underneath, the detail your privacy officer needs.
localStorage, no sessionStorage, no browser fingerprinting.
That is why there is no banner: we do not store or retrieve information on your terminal
equipment.
Two pieces exist today: the engine and the desktop app that wraps it, for Mac and for Windows. The browser extension and the compliance panel do not exist yet, and this page talks about them in the future tense on purpose.
There is one sentence we will not write even though it would sell better: “this software makes no connections”. It is not true. The app asks whether there is a newer version, sends a daily count of your allowance, and will talk to Stripe when you pay. The sentence that is true — and that can be checked rather than believed — is the one that matters: the text it analyses does not leave your computer.
While a conversation is open, the engine holds two things in memory: the map that lets a masked value be put back, and the memory of the conversation. It cannot put them on disk itself. Both desktop apps do keep them, encrypted: the Mac one inside Application Support, with a key derived from the Secure Enclave; the Windows one inside LocalAppData, with user DPAPI.
The thirty days are a deadline for being able to open it, not a deletion deadline. That saved conversation stops being openable after thirty days without a save; the file itself does not go anywhere. On the Mac the app deletes it the next time you open Nonimo, and there is a “Delete everything” in settings. On Windows there is no cleanup and no button today, and closing saves. File by file, it is on the security page.
One more caveat: any operating system can write a program’s memory to the swap or hibernation file, which is why we recommend full-disk encryption.
| What travels | What never travels |
|---|---|
| An installation number generated on your computer at install time; how many words you have used this month and how many times; how much of that was documents and how much pasted text; whether you hit the monthly limit and on what day; the version of the app and of the engine, the platform and the language; whether you are on the free or the paid plan; the version number of this send format; and how many terms your own dictionary holds. Once a day, in a single send. | Not one word of your text. Not one term from your dictionary — the count, never the terms. No value the engine found. Not your name, your email or your computer’s name. Not even which categories were detected. |
And that is not an intention of ours, it is a mechanism. Of those fourteen fields, twelve cannot carry text in any form — they are numbers, yes/no, dates, values from a closed list and a hexadecimal identifier — and the other two are the version strings, bounded by shape: forty characters at most. Our server rejects any key not on the list and any value that does not have that shape, so an email address or a path on your disk cannot fit through this channel even if we wanted it to.
It ships on, and it cannot be switched off from inside the app. The way to object is to write to hello@nonimo.ai with the installation number the app shows you: we stop keeping it and stop using it, and keep deleting whatever arrives. Put precisely, because it matters: no instruction exists that tells an installed copy to stop — so what we can honour is the handling, not the packet.
What for. To keep count of your monthly allowance, to know whether the product is used at all, and to know which platforms and languages still need testing. We build no profiles, cross it with nothing and give it to nobody.
The app works without it. With no network, or with our server down, it keeps masking against your local counter. If the server were a requirement, a failure of ours would leave everyone unprotected.
There are two other sends, and you trigger both. Problem reports, when you press the
button; and the coverage report, which sends shapes and never values — that something
shaped AAA-9999-99999 appeared 37 times after the word “order”, never the
value — which ships off and you turn on.
The free plan has a monthly word limit, and a page on this site offers to lift it: you leave an email address and we send you a licence file. It is free, there is no account and it is not a payment. It is the only text box on the whole site.
The licence is checked on your own computer, and it keeps working without an internet connection. A licence can contain a verification address. The licences we issue today contain none, but some issued in our first days do. Where one is present, the app contacts our server once each time it starts, to ask whether the key is still active and on how many computers it is in use. It sends the licence number and the installation number, and nothing else.
Staying anonymous. You can read this whole site, and download and use the free version, without telling us who you are. Nothing here is behind a sign-up. Past the monthly limit there is one gate, and it is the only one: lifting it takes an email address.
Both are in development, and this describes the design. The day they exist, we will update this page against published code and not against the plan.
Three processors and no others:
We do not sell, rent or share your data with anyone else. There is no advertising behind this, no social networks, no data brokers. Your data is handled outside Australia by those three, and we would rather say so plainly than bury it. If a competent authority legally compelled us to hand over information, we would hand it over and tell you, unless the order itself forbids us from saying so.
| What | How long |
|---|---|
| Email correspondence | 3 years from the last exchange. If you ask us to delete it sooner, it goes |
| Threads that end in a contract | For as long as the relationship lasts, then whatever the accounting and tax rules require |
| Server logs | Kept by Cloudflare under its own retention policy. We do not export them or keep them separately |
| Free licence sign-up | While the licence is alive, plus the time we need to be able to reissue it. We have not fixed a number of months, and we would rather write that than publish a figure we would not keep: in the meantime it is deleted as soon as you ask |
| The personal version’s daily usage counts: | 24 months, then they are deleted. They are counts, not content: there is nothing inside to reconstruct |
| Problem reports you send us from inside the app: | 13 months, then they are deleted. Deliberately the shorter of the two: a report is the only thing on this list that can carry words you wrote |
| Records tied to a licence key (one installation number and two dates per computer) | 13 months |
| Billing data | Whatever Australian accounting, tax and corporations law requires, which is longer than we would choose |
Access and correction. Write to hello@nonimo.ai and we will tell you everything we hold about you and correct anything that is wrong. We answer within 30 days and there is no charge.
Complaining. Tell us first if you like, but you are under no obligation to go through us. You can complain to the Office of the Australian Information Commissioner, the regulator that oversees the Australian Privacy Principles, at oaic.gov.au or on 1300 363 992.
Which law we hold ourselves to. The Australian Privacy Principles. If the small business exemption in the Privacy Act 1988 applies to a company our size, we are not going to shelter behind it: this page is written to APP 1.4 and we will handle a request as though the Act bound us. A company that sells privacy should not be arguing that privacy law does not apply to it.
If you are in Spain or the European Union. Our Spanish privacy page sets out the same practices with the information the GDPR requires — the legal bases, the international transfers, the retention periods and how to complain to the Spanish data protection authority. There are also German, French, Italian and Portuguese versions.
Automated decisions. We make no automated decisions about you and build no profiles. The engine decides what to mask inside the computer of whoever is using it, and we neither see that decision nor receive it nor use it for anything.
Nonimo is a product of Llevant Group Pty Ltd (ABN 17 691 906 751), an Australian company which also trades as Aivy Automations. Principal place of business: 1A Bruce Street, Kensington VIC 3031, Australia. Llevant Group Pty Ltd is the entity responsible for the information described on this page. Privacy contact: hello@nonimo.ai.
We have no establishment in the European Union, so the Australian address above is the one to write to from anywhere.
When we change this page we change the version and the date in the footer too, and we keep the previous versions: ask and we will send them.
Version 1.8 · 23 September 2026