Nox privacy whitepaper — how your data actually moves

A plain-language walkthrough of how Nox handles your data — what is collected, where it goes, who can see it, and the controls you have. The legally binding document is the Privacy Policy; this whitepaper explains the same practices in the way a person would actually ask about them.

What happens to a message you send

When you send a message, it travels encrypted (TLS) to Nox's servers, where a deterministic emergency check screens it first. Everyday chat is answered by Vela 2.5, which runs on a model provided by Anthropic through its API, with no training on your chats. Orion 2.5, Orion Flash 2.5, Orion 2.1 and Orion Flash 2.1 run on Fireworks AI inference infrastructure, which by default keeps no copy of your prompts or answers and does not train on them. If your message includes a photo and the selected model can't read images, the answer is generated through OpenAI instead, and a few supporting features also use OpenAI (see “Who processes your data”), under terms that do not allow your conversations to be used for training. The conversation is stored in Nox's managed PostgreSQL database so you can return to it — unless you are in Incognito mode, in which case it is never stored at all.

What Nox collects — and what it doesn't

Nox stores your account basics (from your sign-in provider), your conversations, any facts you let Memory keep, your plan and billing state, the check-in inputs you log (like sleep hours or stress level), and the tasks you give Pebs, Nox's agent. Nox does not sell your data, does not run third-party advertising trackers in the app, and does not collect data from your device beyond what you type, say, or attach.

Health data is treated as sensitive by default

Anything health-related you share — symptoms, medications, photos, check-in logs, remembered facts — is treated as sensitive: used to answer you and to run the features you invoke, and not for advertising or sale. The Privacy Policy describes this handling in binding detail.

Who processes your data

Vela 2.5, the everyday chat model, runs on a model provided by Anthropic (no training on your chats under its API terms). The Orion models run on Fireworks AI inference infrastructure (zero data retention by default, no training on your chats). OpenAI generates answers to photo messages when the selected model can't read images, and handles specific supporting features — generated illustrations, Memory upkeep, check-in scoring, and voice dictation — also with no training on your chats. ElevenLabs produces speech in Voice Mode. When you let Nox search the live web, the short search query — never your message or conversation — goes to Brave Search, a plain search index; Nox then reads the pages itself. The rest are Stripe (payments — Nox never sees your full card number), Resend (the optional Pebs task emails), Clerk (sign-in), and the managed database and hosting infrastructure the app runs on. Each provider receives only what its job requires. If you connect apps like Google Calendar, Nox accesses them only for the action you confirm.

What Pebs, Nox's agent, can do with your data

Pebs carries out multi-step tasks for you in an isolated cloud browser that runs on Nox's own infrastructure: it searches the web, reads pages, creates files, and can repeat a task on a schedule you set. Its reasoning is done by Nox's own GHI-1 models on Fireworks AI infrastructure; a web search sends only the short search query to Brave Search, a plain search index, and no AI company is involved in a Pebs task. Passwords, verification codes, and card details you give Pebs go through secure cards straight into the browser — they are never saved, never shown to the model, removed from everything the model reads, and masked in screenshots. Anything that sends, buys, or changes something outside Nox waits for your approval of that exact action, and placing an order is always a separate step from entering a card; Nox is not the seller and does not process the payment. Live-view frames are held in memory only. Optional task emails (sent through Resend) carry a task title, the approval or question text, and a link — never card details, passwords, or codes. A share link shows only a task's messages and step titles. Deleting a task removes its messages, steps, and files; deleting your account removes every Pebs task, schedule, saved preference, and share link. Section 12 of the Privacy Policy is the binding version.

Who at the company can see your chats

There is no routine human review of conversations. Access to production data is limited to what is needed to operate the service, debug a problem you report, or meet a legal obligation — the narrow cases the Privacy Policy spells out.

Nox is not a HIPAA-covered service

Nox is a consumer wellness product, not a healthcare provider, and is not covered by HIPAA. That does not lower Nox's own obligations — the practices described here apply regardless — but it does mean your Nox conversations are not 'medical records' in the legal sense, and Nox says so plainly rather than implying otherwise.

The controls you have

Delete any conversation. Review and delete every fact Memory holds, or turn Memory off. Use Incognito for conversations that are never saved. Disconnect connected apps at any time. Stop, take over, or delete any Pebs task, pause its schedules, and turn off its emails and share links. Cancel billing in the Stripe portal. For a copy of your data or full account deletion, email Info@Xhealthus.com.

How long data is kept

Conversations, memories, and Pebs tasks are kept until you delete them or your account is deleted. Incognito conversations are never written to storage. Billing records are retained as required for accounting and tax law. The Privacy Policy's retention section governs the specifics.

What we're still improving (honestly)

Nox has not yet completed an independent third-party security audit or certification (such as SOC 2), and the product's data-handling documentation is still growing alongside the product. This whitepaper will be updated as those milestones are reached — the same measured-not-promised approach as the rest of Nox's transparency pages.