Privacy Policy

1. Introduction

This Privacy Policy explains how Richard Huynh, trading as Noddr (“Noddr”, “we”, “us”, or “our”) collects, uses, discloses, and protects information in connection with:

• the Noddr iOS application and the Noddr macOS application (each, and together, the “App”). Except where this policy names one platform specifically, everything it says about the App applies to both;
• the Noddr hook and Mac helper you install alongside your coding agent (together, the “Local Components”);
• the Noddr backend services that relay approval requests and synthesize speech (the “Services”); and
• this website at noddr.cloudand its subdomains (the “Site”).

Together these are the “Product”. We have designed Noddr so that it works without an account, without a login, and without us building a profile of you. We do not ask for your name, email address, phone number, or payment details in order to use it.

This policy nonetheless describes the limited information that is processed in detail, because some of it — in particular the content of the commands your agent asks you to approve — can be sensitive. Section 6 covers that, and is the part we would most like you to read.

2. Summary at a Glance

Provided for convenience only. It does not replace the full policy below.

3. Scope and Roles

This policy applies to the Product. It does not apply to:

• Your coding agent.Noddr is a permission-approval front end for an agent such as Claude Code. The agent, the model provider behind it, and everything you send to it are governed by that provider’s terms and privacy policy, not ours. See Section 8.4.
• Third-party services you separately use, including Apple, your code host, or your employer’s systems.
• Websites linked from the Site.

We act as the controller(or “business”) for the processing described in Section 5, and our infrastructure vendors act as processors(or “service providers”) on our behalf under written terms.

Where you use the Product in the course of your employment, your employer may be a separate controller of the underlying content. Nothing here overrides your obligations to them.

4. How Noddr Works

Understanding the data flow makes the rest of this policy much easier to read.

1. Your coding agent is about to run a tool or command. A small program you install — the hook — intercepts that moment.
2. The hook publishes a short message — the tool name and a summary of what is about to run — onto an ephemeral broadcast channel hosted by our backend provider. The channel is named after a random identifier unique to your installation.
3. Your iPhone — or the Noddr app on your Mac — subscribed to the same channel, receives the message, reads it aloud through your AirPods, and waits for a head gesture.
4. You nod to approve or shake to deny. Optionally, you speak a short reply.
5. That device publishes the verdict — and your reply, transcribed on the device — back on the same channel. The hook receives it and tells the agent to allow or deny. The verdict is cryptographically signed with a secret established when your devices were linked; the hook rejects any verdict it cannot verify.
6. Nothing in steps 2–5 is written to a database by us. The messages exist only in transit and in memory.

Linking your devices. Where your phone is the approving device, the one-time link between your Mac and your phone is established over your local Wi-Fi network using Bonjour/mDNS, so there is no pairing code to type. Once the phone confirms the link, the Mac stops advertising permanently. Where the macOS app and the hook are on the same machine, no link step is needed and nothing is advertised on your network at all — the app reads the identifier and secret directly from the local file the hook already created.

5. Information We Collect

5.1 Information you provide directly

Only your email address and the contents of your message, if you choose to contact us for support, to exercise a privacy right, or to report a security issue — plus anything you choose to include in a bug report or beta feedback.

We do not collect a name, username, password, date of birth, postal address, phone number, payment card, or government identifier in order to operate the Product.

5.2 Information generated by the Product

5.3 Information collected automatically by infrastructure

Like any internet service, our providers generate operational records when your software connects to them:

• Connection logs held by our backend provider, which may include IP address, timestamps, connection status, and coarse geolocation inferred from IP.
• Function error logs written when the speech-synthesis proxy fails, recording the error and the upstream status code. These are not designed to contain approval content, and we do not deliberately log it.
• A global rate-limit counter consisting of a single database row holding a window-start timestamp and a request count. It contains no installation identifier, no IP address, and no approval content, and cannot be associated with any individual.
• Website request logs held by our hosting provider (IP address, user agent, requested path, timestamp).

We do not combine these operational records with the installation identifier or with approval content to build a profile.

5.4 Information we deliberately do not collect

• No account credentials, because there are no accounts.
• No advertising identifier (IDFA) and no App Tracking Transparency prompt, because we do not track you across apps or websites.
• No contacts, calendar, photos, health data, or precise location.
• No cookies, pixels, session-replay, heatmaps, or web analytics on the Site.
• No biometric identifiers.Head motion distinguishes “nod” from “shake”; it is not used to recognise, authenticate, or identify any person, and we derive no biometric template from it.
• No audio recordings on our servers.
• No persistent record of your commands, verdicts, or replies.

6. Content of Approval Requests

The summary of the action awaiting approval is transmitted off your machine. That is the fundamental mechanism of the Product and cannot be avoided while using it.

Please note the following.

1. We do not store this content. It passes through an ephemeral broadcast channel in memory and is not written to any database of ours.
2. It is encrypted in transit (TLS/WSS) between your machine, our backend provider, and your approving device. It is not end-to-end encrypted; our backend provider handles it in transit and could technically observe it.
3. The announcement text, which embeds this summary, is additionally sent to Google Cloud Text-to-Speech so it can be spoken aloud in a natural voice. This happens on both the iOS and macOS apps. See Section 8.2.
4. Reading your channel is protected only by the secrecy of your random installation identifier. Anyone who obtained it could subscribe to your channel and see the commands your agent proposes. It is a 122-bit random value and is never displayed in the App’s normal interface, but it is the whole of the boundary against reading, and you should treat the file storing it as sensitive.
   
   Approving is protected by a second secret.Verdicts and entitlement vouches are signed with the link secret established between your devices, and the hook rejects anything it cannot verify — so someone who obtained only your installation identifier could watch your session but could not approve a command on your behalf.
   
   Where these values are exposed.Both are put on your local network in a Bonjour/mDNS record during pairing. That window runs from the Mac helper’s first run until your phone confirms the link, and then stops permanently — it is bounded by that confirmation rather than by a fixed time, so on a machine that is never linked it does not close on its own. Where the macOS app and the hook share a machine, neither value is put on the network at all.
5. It will appear on your iPhone’s lock screen and Dynamic Island while an approval is pending, or in a floating panel on macOS, and will be spoken aloud through your audio output. Consider your physical surroundings.

If you work with regulated, classified, or contractually restricted material, review this section with your security team before enabling Noddr, and consider limiting the hook to tool types whose summaries cannot contain sensitive values.

7. Sensitive Categories

7.1 Head-motion data

Motion samples from your headphones are read on the device running the App — your iPhone, or your Mac — evaluated against fixed thresholds to classify a nod or a shake, and discarded. They are never transmitted to us or to any third party, never stored, and never used to identify, authenticate, or profile you. This is the same code on both platforms. We do not consider this biometric data within the meaning of Article 9 GDPR or of state biometric-privacy statutes, because it is not processed for the purpose of uniquely identifying a natural person.

7.2 Voice and speech

Voice Reply is off by default and must be turned on by you. When it is on, and only during a bounded reply window that ends after silence or at most 12 seconds:

• your microphone is activated and audio is buffered in memory on the device;
• the audio is transcribed by Apple’s on-device speech recogniser. The App explicitly requires on-device recognition, so the audio is not sent to Apple’s servers, to us, or to anyone else;
• the audio buffer is released when the window closes. We never receive it;
• the resulting text— not the audio — is transmitted back through the relay so your agent can act on it, and is therefore subject to Sections 6 and 8.4.

You may revoke Microphone and Speech Recognition permissions at any time in iOS Settings, and turn Voice Reply off in the App, without affecting nod/shake approval.

Some jurisdictions classify voice recordings, or the contents of communications, as sensitive personal information. Where that applies we process it only on the basis of your consent and only to deliver the feature you asked for; we do not use it to infer characteristics about you.

8. How We Use Information, and Legal Bases

We use information only for the purposes below. For individuals in the European Economic Area, the United Kingdom, and Switzerland, the applicable legal basis under Article 6 GDPR (or its UK/Swiss equivalent) is stated alongside.

Where we rely on legitimate interests we have carried out a balancing assessment and concluded the processing is necessary, proportionate, and consistent with your reasonable expectations. You may object — see Section 14.

We do not use your information for advertising, for profiling, for credit or eligibility decisions, or to train machine-learning models.

8.1 Backend relay provider

We use Supabaseto host the ephemeral broadcast channels and the speech-synthesis proxy. Approval content, verdicts, and reply transcripts transit Supabase’s infrastructure as Broadcast messages, which are not persisted to any table. Our project stores no user table, no authentication records, and no message history — only the non-identifying rate-limit counter described above.

The public key embedded in our software grants access only to unauthenticated broadcast channels and to the speech-synthesis endpoint; it grants no database read or write access.

8.2 Speech synthesis

To speak announcements in a higher-quality voice, the announcement text — which embeds the approval summary, truncated to 500 characters — is sent to our proxy and forwarded to Google Cloud Text-to-Speech. Google returns synthesized audio, which your device caches locally so repeated fixed phrases are not re-requested. This applies equally to the iOS and macOS apps— both use the same synthesis path.

• We do not retain the text after the request completes.
• Google processes it as our vendor under the Google Cloud Platform terms and data-processing terms then in force.
• If you prefer that no announcement text leaves your device, the App falls back automatically to the on-device Apple voice whenever cloud synthesis is unavailable.

8.3 Website hosting

The Site is hosted on Vercel, which processes request logs as described above. The Site loads web fonts from Fontshare and Google Fonts; your browser therefore discloses your IP address and user agent to those providers when a page loads. The Site sets no cookies and runs no analytics, tag manager, or advertising technology.

8.4 Your coding agent and its model provider

8.5 Apple

If you obtain the App through the App Store or TestFlight, Appleprocesses your download, device and OS details, crash reports, and any beta feedback you submit, under Apple’s own privacy policy. We may receive aggregated, non-identifying App Analytics and anonymised crash reports where you have consented to share analytics with developers. We cannot link these to your installation identifier.

9. Disclosure of Information

We disclose information only as described here. We do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising, under any definition of those terms in any jurisdiction. We have not done so in the preceding twelve months.

We may disclose information to:

1. Service providers and processors, listed in Section 10, who act only on our documented instructions under contracts containing confidentiality and security obligations.
2. Legal and regulatory recipients, where required by law, court order, subpoena, or other valid legal process, or where necessary to establish, exercise, or defend legal claims. Where legally permitted, we will make reasonable efforts to notify affected users before disclosing, and we will challenge requests that appear overbroad or unlawful.
3. Safety and security recipients, where necessary to investigate, prevent, or respond to suspected fraud, abuse of the Services, or threats to the security or rights of any person.
4. A successor entity, in connection with a merger, acquisition, reorganisation, financing, or sale of assets. Any successor remains bound by this policy for information collected before the change, or you will be notified before any materially different policy applies.
5. Anyone, with your consent or at your direction.

We do not disclose information to data brokers.

10. Service Providers and Sub-Processors

We keep this list current. Material additions will be reflected here and, where required, notified in advance.

11. Retention

We retain personal information only as long as necessary for the purpose it was collected for.

12. International Transfers

We operate globally, and so do our providers. Your information may therefore be processed in countries other than your own, including the United States, which may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal information out of the EEA, the United Kingdom, or Switzerland, we rely on one or more of the following safeguards:

• the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss addendum, as incorporated into our agreement with Google under its Cloud Data Processing Addendum;
• an adequacy decision covering the recipient country, or a certification scheme recognised by the relevant authority; or
• a derogation under Article 49 GDPR where strictly applicable.

You may request a copy of the relevant safeguards at privacy@noddr.cloud. We will provide them, redacted as necessary for commercial confidentiality.

13. Security

We apply the following technical and organisational measures.

• Transport encryption. All communication between your devices, our providers, and Google uses TLS.
• No message persistence. Approval content is relayed over ephemeral broadcast channels and is never written to a database by us. There is no archive to breach.
• No stored secrets on the client. The API key used for speech synthesis is held server-side and is never present in the App or the hook.
• Database access control. The rate-limit table is protected by row-level security with no policies, denying all access to the public key; only the server-side service role can reach it.
• High-entropy channel identifiers.Channel names are 122-bit cryptographically random UUIDs, generated locally and never displayed in the App’s ordinary interface.
• Authenticated verdicts. Every verdict carries a signature computed with a secret established between your own devices at link time and never sent over the internet. The hook rejects any verdict it cannot verify, and it fails closed— a missing secret rejects rather than allows. Someone who obtained your installation identifier alone therefore cannot approve a command on your behalf. The same signature protects entitlement vouches.
• Bounded local-network exposure. The Mac advertises its identifier and link secret over Bonjour only until the phone confirms a link, then stops permanently and records that fact on disk. Where the macOS app and the hook share a machine, nothing is advertised at all.
• On-device processing by defaultfor the two most sensitive inputs — audio and motion — on both iOS and macOS.
• Fail-safe defaults. Any failure, timeout, or unreachable backend causes the agent to fall back to the ordinary on-screen prompt. A destructive-command denylist always requires on-screen approval and can never be satisfied by a gesture.

No system is perfectly secure. We cannot guarantee the security of information transmitted over the internet, and the confidentiality of your channel depends on the secrecy of your installation identifier. Please read Section 6.

Reporting a vulnerability. Please report suspected vulnerabilities to security@noddr.cloud. We will acknowledge promptly and will not pursue legal action against good-faith researchers who act within the scope of a responsible disclosure. That scope, the full safe-harbour terms, and the weaknesses we already know about are set out in our Security & Disclosure Policy.

Breach notification. Where a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required, within 72 hours, and notify affected individuals where the law requires it. Because we hold no contact details for users, notification to individuals will ordinarily be given by prominent notice in the App and on the Site.

14. Your Rights and Choices

14.1 Rights available depending on where you live

Subject to your jurisdiction and to applicable exceptions, you may have the right to:

• access the personal information we hold about you, and obtain a copy;
• correct inaccurate or incomplete information;
• delete your information;
• port it to another controller in a structured, machine-readable format;
• restrict or object to processing, including processing based on our legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• opt outof sale, sharing, targeted advertising, or profiling producing legal or similarly significant effects — none of which we carry out;
• limit the use of sensitive personal information — we already limit it to delivering the feature you enabled;
• not be discriminated against for exercising any of these rights. We do not charge different prices or provide a different level of service to anyone who exercises a privacy right;
• appeal a refusal, where your state or country provides an appeal right; and
• complain to a supervisory authority (see Section 17).

14.2 The practical reality of an anonymous product

Because Noddr has no accounts, we usually hold nothing that we can link to you. Approval content is not stored. The installation identifier lives on your own devices, and we keep no register mapping it to a person.

This means that for most access and deletion requests, our truthful answer will be that we hold no personal information about you. Where a request concerns provider-held operational logs, we will need enough information to locate the relevant records — typically an approximate time window and the IP address you used. We will not ask you for, and you should not send us, your installation identifier unless you specifically want us to act on records tied to it. Under Article 11 GDPR and equivalent provisions, we are not required to acquire additional information solely to identify you.

14.3 In-product controls

• Turn Noddr offwith the single switch on the App’s main screen. No approval requests are relayed while it is off.
• Turn Voice Reply off in App settings. The microphone is then never activated.
• Revoke Microphone, Speech Recognition, Motion, or Local Network permissions at any time in iOS Settings.
• Restrict which tools trigger a requestby narrowing the hook matcher in your agent’s settings, so sensitive tool types never generate a summary that leaves your machine.
• Disable the Live Activity in iOS Settings if you do not want approval summaries shown on your lock screen.
• Uninstall the hookby removing its entry from your agent’s settings.

14.4 Making a request

Email privacy@noddr.cloud. Please state the right you wish to exercise and your country or state of residence. We will respond within the period required by applicable law — generally one month under the GDPR and UK GDPR (extendable by two further months for complex requests, with notice) and 45 days under US state privacy laws (extendable by a further 45 days, with notice).

We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we will tell you before proceeding. Where your state permits it, an authorised agent may submit a request on your behalf; we may require written proof of authorisation and may require you to verify your own identity directly.

14.5 Deleting everything yourself

You can remove essentially all Noddr-related data without contacting us:

1. Delete the App from your iPhone. This removes the stored channel identifier, the link secret, the settings, and the cached synthesized audio.
2. If you installed the Noddr app on your Mac, delete it from /Applications. This removes its copy of the channel identifier and any stored entitlement vouch.
3. On your Mac, delete ~/.noddr/— the installation identifier, the link secret, the link marker, and the local helper logs.
4. Remove the background helper: delete ~/Library/LaunchAgents/cloud.noddr.advertiser.plist, unloading it first with launchctl if it is running.
5. Remove the Noddr hook entry from your agent’s settings file.

After these steps, no identifier of yours exists anywhere in the Product other than short-lived provider logs, which expire on their own schedule.

15. Region-Specific Disclosures

15.1 European Economic Area, United Kingdom, and Switzerland

• Controller: Richard Huynh, 4450 Nelson Brogdon Blvd, Ste A9, Buford, GA 30518, USA.
• Data Protection Officer: we are not required to appoint one under Article 37 GDPR, because our core activities do not consist of large-scale regular and systematic monitoring or large-scale processing of special categories of data. Privacy enquiries are handled at privacy@noddr.cloud.
• Automated decision-making: the App classifies a head gesture as a nod or a shake, and the hook applies a fixed denylist of destructive commands. These are technical classifications of your own deliberate input and do not produce legal or similarly significant effects within the meaning of Article 22 GDPR. No profiling is carried out.
• Supervisory authority:you may lodge a complaint with the authority in your country of residence, place of work, or the place of the alleged infringement — or, in the UK, with the Information Commissioner’s Office.

15.2 California (CCPA/CPRA)

Notice at collection. The categories we collect and the purposes for each are set out in Section 5 and Section 8. Mapped to the statutory categories:

Sensitive personal information.We do not collect Social Security or government identifiers, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, or biometric information used for identification. To the extent that the contents of a communication and voice-derived text are treated as sensitive personal information, we use them solely to perform the service you requested and for the purposes permitted by § 1798.121(a) and its implementing regulations. We therefore do not offer a separate “Limit the Use of My Sensitive Personal Information” link.

Sale and sharing.We do not sell personal information and do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, including with respect to any consumer under 16 years of age. We therefore do not offer a “Do Not Sell or Share My Personal Information” link.

Shine the Light (§ 1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.

15.3 Other United States jurisdictions

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, as those laws come into effect — have the rights described in Section 14. In addition:

• we do not sell personal data, conduct targeted advertising, or engage in profiling in furtherance of decisions producing legal or similarly significant effects. There is accordingly nothing to opt out of, but you may still submit a request and we will confirm this in writing;
• universal opt-out signals: the Site honours Global Privacy Control by default in the sense that it performs no sale, sharing, or targeted advertising for any visitor, whether or not a signal is present;
• appeals: if we decline a request you may appeal by replying to our decision. We will respond within the period your state prescribes, generally 45 or 60 days, and will tell you how to contact your state Attorney General if you remain dissatisfied;
• we do not process personal data for purposes requiring a data protection assessment under these statutes.

15.4 Canada

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and with your knowledge and consent, which for Voice Reply is express and opt-in. You may withdraw consent subject to legal and contractual restrictions. Complaints may be directed to us and, if unresolved, to the Office of the Privacy Commissioner of Canada or your provincial regulator, including the Commission d’accès à l’information du Québec.

15.5 Australia

We handle personal information in accordance with the Australian Privacy Principles. We do not adopt or use government-related identifiers. Complaints may be made to us in the first instance and thereafter to the Office of the Australian Information Commissioner.

15.6 Brazil

Our legal bases correspond to Article 7 LGPD: execution of a contract (Art. 7, II and V), consent for Voice Reply (Art. 7, I), legitimate interests (Art. 7, IX), and compliance with legal obligation (Art. 7, II). You hold the rights in Article 18, including confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent.

15.7 Other jurisdictions

• Japan (APPI): we do not provide personal data to third parties without consent except as permitted by law, and we disclose our foreign transfers in Section 12.
• South Korea (PIPA): consent for Voice Reply is obtained separately from other processing, and the categories, purposes, and retention periods are set out above.
• India (DPDP Act 2023): you may withdraw consent and request erasure at privacy@noddr.cloud, and may raise grievances with our contact point before approaching the Data Protection Board.
• South Africa (POPIA): information officer contact: privacy@noddr.cloud.
• China: the Product is not offered to users in mainland China and we do not process personal information for the purpose of providing services to individuals located there.

If your jurisdiction grants rights not listed here, contact us and we will honour them where they apply.

16. Additional Matters

16.1 Children

The Product is a developer tool. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact privacy@noddr.cloud and we will delete it.

16.2 Cookies, tracking, and Do Not Track

The Site sets no cookies, uses no local storage for tracking, and deploys no analytics, advertising, or session-recording technology. The App stores a small number of local preferences on your device — the channel identifier, the Voice Reply setting, an onboarding flag, and cached audio — none of which are transmitted to us or used for tracking.

Because we do not track users over time or across third-party sites, we do not respond differently to Do Not Trackbrowser signals; there is no tracking to disable. This statement is provided under California Business and Professions Code § 22575(b)(5).

16.3 Third-party links

The Site and the App may link to third-party destinations, including TestFlight and the App Store. We are not responsible for their privacy practices, and this policy does not apply to them.

16.4 Beta and pre-release software

Portions of the Product may be distributed as beta software through TestFlight. Beta builds may contain diagnostic surfaces not present in released versions, and Apple collects additional feedback and crash information from beta testers under its own terms. Beta software carries a higher risk of defect; do not use it with material you cannot afford to expose.

16.5 No warranty of agent behaviour

Noddr conveys an approval decision. It does not evaluate whether the action your agent proposes is safe, correct, or lawful, and it does not alter what your agent does after approval. The destructive-command denylist is a safety net, not a guarantee. Responsibility for what your agent executes remains with you.

17. Contact and Complaints

If you are not satisfied with our response, you may complain to your data protection authority. In the EEA, a list is maintained by the European Data Protection Board. In the UK, contact the Information Commissioner’s Office. In other jurisdictions, contact your national or state privacy regulator.

18. Changes to This Policy

We may update this policy to reflect changes in the Product, our providers, or the law. When we do, we will revise the “last updated” date above and increment the version number.

If a change is material— for example, if we begin retaining approval content, add analytics, introduce accounts, or change the categories of recipients — we will provide prominent advance notice in the App and on the Site before it takes effect, and, where the law requires it, obtain your consent.

Previous versions are archived and available on request.