Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account Information: Your name, chosen 9-digit nmbr, password (hashed), and profile picture.
• Communication Content: Chat messages, email messages, call transcripts, and social feed posts you create.
• Call Data: Call history, duration, and transcripts generated after voice and video calls end. Call transcripts are encrypted at rest using the same AES-256-GCM encryption as chats and emails.
• AI-Generated Data: Insights, facts, tasks, reminders, events, and suggestions extracted by AI from your communications.
• Media Content: Photos, videos, and AI-generated stickers you create or share.
• Device & Session Information: Device type, browser, login timestamps, and session data for security monitoring.
• Usage Data: Feature usage patterns to improve the service.

2. How We Use Your Information

We use your information for the following purposes:

• Providing and maintaining the nmbr communication service (calls, chats, emails, feeds).
• AI analysis of your communications to extract insights, facts, tasks, reminders, and events about your contacts.
• Call transcription after a call ends, and AI-powered suggestions in chats and during calls.
• Powering the Ask nmbr AI assistant to answer questions about your contacts and conversations.
• Generating smart reply suggestions.
• Delivering push notifications for incoming calls, messages, and activity.
• Security monitoring including login alerts, device trust verification, and suspicious activity detection.
• Improving the service and developing new features.

3. AI Processing & Third-Party Services

nmbr uses third-party AI services (currently OpenAI) to process your communications for analysis, transcription, and suggestions. When your data is sent to these services:

• Data is transmitted securely and used solely to generate responses for your account.
• Your data is not used to train AI models by nmbr or its third-party providers.
• AI-generated insights are stored privately in your account and are not shared with other users.
• Call audio segments are transcribed and then discarded; only the text transcripts are retained.
• AI processing occurs in-memory only — your encrypted content is decrypted for the duration of the analysis and is never written to disk in unencrypted form. After processing, results are encrypted before storage.

nmbr uses LiveKit Cloud infrastructure for real-time audio and video call connectivity. Call media is routed through LiveKit's servers to ensure reliable connections. LiveKit processes media streams in transit but does not store or retain your call audio or video content.

4. Data Security & Encryption

We implement robust security measures to protect your data:

• Encryption at Rest: Chat messages, email content, and call transcripts are encrypted using AES-256-GCM before being stored in our database.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS/HTTPS.
• Password Security: Passwords are hashed using bcrypt and never stored in plain text.
• Two-Factor Authentication: Optional 2FA adds an additional layer of protection.
• Device Trust & Login Monitoring: We track login sessions and alert you to unrecognized devices or suspicious activity.
• reCAPTCHA Protection: Bot protection is used during registration and login to prevent automated attacks.

nmbr employees do not have access to your encryption keys and cannot read your messages, emails, call transcripts, or other encrypted content. Access to encryption infrastructure is restricted to automated systems only.

Please note: nmbr uses server-side encryption, not client-to-client end-to-end encryption. This means your data is encrypted on our servers, but it is decrypted in-memory for AI processing. Decryption occurs only momentarily during analysis and content is never stored unencrypted on disk. No method of electronic transmission or storage is 100% secure.

5. Social Feed & Content Visibility

Content you post to your social feed (photos, videos, text posts) is visible to your contacts. Feed posts are analyzed by AI to extract insights, which are stored privately in your account. You can delete your feed posts at any time.

6. Push Notifications

If you enable push notifications, we store a push subscription token associated with your device. This token is used solely to deliver notifications for incoming calls, messages, emails, and other activity. You can revoke notification permissions at any time through your browser or device settings.

7. Profile Pictures & Media Storage

Profile pictures are resized, compressed, and stored in cloud object storage. Feed media (photos and videos) are also stored in cloud object storage. These files are associated with your account and are removed when you delete the corresponding content or your account.

8. Information Sharing

We do not sell your personal information. We only share your information in the following circumstances:

• With third-party AI services for communication analysis and transcription (as described in Section 3).
• With third-party infrastructure providers for call connectivity.
• With AI agents you choose to add as contacts, limited to what you grant each one (as described in Section 9).
• To comply with legal obligations or respond to lawful requests.
• To protect our rights, safety, and the safety of our users.

9. AI Agents & Developer Access

nmbr lets you add AI agents as contacts. An agent is software that runs outside nmbr, operated by a developer or by you, with its own nmbr; it is labelled as an agent in the app. If you never add an agent, this section does not apply to you.

• What an agent can receive: An agent can only reach people who added it. When you add one, a consent card lists what it asks for and you choose what to grant. Depending on your choices, nmbr delivers to it: the messages and voice notes you send it (with their transcripts), your name, nmbr and profile picture, your tasks, reminders, calendar events and notes, and your summary and transcript of your calls. A call transcript includes what the other people on the call said.
• How it is delivered: nmbr decrypts this content on its servers and sends it to the agent's software over an encrypted connection. Conversations with agents are not end-to-end encrypted.
• Who holds it afterwards: Once delivered, this content is held by whoever operates the agent, on their own systems and under their own privacy practices. nmbr does not control what they do with it. Only add agents you trust.
• What an agent can do: An agent can message you and propose actions. A proposal appears as a card that you approve, edit or reject. Actions on your account, such as adding a task, run only after you approve, unless you chose to let a specific action run without asking.
• Your controls: You can block or remove an agent at any time, and change which actions it may run without asking. Removing an agent ends its access; it does not delete what was already delivered to it. The app shows you what each agent did on your account.
• Records we keep: nmbr keeps a record of agent activity (proposals and their outcome, actions run on your account, messages that were refused, and pauses) for safety and audit. This record does not contain message content.
• The plugin for Claude Code: If you install the nmbr plugin for Claude Code, messages between you and your own agent are relayed between nmbr and the Claude Code session on your computer, together with the permission requests that session raises. The plugin stores your agent token and the list of people allowed to message the session on your computer only, and it contacts no service other than nmbr.
• Developer keys: A developer key you create in Settings lets your own scripts act as you, within the limits you chose when creating it. Keys are stored in hashed form and can be revoked at any time.

10. Your Rights

You have the right to access, update, or delete your personal information at any time through your account settings. You can manage active sessions, change your password, enable or disable 2FA, and control your privacy settings (who can send you contact requests). You may also request a copy of your data or ask us to restrict processing.

11. Data Retention

We retain your data for as long as your account is active. When you delete your account, it enters a 30-day recovery window during which support can restore it on request — your data is preserved and your nmbr is held during this period. After 30 days, we permanently remove your personal information, communications, AI-generated insights, and media from our systems. Your nmbr may then become available for other users after a cooling-off period. When a nmbr is reassigned, all previous account data is permanently and irreversibly deleted — the new holder has no access to any prior user's data, contacts, or conversation history. Some data may be retained in encrypted backups for a limited period before being purged.

12. Children's Privacy

nmbr is not intended for users under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of nmbr after changes are posted constitutes your acceptance of the updated policy. We will notify you of significant changes through the app or via your nmbr email.

14. Contact

For privacy-related questions or concerns, please contact us at support@nmbr.ai or reach us directly through nmbr Support (900-900-900).