Nuto Privacy Policy

Effective date: October 5, 2026
Last updated: October 14, 2026

This policy explains what information Nuto (栗记, "Nuto", "we") collects when you use the Nuto apps for iOS and Android, the web app, the command-line tool (nuto / sq) and the MCP interface; how we use it; who we share it with; how long we keep it; and how you can control it.

1. Who we are

Wuhan Squirrel Partner Technology Co., Ltd. operates Nuto.

• Address: Room 305-7, 3/F, No. 114 Hanyang Avenue, Jianqiao Subdistrict, Hanyang District, Wuhan, Hubei Province, China (湖北省武汉市汉阳区建桥街道汉阳大道114号3层305号-7)
• Privacy contact: privacy@sqmem.top

2. Information we collect

2.1 Information you give us

• Account information: your email address, an optional display name, and your password. Passwords are stored only as argon2id hashes; we cannot read them.
• From sign-in providers: if you sign in with Apple, GitHub or Google, we receive your account identifier and email address from that provider, and your name if it shares it; GitHub and Google also send the address of your profile picture there, which we keep with your account but do not show. Sign in with Apple lets you hide your email address, and we then receive an Apple address that forwards to yours. For Sign in with Apple we also keep, encrypted, a token Apple issues, so that we can end Nuto's access at Apple when you delete your account. We never receive your password there.
• Content you create: issues (title, body, status, priority, start and due times, labels, assignee), comments, memories, workspace names, and the files you attach (the file itself, its name, type and size). Attachments can be photos (picked from your photo library or taken with the camera), videos or any other file.
• Secrets in the vault: if you use Nuto's vault, the name, description and value of each secret you keep there. The value is encrypted before it is stored (section 8).
• Avatar: if you choose one in your profile, either one of Nuto's drawn avatars or a picture you upload. Before we store an uploaded picture, we crop it to a square, shrink it to 256 pixels a side, remove metadata such as the location in a photo and re-encode it; we do not keep the file you sent.
• Workspace invitations and join requests: to invite someone to a workspace, an admin enters their email address. We use it only to find their Nuto account (only people who already have one can be invited) and keep the invitation: who invited whom, with which role, and the answer. If you ask to join a workspace, we keep your request, with the note you add to it.
• Feedback you send: the message, an optional contact email, and the app version, operating system (on the web, also the browser), language and screen it was sent from; from the phone apps, also the app's install ID (section 2.2), and from the command-line tool, the name of the assistant using it. If you are signed in, it is linked to your account, and you can attach up to three screenshots you choose; screenshots cannot be attached without an account. A screenshot can show whatever was on your screen, so check it before sending. Before we store one, we remove metadata such as the location in a photo and re-encode the image.

2.2 Information created as you use Nuto

• Devices and sessions: device kind and platform (for example "iOS"), the app's user-agent string at sign-in, and session tokens (stored only as hashes). The phone apps and the web app do not read your device's name, model, hardware identifiers or advertising identifier (IDFA / GAID).
• The AI assistants you connect: the command-line tool tells us which assistant and model it is working for (for example Claude Code), and your computer's name, operating system and processor type; you can set other values with the tool's options. We store these with what it writes (issues, comments, memories and their history) and with the issue it is working on. It also sends the project it is working in, as the address of the project's repository (for example github.com/acme/api), which is stored with the memories written there. When an assistant brings in memories from its own memory files, we record which assistant did it and the names of the files it read (for example ~/.claude/CLAUDE.md), not their contents.
• Notifications: when something concerns you (you are assigned an issue or @-mentioned, someone comments on or moves an issue you are part of, you are invited to a workspace or someone asks to join one you manage, your role in a workspace changes or you are removed from it, your password changes, or the memories of a workspace whose plan you pay for near its limit), we put a notice in your Nuto inbox. It holds what it is about: an issue's key and title, the first words of a comment (up to 280 characters), a join request's note, a workspace's name and who acted. As your notification settings say, we also email it to you, in the language your app last used; notices about your account are always emailed. We keep your notification settings and that language with your account.
• Time zone: the IANA time zone your device reports (for example Asia/Tokyo), so your schedule lands on the right days. We keep the latest one on your account, for requests that cannot say where you are (such as those through MCP), and it is stored with the issues you create.
• Usage analytics: events such as opening and backgrounding the app, the steps of signing up and signing in, creating issues, syncing, and searching (whether a search found anything, never what you searched for), plus the error code and API name when something fails. Each event carries the app version, language, time-zone offset and platform, the session and device it came from, and whether you or an assistant made the call. When our setup guide, install scripts or downloads are fetched, we also record the campaign tags in the link and the site that referred to it. The app generates a random install ID for itself on your device; it is not a hardware identifier and is never shared with other apps. When you sign up or sign in, that install ID is linked to your account.
• Invite program: if you sign up through someone's invite link, or enter their invite code, we record who invited you and how far you have got (signed up, your agent has scheduled something, rewarded). An invite link keeps its code in a cookie in your browser (nuto_ref, for up to 30 days) until you sign up; it holds nothing else.
• Creators: if you arrive through a creator's referral link or enter a creator code, we record on your account that code, how you gave it (for example at sign-up), and the referral token our payment provider Creem gives the visit, to credit the creator; we also note when an assistant you connected first puts a dated issue into Nuto. Until you sign up, a link keeps the code and the token in cookies in your browser (nuto_aff and nuto_cref, for up to 90 days). When you subscribe through Creem, the code and the token go to Creem with your checkout (section 4.3). We keep the token until your account is anonymized (section 6), and the code after that too, with no name or address attached, so that the creator's counts stay right.
• Beta codes: while Nuto runs a closed beta, a new account starts working once a beta code we gave out admits it; until then it can do nothing but take a code, sign out or delete itself. We record which code admitted your account, and when. A sign-up link that carries a code keeps it in a cookie in your browser (nuto_beta, for up to a day) until you sign up; it holds nothing else. A beta code is not an invite code and rewards no one.
• Purchases: when you subscribe through the App Store, Google Play or Creem, we keep the product, status, period and transaction identifiers so we can grant what you paid for. We never see your card or payment details; Apple, Google or Creem handle those.

2.3 What we do not collect

We do not collect your precise or approximate location, contacts, calendars (apart from events you add to the "Nuto" calendar while two-way sync is on, section 2.4), health data, microphone input, or advertising identifiers. The camera opens only when you choose to take a photo for an issue, and only the photo you keep is uploaded, as an attachment. Attachments are stored as you upload them, so if a photo's file records where it was taken, that stays in the file (previews of it never carry it); uploaded avatars and feedback screenshots have it removed. Our analytics do not store your IP address. Nuto contains no third-party analytics, advertising or crash-reporting SDK.

2.4 Information handled on your device

These features run on your phone or in your browser. Except where said below, what they touch is never sent to us. The calendar, reminder and widget features are in the iOS and Android apps only: "Show your phone's calendars" and "Two-way sync with your calendar" are off until you turn them on, and reminders are on until you turn them off. "Your calendar" below means the issues assigned to you, and those with no assignee that you created.

• Offline copy: so that Nuto works without a connection, the phone apps keep a copy of your issues, comments, memories, labels and attachment details in their own storage on your phone, and the web app keeps one in your browser's storage, along with changes you made offline that have not been sent yet. Signing out deletes this copy. The phone apps keep your sign-in in the phone's secure storage.
• Show your phone's calendars: when on, Nuto reads the events in the system calendars you choose, on your phone, to show them in Nuto's calendar and to warn you when a time you pick overlaps one. The events are held in the app's memory only: never written to Nuto's database, never uploaded, never counted in analytics.
• Two-way sync with your calendar: when on, Nuto creates a calendar named "Nuto" in your phone's system calendar (or reuses the one it made before) and keeps a copy there of every open issue with a time on your calendar: its title and time, and in the notes its key (for example SQ-12, followed by "Urgent" or "High priority" when it is one) and a link that opens it in Nuto. Issue bodies are never written, and the copies carry no alerts. What you do in that calendar comes back to Nuto as your own edit: a changed title or time changes the issue, and deleting a copy cancels the issue (you can reopen it from the closed issues). An event you add to the "Nuto" calendar is sent to Nuto and becomes a new issue, with its title, its time and its notes as the issue's body. Events in your other calendars are never sent. On Android the "Nuto" calendar is kept on the phone only; on an iPhone it is created in iCloud when you use iCloud calendars, and otherwise on the phone. These events belong to your system calendar: if it syncs with iCloud, Google or another account, they sync as your agreement with that provider says; Nuto does not control that. Turning the feature off, or signing out, deletes the copies this phone wrote; the calendar itself stays, because it can hold events from your other devices or events of your own.
• Reminders: urgent and high-priority issues on your calendar remind you through your phone's local notifications, 4 hours before and when they start or are due (an all-day issue, the evening before). Each issue keeps one notification: a new reminder replaces the one before (on an iPhone, the next time you open the app). On Android, an urgent issue also stays in your notifications on its day, and once it is overdue, until it is finished. To keep them up to date, the app reads which of its own notifications are on your screen and withdraws those that are out of date; it reads no other app's notifications, and nothing about them leaves your phone. Your phone schedules them from the issues it has synced; no push service is involved. You can turn them off under "Calendar and reminders". Signing out cancels every reminder.
• Home-screen widget: if you add Nuto's widget to your home screen, the app hands it the titles, priorities and times of the workspace's open issues that most need attention, kept in storage only the app and its widget can read. It never holds issue bodies, comments, attachments or your sign-in. Anyone who can see your home screen can see what it shows. Signing out empties it.

2.5 Cookies and storage in your browser

The web app sets no advertising or tracking cookies. Its cookies are Nuto's own: nuto_ref, nuto_aff, nuto_cref and nuto_beta keep the code of an invite, creator or beta sign-up link until you sign up (section 2.2), and while you authorize an AI assistant through MCP, sq_mcp_browser and sq_mcp_session keep that sign-in until it expires. In your browser's storage the web app keeps your sign-in (a session token with your name, email address and avatar), its random install ID for usage analytics, your language and a few display choices, unsent feedback or edits, and the offline copy, image previews and files waiting to upload or download (section 2.4). Signing out removes the offline copy and the previews.

The footer of our public pages, these legal pages among them, shows badges from Fazier and Smol Launch, sites that list Nuto. Your browser loads those images from fazier.com and smollaunch.com, which, like any website, receive your IP address and browser details. Pictures that you or others link to from the web in an issue or memory are likewise loaded from the sites that host them.

3. How we use information

• To provide Nuto: signing you in, syncing issues and memories, sharing with your other devices and your workspace members, generating attachment previews, scheduling, emailing the codes that verify your address, reset your password or confirm deleting your account, and sending your notifications (section 2.2).
• AI features: so that memories and issues can be searched by meaning, we send the text of memories, the title and the start of the body of each issue (up to about 1,000 characters), your search queries and questions, and the task an assistant describes when it asks for context to DeepInfra to compute embeddings (vectors), which we store in our database. Comments, attachments and vault secrets are not sent. Before a memory, or a note an assistant records through a checkpoint, is stored or sent, Nuto replaces what looks like a secret (an API key, a token, a private key, a password) with a marker such as [REDACTED:api_key]. Issue titles and bodies, other comments and search queries are not filtered this way, so keep secrets in the vault. Our servers do not currently process your content with any large language model.
• Your own AI assistants: if you connect an assistant such as Claude Code or Codex to Nuto through MCP or the command-line tool, it reads and writes your memories and issues within the scope you grant. What that assistant then sends to its own model provider is governed by your agreement with that provider, not by Nuto.
• Subscriptions: confirming subscription status and handling upgrades, downgrades, cancellations and refund reviews.
• Security: rate limiting and preventing abusive sign-ups and attacks.
• Improving Nuto: we use the usage analytics in section 2.2 to learn whether features work. Analytics are used only for Nuto: never for advertising, never sold, and never combined with other companies' data.
• Invite program: to give you, and the person who invited you or whom you invited, the rewards of the invite program: extra storage and, for the inviter, a member seat. A reward is earned when the invited person's connected agent puts a dated issue into Nuto; we check that it happened, not what it says.
• Feedback: we read the feedback you send in order to answer you and to improve Nuto. We reply to your account's email address, or to the one you gave.

We do not sell your personal information, and we do not use it for targeted advertising or to track you across other companies' apps or websites.

4. Who we share information with

4.1 Your workspace members

The issues, comments and attachments you create in a workspace, the memories and vault secrets you share with it, and your display name, avatar and email address are visible to the other members of that workspace. Memories and secrets you keep private are visible only to you and to the assistants you connect. Members also see an issue's activity (who changed what, including its earlier titles), which assistant, model and computer (as the command-line tool names them, section 2.2) wrote something or is working on an issue, and who deleted an issue; any member who can edit an issue can bring it back after it was deleted.

If you invite someone to a workspace, they see its name and your display name, avatar and email address before they answer. If you ask to join a workspace, its admins and owners see your display name, avatar, email address and your note; you see the name of the admin who answered.

A picture you upload as your avatar is served from a random link that works without signing in, so that every Nuto app can show it: anyone that link is passed on to can see the picture.

4.2 The invite program

Anyone who opens your invite link sees your display name. If you invited someone, you see the first character of their email address and its domain (for example a***@example.com) and how far they have got; nothing else about them. If someone invited you, they see the same about you.

4.3 Service providers

These companies process data on our behalf, only on our instructions and only to provide the service:

4.4 Legal requirements

We may disclose information where the law, a court or a government authority lawfully requires it.

5. How long we keep information

6. Deleting your account

You can delete your account in the app, under Settings → Account → Delete account. To make sure it is you, we email an 8-digit code to your account's address. If you are the only owner of a workspace that others still use, first make someone else an owner, or remove the others.

• Immediately: you are signed out on every device, and every access token, device authorization and AI-assistant authorization stops working. Your account no longer appears in any workspace's member list.
• Within 30 days: signing in again with the same account restores it, with its content.
• After 30 days: the account is anonymized. We delete your email address, display name, avatar, time zone, password, every sign-in provider link, your detailed usage analytics, your notifications and notification settings, your secrets in the vault, the record of which assistants brought in memories, the feedback you sent while signed in (with its screenshots), your invite code and Creem's referral token. Workspaces no one else was in are closed: no one can open them again, their attachment files are deleted, and 30 days later they are deleted for good with their issues, comments and memories. We also remove the names of your computers and phones from our records, including from the details recorded with what you wrote. Your email address can then be used to create a new account.
• What remains: issues and comments you created in workspaces shared with others, and the memories you shared with those workspaces, stay there for the other members, no longer linked to your name or email address. Memories you kept private there are erased. Also kept, without your name or address: the assistant, model and operating system recorded with what you wrote; who invited whom in the invite program; which beta code admitted your account; the creator code you came with, so that the creator's earnings stay correct; notifications other members received about what you did (they now say "Someone"), until those notifications expire (section 5); records of invitations and join requests, until 30 days after they closed (section 5); and a mention of you in someone else's text, which keeps the name it was written with. Subscription and transaction records are kept as the law requires. Our database backups may still contain your data for up to 30 days, after which it is deleted with them. The copy of a feedback message that was emailed to our team stays in our mailbox until you ask us to delete it (section 7).
• Subscriptions: deleting your account cancels a subscription bought through Creem, which then ends with the period already paid for. It does not cancel a subscription bought through the App Store or Google Play; please cancel it in that store's subscription settings.

7. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to ask how we process it, to withdraw consent, and to complain to a regulator.

• Deletion: see section 6.
• Access, correction, export and other requests: email privacy@sqmem.top. We reply within 30 days, or sooner where the law requires, and may first need to verify that the request comes from you.
• Usage analytics: usage analytics are part of how Nuto works and cannot currently be turned off in the app. If you object to this processing, contact us at privacy@sqmem.top.

8. Security

• All data travels over encrypted connections (HTTPS / TLS).
• Passwords are hashed with argon2id. Session tokens, access tokens and verification codes are stored only as hashes.
• Secrets in the vault are encrypted with AES-256-GCM. Their values are never put in search indexes, sent to DeepInfra, or kept in the apps' offline copies, and a value is returned only when you, or an assistant you have given access to secrets, asks for it.
• Attachments are kept in private storage and reached only through short-lived signed links. Feedback screenshots are kept in private storage with no links at all: only our operators can open them, one at a time, and each opening is logged. Uploaded avatars carry no metadata and are reached through random links.
• Row-level security in our database keeps each workspace's data apart from every other.
• Staff access is limited, and our operations console records every look it gives at an account's data. That record cannot be changed afterwards and is kept, also after the account is deleted.

No system is perfectly secure. If an incident affects your personal information, we will notify you and the authorities as the law requires.

9. International transfers

Our servers are located in the United States (Seattle, Washington and Dallas, Texas). The providers in section 4.3 may process your data in the United States and other countries, so your data may be transferred outside the country where you live. We protect such transfers as the law requires. The recipients of these transfers are the providers listed in section 4.3; the table there shows the data each one receives and why.

10. Children

Nuto is intended for people 18 and over and is not directed to children under 16. If you believe a child has given us personal information without a parent's or guardian's consent, contact us and we will delete it.

11. Additional information for certain regions

• California residents: we do not sell personal information and do not "share" it for cross-context behavioral advertising. You have the right to know, delete and correct your personal information, and we will not discriminate against you for exercising these rights.
• Australia, Canada, Japan and New Zealand: privacy laws in your country (for example the Privacy Act 1988 in Australia, PIPEDA in Canada, the Act on the Protection of Personal Information in Japan and the Privacy Act 2020 in New Zealand) may give you rights to access and correct your information and to complain to the regulator. Contact us at privacy@sqmem.top and we will reply within 30 days. You can also complain to the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner of Canada, Japan's Personal Information Protection Commission or the Office of the Privacy Commissioner of New Zealand.
• Other countries and regions: wherever you live, you can use the rights in section 7: to access your information and get a copy of it, to have it corrected or deleted, to object to how we process it, and to withdraw a consent you gave. Email privacy@sqmem.top and we will reply within 30 days, or sooner where your law requires. Where a local law, such as Brazil's General Data Protection Law (LGPD) or India's Digital Personal Data Protection Act, gives you further rights or names a regulator, we honour those rights, and you can also complain to that regulator (for example Brazil's ANPD or India's Data Protection Board). That address is also our contact for data protection matters.

12. Changes

We may update this policy. We will tell you about significant changes in the app or by email before they take effect. By continuing to use Nuto after an update, you accept the updated policy.