What we hold, and what we cannot.

A privacy tool that is vague about its own data collection is not worth trusting. So here is the whole list.

In effect 23 August 2026

The short version

We never sell your data, and there are no third-party trackers or ad networks in the extension. Sponsored entries in Discover are sold by us directly, and carry no outside code.
Your saved sites sync through our servers, so they are not end-to-end encrypted. They are encrypted at rest with a key held outside the database — but we could technically decrypt them, and we are telling you rather than implying otherwise.
The pages you browse normally are never seen by Nook. Only the sites you deliberately save, and the tabs you opened from Nook, are tracked at all.
Your PIN never leaves your device. It is not sent to us and we cannot recover it.
Delete your account and the saved sites, close history and settings go with it. One message through the contact page is enough.

The summary above is written for humans and is not the agreement. Where it and the numbered clauses disagree, the clauses win.

Our position

Nook exists so that parts of your browsing stay out of casual sight. It would be absurd to build that and then quietly harvest the same information. So the rules we hold ourselves to are short:

Collect only what the feature actually needs to work.
Never sell, rent or trade personal data. Not to advertisers, not to data brokers, not to anyone.
No third-party analytics, no advertising SDKs, no session recording, no fingerprinting.
Say plainly where the protection ends, rather than implying it goes further than it does.

This policy covers the Nook browser extension and this website. It sits alongside our Terms & conditions.

What we collect, and why

DataWhy it exists

Google account details Your email address, display name, profile picture and Google's account identifier, received when you sign in. This is how your account exists and how your sites reach your other devices.

Saved sites The URL, domain, title, category, any keyword or note you add, and the icon and preview image the site itself publishes. Stored encrypted (clause 03) so the same shelf appears on every device you sign in on.

Close history When a rapid hide or auto-close fires, the addresses that were open at that moment are recorded as a group so you can reopen them later. Encrypted, and deletable one group at a time from the History screen.

Settings Panel size, theme, auto-lock and auto-close timers, cover site, shortcut combo, and whether the Adult category is visible. Synced through your browser's own settings sync and mirrored to your account.

Sign-in records Time, IP address and browser user-agent for each sign-in, sign-out and failed attempt. Kept to spot account takeover and abuse. IP is stored in packed binary form, not as readable text.

Discover activity Which Discover cards were shown, clicked or saved. Used to pay sponsors accurately and to judge which suggestions are useful. Tied to your account so a card is not counted twice.

Subscription status Your plan, its status and renewal date, plus the Stripe customer and subscription identifiers. Needed to know whether paid features are on.

Messages you send us Anything you type into the contact or partner form — name, email, your message, plus the IP and browser that submitted it as a spam check. Partner applications are also stored so an application is not lost if email delivery fails.

Ordinary browsing is invisible to us Nook only ever looks at a tab to check whether its domain matches a site you saved. Pages you have not saved are never read, logged or sent anywhere — not their addresses, not their contents.

How your sites are stored

Saved sites and close history are encrypted before they are written to our database, using AES-256-GCM. The key lives in the server's environment, not in the database, so a stolen database dump on its own is not readable.

For de-duplication we store a keyed HMAC of the address rather than a plain hash, so the stored values cannot be reversed with a dictionary of popular sites.

This is not end-to-end encryption, and we will not pretend it is Because your shelf has to appear on every device you sign in on, the server holds the key that decrypts it. That means we could technically read your saved sites. We do not, access is restricted to what is needed to operate and support the Service, and we would resist an improper request — but a promise is not the same as being unable to. If that distinction matters to you, it should inform what you save.

Everything travels over HTTPS. Your quick-open PIN is a separate matter: it is stored on your own device and is never transmitted to us, so we cannot see it, recover it, or reset it for you.

The browser permissions, one by one

Chrome shows these at install and some of them look alarming out of context. Here is what each one is actually for.

PermissionWhat Nook uses it for

Read your browsing history To delete entries, not to read them. When a tab you opened from Nook closes, its history entry is removed.

Manage browsing data To clear the cookies, cache, local storage and service workers belonging to the site you just closed — and only that site.

Access to all sites Two reasons: the panel is drawn as an overlay on whatever page you are on, and the extension must be able to recognise a saved domain on any site you might visit. It does not read page contents.

Tabs To know which tabs came from Nook, mark them, and close them all when you press Esc twice.

Storage & sync To keep your settings and local cache, and carry preferences to your other devices through Chrome.

Identity Google sign-in only. It requests your basic profile and email, nothing more.

Idle & alarms To notice when you have walked away, so the panel can lock and private tabs can close on your timer.

Context menus & favicon The right-click “Add this site to Nook” entry, and the site icons shown on your cards.

What we never collect

The contents of pages you visit. No page text, no form data, no screenshots.
Your general browsing history. Only sites you deliberately saved are known to us.
Keystrokes, clipboard or microphone or camera. The extension requests none of these.
Your Google password. Sign-in happens inside Google; we only receive the resulting token.
Your quick-open PIN. It stays on your device.
Card numbers. Payment details are entered on Stripe's own pages and never reach our servers.
Precise location. We do not request it. IP addresses in sign-in records give a rough country at best.

Adult category data

Whether you have the Adult category switched on, and any site you save into it, is stored the same way as everything else in clause 03 — encrypted at rest, and covered by the same caveat that this is not end-to-end encryption.

The setting is off by default. If you never turn it on, no adult category ever appears and nothing about it is recorded beyond the setting sitting at its default.
Sites in that category never render a preview image anywhere in the interface, only a favicon — including on shared or mirrored screens.
We do not build interest profiles, segment users by category, or use what you save for advertising. Discover counts are used to pay sponsors and are not combined into a profile of you.
We do not disclose category membership to advertisers or partners. Sponsors receive aggregate counts for their own listing, not who saved it.

Some laws treat data revealing sexual orientation or sex life as a special category requiring extra protection. Where such a law applies to you, we process this data only on the basis of your explicit, revocable consent — the act of switching the category on — and you can withdraw it at any time by switching it off and deleting the entries.

Who else touches your data

A short list, because every extra company is extra risk.

WhoWhat they get

Google Sign-in. Google knows you authenticated with us; it does not receive your saved sites.

Stripe Payment processing. They handle your card and billing address; we receive only the plan status and their identifiers. Subject to Stripe's own privacy policy.

Google Gemini Optional automatic sorting — see clause 08. Receives a page title and domain, nothing else, and only when the local sorter cannot tell.

Our email provider Delivers messages you send through the contact and partner forms.

Our hosting provider Runs the servers and database. Standard infrastructure access under contract.

We may also disclose data if we are legally compelled to, or to protect someone from serious harm. Where the law permits it, we will tell you first.

If Nook is ever sold or merged, your data may transfer with it. You would be told before that happens and given the chance to delete your account first.

Automatic sorting

When you save a site, Nook first tries to guess its category on your own device, using simple keyword rules. That happens locally and nothing is sent anywhere.

If the local guess fails, the page title and domain may be sent to Google's Gemini API to pick a category. That is the entire payload — no URL path, no page content, no account identifier.

You can turn this off In Account, switch off cloud sorting. Unsorted sites simply land in Others, and nothing about them leaves your device.

How long we keep things

Saved sites and settings — until you delete them or close your account.
Close history — until you delete the group, or your account. It is the most sensitive thing we hold; clearing it periodically from the History screen is a good habit.
Sign-in records — up to 12 months, for abuse investigation.
Discover activity — up to 24 months, for sponsor reconciliation.
Billing records — as long as tax and accounting law requires, typically 7 years. These we cannot delete on request.
Contact and partner messages — up to 24 months.
Expired sessions — refresh tokens expire after 30 days; access tokens after 15 minutes.

Your rights over your data

Wherever you live, you can ask us to do all of the following, and we will not make it difficult:

See it — a copy of the personal data we hold about you.
Correct it — fix anything wrong.
Delete it — close your account and have the data removed, except records we must keep by law.
Take it elsewhere — an export of your saved sites in a machine-readable format.
Object or restrict — ask us to stop a particular use, such as cloud sorting.
Withdraw consent — for anything you opted into, including the Adult category.

Send the request through the contact page from the email address on your account. We aim to respond within 30 days. There is no charge.

If you are in the UK, EU or EEA, our lawful bases are: contract for running the account and syncing your sites, legitimate interests for security records and abuse prevention, consent for cloud sorting and the Adult category, and legal obligation for billing records. You also have the right to complain to your local data protection authority.

If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the past twelve months. Exercising your rights will never result in worse service.

Our servers are located in [SERVER REGION]. If you are elsewhere, your data is transferred there under appropriate safeguards.

Children

Nook is not intended for children. You must be at least 13, or older where your country requires it, and at least 18 to enable the Adult category.

We do not knowingly collect data from children below that age. If you believe a child has created an account, tell us through the contact page and we will delete it.

Changes, and how to reach us

We will update this policy as the Service changes. The date at the top shows the version in force. If a change materially affects how we handle your data, we will ask you to review it inside the extension rather than quietly swapping the page.

Nook is operated by [LEGAL ENTITY], [REGISTERED ADDRESS]. Privacy questions, data requests and complaints all go through the contact page — pick Something else and say it is a privacy request.

Something here unclear? Ask before you agree — the contact form reaches a person, not a queue.

Ask about this