STRAIGHT
ANSWERS
Everything is here,
nothing folded away.
PRIVACY
Does anyone at NoBS read my brief?
Not as part of how the product works. Processing is automatic. Briefs are not queued for review, sampled for quality, read to improve the product, or opened by support, and no screen in NoBS displays brief content for review. Administrative access exists for running and securing the service, and it is separate from anything in the normal experience.
Do you keep a list of clients and brands?
No. There is no cross-account list of client names, brands, campaigns, budgets, deadlines or brief subjects, and no feature is built on one. Those details stay inside your own encrypted record.
Are there trackers on this product?
No advertising trackers, no session recording, no cross-site analytics. What runs: page-view counts, our own product events (never with brief text), and Sentry error monitoring, scrubbed. Details in the Privacy Policy.
What ends up in your logs?
Whether something succeeded or failed, how long it took, token totals, error categories and a hashed account identifier. Not brief text, not file contents, not generated output, not client or brand names, not passwords, cookies, tokens or keys — and not on error or retry paths either, which is usually where this kind of promise quietly breaks.
ENCRYPTION
Is my brief encrypted?
Yes. Brief content and everything derived from it are wrapped in a per-record AES-256-GCM envelope before being written to storage. Traffic between your browser, NoBS and every provider runs over HTTPS and TLS.
Why name the algorithm?
Because a name can be checked and "encrypted at rest" cannot. AES-GCM is authenticated encryption: it protects the content and lets us detect whether a stored record was altered.
Is it end-to-end encrypted?
No, and we would rather say so than borrow the label. NoBS has to read a brief to translate it — end-to-end encryption would prevent that, and prevent the product working. What we do instead is protect it in transit, seal it before storage, tie access to a verified server-side session, and keep the list of services that see readable content as short as the job allows.
FILES
Do you keep the file I uploaded?
No. The document is parsed during the request, the text is extracted and encrypted into your brief record, and the file itself is removed. There is no file store.
Could someone guess the address of my file?
There is no address to guess. Nothing you upload becomes a file sitting at a URL. It exists as encrypted text inside your own record, reachable only through an authenticated request.
Do you store exported PDFs?
No. An export is built for the request and streamed straight back to your browser. Nothing is written to our storage, and the conversion service is instructed not to keep it.
ACCOUNTS
Could another user reach my brief?
No. Reaching a brief needs both the project reference and your account identity, and the account identity comes from your verified server-side session rather than anything your browser sends. A project reference on its own resolves to nothing. Share links work differently — see Sharing below.
How are sessions protected?
Sessions live on the server. The cookie in your browser holds nothing but a cryptographically random identifier, marked HttpOnly, Secure and SameSite. There is nothing in it to read or forge.
How are passwords stored?
Not readably. Passwords are hashed with bcrypt at cost factor 12, with a unique salt for every password, and repeated login attempts are rate-limited.
Are API keys exposed in the browser?
No. Credentials for AI, storage, email, payments and export are held server-side, and every call to those services starts from our backend. Nothing reaches browser code.
SHARING
What happens when I share a brief?
You get a long, randomly generated link showing the brief and its translated output. It does not expose your email, your account, or the document you uploaded.
Does the person need an account?
No — and that cuts both ways. Anyone holding the link can open it, so treat it the way you would treat the brief itself. Links stop working after 90 days, and deleting the brief ends access immediately.
PROVIDERS
Which services see anything?
OpenAI for translation, Brave Search for reference discovery, Upstash for storage, Vercel for hosting, ConvertAPI for PDF export, Resend for account email, Stripe for payments, Loops for news and notices, Sentry for error monitoring. Each one and what it receives is listed on the Trust and Security page.
Does every provider get the whole brief?
No. OpenAI receives the brief content needed to translate it. Brave Search receives derived search terms. ConvertAPI receives rendered output when you ask for an export. Resend and Stripe receive account and billing information only. Upstash stores the encrypted record. Loops receives email addresses for news and notices. Sentry receives error reports, scrubbed of brief content.
Does Stripe see my brief?
No. Stripe handles subscriptions and billing. Card details never reach NoBS at all, and Stripe receives no brief content from us.
DELETION
What happens when I delete a brief?
The project record, the extracted text, every saved version, all generated output and the related indexes go together. Any share link for that brief stops working at the same moment.
What happens when I delete my account?
Your briefs, outputs and share links are deleted and any subscription is cancelled at once. For legal purposes we keep a limited record — name, email, account id and your consent records — for five years, as the Privacy Policy describes.