Privacy Policy

Effective October 22, 2026

This policy explains how NanoLabs AI (“we”, “us”), the operator of Nano, collects, uses and shares information when you use Nano, our personal assistant over iMessage, and its websites at nanobot.sh and app.nanobot.sh (together, “Nano”). Nano is currently an invite-only beta.

Information we collect

• Phone number and first name. To sign in, you enter your mobile number and, optionally, your first name on our website, and then text Nano a one-time code from that phone. We store your phone number and first name. Sign-in codes are stored only in hashed form and expire after a few minutes. We also store the time zone your browser reports, so Nano can understand times like “tomorrow at 3”.
• Messages. The messages you send Nano and Nano’s replies, in iMessage and on the website.
• Task history and approvals. The tasks Nano works on, the steps and tool results for each task, and your approvals or rejections of actions such as sending an email, creating an event or sending a transaction.
• Nano’s notebook about you. Details you tell Nano, your projects and preferences, and facts it learned while working for you (see “Google user data” below).
• Google account information. If you connect Google, the email address and account ID of the Google account you connect, the permissions you granted, and the OAuth access and refresh tokens that let Nano act for you.
• Gmail and Google Calendar data that Nano accesses to complete a request you make, such as search results, the message you asked about, calendar names, events and free/busy times, and, unless you turn background checks off, what it reads to check for important new email and calendar changes. See “Google user data” below.
• Wallet information. If you use Nano’s Solana features, the public address of the wallet Nano creates for you, your balances, and the transactions Nano prepares, you approve, or that arrive in your wallet. Wallet addresses, balances and transactions on the Solana blockchain are public by design.
• Purchase information. When you buy crypto through Nano, we receive from Crossmint the order details we need to run Nano and support you: the amount, currency, fees, the asset and wallet address it was delivered to, the order status, and whether your identity check passed. We do not receive or store your full card number, card security code, or the identity documents you give Crossmint.
• Operational logs. Minimal technical logs, such as service health and error codes. They do not include the content of your messages or email, or your phone number.
• Website. Our website at nanobot.sh does not use advertising or analytics cookies. Our hosting provider processes standard request data, such as IP address and browser type, to deliver and protect the site.

How we use information

• To sign you in and link your phone number to your Nano account.
• To understand your requests, carry them out, and reply to you.
• To show you the exact action Nano proposes (such as an email, an event or a transaction) and to carry it out only after you approve.
• To show your conversation, task and purchase history to you.
• To keep Nano secure, prevent fraud and abuse, enforce usage limits, and fix problems.
• To respond to you when you contact us, and to meet our legal obligations, including record-keeping, sanctions and anti-money laundering rules.

We do not sell your information, and we do not use it for advertising.

Google user data

Nano’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide Nano’s features: answering questions about your email and calendar, drafting and sending email you approve, creating calendar events you approve, and, unless you turn it off, letting you know about important new email and calendar changes.
• Background checks are on by default. Every few minutes during your waking hours, Nano looks only at the IDs of your recent unread inbox messages and upcoming calendar events, and keeps just a fingerprint of them, with no content. When something changes, Nano reads the new messages or events that look important (for example someone waiting on your reply, travel, a bill, a security alert, or something related to your projects) to decide whether to text you. It texts you at most twice a day and never during quiet hours (9 PM to 8 AM unless you change them). Background checks can only read; replying, drafting or booking still needs your YES. Text Nano to turn them off, choose Gmail or Calendar only, change quiet hours or pause them.
• We do not use Google user data for advertising, including targeted, personalized or retargeted ads.
• We do not sell Google user data.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models. To process your request, Nano sends the relevant parts of it to our AI provider, Anthropic, under terms that prohibit Anthropic from training its models on that data.
• No person at NanoLabs AI reads your Google user data unless you give us permission (for example, when you ask for support), it is needed for security purposes such as investigating abuse, or it is required to comply with the law.
• Nano keeps a private notebook, its long-term memory of you, so it can help over time: details you tell it in chat, your projects, ideas and preferences, and facts it learned while working for you, which can include details from emails or calendar events it read for you. Facts from email or calendar are marked with where they came from. Only Nano uses the notebook, to help you in your own chats. You can text Nano to ask what it knows about you, to show any page, or to forget anything, and it removes that from the notebook and its history. Email excerpts that Nano read to complete a task also stay in that task’s history (see “Data retention”).
• We transfer Google user data to others only as needed to provide your request (our AI provider, and our messaging provider when Nano’s reply to you includes an excerpt), for security, or to comply with the law. We never share Google user data with Crossmint or any payments or blockchain provider.

Nano requests these Google permissions: read your Gmail (to find and read messages you ask about, and for background checks unless you turn them off), compose Gmail (to save drafts and send email you approve), and view your calendar list, events and free/busy times and create events on calendars you own. Nano does not delete, label, archive or change your existing email, and it does not edit or delete existing calendar events.

Buying crypto with Crossmint

Card, Apple Pay and Google Pay purchases of crypto in Nano are provided by Crossmint, a third-party payments and identity verification provider. Before your first purchase you will be asked to accept Crossmint’s Privacy Policy and Terms of Service. Crossmint and its partners are responsible for the information you give them and handle it under their own policies.

• Identity verification (KYC). The law requires identity checks before you can buy crypto. Depending on the amount and where you live, Crossmint may ask for your full name, date of birth, nationality, country of residence, email address, government ID number, a photo of your ID document, a selfie or liveness check, and information about your source of funds or employment.
• What we share with Crossmint. Only after you accept Crossmint’s Privacy Policy, and only to set up and complete your purchase, we may share your name, email address, phone number, country, and your Nano wallet address, so you don’t have to type them again and the crypto arrives in the right wallet.
• Payment details. Your card or wallet payment details go to Crossmint and its payment processors, not to us.

Blockchain data

Transactions on the Solana blockchain, including your wallet address, amounts and the addresses you send to or receive from, are public and permanent. Anyone can see them, and neither we nor anyone else can change or delete them. Deleting your Nano account does not remove anything from the blockchain.

AI processing

Nano uses an AI model from Anthropic to understand your messages and decide how to help. When you make a request, we send Anthropic the information needed to handle it: your message, relevant recent conversation, the relevant parts of Nano’s notebook about you, and the results of any tools Nano used for that request, such as a short email excerpt, calendar entries or wallet balances. Anthropic processes this data to return a response to us. Under its commercial terms, Anthropic does not train its models on this data, and it may keep it for a limited period (currently up to 30 days) for safety and abuse monitoring. We never send Anthropic your identity documents or payment card details.

AI output can be wrong. That is why Nano shows you the exact email, event or transaction and waits for your approval before it acts.

Service providers

We share information with these providers only so they can run Nano for us:

• Anthropic: AI model that processes your requests.
• Linq: delivers iMessages between you and Nano. Messages also travel through Apple’s iMessage service.
• Railway: hosts our servers and database.
• Google: Gmail and Google Calendar APIs, used at your direction when you connect your Google account.
• Crossmint: crypto purchases with cards, Apple Pay and Google Pay, identity verification, and payment processing.
• Solana network infrastructure: providers that relay your approved transactions to the Solana blockchain and read public balances.
• Cloudflare: hosting for nanobot.sh and DNS for our domain.

We may also disclose information if required by law, to protect the rights, safety and security of our users or others, or as part of a merger or acquisition, in which case this policy will continue to apply to your information.

Data retention

• We keep your account information, messages, task history and approvals for as long as your account is active, so you can see your history. We do not automatically delete older history yet.
• Sign-in codes expire after a few minutes, and Connect Gmail links expire after 30 minutes or after one use.
• If you disconnect Google in Nano, we stop accessing your Google account and delete the stored Google tokens right away.
• If you delete your account, we disable it and delete your Google tokens immediately. We then remove your messages, task history, approvals, preferences, Nano’s notebook about you, phone number and files from our active systems. We keep a minimal record that the account was deleted (an internal ID and timestamps, with no content) so it cannot be accidentally restored.
• Records of crypto purchases and transactions may be kept for as long as the law requires, even after you delete your account. Crossmint keeps identity verification records under its own policy and legal obligations.
• Copies held by our providers follow their own retention (for example, Anthropic’s limited retention described above). Messages already delivered to your phone, emails or events Nano already sent or created at your request, and blockchain transactions are not affected by deleting your Nano account.
• Backups we make for disaster recovery are kept only as long as needed for that purpose and are not used to restore deleted accounts.

Your choices and deletion

• Disconnect Google. You can disconnect Google in the Nano web app, or remove Nano’s access at any time from your Google Account at myaccount.google.com/permissions.
• Delete your account. Sign in at app.nanobot.sh, open Settings and delete your app data. Or email support@nanobot.sh from any address and tell us the phone number on your account; we will verify the request and delete your account. Move any funds out of your wallet before you delete your account.
• Get a copy of your data. You can export your data from Settings in the Nano web app, or ask us at support@nanobot.sh.
• Approvals. You can reply NO to, or simply ignore, any action Nano proposes. Nothing is sent, created or paid without your approval.
• Your privacy rights. Depending on where you live, you may have the right to access, correct, delete or port your information, or to object to or restrict how we use it. Email us to make a request. We will not treat you differently for using these rights.

Security

Connections to Nano’s websites and between Nano and its providers are encrypted in transit with TLS (HTTPS). Google OAuth tokens are encrypted at rest with AES-256-GCM before they are stored, and are never shown to the AI model, your browser or our logs. Access to our systems is limited to the people who operate Nano. No system is perfectly secure, so please contact us if you believe your account has been compromised.

Children

Nano is not intended for children under 13, and we do not knowingly collect information from children under 13. Buying crypto requires you to be at least 18. If you believe a child under 13 has given us information, contact us and we will delete it.

International users

We operate Nano from the United States, and our providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for these transfers.

Changes to this policy

We may update this policy. If we make material changes, we will update the effective date above and let you know through Nano or our website before the changes take effect.

Contact

NanoLabs AI, support@nanobot.sh