Privacy

N0X starts with local-first document Q&A and filename/chunk citations. Search, remote Ollama, cloud, and telemetry are separate network paths. The Browser provider runs inference, document retrieval, and enabled memory in your browser after required assets are available.

What stays local

When network features are off, Browser-provider prompts and responses, conversation history, document chunks, and RAG vectors stay under the app's browser origin. The original file is not uploaded for indexing. N0X computes a SHA-256 digest of its bytes locally for cache identity and duplicate detection; the digest is not sent to a server. Removing or clearing an attachment waits for its IndexedDB cache deletion to commit before the UI reports success.

For an inspectable cited answer, N0X stores the exact retrieved passages used for that answer with its conversation in Chat History. Removing an attachment or clearing the RAG Vector Cache does not rewrite old answers; clear Chat History to erase those evidence snapshots.

N0X saves and retrieves semantic memories only while Memory is enabled. Turning Memory off leaves existing entries stored until you delete them. Model weights use browser-managed caches; browser eviction, clearing site data, or clearing Model Weights removes them. Cloud API keys use sessionStorage rather than localStorage or IndexedDB, although crash and session-restore behavior varies by browser.

When data can leave your device

• Direct Deep Search sends your query through the N0X API route to available search and page-extraction providers.
• Cloud API requests go to the OpenAI-compatible endpoint you configure. Relevant document excerpts, enabled-memory context, and Deep Search results can be included in that prompt; N0X does not upload the original file as a separate attachment.
• If auto-routing is enabled, a complex request can select the configured Cloud API and include the document, memory, or search context enabled for that request.
• A remote Ollama URL sends the composed prompt and any enabled document, memory, or search context to that host. A loopback Ollama URL stays on your device.
• Browser model assets and embedding assets can download from external hosts on first use or after cache eviction. Opening the workbench also checks Chrome's Prompt API without starting an install. N0X asks Chrome to install Gemini Nano only after you explicitly select/install Chrome AI.
• Remote images in generated Markdown are blocked by default. Choosing Load once contacts that image host without a referrer; the host still receives the network request and your IP-level connection metadata.
• Generated HTML previews use an opaque-origin sandbox and block ordinary subresource and connection paths. Preview code can still attempt to navigate its own frame to an external destination, so review generated code before opening Preview.

Telemetry

Product telemetry is opt-in. A non-modal first-visit banner offers No thanks or Allow analytics; no analytics event is sent before you choose Allow. If enabled, N0X sends sanitized page views to Vercel Web Analytics and funnel events such as provider selected, model load result, first message sent, document uploaded, and search used to the N0X analytics route. The page-view URL keeps the path and explicit ref/UTM attribution; other query values and URL fragments are removed. Vercel and the deployment can still observe ordinary request and service metadata under their own policies. Telemetry does not send prompts, responses, document text, file names, API keys, or memory content.

With telemetry off, neither the Vercel Analytics component nor N0X funnel events are sent. Your choice is stored locally in this browser and can be changed below.