Navorynth Privacy Notice (DRAFT)
DRAFT — REQUIRES LEGAL REVIEW.
The short version
Navorynth runs on your computer and stores your projects there. There is no telemetry. The only Navorynth online service is the account service, which signs you in and checks your subscription; it never receives your projects, files or API keys. When your AI team works, Navorynth sends what each step needs directly to the AI providers you connect (OpenAI, Anthropic, Google Gemini, xAI) using your own API keys, and you pay them directly. Your keys are kept in Windows Credential Manager and are only ever sent to the provider they belong to. [REVIEW: V1 Beta account service and subscription payments]
- Navorynth sends us only what your account needs. The one Navorynth service it contacts is the Navorynth account service (sign-in and your subscription status only: your email, an account id and whether your subscription is active; payments are handled by Stripe). There are no analytics, no crash reports and no telemetry, and your projects, files and API keys are never sent to Navorynth.
- Your projects are sent to the AI providers you choose, when a model is called. Your idea, plan, relevant code and files, test output and screenshots go directly from your computer to OpenAI and Anthropic, with your keys, because that is how the AI does its work. The providers’ own terms, privacy policies and your account settings govern that data.
- Your API keys stay on your computer, in Windows Credential Manager. They are sent only to the provider they belong to.
- Everything else stays on your computer: your projects, plans, logs, settings and license. DATA_AND_PRIVACY.md lists every file, what it contains and how to delete it. Uninstalling Navorynth keeps your data unless you delete it.
- The Navorynth app and dashboard are local. They show Navorynth’s own pages from your computer (127.0.0.1), load nothing from the internet, have no analytics, and never handle your API keys in the page.
What the seller receives
| When | What | How |
|---|---|---|
| You buy | Name, email, plan, payment status, the license id we issue [REVIEW: exact fields] | [PAYMENT PROVIDER / MERCHANT OF RECORD]. Card details go to the payment provider only. |
| White-glove setup session | What you show or tell us during the session | [DECISION NEEDED: format (e.g. screen share), whether it is recorded (recommendation: no).] We never ask for your API keys. |
| You ask for support | What you choose to send, e.g. your email and a diagnostics bundle | Email. The bundle contains no keys and no source code; you can read it before sending (SUPPORT.md). |
| Using Navorynth | Nothing |
Your license file contains the customer name we put in it; it stays on your computer.
[REVIEW: retention period for purchase, onboarding and support records; legal basis; data-subject rights and how to exercise them; seller contact for privacy requests: [PRIVACY EMAIL].]
What goes to the AI providers
Only when a model is called (planning, building, reviewing). Opening Navorynth, browsing your projects, the license check and the offline demo send nothing.
| Provider | What | Role |
|---|---|---|
| OpenAI (your key) | Your idea and answers, the plan, excerpts of project files you sent to the team, the Builder’s proposed actions, filtered code changes, test output, screenshots of your product for the visual review, project rules | Product Manager and Reviewer |
| Anthropic (your key, through Claude Code) | Instructions, project rules, excerpts of project files you sent to the team, the code files Claude reads and writes, command and test results | Builder |
Your keys are also checked with their provider (no AI tokens used) at setup and before work starts.
Before anything is sent, Navorynth removes known secret files (such as .env and key files) from what the
models can read, redacts anything that looks like a credential, and refuses to send a request that still
contains one of your keys. See DATA_FLOW.md and NETWORK.md for every network destination
(including package registries, which receive package names only).
OpenAI requests are sent with store=false. Retention, training use and other processing by each provider are
governed by your agreement with that provider: check your OpenAI and Anthropic account settings. More in
AI_PROVIDER_DISCLOSURE.md.
Personal data in your projects. If your ideas, files or test data contain personal data about other people, it may be sent to the providers as described above. You decide what to put in a project. [REVIEW: customer’s role and obligations when projects contain third parties’ personal data.]
Children
Navorynth is not directed at children. [REVIEW]
Changes
[REVIEW: how changes to this notice are communicated.]