nitnoi

Privacy notice

ไทย

Last updated 28 October 2026

nitnoi carries messages between people who do not share a language, whether two of them or a group. Doing that means reading what you write, so this notice says plainly what is read, by whom, where it is kept, how long it stays, and what you can ask us to do about it.

Who is responsible

nitnoi is operated by CodeCraft Innovations B.V., which is the data controller for the personal data described here. You can reach us at [email protected] about anything on this page, including a request to see or delete your data. For anything about your data, write to [email protected]. A person reads it.

nitnoi is used mainly by two people talking across a language, at least one of whom is in Thailand, so this notice is written against Thailand's Personal Data Protection Act B.E. 2562 (2019).

What we process

• Your phone number. It is your account. You sign in with a one time code sent by SMS through our sign in service and its SMS provider, Twilio. nitnoi's own servers never see the code, and they store the number in E.164 form.
• A recovery email, if you add one. In Your account you can add an email address that helps you get your account back if you lose your phone number. It is kept by our sign in service, never on nitnoi's own servers, until you remove it, which you can do in Your account at any time. Deleting your account removes it too: the sign in service erases it together with your phone number. To check that the address is yours, and each time you use it to recover your account, the sign in service emails it an eight digit code through Google's mail relay; a recovery also needs a code sent by SMS to your new number.
• Being found by your number. Someone who types your full phone number into nitnoi sees your display name and profile photo, and can send you a request to talk. Nothing connects unless you accept, and declining tells them nothing. You can turn this off in Settings, under Conversations, with "Let people find me by my phone number": while it is off, looking up your number shows nothing, exactly as if nobody had it. The number someone types to look you up is not stored. A request keeps who asked whom, when, and your answer. Looking numbers up is limited to 10 an hour and 30 a day for each phone number doing the looking, which makes working through numbers slow.
• Scanning a QR code. When you scan someone's nitnoi QR code to start talking, the app uses your camera only to read the code, and only while the scanner is open. The picture is read on your phone and is never sent or stored; only the link in the code is used, to open that person's invitation. In a browser, the camera is opened without the microphone.
• Your display name and profile photo. The name and picture the other person sees. A profile photo is optional, and you can remove it at any time from your account settings. Your name and photo are shown to the people you are in a conversation with, and in the other places this policy describes: to someone who looks you up by your number, to the members of your groups and people who open a group's invite link in nitnoi, to people who read your Nearby posts and replies, and to the author of a Nearby post you like.
• Your gender, if you give it. When you sign up, and later in Your account, you can say you are a woman or a man, or prefer not to say. It is not shown to anyone. Many languages, Thai among them, choose their words by the gender of the person speaking and of the person spoken to, so when nitnoi knows it, the translation providers named below are told, with each message, whether its writer and its reader are a woman or a man. It also decides whether the voice that speaks your words in Together Mode and Table Mode, and reads Decoder translations to you, is a woman's or a man's, unless you choose a voice. If you have not said, nitnoi may work this out from the Thai you write, or by asking DeepSeek whether your display name is a woman's or a man's. You can change it at any time.
• Chat backgrounds. A conversation's background can be one of our designs or a photo from your phone. A photo is made smaller on your phone first, at most 1080 pixels wide, which also strips the location and camera details stored in it, and is then uploaded to our storage, up to 5 MB. Your default background, and one you choose "Just for me", only you see. One you choose "For both of us" is what the other person sees in that conversation too, until one of you changes it or stops sharing it.
• Your contacts, if you allow them. When you send a first message, nitnoi sends the phone numbers in your contacts to our servers, which compare them with the numbers of nitnoi accounts to show you who is already on nitnoi. To tell you when someone you know joins, it keeps each number only as a keyed hash, never as the number (see Your contacts).
• A one-time location, only when you send it. A conversation has a button that shares where you are, as a message. It reads your position at the moment you tap it, about a hundred metres accurate, and sends it through our servers to the participants in that chat like any other message only when you press Send. When a place someone in the chat shared is on your screen and you have already allowed location, the phone compares that place with the last position it already knows, to say how far away it is. That happens on your phone, and the position is not sent anywhere. Refusing location permission leaves the other features working.
• Live location, only when you start sharing. In a person or group chat, you can choose Share live location for 15 minutes, 1 hour or 8 hours. This is optional. After you tap Share and allow location access, including in the background, nitnoi collects location data to share your changing location with the participants in that chat, even when the app is in the background, closed, or not in use. Your device sends its position, accuracy and capture time through our servers during that active share. Updates can pause without a connection or if the app is closed; the card shows when the last update arrived. Live updates end when your chosen time runs out, and you can tap Stop sharing at any time. We do not collect your device's location in the background outside an active live share, and the locations you share are not used for advertising. Each update replaces the previous live position on our servers, and the current live position expires at the chosen deadline. The starting location, the deadline and whether sharing stopped stay with the message under the retention rules below; stopping or expiry does not delete that message.
• Places you search for. The same button can search for a place, such as a café or a viewpoint, and send it as a card. Your phone sends what you type to our authenticated place-search service, which forwards it to Google Places with the language to answer in and, when the phone knows where it is, a position rounded to about a kilometre so the nearest places come first. Our service enforces usage limits; it does not keep a search history. A place you send is stored as Google's identifier for it, without its name or address: each phone that shows the card asks our service for them in its own reader's language, and our service asks Google.
• Nearby posts. Nearby uses a foreground location fix to find posts around you and places a post you send in a coarse area. Your exact position is never published. People nearby can see your post, display name and photo, reply and like it. Posts expire after twelve hours; their text and area are removed by our cleanup. An optional invitation can include a place and start time. To make retries safe, we retain your account identifier and a random post identifier after a post is removed, without its text or location. These retry identifiers are removed when you erase your account.
• Your messages. The text exactly as you sent it, the translation of it, and the extra reading that nitnoi produces about it, such as a warning that a phrase can be taken two ways and the questions that clear it up.
• Voice notes. The audio is uploaded so it can be transcribed, and the clip itself stays so you can both replay it, until you erase your data. The transcript and its translation stay with the message.
• Your conversation with nitnoi. What you write to nitnoi, the app's AI, what it answers, and the short things it remembers about you. There is a section about this below.
• Photos, videos and files. What you send in a conversation is uploaded to our storage and kept with the message. A photo is normally made smaller on your phone first, which also strips its location and camera details; a video or a file is kept as you sent it, and a video also gets a preview picture and a copy made for playing. A GIF you choose is fetched from Klipy by your phone and sent like a photo. A photo or video sent to be seen once is deleted from our storage, with its copies, as soon as the other person opens it. When you ask nitnoi to translate the words in a photo you received, the photo goes to Google to read them, and the words and their translation are kept with that message.
• Calls. We record who called whom, when, how long it lasted, and whether captions were switched on. We do not record call audio. If live captions are on, the caption text is kept as the call's transcript, which both of you can reread from the call's page for 90 days.
• Live captions. While captions are on, both voices are sent to a speech provider for translation. The caption text is stored as the call's transcript for 90 days. It is visible to both of you, and gone from your side the moment you delete that call from your history. The stored text itself is erased when both of you have deleted your accounts, the same way the rest of a conversation is. A captioned call is not end to end encrypted, both of you see that on screen while it runs, and either of you can stop captions at any moment without the other agreeing.
• Together Mode and Table Mode. When the two of you are in the same room, nitnoi can interpret between you out loud: through both phones with earbuds in, or through one phone laid on the table between you. We keep the session the way we keep a call, and a transcript of what was said is saved only if the person who starts it asks for that before it begins. There is a section about this below.
• Talk face to face. The record of an in person translation with someone who does not use nitnoi: who started it, when it started and ended, how long it lasted, the two languages, which version of the notice was shown, why it ended, and what is needed to count its minutes. No audio is recorded and no transcript is saved. There is a section about this below.
• Stories. A photo or video you share as a story, with any caption, drawing or writing you add, and the song you pick, which we keep only as a reference to Apple's catalogue, never as audio. A photo is made smaller on your phone first, which also strips its location and camera details. You choose who sees a story: everyone you talk to, only the people you pick, or everyone except them, from a list of up to 256, and we remember your last choice for next time. When someone views your story we record who and when, and you can see that list. A reaction records who reacted and with which emoji, and the first one also sends you a notification. Writing you choose to show in both languages is translated the way your messages are, and the translation is kept with the story.
• Your shared dictionary. The words and phrases the two of you teach nitnoi inside one conversation. It belongs to that conversation and is never used in anyone else's.
• Tone check. In a conversation with one other person that nitnoi translates, nitnoi tells you before you send a message if it might come across differently once translated. Each time you pause while typing, what is in the message box goes to DeepSeek, or to OpenAI in its place as OpenAI's entry below says, with the recent messages in that conversation, the one you are replying to, your shared dictionary, both your display names and languages, the name you gave the other person if you renamed them, and whether each of you is a woman or a man where you have said. Nothing reaches the other person until you send it, and we do not store what you typed: we count the day's checks and record what each one cost, without your words. Tone check is on unless you turn it off in Settings, under Privacy & chats.
• Help me explain. When you ask nitnoi to help you explain a message in a conversation with one other person, that message goes to DeepSeek, or to OpenAI in its place as OpenAI's entry below says, with the recent messages in that conversation, up to 12 matching entries from your shared dictionary, both your display names and languages, and the name you gave the other person if you renamed them. It drafts the explanation, and the draft is translated for the other person the way a message is. The draft is held for 30 minutes from its last change so you can check and adjust it, and nothing reaches the other person until you send it. Once sent, it is kept like any other message.
• Online Decode. What you decode online while signed in is kept in your history, Recent translations: the words you pasted, typed or said, their translation and the possible readings, and for a photo or video, the file itself and the words read from it. Only your last 50 are kept, and each new one pushes out the oldest. Signed out, nothing you decode is saved; it is held for up to five minutes while it is being answered, and a photo is read and not kept. When you record a clip for the Decoder, the audio goes to Google (Gemini) to be turned into text. Live Decoder transcription also sends your audio to Google (Gemini) while you speak, so words can appear as you talk. If the OpenAI live service is enabled instead, your audio goes to OpenAI. nitnoi does not keep that audio. On phones, Decoder may keep the microphone running for up to 30 seconds after a turn so the next press catches the start of your speech. Between turns, only the latest 700 milliseconds are held in a rolling buffer on your phone; this idle audio is not sent or saved. Your next press includes the available buffer before the audio from that press. The buffer is discarded when you leave Decoder, background the app, change accounts, start playback, or another feature needs the microphone, and when the microphone closes or fails. Only audio adopted by a new press is sent for transcription. For live Decoder transcription, OpenAI may retain audio and related content in abuse-monitoring logs for up to 30 days, or longer when required by law or reasonably necessary to prevent harm. This is separate from nitnoi, which does not keep that audio. As you type, the Decoder translates what you have typed so far without waiting for you to finish: those in-between translations are sent to be translated like any decode, and only the words you stop on are kept in your history. Signed in, we also note that someone asked about those words, in a one-way form that cannot be read back, and once at least three different people have, the translation is kept once and answers everyone signed in who asks after them. There is more about this below.
• Offline Decode. On supported phones, downloaded language models translate on the phone: Apple supplies the models on iPhone and Google ML Kit on Android. Android shows the attribution “powered by Google Translate” for these translations. Only tapping Download or Try again requests translation language downloads. On-device voice recognition depends separately on the phone and its installed speech languages. Offline text, translations and audio stay on the phone for the current session; they are not added to server history or uploaded when a connection returns. Content-free usage events can be queued and uploaded later, recording that translation or listening ran offline without the text, transcript, translation or audio. Google ML Kit may contact Google for models and updates and send diagnostics and usage metrics, including device and app information, installation identifiers, performance, input/output sizes, error codes and the identified or configured languages; it does not send the input text or translated output. See ML Kit privacy information and Google's data disclosures.
• Notifications. The push endpoint your browser or phone gives us, and the notifications we send. When you allow notifications in a browser, the browser gives us a push subscription, an address and keys, which we keep for that device. A message notification can contain up to 120 characters of the message so that it is worth reading. For a conversation you locked with "hide previews" on, the notification shows neither who wrote nor what they wrote. A browser notification is encrypted for that browser before it is sent. The browser's own permission prompt and the app's reminder to turn notifications on are not a separate agreement.
• Billing. Which plan you are on and the references our payment providers give us. Card details are handled by Stripe and never reach us.
• Settings. Your language, whether messages are translated automatically, your timezone, and whether you share read receipts and when you are online, for all your conversations or differently in one. Both work in both directions: turn one off and the other person stops seeing it about you, and you stop seeing it about them. We record when you read each message, unless your read receipts are off when you read it. We also note when you last used nitnoi, at most once every fifteen minutes and whatever your settings; nobody you talk to sees it, and we use it to count how many people use the app. Whether you are online, and which conversation you have open, is held in memory only, for a minute or two.
• Which version of the app you use. The app tells our servers which version it is: iPhone, Android or web, its build number and its version. We keep the latest with your account, with when you started using it, and write it down only when it changes. We use it so the app is only offered what it can show, such as a conversation with someone who reads it in LINE, and so a notification we take back is taken back in a way that version understands. Older iPhone versions do not say which they are, and are recognised by the build number the phone adds to every request.
• Chat lock. If you lock conversations, we keep which ones are locked, a scrambled form of your PIN (a salted, deliberately slow hash, not the PIN itself), and, for each phone that unlocks them with your face, fingerprint or passcode, a scrambled form of a secret only that phone holds. We also keep how soon the lock comes back on each device, and whether notifications from locked conversations hide what they say. The other person is not told that you locked a conversation.
• Where you came from. A link to nitnoi from one of our ads or posts carries labels naming the campaign, and some ad networks add their own reference to the click. The app keeps the first of these that brought you, together with the site that sent you and the page you landed on, and never overwrites it later. On Android, Google Play passes the same labels to the app when it is first opened.
• How the app is used. The iPhone and Android apps use Google Analytics for Firebase to count installs, app opens, the screens people use, and purchases. It works with identifiers for the app on your phone, the kind of phone and its system version, and an approximate location worked out from your IP address. It is not given your phone number, your name, your account or anything you write, and it does not use your phone's advertising identifier.
• How you use nitnoi itself. The apps also tell nitnoi's own servers how they are used: which screens you open and how long each stays in front of you, which buttons and controls you tap, by the name the app gives them, and when you use a feature such as the Decoder, a translation, a call or a game, with how long it lasted. Each record carries the app's version, the kind of phone and its system version, your language and your time zone. While you are signed in it is tied to your account; before you sign in, to a random number the app makes up when it is installed. It never holds what you write or say: no messages, translations, recordings, photos, contact names or anything you type. It stays on nitnoi's own servers, and no analytics company receives it. You can stop it at any time: open You, then Privacy & chats, and turn off Share usage statistics. The copy you can make in the app leaves these records out; write to [email protected] and we will send them to you.
• Feedback you send. What you write in the app's feedback form, the rating you give, and the screen you sent it from.

Why we are allowed to process it

Carrying and translating your messages is the service itself, and so is everything nitnoi does with what you write and say to make it understood: transcribing voice notes, explaining a message and asking the questions that clear up an ambiguous phrase, rewriting your tone, checking how a message will come across before you send it, helping you reply, reading what you paste into the Decoder, live captions, interpreting out loud in Together Mode, Table Mode and face to face, and the recap of a session you chose to keep. Processing your messages and your voice through the translation and AI providers named below is necessary to provide that service, so we rely on the necessity of performing our contract with you: section 24(3) of Thailand's Personal Data Protection Act and, for people in the European Union, Article 6(1)(b) of the GDPR. It is what you agree to when you sign up, where the sign in screen says that messages are translated automatically, and there is no separate switch in each conversation.

Letting someone who has your full number find you, and ask you to talk, is part of that service too, and the switch that turns it off is yours at any time. Keeping a record of who has already had a free trial, or the free first 14 days of Plus every new account gets, relies on our legitimate interest in preventing abuse, and keeping the number a block was placed against relies on our legitimate interest in the safety of the person who placed it. Billing records are kept because tax and accounting law requires it.

Recording how nitnoi itself is used, and reading the feedback you send, relies on our legitimate interest in learning which parts of nitnoi help people, which confuse them, and what to fix or build next: section 24(5) of Thailand's Personal Data Protection Act and, for people in the European Union, Article 6(1)(f) of the GDPR. You can object to it at any time, as Your rights below describes.

Talking face to face has only one nitnoi user. For the person across the table, who has no account, we rely on our legitimate interest in helping two people understand each other while they talk, with no recording, no saved transcript, and either of you able to stop at any moment: section 24(5) of Thailand's Personal Data Protection Act and, for people in the European Union, Article 6(1)(f) of the GDPR.

Studio is a feature you ask for, like the others above. Each edit happens only when you tap a Studio tool, and it relies on the necessity of performing our contract with you: section 24(3) of Thailand's Personal Data Protection Act and, for people in the European Union, Article 6(1)(b) of the GDPR. Studio is for people 18 or older. You can stop by not using Studio, and turn off "The people I talk to can use my photos in Studio" for the photos you sent the person you talk with. Nothing else in nitnoi depends on it.

Your conversation with nitnoi is part of the service as well, on the same basis as carrying and translating your messages. nitnoi answers what you write to it, shows how your words read in the other language, remembers what you tell it so it can answer like someone who knows you, and checks what you write for signs that you might harm yourself so that it can answer with crisis lines. All of this relies on the necessity of performing our contract with you: section 24(3) of Thailand's Personal Data Protection Act and, for people in the European Union, Article 6(1)(b) of the GDPR. It is what you agree to when you sign up, and nitnoi has no separate switch. Its welcome, and the two messages it may send you in your first days, rely on our legitimate interest in helping a new account find its way.

Counting how the app is used, and learning which of our ads and links bring people to nitnoi, relies on our legitimate interest in understanding and advertising our own app. It is kept as small as it can be: no advertising identifier, nothing from your conversations, and nothing that follows you around other companies' apps. You can object by writing to [email protected].

Nothing that keeps you safe depends on your plan. Warnings about words that can be taken two ways, the questions that clear them up, and the words you have taught us work on every plan.

Together Mode and Table Mode

When the two of you are in the same room, nitnoi can interpret between you out loud. In Together Mode both phones join the session and each of you wears earbuds: you hear each other's real voices across the table, and the translation arrives in your ear a moment later. In Table Mode one phone is laid between you, it hears both of you on its own microphone, the screen splits so each of you reads your own language, and it speaks each translation through its speaker.

While a session runs, and only while it runs, both voices travel through the same relay a call uses, which records nothing, to our caption worker and on to Google (Gemini), which recognises the speech as text live. Each finished line is then translated: by DeepSeek when the two languages are English and Thai, with Google asked instead if DeepSeek fails within the time allowed, and by Google for every other pair. Google then speaks each translation as the voice you hear. Live captions on a call go through the same caption worker in the same way, except that a call asks DeepSeek first for every language pair, with Google as the fallback. Sessions spend the same monthly minutes as captions.

So that a common line is not paid for twice, the caption worker keeps recently translated lines and their translations in its memory: one store serves Together Mode, Table Mode and face to face sessions and another serves calls, each shared by everyone the worker serves and holding up to about 2,000 lines with no time limit. A line leaves when newer lines push it out or the worker restarts. It lives only in the worker's memory and is not saved to disk, to a database or to our logs, and a line that matches a couple's glossary is never kept there. Our logs never contain what was said, its translation or any audio.

A transcript of what was said is saved only if the person who starts the session turns on "Keep what we say" before it begins, and the other person is told on screen that it is on. Then every finished line becomes the session's transcript, which the two of you can reread for 90 days and which is then deleted by the same nightly sweep that deletes caption text. Afterwards, DeepSeek reads the transcript and picks out up to eight phrases worth learning. The recap it writes holds those phrases and one line from the session showing each one in use, so a little of what was said outlives the transcript: the recap stays with the session until you erase your data.

With that switch off no transcript or recap is saved, and no audio is recorded either way; only the translation memory described above holds recent lines, with no time limit, until newer lines push them out or the worker restarts. What we keep either way is the session record: who started it and with whom, which of the two shapes it was, when it started, was answered and ended, how long it lasted, why it ended, whether the transcript was kept, and the fields used to count its minutes.

Nearby

Nearby shows short posts from people close to you on a map. Before anything leaves your phone, the app turns your location into a grid cell of about 1.5 km and a map area of about 500 m. Your exact coordinates are dropped on the phone and are never sent or stored. A post is drawn on the map at its area's centre, never more precisely, and reaches people within about the distance the app shows you.

People nearby see your name, your photo and what you write in posts and replies, and they can like posts. Everyone who can see a post sees how many likes it has, and its author also sees the names and photos of the people who liked it, so when you like a post, its author sees your name and photo. Nothing else from your profile, and none of your contacts or messages, is shown. When someone reads a post in another language, it is translated by the providers named under Who else sees your data, and the translation is kept with the post. Posts and replies are checked against a list of words we maintain ourselves; no outside company filters them.

Posts and replies disappear after 12 hours and are then deleted, with their translations, likes and invitations, by a cleanup that runs at least every hour. A request to start a conversation from a post is deleted 24 hours after the post ends. If someone reports a post or reply, the report keeps a copy of it until 30 days after we decide the report, or 180 days after it was filed, whichever comes first; the report itself, its reason and our decision stay. Backups follow the rules under How long we keep it.

Your contacts

When you allow contacts access, the app reads the phone numbers in your address book, puts each one it can read into full international form on your phone, using your country where a number needs it, and sends them to our servers in pieces of up to 1,000. The server compares the numbers themselves, in that form, with the numbers of nitnoi accounts; that comparison does not use hashes. To honour blocks placed on a phone number, it also works out a SHA-256 digest of each number sent and looks those digests up among the blocks; the digests are not kept after the check. It answers only with people who can be found by their number, have no block with you in either direction, have an active account and are not you. For each one it returns their name, a link to their photo that works for ten minutes, the number as your phone sent it, and a ready-made greeting based on your two languages. Numbers are not written to our logs and, apart from the daily sync below, are not kept after the check.

At most once a day the app also sends your address book to be remembered, so that we can tell you when someone you know joins. Each readable number is kept only as a keyed hash (HMAC-SHA256 with a secret key held by nitnoi), never as the number. A sync that completes within its time window forgets the hashes of numbers it no longer sent, and a hash that has not been refreshed for 30 days expires and is removed by a regular cleanup. When the app finds contacts access turned off, or its daily sync finds no readable number, it asks us to forget them all, and they also go when your account is deleted. Anyone can turn off being found by their phone number.

The sync also sends the names you saved for each number, including multiple names and numbers. We keep those names with your keyed phone hashes, without storing additional raw contact numbers. Names expire after 30 days without a name refresh, even if an older app refreshes the number. Completed syncs reconcile removed names and numbers, including limited contacts access. Revoking contacts access, forgetting remembered contacts and deleting your account remove the names too. Your own personal-data export includes your retained names and synchronization dates, never the hashes or secret key.

For authorized staff owners, Nora and Praxis can search these saved names to find an account for a group request. Every phone lookup and saved-name association follows phone discoverability, account availability, fixture boundaries and blocking in both directions, even for existing conversation partners. Someone who turns off phone discovery can still be listed or found by their conversation display name or your private conversation alias, without linking a phone or saved contact name to their account. A privacy-refused saved contact and an unregistered one have the same unresolved answer. This differs from inviting a phone number to a group: that returns a link without matching the number to an account or contacting the person.

Talk face to face

Talk face to face is Table Mode with someone who does not use nitnoi. You put your phone on the table between you, and the phone's microphone hears both of you. While the session runs, and only while it runs, both voices go through the call relay, which records nothing, to our caption worker and on to Google (Gemini), which recognises the speech as text. Each line is translated by DeepSeek when the two languages are English and Thai, with Google asked instead if DeepSeek fails within the time allowed, and by Google for every other pair. Each sentence is shown on the split screen in both languages, and Google speaks it out loud in the other person's language. The translation memory described under Together Mode and Table Mode holds recent lines, with no time limit, until newer lines push them out or the worker restarts. The voice cannot be switched off in this mode, so nobody can be translated silently.

No audio is recorded, and no transcript or recap is ever saved for a face to face session. What we keep is the session record, so that the minutes can be counted against your plan: the account that started it, when it started and ended, how long it lasted, the two languages, which version of the notice was shown, why it ended, and the fields used to count its minutes. It spends the same monthly minutes as calls and Together Mode.

The other person, who never signed up

The person across the table has no nitnoi account. Their half of the screen, in their own language, tells them that nitnoi listens to both of you and says each translation out loud, and either of you can end the session at any moment. If you tell the app their gender, it is sent to our caption worker only to choose the wording and the voice during the session, and it is not stored. Afterwards we keep nothing that identifies them: no recording of their voice, no transcript of their words, no name, no number. The session record names the account that started it and the two languages, and nothing else about them. If you are the person who was at the table and you want to ask us about this, write to us and we will help.

Talking through LINE

The nitnoi MINI App opens inside LINE for invitations and your settings. LINE's permission screen asks for your profile: your LINE user ID, display name and profile-picture URL. We request the openid and profile permissions, not your email, phone number, contact list or other LINE chats. We verify LINE's ID token with LINE and issue a session lasting at most fifteen minutes. This session stays in the page's memory; it is not an app login. Opening an invitation creates no nitnoi account. Starting a conversation through LINE needs no separate agreement: these Terms and this Policy cover it. When you start one, we record when it started and which version of the notice was shown. You can view or download your data in My nitnoi, and stop, block, report or delete there after confirming. LINE's own SDK and permission settings are controlled by LINE.

If someone invites you to talk through the nitnoi official account in LINE, you can reply without installing nitnoi or giving us a phone number. Before connecting, we show a notice in Thai and English about how the conversation works. This is for people aged 13 and over. We record when the conversation started and which version of the notice was shown.

LINE gives us your LINE user ID, display name and profile picture where available, the messages you send, and whether you have added or blocked the official account. We use these to recognise you, connect you to the person who invited you, deliver and translate text, and avoid sending messages LINE cannot deliver. LY Corporation, which operates LINE, carries the messages under LINE's own terms and privacy policy. This conversation is not end-to-end encrypted.

AI reads the text to translate it on servers outside Thailand. These are the same providers named below, each doing for this conversation the work described there: DeepSeek, Google (Gemini), Anthropic (Claude), OpenRouter and OpenAI. This needs no separate agreement or switch: these Terms and this Policy cover it.

We keep your LINE identity, name, picture and conversation while it is open. If you move the conversation into the nitnoi app, your data merges into your app account: the conversation and its history, what you sent, reacted to and reported in it, any report about you in it, a second seat someone gave you, and your reading language join that account, and your LINE identity stays linked to it. We confirm the move with LINE and with your app account before it happens, then delete the separate LINE-only account, send one last message in LINE to say where the conversation went, and stop relaying it there. Use the Menu button to stop, block the other person, report a problem, change language, or delete your data. Deletion asks you to confirm and removes your LINE identity, name and picture. Only a one way digest of your LINE user ID is kept, with the day your free first 14 days of Plus end, so they are given once; it is deleted 12 months after that day, or after the deletion if you had none. Messages you already sent stay in the other person's chat, just as between two nitnoi app users; deleting your account does not take their conversation away. The same account deletion and backup rules below apply. Temporary webhook records are removed within thirty days; processed message bodies are cleared from that inbox immediately, and reply tokens and unused confirmation buttons are short lived.

If the read feature is enabled, LINE shows your messages as read after the other person actually reads them in nitnoi, subject to their read receipt settings. Adding nitnoi as a friend lets replies from that person keep reaching you. nitnoi will never ask for an OTP, a password or your bank account through this conversation.

Your conversation with nitnoi

Every new account finds a conversation with nitnoi in its Chat list. nitnoi is an AI, not a person: it says so in its first message, and an "AI" tag sits by its name. For an account with a US or Canadian (+1) phone number it also says so again after every three hours of continuing conversation. It is an AI companion for the language side of talking with someone: it welcomes you, answers questions about the app and about the other person's language and culture, and shows you how something you would like to say reads in that language. In your first days it may write to you twice, never more, and you can mute it like any conversation.

What you write to nitnoi goes to DeepSeek so that it can answer, together with the recent messages of that conversation, your display name, your languages and the short things it remembers about you. If DeepSeek fails or takes too long, Anthropic (Claude) answers instead. If Anthropic cannot be used either, because our account with it has run out of credit or our key has been refused, OpenAI answers instead. Your conversation with the nitnoi AI assistant accepts written messages, emoji and stickers. When nitnoi shows you how your words read in the other language, those words are translated the same way as your chat messages: by DeepSeek, with Google asked at the same time when DeepSeek is slow, and by Anthropic (Claude) at the same time, whose version replaces the first when it passes the same checks. When DeepSeek or Anthropic cannot be used, OpenAI does that company's part of the translation instead, as OpenAI's entry under Who else sees your data says. nitnoi sees only its own conversation with you, never your other conversations, your contacts or your photos. Like everything else you write in nitnoi, none of it is used to train any model: we do not train on it, and DeepSeek, Google, Anthropic and OpenAI act on our instructions and may not use it for their own purposes.

nitnoi remembers short things you tell it, such as the name of the person you want to talk with, how you met, what you are learning or a visit coming up, so that it can bring them up later the way a friend would. What it remembers belongs to you alone: it is never shown to anyone else, including the person you talk with, and never used in anyone else's conversation. Telling nitnoi to forget everything deletes its memories about you, and so does clearing the nitnoi chat. Otherwise a memory stays until you delete your account, except that one nitnoi has not recalled for 12 months is deleted automatically.

nitnoi watches its conversations for signs that someone may be in danger, and points them to help. This is the protocol it follows. Every message you send nitnoi is checked by our own code, for clear phrases in English and Thai about wanting to die or to harm yourself, before any AI model is asked and even when you have used up the day's replies. Whenever the AI model writes an answer, it is also asked whether anything you wrote suggests you might harm yourself or end your life, even indirectly or half joking. If either finds a sign, nitnoi sends nothing an AI wrote. It answers with one fixed message: a few words of care, then the crisis line for your country, which it takes from your phone number or else from your device's time zone, and what to do if you are in danger right now. Where it has no verified line for your country, it gives your local emergency number and findahelpline.com, which lists free, confidential helplines in over 150 countries. That message carries no suggestions or buttons, and it does not count against your replies for the day. If you tell nitnoi that someone else is in danger, it is instructed to answer with care and to suggest calling local emergency services. Nobody is notified. Nothing about it is added to your account: nitnoi's answer stays in your conversation like any other message, and the only count we keep is how many times this happens each day, in each language, which names nobody and holds nothing you wrote.

"How nitnoi works", which opens from nitnoi's name, says in one line: "nitnoi is AI and can be wrong. It may not suit some minors." So check anything that matters, and do not share passwords, codes, bank details or any other secret with nitnoi.

The conversation is kept like any other conversation, for as long as your account exists. Clearing it hides it from you, and nitnoi no longer reads what came before. It is part of the copy of your data you can make in the app, together with what nitnoi remembers about you, and deleting your account deletes both entirely, because there is nobody on the other side who keeps a copy.

Groups

A group is a conversation with up to 32 people. Everyone in it sees your display name, your profile photo, the language you read and what you write there, from the moment they joined, each of them in their own language. The translation providers named under Who else sees your data do the same work for a group as for a conversation between two people. A group that has Nora in it also shares its conversation with CodeCraft's Praxis system, as described below. Your phone number is never shown to the group.

Only someone you already have a conversation with can add you to a group, and you can leave at any time. You see what was said from the moment you joined; if you leave and are added back, you see the group again from your return, never what was said while you were away. Admins can change the group's name, photo and settings, add and remove people, make others admins, and make or turn off its invite link.

Nora is CodeCraft's AI assistant and shows in a group as "Nora (CodeCraft AI)". She runs on Praxis, CodeCraft's own work system, and posts progress updates and questions for the group to decide. Only a nitnoi staff member who is an admin of the group can add her, only once everyone in it has an up-to-date app, and a line in the group shows who added her. From then on, and never for anything said before, nitnoi sends Praxis each new message in the group: who sent it (their account ID, display name and language), what they wrote (for a voice message, its transcript), its English translation, the message it replies to, its kind and anything attached to it, such as photos and files, except view-once media. Later edits and deletions follow. Praxis also receives the group's name, the account ID of the admin who added her, and the account ID, name and language of each person in the group: when Nora is added, whenever its membership changes and whenever Praxis asks while she is in the group. It also receives each answer to one of Nora's questions with the account ID, name and language of the person who gave it, and, when someone taps Open on one of her messages, their account ID and name, so the CodeCraft page it opens knows who they are. Any admin can remove Nora at any time. After that, nitnoi sends no more of the group's messages or details and holds back anything not yet sent. It tells Praxis that she was removed, with the account ID of the admin who removed her, and, later, when a message Praxis already has is deleted. Whenever someone in a group Nora has been in deletes their account, nitnoi tells Praxis, giving that person's account ID.

Anyone who has a group's invite link can open a page that shows the group's name and photo, how many people are in it and the languages they read, and nothing about any one of them: no names and no faces. Opened in nitnoi by someone signed in, the link also shows the names and photos of the people in it. While approval is on, which it is unless an admin turns it off, following the link asks to join and an admin decides.

The words a group teaches nitnoi are remembered for that group only and never used to translate for anyone else. Group messages are not end-to-end encrypted, for the reason the next section gives.

When you leave a group, what you wrote stays for the others, and you can still read its words up to the moment you left, without its photos and files, until you delete the chat. When you delete your account, each group you are in is kept for the people still in it: what you wrote stays, shown as from a deleted account, and your photos, videos, voice notes and files are deleted. A group nobody else is in any more is deleted with your account. You can report a group, one of its members or a message in it; a report comes to us and never to the person reported.

Authorized Nora/Praxis requests can resolve a staff owner's existing conversation names, private aliases and synchronized saved contact names under the restrictions in Your contacts. Resolution itself sends no invitation or message and grants no group membership. Our service assistant Nora can, only with our team's approval, make a group for one of our own staff, who is its admin. Nora is in that group just as she is when a person adds her. People are added to it only the ordinary way, by that staff member, with whom they already have a conversation, and they see the ordinary line saying who added them. When our team approves someone by phone number, our own project tool sends that number to nitnoi only to get the group's invite link back. nitnoi uses it for that one request and never stores it, logs it, matches it to an account or contacts that person; they decide for themselves whether to join through the link. The record of our team's approval is kept with the group, so we can always see who allowed it, and is deleted with the group.

Not end-to-end encrypted, on purpose

nitnoi translates your messages, and an app that translates for you cannot also be end-to-end encrypted: a service that can read nothing cannot translate anything. Your messages are encrypted on the way to us and while stored, and our servers can read them. Any app that claims to do both is not telling you the truth.

Who else sees your data

We use other companies to do specific jobs. They act on our instructions and may not use your data for their own purposes. We do not sell your data, and we do not train any model on your conversations.

• Google (Gemini) transcribes voice notes, recorded Decoder clips and live Decoder speech. It also reads the words in a photo or video you give the Decoder, and in a photo you received and asked nitnoi to translate. If Google cannot read them or takes too long, Anthropic is asked as well, as its entry below says. When DeepSeek, below, is slow to translate a message or something you gave the Decoder, or to work out which language it is in, Google is asked the same question at the same time, and whichever answer arrives first is the one used. Google also draws every Studio picture, and makes the short video of Bring to life where it is offered: it receives the photo or photos you chose and the instruction, and sends the picture or video back. The Studio section says exactly what is sent and kept. In Together Mode, Table Mode, face to face sessions and captioned calls, Google recognises the speech, translates the recognised text for every language pair DeepSeek is not asked about and whenever DeepSeek fails before its time runs out, and speaks the translations.
• DeepSeek translates messages in every language nitnoi supports, and what you give the Decoder to translate, as you type or speak and once you stop. It translates the recognised speech of a Together Mode, Table Mode or face to face session between English and Thai, and the captions of a call. It also translates a message again when its sender edits it, works out which language a message is in when OpenRouter, below, cannot say, and writes the possible meanings of a message when Anthropic cannot. It does the writing you ask for, too: it rewrites your words when you choose a tone, writes what you ask "Ask nitnoi" for and what "Help me explain" drafts. It checks how a message you are writing will come across, as the point on the tone check above says. It is asked about a display name as the point on gender above says, and it reads a Together Mode or Table Mode transcript, where one was kept, to write the recap from it. It also translates the words nitnoi shows you in the other language, and writes nitnoi's answers in your conversation with nitnoi, as its section says. When you open GIFs, DeepSeek reads a short excerpt of your recent conversation and any text in the message box to suggest generic GIF search terms. Klipy receives only those generic terms, never your messages, names or contact details. DeepSeek is in China.
• OpenAI answers when you tap "Translate more carefully" on a message, or choose "Deep" in the Decoder: it translates the words again and writes their possible meanings. When its live Decoder transcription service is enabled, it also writes down what you say to the Decoder, as you say it. That is this company acting for us on what you wrote or said. When DeepSeek or Anthropic cannot be used because our account with them has run out of credit or our key has been refused, OpenAI takes over the work listed in their entries until they can be used again. Reading the words in a photo or video never moves to OpenAI, and nitnoi's own answers move to it only when DeepSeek cannot answer and Anthropic cannot be used either. OpenAI appears once more further down this page, as an advertising network that is told about a click on an ad and is never given anything you write; the two are separate arrangements.
• Anthropic (Claude) translates each new message too, at the same time as the first translation: the first may be shown while Claude works, and Claude's takes its place when it passes the same checks, except from Turkish into English, where DeepSeek's first translation stays unless it fails them. Claude also translates everything you give the Decoder to translate from Thai into any language other than English, from Turkish into Thai and from English into Turkish: the first translation may be shown as you type or speak, and Claude's usually takes its place once you stop. For every other translation, Claude gives a second opinion when an automatic check finds something wrong with it. It also writes the possible meanings of a message that "What it means", "Other meanings" and the Decoder show, and the question that "Ask them" sends. When Google cannot read the words in a photo or video you give the Decoder, or in a photo you received and asked nitnoi to translate, or takes too long, Claude is asked to read them as well: it receives the photo, or still frames from the video but never its sound, and sends back only the words it sees. The first answer to arrive is the one used. When DeepSeek cannot answer for nitnoi, or takes too long, Claude writes nitnoi's answer instead, and it translates the words nitnoi shows you in the other language the way it translates each new message.
• OpenRouter is asked which language a message is in, when it is written in Latin letters and the letters alone do not settle it. It is sent at most the first 240 characters of the message, and answers with one language, or with nothing when it is not sure, and then DeepSeek is asked instead.
• A speech provider receives call audio while captions are running, and the voices in a Together Mode, Table Mode or face to face session while that session runs, and recognises the speech as text live. It also turns each translation into the voice those sessions speak out loud, and reads a Decoder translation or nitnoi’s reply aloud when you ask it to. This is Google today, for every language. The text it recognises is translated by DeepSeek or Google, as their entries say. Part of this work is moving to Typhoon, a Thai provider: once it has, Typhoon will hear the person whose language is Thai on a call or in Together Mode and write down what they say. A session around one phone, which is Table Mode and talking face to face, always uses Google to recognise the speech, whichever two languages are being spoken.
• Our sign in service and Twilio send and check the SMS code. Google's mail relay delivers the email code for a recovery email.
• Push services operated by Apple, Google and your browser's vendor deliver notifications, including the message preview inside them.
• Stripe takes payments, including PromptPay payments, and receives your phone number, your display name and your nitnoi account id. RevenueCat handles purchases made inside an app store. It receives your account id and, when an ad or one of our links brought you, the campaign labels and click reference described above.
• Google Analytics for Firebase counts installs, app opens, the screens people use and purchases, as described above.
• A call relay passes call audio between the two of you. It records nothing.

The companies below are not our processors. What each one sees is spelled out here. They receive the search terms or shared identifiers described below, never your conversation messages.

• Google Places supplies place search. Our authenticated service forwards what you type to Google, with the language to answer in and, when your phone has a position, a point rounded to about a kilometre. When a place is shared, the same service asks Google for its name and address by Google's own identifier for it. Google sees the search or place identifier, the language, the rounded point when supplied, and our server's IP address. We use your account to enforce usage limits, without sending your account identity or conversation messages to Google, and do not keep a search history.
• Klipy supplies the GIFs. Your searches go to our server, which asks Klipy for matching GIFs without telling them who or where you are. The GIF pictures themselves load onto your phone straight from Klipy's servers, which see your IP address the way any image host does, but never the words you typed. We ask for their strictest safe search on every request. Conversation-based GIF suggestions use only the generic terms described above.
• Apple supplies the song list, the artwork and the 30 second previews in the story music picker. What you search for goes to our servers, which ask Apple, so Apple never sees what you typed. The artwork and the preview itself load onto your phone straight from Apple, in the picker and when you watch a story with a song, so Apple sees your IP address. We keep only a reference to the song, never its audio.
• Apple Search Ads. On iPhone, the app asks Apple whether it was installed from one of our ads in the App Store. Apple answers with the campaign and the search keyword, and RevenueCat keeps that answer with your purchases. No advertising identifier is used.
• Google Ads. When the app is first opened, Google Analytics for Firebase tells our Google Ads account that an install happened, so we can see which of our Google ads led to installs. Google is not told who you are, and we have switched off its use of this data for personalised advertising.
• OpenAI, as an advertising network. This is not the OpenAI lane named among our processors above, which answers "Translate more carefully" and "Deep" and is never told anything about an ad. If an ad shown in ChatGPT brought you to nitnoi and you later subscribe through Google Play, we tell OpenAI that the click on that ad led to a subscription: the reference OpenAI added to the link, the plan's price and currency, and when it happened. We never send your phone number, your name or anything you write, and we never report purchases made through Apple's App Store.

Where your data goes

Some of these companies are outside Thailand. Message text, voice note audio, what you say to the Decoder, call audio for captions, the voices in an in person session, and the photos and videos you give the Decoder or ask to have translated are processed by providers in the United States. The photos you give Studio go to Google, which may process them in any country where it operates. Messages in every language, what you write to nitnoi, and everything else DeepSeek does as listed above, are processed by DeepSeek in China; when Anthropic answers for nitnoi instead, that happens in the United States. When OpenAI takes over DeepSeek's work, as OpenAI's entry above says, that happens in the United States, and so does nitnoi's answer when OpenAI writes it. The relay that passes live call audio, and the audio of an in person session, is hosted in Singapore. Payment, SMS and email providers are also outside Thailand, and GIF searches, place searches, and the song list, artwork and previews behind stories, go to companies in the United States. App analytics and ad measurement are handled by Google and OpenAI in the United States. Thailand has not issued an adequacy decision covering these destinations, which means your data may be processed in countries that do not protect it the way Thai law does. If that is not acceptable to you, nitnoi is not the right app for you, because there is no version of this product that translates without sending your words somewhere.

Your profile photo, the photos, videos and files you send, your chat backgrounds and your stories are kept in our own storage with the rest of your data. They go to one of the companies above only where this page says so.

How long we keep it

• Your conversation is kept for as long as your account exists, apart from messages sent under a timer, which the next point is about. It is the thing you are keeping, and blocking someone or reaching the limit of your plan never deletes any of it.
• Your conversation with nitnoi is kept while your account exists, like any conversation. What nitnoi remembers stays until you delete it, clear the nitnoi chat or tell nitnoi to forget everything, and anything it has not recalled for 12 months is deleted automatically.
• Groups are kept while anyone is in them. After a group's last member leaves, the people who left before can still read their part of it for 30 days, and then it is deleted with its messages, photos, videos and files, unless a report about it is still being reviewed.
• Disappearing messages. Either of you can give a conversation a timer of 24 hours, 7 days or 90 days, and you can choose a timer that new conversations you start begin with. A message sent while a timer is on is deleted that long after it was sent, for both of you: its words, its translation and everything nitnoi worked out about it, a place it shared, its photo, video, voice note or file and their copies, its reactions, its pin, and its notification, which we also try to take off the other person's lock screen. What is left is an empty record of who sent a message, when, and what kind it was, with nothing of what it said or showed, and the note in the conversation that says who set the timer. A timer covers only the messages sent while it is on: turning it on leaves earlier messages as they are, and turning it off does not keep the ones already sent under it. Nothing from a timed message is remembered to translate later ones or shared with everyone, as the points below on what we remember say. Saved phrases kept before Phrasebook was retired remain in your data export, with their words and translations, until you clear that chat or erase your data. A timer cannot stop a screenshot, and a message that reaches the other person in LINE stays in LINE whatever the timer says, so a timer cannot be turned on while they read the conversation there.
• Voice note audio stays for both of you to replay, until you erase your data. Encrypted backups age out within 14 days, and deletions are re-applied after any restore from backup. Payment webhook copies are pruned after 90 days and notification records after 30 days.
• Photos, videos and files stay with their message for as long as the conversation is kept, like its text. One sent to be seen once is deleted when it is opened. Unsending a message, or deleting it for everyone, which the sender can do for 24 hours, deletes its file and copies too. Deleting a message only for yourself, or clearing a chat, hides it from you and deletes nothing. A file uploaded but never sent is deleted after about two days.
• Studio pictures stay in your Studio history for 30 days and are then deleted, together with the copies of the photos that went into them. A picture someone has reported is kept past its 30 days while the report is being reviewed, and is deleted once a decision has been made. A picture you sent as a message or a story is a separate copy that stays with that message or story, for as long as it does. The record of each edit (which tool, when, which photos by reference, what it cost) is deleted with the picture.
• A chat background photo stays until you replace or remove it. A photo no background uses any more is deleted about an hour later, and a background chosen for one conversation also goes when that conversation is closed or blocked, or you leave it.
• Stories last 6, 12, 24 or 48 hours, as you choose, 24 unless you change it. When a story ends it disappears at once, and within a few hours the story, the list of who saw it, its reactions and its photo or video are deleted. Nothing is archived. The notification about a reaction is deleted after 30 days, like other notifications, and your last choice of who sees your stories stays until you change it.
• The Decoder keeps your last 50 decodes, and each new one pushes out the oldest. There is no time limit, so your last 50 stay until you delete them, one at a time in Recent translations, or erase your data. A photo or video is deleted once no decode in your history still uses it, an hour after it was uploaded at the earliest. Threads you named in an earlier version of the app keep their name and a short preview until you erase your data or ask us to delete them.
• Chat lock details stay while you use it. Removing the chat lock deletes the scrambled forms of your PIN and of the phones' secrets, and which conversations were locked.
• Caption text is kept as the call's transcript for 90 days, then deleted by a nightly sweep. The call itself stays in your history, with the words removed: who called, when, and how long it lasted. A Together Mode or Table Mode transcript, where one was kept, is the same text under the same sweep; the recap made from it stays with the session until you erase your data.
• A face to face session leaves a record of who started it, when it started and ended, how long it lasted, the two languages, the version of the notice that was shown, why it ended, and what is needed to count its minutes. It is kept while your account exists, because it is what the minutes on your plan are counted from, and it goes when you erase your data. Nothing that was said is in it, and no transcript of the session is saved.
• Requests to talk are kept while both accounts exist. One nobody answers expires after 30 days, and every request you sent or received is deleted when you erase your data. If someone blocked you, from a request or inside a conversation, we keep a one way digest of your phone number with their block, so the block still holds if you delete your account and sign up again with the same number. It is deleted when they unblock you or delete their own account.
• Your free first 14 days of Plus. When you delete your account, we keep a one way digest of its phone number, and of its LINE user ID if it has one, and the day its free days of Plus ended or end (or that it had none), with no account attached, so the same number or LINE account cannot start them again by signing up anew. We delete it 12 months after those free days end, or, for an account that never had any, 12 months after it was deleted.
• What we remember for your conversation. A short message, up to 160 characters, that your conversation sends again is translated from what it was taught the first time, and that is remembered for your conversation only.
• What is shared once at least three have asked. When at least three different conversations have sent the same words, three different people signed in to the Decoder have asked about them, or three conversations have asked about them in a photo they received, we may keep one translation of them for everyone, so that it is not paid for again; for the Decoder and photos that reaches up to 280 characters. A message counts only when it was translated on its own: one translated with the messages before it, a reply, or one with either of your names in it is remembered for your conversation alone. Until then we keep only a one-way mark for each person or conversation that asked, from which neither the words nor who asked can be read back.
• How long, and what is never remembered. Everything remembered can be read only when someone asks for exactly those words, and is deleted after 30 days without use and after 90 days at most. Nothing is remembered from a message set to disappear or sent to be seen once, from a conversation while either of you has it locked, or from the Decoder used signed out. Unsending a message, deleting it for everyone or editing it takes back what it taught, including a translation it helped to share with everyone. Because what is remembered can only be found through the words themselves, erasing your data cannot reach it; it goes on its own within these limits.
• Push endpoints are deleted when you sign out, when you turn notifications off for that device, and automatically when the push service tells us the address is dead.
• Backups of the database are kept for about fourteen days, plus the transaction log needed to restore them. Something deleted from the live system can survive in a backup until it ages out, and we re apply deletions after any restore.
• Billing records are kept for as long as tax and accounting law requires.
• App analytics at Google. Google keeps the detailed events for two months and the record of an app installation for fourteen months after it was last used. After that only totals remain. Google's analytics is not tied to your account, so deleting your account cannot single it out; it ages out on this schedule instead.
• How you use nitnoi itself is kept for thirteen months and then deleted, and feedback you send for two years. Deleting your account deletes both.
• Where you came from is kept with your account record, and at RevenueCat with your purchases.
• A copy of your data that you make in the app can be downloaded for 48 hours after it is ready, and is then deleted. The note of what you asked for and when goes 30 days after the copy was finished, or when you erase your data.

Your rights

• See it and get a copy. You can make a copy yourself in the app: open You, then Your account, then Export my data. Take everything nitnoi holds about your account, including the conversations you are part of, or choose what goes in it. The copy is a single ZIP file with the photos, videos, voice notes and files you chose inside it, up to 5 GB; anything that does not fit, or could not be read, is listed in it with the reason. You can download it for 48 hours after it is ready, and then it is deleted. From a group, the copy holds what was said while you were in it and everything you wrote there, with the photos, videos and files you could open and every one you sent. A copy that includes a conversation you have locked asks for the unlock that opens that conversation (your face, fingerprint or PIN), both when you make it and when you download it. You can also write to [email protected] and we will send you a copy.
• Correct it. Your name and your language settings are yours to change in the app at any time.
• Delete it. Ask us to delete your account and we destroy your side of it: your account record and profile photo, your chat backgrounds, your stories and everything recorded about them, the voice notes, photos, videos and files you sent, your Decoder history, your Studio history, your chat lock, your conversation with nitnoi and what it remembers, the conversations you are in and the data derived from them (a group is kept for the people still in it, as Groups says), and, at our sign in service, your phone number and recovery email, subject to what follows.
• Object, or stop. Translation and the features described above are how nitnoi works, so no switch in a conversation keeps what you write from being translated for the person you write to. Turning off automatic translation in the app keeps the messages you receive from being translated until you ask. To stop everything, delete your account in the app: open You, then Your account, then Delete account. Or write to [email protected] and we will delete it for you. To object to anything else described here, such as the app analytics, write to the same address.
• Complain. You can complain to Thailand's Personal Data Protection Committee. We would rather you told us first, at [email protected].

What deletion means for the other person

A conversation belongs to two people and is both people's personal data at once. When you delete your account, every conversation you were in is closed and disappears from the app for the other person as well, and your account record is emptied so that nothing in it points back at you. The other person, if they have not deleted their own account, can still obtain the history of that conversation through their own copy request, because it is their conversation too. It is destroyed when they delete their account.

A group belongs to everyone in it, so deleting your account does not close one. Each group you are in is kept for the people still in it, with what you wrote shown as from a deleted account and your photos, videos, voice notes and files deleted; a group nobody else is in any more is deleted with your account.

Three records survive deletion on purpose, and each keeps a one way digest of your phone number rather than the number itself. An account that only signed in through LINE has no number, so only the record of its free first 14 days survives, as a digest of its LINE user ID. The free first 14 days of Plus are given once per person, so the digest is kept with the day yours end, or with the fact that you had none, and so is a digest of your LINE user ID if your account has one: an account made again with the same number or LINE account has only what was left of them. We keep those digests for 12 months after that day, or after you delete your account if you had none, and then delete them. If you have used a free trial, the digest stops the same number taking a second one. If someone blocked you, the digest stays with their block, so the same number cannot find them or ask them to talk again, even from a new account, until they lift the block or delete their own account. A digest is not a secret: there are few enough phone numbers that someone who held our database and tried every possible one could match it. What it does mean is that we stop keeping your number in a form anyone can simply read. The digests kept for the free first 14 days go further: they are made with a secret key kept apart from the database and its backups, so the database alone cannot be matched to a number or a LINE account.

Unlinking a conversation

The app no longer offers unlinking, though versions from before 28 October 2026 still do until they are updated. Unlinking ends a conversation for both of you immediately, revokes the dictionary the two of you built, and removes the conversation from the app for both people. It is not a deletion of the underlying data. If you want the content gone, delete your account.

The Decoder and people who never signed up

The Decoder works on words you paste, type, say or photograph, which are usually someone else's: a person who does not use nitnoi and has not agreed to anything. While you are signed in, what you decode is kept in your Recent translations, your last 50, so that you can look back at what something said. Deleting one there deletes it permanently, and we recommend deleting what you no longer need. Words fewer than three people have decoded are never kept for anyone else; the translation of words three or more people decoded may be kept once, as described above, and goes on its own within 30 days of the last time anyone asks for it. If you are the person whose words someone put into nitnoi and you want them removed, write to us. We cannot see who decoded what without searching for it, so tell us what you can, the words themselves or roughly when, and we will look for them and delete what we find.

Studio: pictures you edit with AI

Studio is the part of nitnoi that changes a photo for you: a look, a new sky or background, something erased, or the two of you put together in one picture. It only runs when you tap a Studio tool. Nothing here happens to photos you simply send.

• What is sent, and to whom. Each edit sends the photo you chose (and, for Us, the photo of the other person you chose) and a short instruction to Google's Gemini models, on servers outside Thailand, which may be in any country where Google operates. Words you type yourself are read by Gemini first, to check them and put them into English; the picture is then made by Gemini's image models. No other company receives any of it. Nothing else goes with it: not your chat, not your names, not your location. The photos are the copies your phone already made small to send. Google does not use them to train its models, and keeps them for a limited time only to detect misuse, under the same arrangement that covers the translation of your messages.
• A look before the edit. For Us, Sky and Backdrop, Studio first asks a Gemini model, under the same arrangement, whether the photo suits the tool: for Us, whether a face can be seen in each photo; for Sky, whether it shows sky; for Backdrop, whether something stands in front. It is sent a small copy of the photo and answers yes or no. It says whether there is a face, never whose it is, and the answer is not kept beyond an hour on our server. A photo that does not suit the tool is not edited and costs you nothing.
• Bring to life. Where nitnoi offers it, Plus members can turn a photo into a short moving picture with no sound. Each one sends that photo, cut to the frame you placed, and a short description of the movement to Google's Veo model, under the same arrangement, and receives a silent video back. The video is kept like any Studio picture: 30 days in your Studio history, and with the message or story you send or post it in, for as long as that stays.
• The other person's photos. Studio can use a photo of the person you talk with only if they sent it to you in your conversation with them, or it is their profile photo, and only while your conversation is open and nobody has blocked it. They can stop this at any time in Settings with "The people I talk to can use my photos in Studio", and the server checks that switch every time, not only the app. A picture made with their photo can be sent to them, forwarded into a chat they are in, and posted to a story they can see, and nitnoi sends it nowhere they cannot see it. Like any photo, a copy someone saves to their own phone is beyond our reach.
• What we keep. The finished picture, in your Studio history, for 30 days (longer only while a report about it is being reviewed); a record of the edit (which tool, when, which photos by reference, what it cost); and, for "Tell it", your instruction as it was given to the model, in English. Never a copy of your chat. A picture you send or post becomes an ordinary photo of that message or story from then on.
• How a Studio picture is marked. Google places SynthID, an invisible watermark, in the pictures and videos its models make. nitnoi also writes a tag into the file of every picture Studio makes, saying it was made with AI (the IPTC digital source type "trained algorithmic media", which other apps and platforms can read), and a picture you send goes with that tag as it is. A copy that is drawn on, or made smaller or larger, on a phone can lose the file tag, never the watermark. Inside nitnoi, a Studio picture's details say "Made in Studio" and with which tool: in its message menu, and under ⋯ when it is open. The picture itself wears no visible label.
• Adults only. Studio is for people 18 or older. Photos of children are not to be used, and the models refuse pictures that would sexualise anyone, add violence, change somebody's body, or add a real person who is not in your photos. A refusal costs you nothing and tells you why.
• Reporting and removal. A Studio picture someone sends you has "Report this picture" in its message menu and in its details, and every refusal has "Report a problem". Your report goes to the people who review reports, with the picture if you choose to include it, and the person who sent it is not told. If a picture of you has been made or shared without your consent, write to the address at the top of this notice and we remove it, and the copies we can find, within 48 hours.

Children

You must be at least 13 to use nitnoi. If the country where you live sets a higher age for using online services on your own, you must be at least that age. Studio is only for people 18 or older. If you believe a child under 13 is using nitnoi, write to [email protected]. We will look into it, and if we find that an account belongs to a child under 13, we will delete the account and its data.

Changes

If we change this notice we update this page and the date at the top, and we tell you directly where the law requires it. Continuing to use nitnoi after a change means the new notice applies to you.