Who is responsible
SUPERMIND PTE. LIMITED is responsible for the personal information processed to provide Nico. This policy covers the website, accounts and Nico services. Contact support@nico.app with a privacy question or request.
Account and service information
Email sign-in processes your email address, verification information and account session. Account services also process device authorizations, security events, subscription status and usage information needed to provide access and prevent abuse. Payment providers process payment details; Nico receives the customer, transaction and subscription references needed to manage billing.
This information is used to authenticate you, provide and secure the service, manage your account, respond to support requests and meet applicable legal obligations. It is not used for cross-site targeted advertising.
Content used by AI and speech services
When you talk with Nico, what you say, along with what she needs to answer, such as what is on your screen, a file you hand her, recent conversation and relevant memories, goes through Nico’s servers to model, speech and search providers. With Plus, the check before an action and the look at today’s calendar travel the same way. Nico’s servers pass all of this along without keeping it.
The work Nico does in the background goes straight from your Mac to the AI provider you connected, with your own account, so that provider’s terms and settings apply. Check them before you hand over anything sensitive.
Data on your Mac
Chat history, task records and generated files are stored on your Mac. Model and connected-account credentials are managed locally, including through macOS Keychain where supported. A task can send relevant content to a provider or destination you authorize.
Memories are kept on your Mac and are never uploaded to Nico’s servers. When a memory helps her answer, it is sent along with that conversation, as described above.
Browser extension
The Nico extension for Chrome and other Chromium browsers communicates only with the Nico app on the same Mac. The extension itself does not send information to Nico’s servers or any other server.
The extension gives the Nico app the addresses and titles of open tabs, and the position, size and front tab title of each window. For a page Nico works on at your request, it also provides the page’s text and structure, screenshots, saved PDFs and downloaded files, and whether you are clicking or typing on that page, but not what you type or where you click. Incognito windows are not included. The extension refuses debugging commands that read cookies or site storage and does not access your browser account. In the browser profile, it stores a random identifier for the profile, an identifier for the current browser session and whether you allow Nico to use the browser.
The Nico app uses this information to find and work on the right tab and to list your browser profiles in Settings. For this, it can also read the browser’s profile names and the extension’s identifier from the browser’s files on your Mac, and the titles of browser windows. Page content used in a task is handled like other task content and can be sent to the AI provider performing the task, as described above.
While Nico works on a tab, the browser shows its debugging notice. You can stop Nico on a tab from that notice or the extension’s popup, turn off “Allow Nico to use this browser” in the popup, turn off “Allow tasks to use browsers with the extension” in Nico Settings, or remove the extension.
Cookies, local storage and diagnostics
The website uses cookies needed for authentication and session security. It can store your language choice and cache public prices in browser local storage, but does not store account access tokens there. When you play the film, it loads from YouTube in privacy-enhanced mode, under Google’s privacy policy.
The website uses Google Analytics to understand how visitors find and use it, such as which pages are viewed, which ad or link led to a visit, scrolling, and clicks on links and downloads. Google Analytics sets its own cookies and receives your IP address and browser details, which Google processes under its privacy policy. Pages whose address carries sign-in, authorization or payment details do not load it, and it is not linked to your Nico account. You can block it in your browser settings or with Google’s opt-out browser add-on. The website does not use session replay.
The website also uses Mixpanel to understand how visitors go from a first visit to signing up and subscribing. On public pages it records which pages are viewed, which ad or link led to a visit, clicks on page elements, how far a page is scrolled and form submissions, but not the text of the page or what you type. Account pages, and pages whose address carries sign-in, authorization or payment details, send only the website’s own events, such as page views and checkout starts, with the page path and its campaign and ad parameters but not the rest of its address. Mixpanel keeps a random visitor ID in your browser’s local storage rather than in a cookie, and uses your IP address to estimate your region. Once you sign in on the website, the visits recorded for that visitor are linked to your account ID, not to your email address or name. You can block it with your browser’s content blocking settings.
The website also reports page views, plan and checkout choices, and download clicks to an analytics service that we operate ourselves. A page view includes the page path, the campaign and ad parameters in its address, and which website linked to it, named by its domain rather than the linking page. Our server passes your IP address and browser details to that service so it can count visitors and estimate their region, and does not store them. These events are not linked to your Nico account.
Operational information helps diagnose failures and protect the service. Diagnostic log uploads in the production Mac app are on by default. You can turn them off in Nico Settings; turning them off stops further uploads. Uploaded diagnostic logs are intended to exclude conversations, model replies, tool and file content, and credentials, and are retained for 14 days.
Newer Mac versions upload only fixed structured diagnostic events in both production and staging; they do not upload old text log segments. Older staging versions can upload redacted text log segments, and provider errors may echo request content into those logs. Redaction does not guarantee that older logs contain no sensitive information.
The production and staging Mac apps also report usage events to an analytics service that we operate ourselves, such as app starts, onboarding steps, whether a permission was granted, how long a conversation or task took and how it ended, which connectors were connected, and app updates. Each event is a fixed name with fixed values or numbers, is tied to your account ID rather than your email address, and contains no conversations, model replies, tool or file content, or credentials. The production app’s events, and the sign-up, sign-in, subscription and payment events the service records, are also sent to Google Analytics under a one-way hash of your account ID, without your email address or IP address. The same events are sent to Mixpanel under your account ID, so that they join the website visits linked to your account, also without your email address or IP address. This setting has no switch in the app.
Service providers and international processing
Information is shared as needed with hosting, email, AI, speech, search and payment providers to supply their services, with support staff handling your request, and when required by law or necessary to protect rights and security. We do not sell personal information.
Providers may process information outside your country. Applicable data-protection requirements govern these transfers. The services you connect directly may have separate responsibilities under their own privacy policies.
Retention, deletion and security
Information is kept for the purposes described here, including account operation, security, payment records and legal obligations. Retention depends on the type of information and the applicable requirements. Backups, payment records and information needed for legal obligations may remain after an account is disabled or a deletion request is made.
You can delete your account any time in Nico’s account settings. Your chats, memories, tasks and files stay on your Mac until you remove them, and data held by a service you connected is managed with that service. For anything else, contact support. Access controls, encryption and other safeguards reduce risk, but no system is completely secure.
Your choices and rights
You can manage connected accounts, revoke device access and change macOS permissions. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. Contact support@nico.app; we may need to verify your identity without asking for your password or verification code.
You may also contact the relevant data-protection authority. Material changes to this policy will be communicated through the website, the app or your account email as appropriate.