Privacy

Draft — last updated November 7, 2026. This page describes plainly what Noa does with your data, based on how the software works today. It is not legal advice and not yet a reviewed legal policy.

The short version

• The extension works in your own Chrome. Your cookies and the sites you're signed in to stay in your browser.
• To do a task, the AI has to see the pages it works on. That page content goes to the AI you choose.
• If you sign in to Noa, our cloud keeps your account, your cloud TODO tasks and your usage, so it can run them and bill you. It keeps your chat history and memory too, so your other computers have them (you can keep memory on this computer only), and your bookmarks if you choose to sync them.
• Your chats, memory and the pages Noa remembers are encrypted: sealed on your computer before they're sent. Our database stores only ciphertext. The one exception is off until you turn it on: Help improve Noa.
• We don't sell your data and don't show ads.
• We advertise Noa on Facebook and Instagram, and our website and dashboard tell Meta which visits, installs and sign-ups came from those ads, and when an account pays. The extension never does: right after you install it, it opens our welcome page once, and that website page counts the install. Nothing you browse or ask Noa to do goes to Meta.

What stays on your computer

These are kept by the extension in Chrome's own storage and never sent to us:

• Your settings, including the Anthropic API key or Jev key you paste in.
• Your chats and memory while you are signed out, the activity log, and documents you attach to a chat. (Pictures you send in a chat go to your account with the chat once you sign in, below. Tasks you added before signing in stay here too, until you move them into your account.)
• Site logins you save. They are encrypted with a passphrase you choose, and unlocked only for the current browser session.

If you use the local helper with your own Claude Code, the helper also keeps its logs of each run on your computer (%LOCALAPPDATA%\Noa).

End-to-end encryption

If you sign in, your chats, memory and remembered pages are always encrypted, with nothing to set up. Your computer makes a random AES-256 key (also shown as 12 recovery words in the extension's settings, under Privacy) and seals every chat, memory entry and remembered page with it before it reaches us. So that signing in with Google is all your other computers need, your account keeps that key, sealed with a server secret that is not stored in our database, and gives it only to your computers signed in to your account. Our database, our storage and the admin pages see ciphertext; our servers could open the kept key, so this protects against a leak of the stored data rather than against Noa itself. We also keep a fingerprint of the key, so your computers can tell which key your account uses, and we refuse anything sent readable.

What stays readable to us: when each item changed, its size, and for memory, scrambled tags of its key so we can cap how much is kept. Memory search runs on your computer instead of ours. It does not yet cover your cloud TODO list or files kept in your account, and it does not hide what the AI must read to do a task (below).

Chats you share

A chat stays yours unless you make a link to it. A link gives a read-only copy of the chat as it was then, at noa.bot/s/<id>, and nothing else: no way into Noa, your computer or your account, and readers don't see who shared it. The copy is encrypted on your computer with a key of its own, which is only in the part of the link after the #. Browsers don't send that part to a server, so we store only ciphertext and can't read the copy. Anyone you give the whole link to can read it. For specific people, we also check that the reader signs in with Google as an address you listed; that makes no Noa account, and we keep the addresses only as salted hashes. Noa hides what looks like a password, key or card number, but pages can hold other private things, and the copy includes the run's raw trace, which holds much more, such as prompts and what Noa typed. You can set a link to expire; after that it no longer opens. Stopping the link, or deleting the chat or your account, deletes the copy, though we can't take back what a reader already saved. If you report a shared chat to us, send its whole link: we can't read it otherwise.

Help improve Noa (off unless you turn it on)

In the extension's settings, under Privacy, you can agree to share chats where Noa makes a mistake, so you never have to report one. If you don't, none of this happens.

• When you agree, we record when, which version of these words, where you agreed, and the IP address, country and browser you agreed from.
• After each turn, your computer sends our server what you and Noa wrote and the steps Noa took since the last check, with the start of what each step read on the page, and with what looks like a password, key or card number hidden. It goes to TypeSafe, which runs Jev, to judge whether Noa made a mistake. If there's no mistake, nothing is kept.
• If Jev flags one, Anthropic's Claude reads the same text and writes a short summary and may overrule Jev. We then keep the summary, a rating of how bad it was, that text, and a copy of the whole chat with what Noa read on the pages. Your account's ID is kept with them. This copy is not end-to-end encrypted: Noa's team and the coding tools we use to fix Noa can read it. Pictures aren't included.
• Chats on a local model are never sent. Chats from before you agreed are not looked at. If you go on with one afterwards, only what happens from then on is judged, with the earlier part as context, and it is in the copy if a mistake is found.
• You pay nothing for it. Turning it off stops it at once. To remove what was sent, use Delete under the same setting; deleting a chat in the extension deletes its reports too, and deleting your account deletes them all.

Your phone

If you pair a phone, it talks to your computer through our relay over an end-to-end encrypted channel (X25519 and ML-KEM-768 for the handshake, so it is designed to resist future quantum computers, then AES-256-GCM). The relay passes messages along without being able to read them. We keep each paired device's name, public keys and, for a phone, where to send its notifications, so your phone can find your computer. Push notifications say only that a job needs you or is done.

What the AI sees

While it works on a task, Noa reads the pages it acts on: their text, a list of the page's buttons and fields, and screenshots. It sends these, with your instructions, to the AI that runs the task:

• Your own Claude Code or Claude API key: the content goes straight from your computer to Anthropic, under your own Anthropic account and terms. It does not pass through us.
• Jev with your own key: the step to perform and the page's list of elements go to TypeSafe, which runs Jev.
• Noa AI: the same content goes through our server to Anthropic (for Claude) and TypeSafe (for Jev). Our server records what each request cost (model, token counts, price) to count it toward your usage. It does not save the content of the request.

Voice and images

Voice is on paid plans. Which service hears you depends on the voice engine you pick in the extension's settings. We don't keep your audio.

• Standard: each clip you record goes through our server to Cloudflare Workers AI to be turned into text. Replies are read aloud by your own browser. We record the clip's length for billing.
• Deepgram: your speech is transcribed the same way. The text Noa says back goes through our server to Deepgram's voice on Cloudflare Workers AI, which returns the audio. We record the text's length for billing.
• Realtime and Realtime mini: while a voice session is open, your microphone audio streams through our server to OpenAI's Realtime API, along with the rest of the conversation, including what the agent reports about the task and the pages it works on. OpenAI's replies come back the same way. We record each response's token counts and cost, not what was said.
• Image generation: when you ask Noa to make a picture, your description goes through our server to OpenAI, which returns the image. We record the cost, not the description or the image.

When the agent signs in to a site with a saved login, that site's username and password are given to the AI so it can type them. Saved logins are never used for X.

What our cloud stores when you sign in

Signing in is optional. The extension works without an account when you bring your own Claude. When you do sign in with Google, our service at app.noa.bot, which runs on Cloudflare, stores:

• Your account: your Google account ID, email address, name and profile picture link. We ask Google only for these (the openid email profile scopes).
• Sign-in sessions for the extension and the dashboard.
• Your cloud TODO list: each task's instructions, attached files, schedule and status, its result (a summary, a link and a final screenshot of the page) and a log of what happened to it.
• API keys you create for your scripts. We store only a hash of each key.
• Memory, unless you keep it on this computer (Settings > Memory; syncing is on by default for a signed-in account): the facts, preferences and task notes the agent keeps, so your other browsers have them. So that memory can be searched by meaning, our server has Cloudflare Workers AI turn each entry into a list of numbers (an embedding) and stores that with it. Entries from a current Noa arrive sealed (encrypted on your computer) and get no embedding.
• Your chat history: each conversation's title, request and what happened in it (the agent's replies and the steps it took, with what it read on the pages), so signing in on another computer brings your chats back, and the pictures you sent in them. Other files you attach stay on your computer. Chats you had before signing in are added when you sign in. Deleting a chat in the extension deletes it from your account too. All of this arrives sealed (encrypted on your computer).
• Bookmarks, if you sync them between computers: each bookmark's title, link and folder.
• Phone calls Noa makes for you: the number called, when, how long, what it cost and the transcript of what was said, so the chat can show the call. During the call its audio passes between Twilio (the phone line), our server and the voice model you picked (OpenAI or Google Gemini). We don't keep the audio.
• Billing and usage: your plan, your usage and how it was used, and a record of each hosted AI request's cost.
• What you agreed to: when you agreed to the Terms of Service and the phone call terms, which version, where (dashboard, checkout or extension), and the IP address, country and browser you agreed from, as our record that you agreed.

Payments

Stripe handles subscriptions and top-ups. Your card details go to Stripe, never to us. We keep the Stripe customer ID and the status of your plan.

Our customer records

We keep track of who uses Noa in RunHQ, the tool we use for sales and support: your email address, name, when you signed up, your plan, and the amount and date of each payment. It does not receive your chats, memory, tasks or anything Noa read on a page.

This website

noa.bot has no ads. Each page loads RunHQ's visit counter, which records page views, the page you came from and time on the page, and keeps an ID for it in a cookie and your browser's storage. On the dashboard, RunHQ's support chat runs in a frame from noa.bot, without counting page views. In Noa Browser it loads only when you press Support, apart from your browsing: it cannot see your tabs or their cookies, and what it keeps is gone when you close the app. Visiting from the EU, the rest of the EEA, the UK or Switzerland (or from somewhere we can't tell), it only loads once you choose Allow on the cookie banner, the same one as for our ads below; change your choice and No thanks deletes its cookie and stored ID. Its fonts load from Google Fonts, so Google receives your IP address when the page loads.

Measuring our ads

We pay for ads on Facebook and Instagram, and measure which ones bring people who install Noa, sign up and pay. This happens only on noa.bot and the dashboard at app.noa.bot, and in our billing. The Noa extension has none of it, and nothing about the sites you visit, your chats or Noa's work is sent.

• Meta Pixel. Pages on noa.bot load Meta's pixel; the dashboard at app.noa.bot does not. It tells Meta which page you opened and when you click Add to Chrome, and Meta sets its own cookies (_fbp, _fbc) for it. Meta can link this to your Facebook or Instagram account if you have one.
• Where you came from. When you arrive from a link with ad tags (utm_source, utm_campaign, utm_content and the like, or Facebook's fbclid), we save those tags in a cookie on noa.bot for 90 days. If you then create an account or sign in to the dashboard, we save them with your account, so we can tell which ad brought you.
• Installs. When you first install the extension from the Chrome Web Store, it opens noa.bot/welcome in a new tab, once; it never opens it again and adds nothing else. That page, like the rest of this website, counts the install, once per browser (it remembers that it did in your browser's storage for noa.bot): it tells Meta's pixel and our server, and our server keeps the install with the ad tags from your cookie, without your IP address or any account.
• Meta Conversions API. When the welcome page counts an install, our server tells Meta: that Noa was installed, the ad tags, Meta's cookie IDs, and your IP address and browser. When you create an account, and when you pay for a plan or credit (renewals too), our server tells Meta: what happened, the amount, your email address and account ID (both hashed with SHA-256 first, so Meta can match them but we never send them in readable form), Meta's cookie IDs, and the IP address and browser of your last sign-in or checkout. We keep those cookie IDs, that IP address and that browser name with your account for this.
• Asking first. Visiting from the EU, the rest of the EEA, the UK or Switzerland (or from somewhere we can't tell), you're asked first, and none of this runs until you choose Allow. Elsewhere it runs unless you say no. Your answer is kept in a cookie on noa.bot for 180 days, and our server follows it too: nothing about your account or your install goes to Meta unless it may.
• Saying no. Change your choice at any time; saying no deletes our ad cookies and Meta's. If your browser sends Global Privacy Control, none of this runs and you're not asked. A tracker or ad blocker stops the pixel too. You can also manage how Meta uses this under Ad preferences in your Facebook or Instagram settings.

Deleting your data

Everything in the extension can be removed by uninstalling it. To delete your account, open the dashboard's Account page and choose Delete account. That cancels any subscription and deletes your tasks, files, chat history and its pictures, keys, sessions, linked phones, call records, synced memory and bookmarks, any chats you shared to help improve Noa, usage records and the account itself, and removes you from our customer records. What Meta already received stays under Meta's own policy. To delete only your synced memory, choose Forget everything in the extension's memory settings.

Contact

Questions, or a request about your data: support@noa.bot.