What Nodu keeps about your household, and what it never asks for

Nodu can only look ahead for your household if it knows what's in your accounts. So it keeps some of your information, and there are things it never asks for. You stay in charge of what it keeps.

What Nodu keeps#

To work out what's coming, Nodu keeps:

• your transactions and balances, from the statements you send
• your bills, pay, loans, goals and budget
• what you tell Nodu about your family, like your children's ages, labelled with who said it and when
• your own chats with Nodu, which your partner can't see
• your accounts, recorded by BSB and the last 4 digits
• your property, your super and your electricity bills, if you add them
• your names, your email addresses for signing in, and mobile numbers if you add them
• a history of who changed what

Our sign-in provider also keeps sign-in times and IP addresses.

Most of it is there because a feature needs it. Your pay and your bills are how Nodu sees a tight week coming, and your goals are how it knows when one is slipping. The change history and the sign-in records are there for security, and so it's clear who changed what.

What it never asks for#

Nodu never asks for banking passwords, logins or one-time codes, tax file numbers or card PINs, and there's no field for them anywhere in Nodu. If one is typed into the chat, Nodu asks you not to and won't repeat it, but the message stays in the chat, so please leave them out.

Your account records keep only the BSB and the last 4 digits, and the database refuses anything longer. Account and card numbers in your transaction descriptions are cut to their last 4 as well. The statement file itself shows the full number, so it's sealed with your household's key and deleted after 30 days.

Statement files go after 30 days#

A statement you send arrives as a file: a PDF or a CSV. Before Nodu stores it, the file is sealed with a key that belongs only to your household. Nodu reads it, and deletes the file 30 days after you sent it. The transactions it read stay in your ledger until you delete your household.

Who sees it#

You and your partner see the same picture. No other household can see it: the database itself walls each household off, so nothing rests on the app remembering to filter.

Nodu's team works on the rules everyone shares, like benefit rates. Their admin pages show counts for each household, such as how many replies Nodu gave and what they cost. They never show what's in your chat or your accounts, and they don't show any household's money.

The few people who run Nodu's database can technically read what's in it. They don't look at household data in normal running. Today that's only Nodu's founder, and we're limiting it to named people and logging every access.

The model that reads it#

Nodu runs on Claude, made by Anthropic, and reaches it through Vercel's gateway. Each request goes to Anthropic first. Only if Anthropic is busy or down does it go to the same Claude model run by Claude Platform on AWS (Anthropic's service on Amazon's cloud), Amazon Bedrock or Google Vertex AI, in that order, and never to anyone else. Anthropic and the gateway say they don't use your information to train AI, and the gateway says the others don't either.

Claude's processing happens outside Australia, mainly in the United States. Vercel says its gateway keeps nothing once a request is done. Zero data retention is on for every Claude request, so none of them stores your requests or Claude's replies once it has answered. If none of them can take a request on those terms, it fails rather than going somewhere that would keep it. Anthropic can still keep a request its safety systems flag for misuse, and any of them can if the law requires it.

We don't sell your information, use it for advertising, or use it to make credit decisions about you.

You're in charge of it#

In Settings, under Your data, you can:

• see each kind of information Nodu holds, how much of it there is, and how long it's kept
• download your records as a file (your accounts, transactions, bills, pay, loans, goals, plan, what you've told Nodu and your own chats, not a partner's), or your transactions as a spreadsheet
• delete your statement files
• delete your household

You can also ask in the chat what Nodu holds. The chat can tell you, but it can't delete anything. Only the owner or an admin of your household can.

When you delete your statement files or your household, Nodu destroys your household's key first, then deletes the files. Backups don't hold the files, and the locked copy of the key in backups is gone within 7 days.

For the detail, see how Nodu protects your data.