Skip to the text
Documents

Nodu privacy policy

What Nodu collects about a household, why, where it's kept and for how long, who else handles it, and how to see, download or delete it.

Updated 23 October 2026About 31 minutes to read

The short version

  • We keep what we need to look ahead for you: your transactions, balances, bills, pay, goals and plan, what you tell Nodu, and the chat.
  • We never ask for banking passwords or logins, or tax file numbers, and there's no field for them anywhere in Nodu. If one is typed into the chat, it's kept with the chat, so please leave them out. Your records keep only the BSB and last 4 digits of an account number. A statement file, which shows the full number, is sealed with your household's key and deleted after 30 days. Nodu never stores personal email.
  • Your data is stored in Sydney, walled off to your household by the database itself. Statement files are encrypted with your household's own key. Nodu's emails, and Claude, the AI behind Nodu, are handled overseas, mainly in the United States.
  • Statement files are deleted 30 days after you send them. What Nodu read from them stays until you delete it.
  • Claude never trains on your data. Nodu runs on Anthropic's Claude, through Vercel's AI Gateway. Both say they don't train on your data, and Vercel says the gateway keeps none of it.
  • You're in control. In Settings, under Your data, you can see what Nodu holds, download your records, delete your statement files or delete your household. In the chat, Nodu can tell you what it holds, but only you can delete.
  • We don't sell your data, show you ads or make credit decisions about you.
Contents15 sections

The full version

Nodu is a family CFO: it reads the statements and bills you send, looks ahead at your household's money, and tells you what's coming. To do that it holds personal and financial information about you and the people in your household. This policy says what we hold, why, where, for how long, who else handles it, and how you can see, download or delete it.

Nodu is invite-only for now: it's open to the people its members invite, and to people Nodu's team gives a place after they ask to join.

Who we are#

"Nodu", "we" and "us" mean Luchlo Partners Pty Ltd, which runs Nodu. You can reach us about privacy at support@nodu.com.au. We aim to reply within 30 days.

This policy covers the Nodu app, the Nodu website, and the texts and emails Nodu sends.

What we collect#

We collect only what Nodu needs to do its job. Most of it comes from you. Some comes from the statements and bills you send. A little comes from how you use the app.

WhatWhere it comes fromWhy we need it
Each member's name, email address and, if you add it, mobile numberYou, when you sign up or a partner invites youSigning you in, telling you who said what, reaching you the way you choose
If you sign in with Google: your Google account's ID and email address, and for a work or school (Google Workspace) account its domainGoogle, when you choose Continue with GoogleSigning you in. Nodu uses the email address only to find or make your sign-in, or, if Nodu can't let you in yet and you ask to join, to keep it with your request, marked as confirmed by Google, and to tell you when there's a place. Otherwise Nodu keeps nothing from Google: what Google sends is checked and thrown away as you sign in. Google's return to Nodu passes through our hosting provider's request log, kept 1 day, with a one-time code and, for a work or school account, its domain. If Nodu can't let you in yet, your browser holds the email address, sealed so only Nodu can read it, for 15 minutes, so the Ask to join page can show it. Never your name or picture, your Google password, Gmail, contacts, calendar or files
Bank account details: the bank, the account's name, the BSB and the last 4 digitsYour statements, or youKnowing which statement belongs to which account. Never the full number
Transactions and balancesThe bank statements you upload (and, later, a bank feed you connect)Spending, bills, your plan and forecast
Bills, renewals and noticesBills you upload (and, later, forward), and your transactionsThe bills radar and reminders
Pay, income, loans, goals and your planYour statements, and what you tell NoduYour forecast, goals and plan
Household facts: children's ages, concession cards, income before tax, business income, housingWhat you tell Nodu or enter in the appChecking benefits you may be eligible for, and estimates
Your properties: where you live and what you own, the address, rooms, what you paid and what you think it's worthYou, on the Property page or by telling Nodu, or your home loan statement's security address when you add it on the Home loan pageYour property's equity and loan figures, beside your other money, and looking its address up on property websites (below)
Your super: each fund, the last 4 digits of your member number, balances, contributions, fees, insurance and coverYour fund's statements, and what you tell NoduYour super beside your other money (never as spendable), and general information like whether your employer's super arrives within 7 business days of payday
What you own, less what you owe, a month at a time: the totals and each part's figure (money in your accounts, property, super, home loans and other loans), with each member's super in itWorked out by Nodu each morning from the figures above: nothing new is collected for itSo you can see later how it has moved. Never used for your forecast
What property websites say about a property: its details, sale history, each site's estimate and rent estimate, and photosWhen you add a property with its street address (on the Property page or the Home loan page), or change its address there or in the chat, Nodu looks it up on Domain, realestate.com.au, propertyvalue.com.au, OnTheHouse, Homely and Allhomes, through Firecrawl. Nodu also looks up, by itself, any property with a street address that it hasn't looked up yet. Each time a lookup finds details, Nodu looks again three months later, until you remove them, change or clear the address, or delete the property. You can ask it to look again from the property's card. Once you've removed a property's details, Nodu looks it up again only if you change its address. Leave the street address out and it isn't looked up. A home you rent is never looked up: setting a home as rented removes what the websites saidShowing those details beside what you told us, each marked with the website it came from
The household's notes for Nodu, and your own chats with it, which only you seeYouAnswering you, and remembering what you said
The statement and bill files themselvesYouReading them. Deleted after 30 days
Settings: how Nodu sounds, when it gets in touch, your quiet hours and limitsYouGetting in touch the way you asked
The first name, and for an emailed one the email address, of someone you recommend Nodu toYou, when you recommend NoduSending them one email with a link to start their own household (or making the link you share yourself), and showing you whether they joined
Feedback you send in the chat: a problem or an idea, in the words you agree to when Nodu reads them back, with the page you sent it from (which page, not its address), the app's version and your device in a few words (like "iPhone, Safari"). Never figures or accounts from your household, unless you write them in: Nodu refuses any figure in digits you didn't type. A question about your money is answered in the chat and isn't sentYou, when you send feedbackFixing problems and improving Nodu. Only Nodu's team reads it, in Nodu itself. The email that tells the team it arrived doesn't include your words. The team may describe a problem, in its own words, in its private issue tracker; your words never go there
Emails we send you (and, once they start, texts), and later your repliesNodu and youKeeping to your limits, and acting on replies like a balance or STOP
How often Nodu replies to your household and what that costs us, by day: counts only, never what was saidNodu, as it repliesKeeping the chat within its daily and monthly limits
Sign-in events and request logs: time, IP address, browserOur hosting and sign-in providersSecurity, and fixing problems
If you ask to join: your email address, who's in your household and which banks you use, whether Google confirmed the address (when you asked after continuing with Google), when you asked, and where from as a keyed hash of your IP address (a one-way fingerprint, never the IP address itself)You, on the Ask to join page after a sign-in Nodu couldn't let inTelling you when there's a place for your household, and limiting requests from one place. Asking sends you nothing: we email you only when Nodu's team gives you a place

Swipe the table sideways to see all of it.

What we don't collect. We never ask for banking passwords, logins or one-time codes, tax file numbers or card PINs, and there's no field for them anywhere in Nodu. If you type one of them, or a full account number, into the chat, it's kept like any other chat message until you leave the household or delete it, so please leave them out. Your account and transaction records keep only the BSB and last 4 digits of an account number: long numbers are cut to their last 4 as your bank or electricity retailer prints them, before they're stored, in transaction descriptions, file and bank names and what Nodu reads from your electricity bills, and the database also checks the stored descriptions, file names and bill words. A statement file that shows the full number is sealed and deleted after 30 days. Once you can forward email to Nodu, anything personal or unrelated to your household's money will be discarded straight away and never stored.

Sensitive information. We don't ask for health, religious, political or similar sensitive information. Your transactions can still hint at it, for example a payment to a pharmacy, a union or a church. We use transactions only to work out your household's money, never to draw conclusions about those things.

Children. Nodu is for adults. Information about children, such as their ages, comes from their parents and is used only for benefit checks and the household's plan.

Why we use it#

We use your information to:

  • run Nodu for your household: read your statements, sort your spending, track bills, forecast your cashflow, check benefits and answer your questions;
  • get in touch the way you've chosen, within your quiet hours and limits;
  • keep Nodu secure, for example by spotting misuse and fixing faults; and
  • meet our legal obligations.

We don't sell your information, use it for advertising, or use it to make credit or insurance decisions about you. Partners in a household see the same information, and that's how Nodu is designed to work. The exception is your chats in Nodu: they're your own, and a partner can't see them. What Nodu notes from your chats, like your pay, a loan or a goal, goes into the household's records, which your partner sees.

When Nodu learns a business's name from a transaction (for example, that "WOOLWORTHS 1234" is Woolworths), the business name goes into a shared list that helps every household. It never includes your name, an amount, an account or a payment to a person.

The Australian Privacy Principles#

Nodu follows the Australian Privacy Principles (APPs) in the Privacy Act 1988. Australian privacy law doesn't use "legal bases" the way Europe's GDPR does. It works like this:

  • We collect only what's reasonably necessary for Nodu to work for your household (APP 3). We'll ask for your consent before collecting any sensitive information.
  • We use and share it for the reason you gave it to us, or a closely related reason you'd reasonably expect (APP 6), and otherwise only with your consent or where the law requires it.
  • We tell you when information goes overseas, and where (APP 8). See Who else handles your data.
  • We protect it, and destroy it when it's no longer needed (APP 11).
  • You can see it and correct it (APPs 12 and 13). See Seeing, downloading, correcting and deleting.

How Nodu uses AI#

Nodu's assistant runs on Claude, made by Anthropic. Requests reach Claude through Vercel's AI Gateway, which sends each one to Anthropic first. Only if Anthropic can't take it (busy, down or an error) does it send it to the same Claude model run by Claude Platform on AWS (Anthropic's service on Amazon's cloud), Amazon Bedrock or Google Vertex AI, in that order, and never to anyone else. It's always with zero data retention. Claude also reads PDF statements and sorts transactions into categories.

  • Claude never trains on your data. Anthropic's commercial terms say it "may not train models on Customer Content". The AI Gateway says it "does not use your prompts or responses for training purposes". It also says "All ZDR-compliant providers also disallow prompt training", so the providers that run Claude when Anthropic is unable to take a request don't train on your data either.
  • What's kept, and for how long.
    • The AI Gateway "does not retain prompts, outputs, or sensitive data", which are "immediately and permanently deleted after requests are completed".
    • Zero data retention is on for every Claude request, from 12 October 2026. Nodu asks the gateway for it on each request, so the gateway sends a request only to a provider that has a zero data retention agreement. If none can take it, the request fails rather than going to one that would keep it.
    • With it on, Anthropic doesn't store your requests or Claude's replies once it has answered, and nor do the others. Anthropic can still keep a request for up to 2 years if its safety systems flag it as breaking its usage policy, and any of them can keep one if the law requires.
  • Where it happens. Claude's processing happens outside Australia, mainly in the United States. The gateway offers only US and EU processing regions, not Australian ones.
  • What Claude sees. Only what's needed for each request: your question, recent chat and the figures Nodu's own checks produced, or the statement being read. Text inside statements and emails is treated as information, never as instructions. The Claude call that reads statement files has no tools, so a hidden instruction in a document can't make it do anything.
  • Figures come from your data, not from the AI. Nodu's numbers come from your own ledger. Estimates, such as income before tax, are labelled as estimates.
  • Property estimates are the websites', not Nodu's. When Nodu looks a property up, each website's estimate is shown as that website's, with the day it was read. Nodu doesn't work out a valuation of its own, and what you've said about your property always comes first.

Automated decisions#

Nodu uses computer programs, some with AI, to work things out about your household's money:

  • the category of a transaction;
  • which payments repeat;
  • your income before tax, from your take-home pay;
  • whether you may be eligible for a benefit; and
  • when your cashflow may run short.

These are information for you, not decisions about you. Nodu doesn't approve or refuse anything, and nothing it works out goes to a bank, lender or government. You can correct any of them, and what you tell Nodu always beats what it worked out.

Where your data is kept#

Your household's data is stored by Supabase in Sydney (the ap-southeast-2 region): the database, the encrypted statement files and sign-in. The Nodu app runs on Vercel in Sydney. Some of the work happens overseas: Claude, the AI behind Nodu, runs mainly in the United States, and Nodu's emails are sent from outside Australia (see below). See Who else handles your data.

  • Walled off by the database. Nodu reaches your household's data in one of two ways: as a restricted database login set to your household for each transaction, or as you, through your own signed-in session. Neither can get around the database's rules, which hand back only your household's rows. With no household set, the login sees nothing.
  • Encrypted at rest. The database and file storage are encrypted on disk.
  • Your own key for your files. Statement files are also sealed with a key that belongs only to your household. The files are encrypted before they're stored, and decrypted only in memory, when Nodu reads them.
  • Crypto-shredding, in plain English. Your key is the only way to open your files. When you delete your statement files or your household, Nodu destroys that key first, then deletes the files. Database backups don't hold the files, and the locked copy of the key in backups is gone within 7 days on our planned hosting plan, when they roll over.
  • Who at Nodu can see it. The few people who run Nodu's database can technically read what's in it. They don't look at household data in normal running. Today that's only Nodu's founder. We're limiting it to named people and logging every access. Nodu's admin pages, open only to a short, named list of staff, manage shared rules (benefit rates, tax figures, electricity plan data) and show counts: how many replies Nodu gave each household and what they cost, with each household's name beside its counts, and how many errors of each kind. They never show what anyone wrote, or any household's money.

Who else handles your data#

These companies handle some of your data so Nodu can work. Each handles only what its job needs, under its own data processing terms (Google, under its terms for Gmail).

WhoWhat they do for NoduWhat they handleWhereHow long they keep it
SupabaseDatabase, file storage and sign-inEverything in this policySydney, Australia. It hands sign-in emails to Resend to sendAs long as Nodu keeps it. Daily backups roll over after 7 days on our planned hosting plan
VercelRuns the Nodu appRequests as they pass through, and request logsSydney, Australia; Vercel's own operations are mainly in the United StatesRequest logs: 1 day
Vercel AI GatewayPasses requests to ClaudeEach Claude request and reply, in passingOutside Australia (global, United States or EU)None after the request
AnthropicClaude, the AI behind NoduEach request and replyUnited StatesNone once it has answered: zero data retention is on from 12 October 2026. Up to 2 years if flagged for misuse, or longer if the law requires
Claude Platform on AWS (Anthropic's service on Amazon's cloud), Amazon Bedrock or Google Vertex AI (only when Anthropic can't take a request, in that order)Run the same Claude modelEach request and reply they answerOutside Australia: Amazon Bedrock and Google Vertex AI in the United States or EU; Claude Platform on AWS doesn't say which regionNone once they've answered: the AI Gateway sends them a request only under their zero data retention agreements. Claude Platform on AWS, being Anthropic's own service, can still keep a request its safety systems flag for up to 2 years, and any of them can keep one if the law requires
ResendSends Nodu's emails, including sign-in emails and recommendations, and receives email sent to support@nodu.com.au or privacy@nodu.com.au, which it passes on to Nodu's teamYour email address (or the address of someone you recommend) and each email's content, and any email you send usUnited States (emails are sent through its Tokyo region)Email logs: 30 days
Google (Gmail)Holds Nodu's team inbox, where email you send to support@nodu.com.au or privacy@nodu.com.au arrives and is answeredAny email you send us, with its attachments, and our repliesUnited States and elsewhere: Google's own serversUntil we delete it, 12 months after we've answered it
Google (only if you choose Continue with Google)Confirms who you are when you sign in with your Google account, on Google's own page. Google handles that under its own privacy policy, not this oneYour sign-in at Google. It gives Nodu your Google account's ID and email address (that Google has checked it, and for a Workspace account its domain), and nothing else: Nodu asks for no name, picture, Gmail, contacts, calendar or files, and tells Google nothing about youUnited States and elsewhere: Google's own serversGoogle keeps its own record that you signed in to Nodu. To stop it sharing these with Nodu, remove Nodu from your Google Account's connections to third-party apps
Twilio or ClickSend (later, when texts start)Sends and receives textsYour mobile number and each textNot chosen yet: we'll add where before Nodu sends its first textWe'll add this before Nodu sends its first text
Basiq or Fiskil (later, only if you connect a bank feed)Accredited Consumer Data Right providerYour bank's transactions and balances, with your consent on their own pagesNot chosen yet: we'll add where before bank feeds startWe'll add this before bank feeds start
Firecrawl (only to look a property's address up: when you add a property with its street address or change its address, when Nodu looks up a property it hasn't yet, when you ask it to look again, and three months after each lookup that found something)Searches the property websites for the address and reads their pagesThe property's street address, suburb, state and postcode. Never your name or anything else about your householdUnited StatesNodu asks it not to keep the pages it reads. We're still checking how long it keeps its request logs
Property websites: Domain, realestate.com.au, propertyvalue.com.au, OnTheHouse, Homely, Allhomes (only for a lookup)Their public pages about the address, and the photos on themFirecrawl's requests for those pages, and Nodu's for the photos. Nothing about your householdAustraliaTheir own logs

Swipe the table sideways to see all of it.

Overseas. Some of your information goes to the United States: Vercel, Anthropic and Resend; Google, if you sign in with it or email us; Amazon Bedrock or Google Vertex AI when they run Claude because Anthropic can't take a request; and Firecrawl when Nodu looks a property's address up. Through the AI Gateway, it may also go to the European Union, where the gateway, Amazon Bedrock and Google Vertex AI can process requests too. Claude Platform on AWS, Anthropic's service on Amazon's cloud, doesn't say which region it uses. Vercel's terms allow processing "anywhere else in the world" its providers operate. We choose providers whose terms say they won't use your data for their own purposes, with one exception: Nodu's team inbox is a Gmail account, under Google's terms for Gmail and its privacy policy rather than a data processing agreement, and those let Google use what it holds for its own purposes too, such as running, securing and improving its services.

We'll update this table before we add or change a provider.

How long we keep it#

WhatHow long
Statement and bill files30 days after you send them, then deleted automatically each morning. Sooner if you delete them
What Nodu has read from a statement while it's still being read (long numbers already cut to their last 4, sealed with your household's key), so a long statement can carry on where it stoppedUntil the statement is filed or can't be read, then deleted. At most 30 days
Personal or unrelated emailNever stored
An email you send to support@nodu.com.au or privacy@nodu.com.auResend receives it, and Nodu has it sent on, as it arrived and without reading it, to Nodu's team inbox in Gmail (Google), where we read and answer it. We keep it there, with our replies, until 12 months after we've answered it, then delete it. The Nodu app never stores it: its database keeps only that it arrived (Resend's reference for it, which address and when), never who sent it or what it says, and deletes that after 30 days
Your ledger and what you told Nodu: transactions, balances, bills, pay, loans, goals, the plan, household facts, properties, super, the chat (a member's own chats go when they leave the household)Until you delete your household
The monthly record of what you own and oweKept like your ledger, until you delete your household. A member who leaves takes their super out of every month of it
What property websites said about a property, and its photosUntil the next lookup replaces it, you remove the lookup, change the address, or delete the property or your household
The change history (who changed what, and when)While your household exists, then deleted with it
Counts of Nodu's replies and what they costUntil you delete your household
Feedback you sent in the chatUntil 12 months after Nodu's team has dealt with it (made it an issue for the team or closed it), and never more than 24 months after you sent it, then deleted automatically each morning. Deleted with your household. A summary Nodu read back that you didn't send is deleted after 7 days
A record that a deletion happened: when, what kind, by which member (an internal id) and with which role, and how many things went. No names, emails or figuresKept after deletion, so we can show a deletion was asked for and done
A request to delete your household while it waits: who asked, when it will happen, and who cancelled it; each person's cancel link, kept only as a one-way fingerprint (a hash), and when its email wentUntil your household is deleted. A cancelled request stays in Settings' history until then
Database backups: your records and the locked copy of your file key, never the files themselves7 days on our planned hosting plan, then replaced
Sign-in events (email, time, IP address)Supabase, our sign-in provider, keeps its log of them in its own log storage for up to 7 days, not in Nodu's database. While you're signed in, your session keeps the IP address and browser it started from, until you sign out or your household is deleted
What Google tells Nodu when you sign in with itNot kept: checked and thrown away as you sign in. Your sign-in is the same one an emailed link signs you in to. If Nodu can't let you in yet, the email address is held sealed in your browser for 15 minutes, and kept only if you ask to join (below). Google's return to Nodu passes through our hosting provider's request log, kept 1 day, with a one-time code and, for a work or school account, its domain
The email address of someone you recommendedUntil they start their household, you cancel, or the link expires after 7 days. Then only a one-way fingerprint of it (a hash) is kept, so the recommendation still counts. The first name you gave stays on your list until you delete your household
An address that asked Nodu to stop recommendation emailsOnly a one-way fingerprint of it (a hash), kept so Nodu never emails it a recommendation again. Never the address itself
A sign-in account with no household: one made when someone asks for a sign-in link (including from a recommendation) and never signs in, one that signs in but isn't let in, or the sign-in of someone who left a household, once that household is deleted and they haven't started anotherDeleted automatically, with its email address, at the first morning clean-up after 14 days without use: no sign-in, sign-in link or signed-in session in that time. Nodu's team's own accounts are never removed this way, and an account Nodu has blocked by hand is kept until the block ends
Request logsSupabase 7 days; Vercel 1 day
A request to join (Ask to join): your email address and answers, whether Google confirmed the address, when you asked, the keyed hash of your IP address, and any place Nodu's team gave youUntil you ask us to remove it, Nodu's team removes it, or the household of a member with that address is deleted. One Google didn't confirm that never had a place is deleted automatically 90 days after you last asked. A place lets your address set up a household for 14 days, unless Nodu's team withdraws it

Swipe the table sideways to see all of it.

Seeing, downloading, correcting and deleting#

You can do all of this yourself, any time. Open Settings and go to Your data.

  • See what Nodu holds. It lists each kind of data, how many, the oldest and newest dates, where it's kept and for how long. You can also ask Nodu, "What do you have on us?"
  • Download your records. Any member can download a file (JSON) holding your household's name and time zone, and: the people in it (names, emails, roles and when they joined, with your own mobile number but never a partner's); your bank accounts (the BSB and last 4 digits); transactions; balances; bills; regular payments; pay and income; loans; your properties, and what property websites said about them; your super accounts, balances, statement figures and contributions; your electricity bills and a year's usage; what you own less what you owe, month by month; goals; the plan; the statements you've sent (the list, not the files); your household facts; and your own chats (a partner's aren't included). Or download your transactions as a spreadsheet (CSV). The download doesn't include the statement files themselves (your bank has the originals), property photos, or what Nodu keeps to do its job, like insights, the Inbox, the messages it sent, your settings and the change history. You can see those in the app, or ask us for a copy.
  • Correct something. Change it where you see it, or say so in the chat. What you tell Nodu always replaces what it worked out.
  • Delete your statement files. Nodu destroys your household's file key and deletes every file. Your transactions and plan stay, so Nodu keeps working. Nodu emails everyone else in your household to say who did it.
  • Delete your household. Nodu destroys the key and deletes every file, every record of your household and your change history. It also removes every member's sign-in, so you're all signed out. This can't be undone, so download a copy first if you want one.
  • If anyone else is in your household, deleting it waits 7 days. That includes anyone the owner removed from the household in the 7 days before. Nodu emails each of them: who asked, the day it will happen, and a link to cancel that works once. Until then the household carries on as normal, every member sees a notice saying when, and any of them can cancel, in Nodu or by that link (someone who was removed, by their link). Nodu doesn't delete anything until each of them has been told, at least 7 days before: if an email doesn't go, Nodu keeps trying, and the day moves later if it has to. Someone who joins while it waits is told too. If nobody cancels, Nodu deletes it early that morning. If the person who asked is no longer an owner or admin by then, it's called off. After a cancel, nobody can ask again for a day.

Who can delete. An owner or admin of the household can delete, after typing a short phrase to confirm. Nodu records which member did it. Deleting your household affects everyone in it, which is why it waits 7 days and tells each of you. It also means any of you can stop it, each time it's asked for. If you only want to stop using Nodu yourself, you can leave the household instead, from the Family page: your sign-in stays yours, and the others keep the household. In the chat, Nodu can't delete anything, even if asked; it will point you to Settings.

After you delete your household, Nodu keeps only the one-line record above. A few copies take a short time to go:

  • database backups, with the locked copy of your file key, roll over within 7 days on our planned hosting plan (they never held the files themselves);
  • request logs, and Supabase's log of sign-ins, go within 7 days;
  • Anthropic keeps no copy of requests from 12 October 2026, except one its safety systems flagged (up to 2 years) or the law requires; requests sent before then go within 30 days; and
  • emails we've already sent stay in your own inbox.

You can also ask us directly for a copy of your information, or to correct or delete it, using the address above. We'll reply within 30 days.

Keeping it safe#

Nodu is built never to ask for the most sensitive things, and so that a mistake in our code can't reach another household's data.

  • Your household is walled off by the database itself.
  • Your files are sealed with your own key.
  • Your records keep only the BSB and last 4 digits of an account number: long numbers are cut to their last 4 as banks print them; a number typed into the chat stays as typed, so please leave them out.
  • Sign-in is passwordless: an emailed link, or your Google account. Nodu never sees your Google password.
  • Our logs carry counts, not your figures or descriptions.
  • The few people who run Nodu's database can technically read it, but don't in normal running. Today that's only Nodu's founder; we're limiting it to named people and logging every access.

If something goes wrong#

If we have a data breach that's likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, under the Notifiable Data Breaches scheme. We'll say what happened, what information was involved and what you can do.

Questions and complaints#

Talk to us first: support@nodu.com.au. We'll reply within 30 days.

If you're not happy with our answer, or we haven't replied within 30 days, you can complain to the OAIC at oaic.gov.au (opens in a new tab) or on 1300 363 992.

Information from Google#

Signing in with Google is the only way Nodu connects to Google today. It gives Nodu your Google account's ID and email address, and for a Workspace account its domain. Nodu uses the address only to find or make your sign-in, or, if Nodu can't let you in yet and you ask to join, to keep it with your request, marked as confirmed by Google, and to tell you when there's a place. Otherwise it keeps nothing from Google, except that Google's return to Nodu passes through our hosting provider's request log, kept 1 day, with a one-time code and, for a work or school account, its domain. If Nodu can't let you in yet, your browser holds the address, sealed, for 15 minutes. The Nodu app doesn't connect to Gmail or any other Google service. Nodu's use of information from Google's APIs, now and if it connects more later, is limited to what this policy describes and follows Google's API Services User Data Policy, including its Limited Use requirements. That means:

  • information from Google is used only to provide Nodu's features to you;
  • it's never sold, or passed to anyone else except to provide Nodu, for security, or where the law requires;
  • it's never used for advertising or to train AI, or to decide anyone's creditworthiness or for lending; and
  • no one reads it except where you ask us to, for security, or where the law requires.

Changes to this policy#

When we change this policy we'll update the date at the top. If a change matters, such as a new provider or a new kind of data, we'll tell you in the app and by email before it takes effect.

Sources#

Opened on 10 October 2026.