Privacy
Your money data stays yours.
Nodu reads your statements so it can look ahead for your family. Here’s exactly what happens to them, what Nodu keeps, and what it never touches.
- No banking passwords, ever
- Nodu can’t move money
- Walled off by the database
- Never used to train any model
Where a statement goes
Four steps, from your bank’s download to the figures Nodu uses.
1You add a statement
A CSV or PDF you download from your bank yourself. Nodu never asks for your banking password.
2Sealed with your household's key
Encrypted with a key that belongs to your household alone before it's stored. The file is deleted 30 days after you send it.
3Read by Claude, which can't act
Nodu's own code reads a CSV, and Claude reads a PDF. Claude also puts each transaction in a category. Neither call has tools: no web, no messages, no actions. Your data never trains any model.
4Into your household's ledger
Behind a wall the database itself enforces, so no other household can see it. Nodu's figures come only from here.
Walled off by the database itself
One household can never read another’s information, because the database refuses it, not because the app remembers to filter.
- Your household’s data is stored in Sydney, by Supabase: the database, the encrypted statement files and sign-in. Nodu’s emails, and Claude, the model behind Nodu, are handled overseas, mainly in the United States.
- Nodu reaches household data only as a restricted login set to one household, or as you, through your own session. Neither gets around the database’s rules.
- With no household set, it sees nothing at all: it fails closed.
- Which household a query touches comes from Nodu, never from the model.
- Database tests check that every household table has its wall, before any change to the database leaves our machines.
The few people who run Nodu’s database can technically read what’s in it. They don’t look at household data in normal running. Today that’s only Nodu’s founder, and we’re limiting it to named people and logging every access.
What Nodu keeps, and what it never does
It keeps the facts it needs to look ahead for your household, and is built never to ask for the most sensitive things.
Nodu keeps
- Your transactions, balances, bills, pay and goals
- Your properties and super, if you add them
- Household details, like children’s ages and concession cards, for benefit checks
- What property websites say about your properties, with their photos
- What you tell Nodu, labelled with who said it and when
- Your chats with Nodu, which only you see. What Nodu notes from them, like your pay or a loan, goes into the household’s records, which your partner sees
- Feedback you choose to send Nodu’s team, in the words you agree to when Nodu reads them back, for up to 24 months
- Your email, to sign you in
- Your accounts, by BSB and last 4 digits only
- Statement files, for 30 days after you send them
Nodu never asks for
- Banking passwords, logins or one-time codes
- Tax file numbers
- Card PINs
And Nodu never
- Keeps full account numbers in your records: only the BSB and last 4 (a number typed into the chat stays with the chat)
- Sells your data, or shows you ads
- Makes credit decisions about you
The model that reads your statements
Nodu runs on Claude, made by Anthropic, reached through Vercel’s gateway. Each request goes to Anthropic first. Only if Anthropic is busy or down does it go to the same Claude model run by Claude Platform on AWS (Anthropic’s service on Amazon’s cloud), Amazon Bedrock or Google Vertex AI, in that order, and never to anyone else.
It doesn’t train on your data
Anthropic’s commercial terms don’t allow training on your information. The gateway doesn’t use it for training, and says the services that stand in for Anthropic don’t either.
It reads, and does nothing else
The Claude call that reads a statement has no tools: no web, no messages, no actions. Text in a statement is information, never instructions, so a hidden instruction in a file can’t make it do anything.
Its figures come from your ledger
Nodu’s numbers come from your own records, never from the model’s memory. Anything estimated is labelled as an estimate.
Where it happens, and for how long
Claude’s processing happens outside Australia, mainly in the United States. Zero data retention is on for every request, so none of them stores your requests or Claude’s replies once it has answered, and Vercel says its gateway keeps nothing either. If none of them can take a request on those terms, it fails rather than going somewhere that would keep it. Anthropic can still keep one its safety systems flag for misuse, and any of them can if the law requires it.
Nodu’s emails to you go through Resend, a US service. Nodu sends a property’s address to property websites only to look it up: when you add it with its street address or change its address, or once for a property it hasn’t looked up yet, or when you ask it to look again. Firecrawl, a US service, reads public property websites for that address and is sent nothing else about your household. Each time it finds details, Nodu looks again three months later, until you remove them. A home you rent is never looked up. Nodu’s chat is never given your street address.
You’re in control
Open Settings and go to Your data. It’s all there, any time, without asking anyone.
See it
Each kind of data Nodu holds, how much, the oldest and newest dates, and where it’s kept. Or ask Nodu what it has on you.
Download it
Your records as a file, or your transactions as a spreadsheet. Any member can.
Delete your statement files
Every file goes. Your transactions and plan stay, so Nodu keeps working.
Delete your household
Every file, every record and every sign-in. It can’t be undone, so download a copy first.
When you delete, Nodu destroys your household’s key first, then deletes the files. Backups don’t hold the files, and the locked copy of the key in backups is gone within 7 days. Your records are deleted straight away, and drop out of database backups within 7 days. Nodu can tell you what it holds, but it can’t delete anything. Only an owner or admin of your household can.
Questions families ask
General information only. Nodu doesn’t give financial advice.
Is Nodu giving financial advice?
No. Nodu gives general information about your own money: what's coming, where it went, and what you may be eligible for. It doesn't recommend credit, insurance or investment products, and it doesn't interpret tax.
Which banks does it work with?
Any bank that gives you a statement. Nodu reads CSV exports from CommBank, Westpac, ANZ, NAB and ING, and PDF statements from any bank.
Who can see our information?
Only your household sees it in Nodu, except feedback you choose to send Nodu's team. Each household's information is kept apart by the database itself, not just by the app. To read statements and reply, Nodu uses Claude, a model made by Anthropic, which doesn't train on your information.
Will Nodu call companies for us?
That's on the way. When it arrives, Nodu will only call with your approval, and will always tell them it isn't a person.
How do we start?
Nodu is invite-only for now. If you've been invited, sign in with your email: there's no password. Then send Nodu a statement for each account you spend from, and invite your partner if you have one.
The full detail: Privacy policy.
Sign in