Privacy Policy

Who is responsible

Nori and meetnori.app are published by Quentin Hermiteau, a sole proprietor (entrepreneur individuel) established in France (“we”, “us”). We are the controller of the personal data described in this policy. Our details are in the Legal Notice.

For any question or request about your data, write to [email protected]. We answer in English or French. Please never include repository contents in an email.

What the app keeps on your Mac

Nori reads and writes your repositories only through the git installed on your Mac. Its own data stays in your macOS user account:

• Preferences, recent repositories, pins and markers, in the app.meetnori.nori preferences domain (com.nori.desktop up to Nori 1.6.0).
• In ~/Library/Application Support/Nori/: marker images, Reviews data, and the undo journal, which records the names of undoable operations and of the branches, stashes and files they touched. Before an undoable operation, Nori also saves a snapshot under refs/nori/undo/ inside the repository; it is never pushed. Undo entries and their snapshots are removed after 30 days.
• In ~/Library/Caches/Nori/Reviews/: cached pull and merge request data, up to 256 MB, excluded from backups. Settings ▸ Storage clears it.
• To show which coding agent created a worktree, Nori reads local files of T3 Code, Claude Code and Codex. It changes nothing in them and sends nothing anywhere.

Diagnostic reports. Settings ▸ Updates ▸ Diagnostic report ▸ Export saves a file where you choose. It contains app and macOS version details, your update setting, the number of saved repositories and Nori’s recent crash and hang reports. It never contains repository contents or paths, Git output, credentials, names or email addresses. Nori never sends it: if you email it to us, we use it only to answer you.

Removing Nori’s data. Quit Nori, move it to the Trash, run defaults delete app.meetnori.nori (and defaults delete com.nori.desktop if you used Nori 1.6.0 or earlier), then delete the folders ~/Library/Application Support/Nori and ~/Library/Caches/Nori. Your repositories and the sign-ins of your other tools are not affected.

What leaves your Mac, and who receives it

Nori uses the network only for the features below. Each time, your Mac talks directly to the service named; nothing passes through us.

Git remotes

Fetch, pull and push run your own git, with your configuration and credentials, against the remotes you configured, such as GitHub, GitLab or your own server. By default, Nori fetches the remotes of each open repository every 5 minutes; set Settings ▸ Git ▸ Fetch automatically to Off to fetch only when you ask. Your agreement with each host governs what it does with your data.

Update checks

Nori uses the Sparkle framework to look for new versions. Once a day by default, and whenever you click Check now, it downloads the update feed from GitHub (raw.githubusercontent.com). Updates are downloaded from GitHub Releases, only after you confirm. GitHub receives your IP address, the version of Nori and standard request details, under GitHub’s privacy statement. You can turn off automatic checks in Settings ▸ Updates.

Reviews

Reviews talks to the API of GitHub, GitLab or Cursor with the account of the command-line tool you already use for it: gh, glab or Cursor’s origin. Nori stores no token: it asks the tool for one when needed and keeps it in memory briefly. For Cursor, it reads the tool’s entry in your login keychain, which macOS asks you to allow. Comments and reviews you submit are published on that service straight away. Responses are cached on your Mac as described above; Forget, next to an account in Settings ▸ Connections, deletes that account’s cached data.

AI text generation

When you click the generate button or use Push & Pull Request, Nori starts the AI command-line tool you chose in Settings ▸ AI (Claude Code, Codex, Gemini CLI, Cursor, or a command you configure) on your Mac and gives it a prompt: the staged or branch diff, file names, the branch name, recent commit subjects, and the repository’s instruction file or pull request template when there is one. The tool sends that prompt to its provider, such as Anthropic, OpenAI, Google or Cursor, under your account and that provider’s terms and privacy policy. Nori has no AI account or API key, and we never receive your prompts. Nothing is sent until you click, and the Git console names the tool and model, never the prompt.

Licensing

Nori contacts api.meetnori.app only to verify your email address, start a trial, activate or release a licence, and confirm it from time to time. It sends your email address, a random installation identifier and the name you give your Mac, never its hostname, hardware identifiers or anything about your repositories. See Trials, licences and purchases.

This website

Hosting

meetnori.app is hosted by Railway, on servers in Europe, and served through Cloudflare, which provides DNS, encryption and protection against attacks. Like any website, they process your IP address, browser user agent, the page requested, the referring page and the time of each request, to deliver the page and keep the service secure. Technical request logs are kept for no more than 30 days.

Audience measurement

On the home, pricing, comparison and download pages only, we measure visits with PostHog Cloud EU, which stores data in Frankfurt, Germany, on our behalf. It is configured to produce anonymous statistics for us alone:

• nothing is stored on your device: no cookie, no local storage, no identifier, and no profile is built;
• we record the page visited, the domain of the site that linked to it, the campaign tags in the link (utm_ parameters), the time spent on the page, how far you scrolled as a percentage, that a link or button was clicked but not which one, and whether you started a download or opened the checkout;
• to count unique visitors without cookies, PostHog computes a one-way hash of your IP address and user agent with a secret that it deletes every day, so a visitor cannot be recognised from one day to the next or across websites. It stores neither your IP address nor your user agent, and does not derive your location from them;
• there is no session recording, no heatmap, and no collection of page text or form input;
• events are kept for up to one year, we only look at totals, and the data is never combined with licensing or any other data.

Because it is limited to anonymous audience statistics in this way, this measurement does not require your consent under the French rules on cookies and other trackers (article 82 of the French Data Protection Act, as applied by the CNIL’s guidelines on audience measurement), but you can refuse it at any time. The legal pages are never measured.

This choice applies to this browser and is stored in its local storage until you clear it. Measurement is also off whenever your browser sends a Global Privacy Control or Do Not Track signal, or blocks posthog.com. The site works the same either way.

Cookies

The public pages of meetnori.app set no cookies. The only value they may store on your device is your choice to turn off audience measurement, if you make it. When you buy a licence, strictly necessary cookies keep track of your checkout so we can show you its result and your licence key, and the account space at account.meetnori.app uses two strictly necessary cookies to keep you signed in for up to 30 days and to protect your requests. The checkout window is run by Lemon Squeezy and may set its own cookies, described in Lemon Squeezy’s privacy policy. We use no advertising or tracking cookies.

Downloads

The download button sends you to GitHub Releases, which serves the file and receives your IP address and request details.

Emails to us

When you write to [email protected], we use your email address and message to answer you, and keep the exchange for up to three years after our last contact in case you follow up.

Trials, licences and purchases

To provide trials and licences, we keep:

• Your email address, verified with a single-use link that expires after 15 minutes.
• For each Mac, a random installation identifier that the app creates and keeps in your keychain, and the name you choose for it, such as “Mac 1”. It identifies neither your Mac nor you outside licensing.
• Your licence: its key, stored encrypted, its type, its purchase date and the Macs it is activated on.
• Your acceptance of the Terms of Use and of this policy: their version identifiers and the time.
• Your marketing consent, only if you tick the box, which is never pre-ticked: the version of the notice and the time. You can withdraw it at any time.
• Trial records: start and end dates. To prevent repeated trials, we also keep keyed one-way fingerprints of your email address and installation identifier.
• Purchase records from Lemon Squeezy: the email address used to buy, order references, amount, currency and tax, refunds and chargebacks. We never receive your card details.
• Security and licensing events, such as a verification, an activation or a licence check. They never contain repository paths, remotes, branches, commits, diffs, authors or Git actions.
• A launch count: the first time a Mac checks its licence, we keep a one-way fingerprint of its installation identifier and the day, only to count how many Macs start Nori. It is never linked to your email address, trial or licence.
• Abuse counters: the number of recent requests per email address or IP address, stored as one-way hashes.

Licences are sold by Lemon Squeezy, which acts as merchant of record: it processes your payment, collects taxes, issues receipts and invoices, and handles refunds, as an independent controller under its own privacy policy. We send operational emails, such as verification links, receipts and licence notices, through Resend; they do not depend on marketing consent.

Why we use data, and on what legal basis

How long we keep data

Lemon Squeezy keeps its own billing records for as long as tax and accounting laws require.

Service providers and other recipients

We do not sell or rent personal data. These providers process it on our behalf, under data processing terms, to run the service:

Our email hosting provider stores the messages you send to [email protected]. Lemon Squeezy, as seller, and GitHub, which hosts downloads and updates, act as independent controllers under their own policies. The Git hosts, code-hosting services and AI providers you use with Nori receive data directly from your Mac, under your own agreements with them. We may also disclose data when the law requires it.

Transfers outside the European Union

The website, the licensing service and its database run in Europe, and audience measurement is stored in Germany. Several providers are nonetheless based in the United States, so personal data may be processed or accessed there. These transfers rely on the EU–U.S. Data Privacy Framework for providers certified under it, such as Railway and PostHog, or otherwise on the European Commission’s standard contractual clauses included in the provider’s data processing terms. You can ask us for a copy of these safeguards.

Security

All connections use HTTPS. Licence keys are stored encrypted, and verification links and session tokens are stored only as one-way hashes. Each part of the service has only the database access it needs, and only the publisher can reach the administration tools, with a passkey.

Your rights

Under the GDPR and French law, you can:

• access your data and get a copy of it;
• have it corrected;
• have it deleted;
• restrict how we use it;
• receive the data you gave us in a portable format;
• object to processing based on our legitimate interest, including audience measurement;
• withdraw your consent to product news at any time;
• give instructions about what happens to your data after your death.

The account space at account.meetnori.app lets you export your data, change your email address, manage your marketing consent and delete your data yourself. Sign in with the email address of your purchase or, while we keep it, of your trial. Because a licence is tied to its owner’s verified email address, deleting your data also gives up your licences. For anything else, write to [email protected]. We answer within one month and may ask you to confirm that you control the email address concerned.

If you think we have not respected your rights, you can complain to the CNIL, the French data protection authority (cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or to the data protection authority of the EU country where you live.

Children

Nori is a tool for software developers and is not intended for children under 15. We do not knowingly collect their personal data; if you think a child has given us data, write to us and we will delete it.

Changes to this policy

We update this policy when Nori, our providers or the law change. Every update changes the version identifier and effective date shown at the top. We announce material changes in advance on this site and, if you hold a trial or licence, by email, and the app then asks you to acknowledge the new version. This policy is published in French and in English; if the two versions differ, the French version prevails.