Every sentence on this page was checked against the code that runs the site. It shows what NeverNo keeps, what it never keeps, who reads your messages and how to check it yourself.
Last checked against the code: November 11, 2026
Your conversations, images, characters and memory, encrypted with a key your browser will not let anyone export. If you turn on sync, an unreadable copy on our servers, without the media.
Your account, plan, credits, usage counters and the account records listed below (devices, payments, trials). Share links, your backup and sync, only encrypted, unreadable to us.
The text of your messages and replies, your images, your voice: they pass through our servers while the reply is made, and are not recorded in readable form.
Everything you create lives in an IndexedDB database called neverno, in this browser only. There is no readable copy on our servers: only, if you create them yourself, a backup, a share link or the sync copy, all three encrypted (see below).
On first use, your browser creates a “non-extractable” AES-256-GCM key: the page can use it to encrypt and decrypt, but no script can read it as bytes, not even ours. It stays in the keys table of the same database and never leaves the device. Each piece of content is encrypted on its own, with a random 12-byte vector.
So your conversations can be sorted and found without decrypting everything, a few markers stay readable: ids, dates, the model used. The table says which.
| What is stored | Encrypted | Stays readable |
|---|---|---|
| Conversations | The title | Id, folder, project, kind (for example a Confessional session), pinned or not, model, character, dates |
| Messages | The text, the model’s reasoning, web sources, steps, versions, your vote | Id, author (you or NeverNo), model, status, links to media, date, reasoning time |
| Folders | The name | Order, date |
| Images, videos and sounds | The file, its description, model and size | Media type, file format, linked conversation, date |
| Characters you create | The whole sheet | Id, dates |
| Memory (accounts) | Each memory and its vector | Conversation it came from, kind of memory, who it is about (you or a character), dates |
| Custom instructions, pending learning | The text | Nothing |
| Settings | The names to mask before anonymized models, the sync data key | Memory on or off, masking on or off, automatic backup, date of the last backup, backup key (non-extractable), your share links with their key, so you can copy them again, sync state (account, key epoch, cursor, date of the last exchange) |
| Sync tracking | Nothing: no content is copied there | The changed rows to send (table and id), and for each item already exchanged its opaque id, its counter, its version and a fingerprint |
| Private vault | Each document’s name and details, the text of each passage and its vector | Ids, passage order, indexing state, number of passages, dates |
| Projects | The whole project: its name, instructions and settings | Id, dates |
| Files of a project or a conversation | The name and the content | Id, linked conversation or project, file type and size, origin (you or an agent), dates |
| Tracking of synced files (when media sync is on) | Each file’s own key | Opaque id, size, number of pieces, upload state, date |
A few interface preferences are kept in plain text in the browser’s localStorage, with no conversation content: the chosen model, the image Studio settings (negative prompt included), the chosen voice, the accent color, a visitor’s avatar, the sidebar state, the upgrade suggestions already shown, and other settings of the same kind (the character chosen in the Confessional, notifications, the welcome screens already seen and, for an account just created, its id and creation time). One exception: while a video, a piece of music or a sound effect is being created, its description and settings are kept there in plain text so the creation can be found again after a reload; they are removed when it arrives or when you remove it, and on your first visit more than 24 hours after a failure. A creation started from an ephemeral chat is never written there.
When you turn a message into a mission, its text goes to the Missions page through the tab’s sessionStorage, in plain text: the page reads it once and erases it, and it is gone anyway when the tab closes.
“Erase everything” in Settings, or clearing the site’s data in your browser, deletes the database and the key. Without a backup or sync, nothing can be recovered, by you or by us.
Nothing readable on our servers. We only keep an unreadable copy, which only your passkey, your recovery key or your approved devices can open. We see how many items you sync and when, never their content.
With an account, you can turn it on in Settings › Data: your conversations, folders, characters, projects (with their files up to 200 KB each), memory, agents, custom instructions and settings follow you to your other devices. Each item is encrypted in your browser with AES-256-GCM before it leaves, under a data key our servers never have, and its id is made opaque: the server cannot tell whether it stores a message, a character or a setting. The vault (documents and passages) syncs too, encrypted the same way. Images, videos and sounds are not synced yet: they stay in this browser, and in your encrypted backup if you make one. A visitor without an account has no sync.
The data key is created on your first device. It is wrapped by your passkey (a WebAuthn key used for this alone, not to sign in), by your recovery key, and sealed for each of your approved devices. A new device gets it through one of these three paths. A stolen session is not enough: every sync request must be signed by an approved device.
| Plan | Space |
|---|---|
| Free | 100 MB |
| Pro | 5 GB |
| Pro+ | 20 GB |
| Max | 100 GB |
Once the space is full, your new changes wait on your device: nothing is lost, and your other devices keep receiving what is already synced. If your plan changes to one with less space than you use, nothing is erased, but nothing new syncs, text included, until you delete enough.
An ephemeral chat (the dashed bubble next to the model picker, or “New ephemeral chat” in the sidebar and the ⌘K palette) works like any other chat, with one difference: it is never written to this browser. Its messages, the images and voices made in it and the files you attach live in the tab’s memory, and nowhere else.
IndexedDB: no conversation, no message, no media, and no key is created for it;/chat?ephemeral=1;What still counts: your messages count toward the daily quota, and a vote on a reply adds to an anonymous total, as in any chat. Nothing changes on our side either: as for every chat, the text crosses our servers to the model and is written nowhere.
The vault (“Vault” in the sidebar) keeps the documents you add, PDF, Word, Markdown, text or code, in the same neverno database, encrypted with the same key. Each document is cut into passages of about 800 tokens; the name and details of the document, the text of each passage and its vector are sealed. Only ids, the order of the passages, the indexing state and the counts stay readable. The original file is not kept.
Finding the passages that answer a question takes a vector for each passage: 1,024 numbers that describe its meaning. That calculation is not done in your browser. Here is exactly what leaves it, and when.
/api/memory/embed);What still counts: each passage indexed and each question searched counts toward a daily quota (vault), and what the calculation costs us is recorded as an amount, as for the memory. On a model marked “Anonymized”, the passages reach its maker with the message, under that maker’s rules. “Erase everything” in Settings deletes the vault with the rest.
A mission (paid plans, and one trial for a free account) runs on our servers while you are away: it is the only part of NeverNo where the server must read your instructions to do the work. We say it plainly, and keep what remains to the strict minimum.
The instructions, the agent’s sheet, the feedback you give and a watch’s last observation are encrypted at rest with a key only the missions server holds, bound to the mission and to your account. During a run, the pages read and the working notes are kept encrypted, then erased as soon as the result is delivered.
The result is encrypted for your devices’ public key: the private key is made in your browser and never leaves it (it goes with your encrypted backup). We have no way to read a delivered result again; its ciphertext is erased from our servers as soon as your device has it, and after 30 days at the latest. These timed erasures (30 and 90 days) are done by a purge that runs every hour.
| Data | Readable by the server | Kept |
|---|---|---|
| Rhythm (days, time, time zone), budget, state, counters | Yes, to wake the mission | As long as the mission exists |
| Instructions, agent sheet, feedback, chosen connectors | Only during a run (encrypted at rest) | As long as the mission exists |
| A watch’s last observation (the few facts to compare) | Only during a run (encrypted at rest) | Replaced at every run |
| Pages read, working notes, step log | During the run (encrypted at rest) | Erased at delivery |
| Delivered result | No: encrypted for your devices | Until your device receives it, 30 days at most |
| A connector’s token or secret | Only for the call (encrypted at rest) | Erased as soon as you disconnect |
Every outward action (sending a message, calling a tool that acts) waits for your one-tap approval; notifications never contain the mission’s content.
Our database (Supabase, Postgres) has no table that can read messages, replies or images: the sync only stores encrypted items there, with no readable kind or id. Here is what it keeps, by family, read from its migrations (supabase/migrations/).
| Data | Why | How long |
|---|---|---|
| Account: email address, sign-up date and last sign-in. Supabase, which handles sign-in for us, keeps for each open session your browser’s full name (its user agent) and the IP address it was opened from, and keeps a log of sign-ins | Signing you in with a code sent by email | As long as the account exists; a session: until it is closed (you can see and close your sessions in Settings › Security) |
| Profile: plan and renewal date, content filter on or off, date of your “18 or older” statement, any suspension, chosen avatar (a seed of at most 64 characters, never a photo), accent color | Applying your plan’s rights, showing your interface on every device | As long as the account exists |
| Payment: Stripe customer id, subscription status, auto top-up (threshold, amount, the card’s id at Stripe), gift codes used, ids of the Stripe events already handled | Billing, managing the subscription, never handling a payment twice | As long as the account exists; invoices at Stripe, as accounting law requires |
Credits: each batch (amount, origin, expiry) and each spend, with its amount, date and a reason that names the feature or the model paid for (for example chat:claude-opus-5.5, confessional, debate:contract, research:…, image:…, media:…). This log therefore shows on which dates you paid for a Confessional session, with nothing of what was said in it | Keeping your balance right, refunding a failed creation | As long as the account exists |
| Usage counters: the kind of action (message, image, search…) and the time, tied to your account; for a visitor without an account, to a random trial id and to a fingerprint of their IP address computed with a secret key (for an IPv6 address: of its whole /64 network, the block one connection can rotate through, not of the single address); for a free account, images, read-aloud and dictation are also counted against that fingerprint, in a separate counter that does not carry the account id (free accounts on one connection share a limit) | Limits over a rolling 24 hours, and the 30-day calendar in “My subscription” | Account: kept 31 days (numbers only, never content), then erased every hour. Visitor without an account: erased every hour past 48 hours. The last minute’s, which limit bursts of requests, after one hour |
| Cost of your included usage: an amount in dollars, a kind (chat, image, voice…) and the time, tied to your account or, for a visitor without one, to their trial id or to the fingerprint of their IP address | Each plan’s daily cost ceiling | Account: erased every hour past 35 days. Visitor without an account: past 48 hours |
| Long creations (video, music, sound effects): the model, status, dates, reserved credits, the provider’s task number and, for a video, the fact that it starts from an imported image | Following the generation and paying for it once | As long as the account exists, with no description and no file on our side; the task number lets the provider find the description it received, for as long as it keeps it |
| Share links: the encrypted text (unreadable to us), its size, its creation and expiry dates, the account that made it | So that whoever has the link can read it | Until the expiry you chose (1, 7 or 30 days) or until you delete it, then erased within the hour |
| Backup: one file encrypted with your passphrase, its size and date | Getting your data back on another device | Until you delete or replace it |
| Encrypted sync: each encrypted item (unreadable to us) with its opaque id, its version, its size rounded to 256 bytes, its time and the device that wrote it; the data key wrapped by your passkey, your recovery key and for each approved device; the space used | Getting your data on your other devices | Until you turn sync off or delete the account; a deleted item leaves a trace without content for 180 days |
| Companions’ spontaneous messages: for each companion, an opaque random id (never which character it is), the frequency you chose, the next time, your time zone and quiet hours, the day of the last notification and whether one is waiting; its name only if you allowed it in the notification. Never a word of a conversation: the message is written on your device when you open the app | Sending a notification without content (“NeverNo”, “Lena is thinking of you” or “A message is waiting for you”) | Until you turn it off for that companion or for the account, start the relationship over, or delete the account |
| API keys: their name, first 12 characters and a SHA-256 fingerprint (never the key itself), the date of last use | Recognizing your API calls | As long as the account exists (a revoked key keeps its revocation date) |
| Votes on replies: counters per day, model, vote and reason | Tuning the Auto mode | Without limit, but with no account, no id and no text: nothing ties them to you |
| Admin log: each action an administrator takes on an account (credits added, suspension…) and some automatic actions (a subscription that reached its end, an order paid in crypto with the declared country and the country of the connection, a sync reset, the purge of an inactive account) | Oversight and security | Kept, even after the account is deleted, without its id; no maximum duration is set yet |
| Usage statistics: event names from a fixed list, a page template, the referrer’s domain, campaign tags, country, kind of device, language, a fingerprint of the day (its key erased every night); for an account, its sign-up day, origin, first payment and totals of revenue and cost | Knowing what to improve, measuring sign-ups and margin | Raw events 90 days, then anonymous daily totals only; the account part until you turn it off or delete the account |
| Inactivity notice: the account id, the date the notice email was sent and the planned deletion date, for a free account unused for three years | Keeping the promise of the privacy policy: a warning 30 days before, one deletion through the same steps as “Delete my account”, never twice | Until you sign in again (the notice is dropped) or until the account is deleted |
| Browsers known to the account: the browser’s and system’s name (“Chrome, Windows”), when it was first and last seen, the date of the alert email | Emailing you when a new browser signs in | As long as the account exists (30 browsers at most) |
| Code confirmation of a sensitive action: for the session that asks, a fingerprint of the 6-digit code, the number of tries and of sends, the time of the last send and the end of the confirmation window | Checking it is you before signing your other sessions out or turning the sign-in alerts off | The code: 10 minutes; the row, without a code: until a later code request more than 24 hours after, or until the account is deleted |
| Trials of paid features: a counter per account and per IP address fingerprint, per feature and per month (or once only, for trials given a single time); for the missions trial, its date | Offering each trial once, without an account farm multiplying it | IP address fingerprint: the current month, erased on the first night of the next one. Account: monthly counters kept 3 months at most; trials given a single time (Claude Opus answers, Confessional, video, agents, missions…): as long as the account exists; everything is erased with the account |
| Orders paid in crypto: the plan, price, status, dates, declared country, country of the connection, VAT and the order number at CoinGate | Opening the plan you paid for, and keeping the accounting and VAT records the law requires | A paid order: 10 years, the period the law requires, detached from the account when it is deleted (automatic erasure at the end of that period is not in place yet); an unpaid order goes with the account |
| Contract evidence: when confirmations and receipts were sent, the version of the notice shown, and the waiver of the right of withdrawal checked before a purchase | Proving what was agreed to and sent, as consumer law requires | As long as the account exists; those of a paid crypto order stay, without the account |
| Granted plans and credits taken back: a plan granted by the administrator, with a free-text note; credits taken back after a refund or a dispute; automatic corrections of reservations (reason, amounts) | Applying a granted plan, taking back refunded credits, closing a reservation left open | Granted plan: until it ends; credits taken back: as long as the account exists; corrections: 365 days |
| Auto top-up: the last payment error (the start of Stripe’s message) and each attempt (amount, status, invoice number, date) | Never charging twice, stopping after three failures | As long as the account exists |
| Developer subscription: the subscription’s id at Stripe, its status and its renewal date | Applying the developer plan’s rights | As long as the account exists |
| Missions, devices and notifications: for each device, its public keys, name, status and dates; the log of approvals and revocations; your browser’s notification subscription address | Encrypting results for your devices alone, notifying you without content | As long as the device or the subscription exists; a device never approved: 30 days; a revoked device leaves a trace without keys for 90 days; log: 90 days |
| Missions, connectors: the access to each connected service (encrypted with the missions server’s key, which can read it to act) and the date it was last used | Reading or acting in your services when a mission asks for it | Until you disconnect it or delete the account; we then ask the service (Google, Notion, Slack, GitHub) to revoke the authorization |
| Sync, account and keys: the wrapped data key, your passkeys, the approved devices; after you turn sync off or reset it, the date you turned it off, and the date, the device and the count of resets | Opening your data on your devices, and keeping an old device from reopening an erased copy | As long as sync is on; the off and reset markers: as long as the account exists |
| Current agents: for each personal agent you run, a keyed fingerprint of its id (never its name or its sheet), when it became the account’s agent, when it last ran and, if it was replaced, when | Applying the number of agents of your plan | The current agent: as long as the account exists; a replaced agent: 31 days, then erased at the next run |
| Queue for the Confessional’s voice: the account or visitor holding a line or waiting for one, its state, its priority and two timestamps | Staying under the number of simultaneous calls, and serving everyone in turn | For the length of the call or the wait; an abandoned line is removed at the next call, yours or someone else’s |
| Statistics tied to the account: its sign-up day, landing page, referring site, campaign tags, country, kind of device, language, whether it tried before signing up, its first paying day and first plan, and its totals of revenue, cost and credits; or, if you refuse them, only the date of that refusal | Measuring sign-ups and margin, and honoring your refusal | Until you turn them off (they are then erased, only the date of the refusal stays) or delete the account |
Service health: for each server error, the route template (for example /api/chat, never the real address nor its parameters), the HTTP status, the error class and the provider, counted per minute | Seeing a route that breaks, and being alerted | 30 days; no account, no id, no message |
| Provider spend: an amount in dollars per minute, per provider and per kind of action, with no account behind it | Being alerted when our costs spike | 35 days |
| Feature switches and alert log: which feature is paused, by whom (an administrator or the automatic cut-off) and the figures of each alert | Pausing one feature without a deploy, and keeping a trace of it | Switches: as long as the site exists; alerts: 90 days |
“Delete my account”, in Settings, erases all of this: the subscription is canceled, the Stripe customer and its cards are deleted, then the backup, the synced copy, links, keys, counters (trial counters included), costs and finally the account. The authorizations given to Google, Notion, Slack or GitHub are revoked at their end; if one of them does not answer, our copy of the access is erased all the same and you can remove the authorization from your account there. What remains: the anonymous vote counters; the admin log, without the account’s id; the accounting records the law requires (orders paid in crypto and the proof of their receipts, detached from you); usage statistics, detached from the account, for up to 90 days; counters tied to the fingerprint of an IP address, which erase themselves (48 hours, or at the end of the month for trials). Outside our database: the sending log of our emails at Resend, Supabase’s technical backups for as long as they are kept, and the invoices Stripe keeps on its side.
Supabase’s technical backups keep a copy of the database, and so of any deleted row, for as long as Supabase keeps them.
To answer you, your message goes through our servers to the model, and the reply streams back to your browser. None of the following is written in readable form to the database or to the logs (the sync, if you turn it on, only stores a copy your browser has encrypted):
Our error logs only note technical markers: a model or provider name, an error code, a credit operation number. An account only appears there under a tag computed with a secret key, which reveals nothing on its own; only deleting an account notes its id, never its email. Elsewhere, some providers keep what they receive for a while: see “Who reads your messages”.
To know what to improve, we count how NeverNo is used, with our own tool on our own servers (/api/analytics): no cookie, no third-party tracker, no fingerprinting script.
A visitor is counted under a fingerprint of the day: a keyed hash of the site, the IP address and the browser, whose key is random and erased every night shortly after midnight (UTC: at the first visit of the day, and at 00:07 at the latest). Neither the address nor the browser is kept, and nobody, us included, can link one day’s visit to the next day’s once the key is erased; it may remain in our database’s technical backups for as long as they are kept.
/chat/:id, never an id), the site that sent you (its domain only) and the campaign tags utm_source, utm_medium, utm_campaign;Raw events are erased after 90 days; only anonymous daily totals remain. Turn “Share anonymous statistics” off in Settings, or let your browser send Global Privacy Control or Do Not Track: you are still counted, with no fingerprint and nothing tied to your account, and what was tied to it is erased. Deleting the account erases its part too.
When you pick a model marked “Anonymized” (Claude, GPT, Gemini, Grok), the company that made it reads your request. Before the message leaves your browser for one of them, a short list of personal data is replaced by placeholders such as [EMAIL_1], and the reply comes back with the real values put back. None of this reaches our servers: the detection, the replacement and the mapping table live in the page, and the table is never stored (it is derived again from the conversation at each message).
It is a closed list, built to break as few questions as possible: no open-ended recognition of names. What it covers, and what it does not, exactly:
+33 6 12 34 56 78) or a national form with separators (06 12 34 56 78, (555) 123-4567, 090-1234-5678);::);The switch is in Settings › Data, on by default; off, your messages reach anonymized models as written. Private models are never masked: nothing is kept there, and a wrong mask would cost more than it protects. Below the message box, “3 items masked” lists what was replaced for the last message. Measured on sealed cases, set aside and never used to tune the detectors: postal addresses are found in 72% of cases, phone numbers in 94%, IBANs in 100%, and across 160 look-alike traps (text that resembles personal data without being it) there was no false alarm. These are results from our own tests, not a guarantee: a detail written in an unusual way can slip through, so reread what you send to an anonymized model. A third improvement pass is planned after launch.
Clean Room (/clean-room) makes a redacted copy of a PDF, a Word file or a text file. The file is read, searched, shown and rewritten in your browser: no route of ours receives it, its text or the list of what you hide. The only things the page loads are the site’s own files, from our address (the PDF reader, and for scanned pages the OCR engine and its language models). It works offline once it is open.
What is found automatically is the same closed list as the masking above: email addresses, phone numbers, IBANs, card numbers, IP addresses, postal addresses written in full, the names on your list. Nothing else; you add the rest by hand, and you review every box before the export.
[EMAIL_1]) or a block of █, your choice, with an optional report that gives counts by kind, never a value.The promise is “the file never leaves your device, and you review before exporting”, not a guarantee: a detector finds nothing it does not know (a name not on your list, a date, a place), and a scanned page depends on what OCR managed to read. The review step is there for that.
A model has to read your message to answer it. This table shows who receives it and whether they keep it. It is generated from the model catalog and the routes to the providers: it changes by itself when the code changes.
No provider receives your email, your account id or your IP address: our server calls them, with its own key. They receive the text of the current conversation and, if you have them, your instructions, your memories and the character sheet. If you write who you are, they read it. At OpenRouter, we also refuse, with every request, to let it be used for training.
“Private”: an open model, served by DeepInfra or by OpenRouter with its zero-retention option, that does not keep requests. “Anonymized”: a closed model; the company that made it reads the text, without knowing who you are, and applies its own rules.
| Model | Label | Who receives the text | Retention |
|---|---|---|---|
| AutoNeverNo | Private, no limits | DeepInfra and OpenRouter | Nothing, under their zero-retention commitments |
| NeverNo UncensoredNeverNo | Private, no limits | A third-party zero-retention host, via OpenRouter | Nothing, under their zero-retention commitments |
| DeepSeek V4 FlashDeepSeek | Private | OpenRouter, then DeepInfra as a fallback | Nothing, under their zero-retention commitments |
| GLM 5.3 FlashZ.ai | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| Qwen 3.5 35BAlibaba | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| Mistral Small 3.2Mistral | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| GLM 5.2Z.ai | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| DeepSeek V4 ProDeepSeek | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| Euryale 70BSao10K | Private, no limits | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| Kimi K3Moonshot | Private | DeepInfra, then OpenRouter as a fallback | Nothing, under their zero-retention commitments |
| Claude Fable 5.2Anthropic | Anonymized | OpenRouter, then Anthropic | No zero-retention route exists: Anthropic may keep the request under its policy |
| Claude Opus 5.5Anthropic | Anonymized | OpenRouter, then Anthropic | Nothing at OpenRouter; Anthropic applies its own policy |
| Claude Sonnet 5.5Anthropic | Anonymized | OpenRouter, then Anthropic | Nothing at OpenRouter; Anthropic applies its own policy |
| Claude Haiku 5.5Anthropic | Anonymized | OpenRouter, then Anthropic | Nothing at OpenRouter; Anthropic applies its own policy |
| GPT-6 AstraOpenAI | Anonymized | OpenRouter, then OpenAI | Nothing at OpenRouter; OpenAI applies its own policy |
| GPT-6.1 SolOpenAI | Anonymized | OpenRouter, then OpenAI | Nothing at OpenRouter; OpenAI applies its own policy |
| GPT-6.1 TerraOpenAI | Anonymized | OpenRouter, then OpenAI | No zero-retention route exists: OpenAI may keep the request under its policy |
| Gemini 4 ArgonGoogle | Anonymized | OpenRouter, then Google | Nothing at OpenRouter; Google may keep a request flagged by its abuse monitoring for up to 90 days |
| Grok 4.7xAI | Anonymized | OpenRouter, then xAI | Nothing at OpenRouter; xAI applies its own policy |
Auto uses private models; some exchanges go through an anonymized model, after masking. Auto’s private models: DeepSeek V4.1 Flash, DeepSeek V4.1 Flash, DeepSeek V4.1 Flash, DeepSeek V4.1 Flash, DeepSeek V4.1 Flash, DeepSeek V4.1 Flash, DeepSeek V4 Flash, DeepSeek V4 Pro, GLM 5.2, NeverNo Uncensored, Qwen 3.5 35B, and Mistral Small 3.2. Outside those exchanges and the political questions below, an anonymized model only answers if you choose it, or if you click the suggestion to ask it under a reply. On some political questions that Chinese models refuse, Auto answers with Claude (Anthropic), an anonymized model, after masking and on zero-retention hosts, instead of DeepSeek, GLM, Kimi or Qwen.
The Studio goes through Runware. Descriptions leave our server with no identifier. This table is generated from the code too.
| Model | Type | Hosted by | Note |
|---|---|---|---|
| Z-Image TurboTongyi | Image | Runware | Sent straight back to your browser |
| FLUX 3 KleinBlack Forest Labs | Image | Runware | Sent straight back to your browserfiltered by its makeranonymized |
| NeverNo UncensoredZ-Image | Image | Runware | Sent straight back to your browser |
| Z-ImageTongyi | Image | Runware | Sent straight back to your browser |
| Qwen Image 2.1 TurboAlibaba | Image | Runware | Sent straight back to your browserfiltered by its maker |
| Qwen Image 3.0 ProAlibaba | Image | Runware | Sent straight back to your browserfiltered by its maker |
| FLUX 3Black Forest Labs | Image | Runware | Sent straight back to your browserfiltered by its maker |
| Nano Banana 2.1Google | Image | Runware | Sent straight back to your browserfiltered by its makeranonymized |
| GPT Image 2.6OpenAI | Image | Runware | Sent straight back to your browserfiltered by its makeranonymized |
| GPT Image 2.6 FlareOpenAI | Image | Runware | Sent straight back to your browserfiltered by its makeranonymized |
| Muse ImageMeta | Image | Runware | Sent straight back to your browserfiltered by its makeranonymized |
| LTX 2.3 FastLightricks | Video | Runware | Placed on Runware’s CDN, from where your browser downloads it |
| P-Video 2 ProPruna AI | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| MiniMax H3 MaxMiniMax | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| HeyGen Video 1HeyGen | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| Veo 3.1 FastGoogle | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| Kling 4.0 FlashKuaishou | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| Wan 3.0Alibaba | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| Seedance 2.5ByteDance | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| LTX 2.3Lightricks | Video | Runware | Placed on Runware’s CDN, from where your browser downloads it |
| P-Video 2 ProPruna AI | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| Veo 3.1 LiteGoogle | Video | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its makeranonymized |
| ACE-Step 1.5 TurboACE Studio | Music | Runware | Placed on Runware’s CDN, from where your browser downloads it |
| ACE-Step 1.5ACE Studio | Music | Runware | Placed on Runware’s CDN, from where your browser downloads it |
| MiniMax Music 2.6MiniMax | Music | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its maker |
| Seed Audio 1.0ByteDance | Sound effect | Runware | Placed on Runware’s CDN, from where your browser downloads itfiltered by its maker |
| Mirelo SFX 1.5Mirelo | Sound effect | Runware | Placed on Runware’s CDN, from where your browser downloads it |
A AES-256-GCM key created by your browser, non-extractable, and a random 12-byte vector for each piece of content. Text is encrypted before it is written, and decrypted only to be shown. Everything goes through the browser’s Web Crypto API, with no third-party library.
Your passphrase becomes a key through PBKDF2-SHA-256: 600,000 iterations, with a random 16-byte salt. The whole file is then encrypted with AES-256-GCM. The passphrase never leaves your browser, and the file goes straight to storage through a signed link.
Without the passphrase, nobody can open the file, us included: a wrong passphrase is simply refused. If you forget it, the backup is lost.
Each link has its own AES-256-GCM key, created in your browser. We only receive the encrypted text; the key is written after the link’s #, a part browsers never send to a server. Whoever has the full link can read it; we cannot.
The link expires after 1, 7 or 30 days, or as soon as you delete it.
Here is the code that encrypts in your browser, as it is in our repository when this page was built. Nothing is summarized or rewritten: these are the files themselves, read-only.
/** * Local-only encryption for the Zero-Log store. * * One AES-256-GCM key per browser, generated on first use as a non-extractable * CryptoKey and kept in IndexedDB: it never leaves the device and cannot be read * back as raw bytes, even by our own scripts. */import { requestPersistentStorage } from "./storage";export type Sealed = { v: 1; iv: Uint8Array<ArrayBuffer>; ct: Uint8Array<ArrayBuffer> };const encoder = new TextEncoder();const decoder = new TextDecoder();export type KeyStore = { load: () => Promise<CryptoKey | undefined>; /** Stores the key unless one is already there (the first stored wins). */ save: (key: CryptoKey) => Promise<void>;};let keyPromise: Promise<CryptoKey> | null = null;let activeStore: KeyStore | null = null;/** Point the module at the table that holds the key. Called once by the database. */export function configureKeyStore(store: KeyStore) { activeStore = store; keyPromise = null;}
Our repository is still private. A public repository will follow, so you can compare this code with the code your browser runs.
No need to take our word for it: your browser’s developer tools are enough (F12, or right-click then “Inspect”, on a computer).
Application tab (Chrome, Edge) or Storage (Firefox), then IndexedDB › neverno › messages. The content field of each message is a { v, iv, ct } object: unreadable bytes. In keys, the key shows extractable: false.
Network tab, then send a message: one chat request leaves, with the current conversation and your current settings. No other conversation leaves.
Memory on: two memory requests then send this last exchange to pick out the facts to remember. New conversation: one chat/title request also sends your first question and the start of the reply, once, to give it a title. Suggestions on (Settings, Content): after a reply, one chat/follow-ups request sends your last question and the start and end of the reply, to suggest what to ask next; nothing is kept. Sync on: sync/push and sync/pull requests carry items your browser has encrypted, whose ct field is unreadable. Your session cookie goes with each of them, the chat request included, as on any site where you are signed in.
Open a share link with the Network tab open: the shares/… request only holds the link’s id. What follows the # appears nowhere.
On neverno.ai, the page’s Content-Security-Policy header lists the only addresses it is allowed to contact: our servers, Supabase, the Runware CDNs for your media, Cloudflare for the anti-bot check, and two addresses reserved for the Confessional’s real-time voice conversation (api.elevenlabs.io and our server rt.neverno.ai), listed ahead of time: as long as that feature is not open, the page never connects to them. No third-party analytics, no ads.
What NeverNo’s privacy does not do, or not yet:
Every change that touches your privacy, dated. Part of the facts on this page (models, providers, durations, encryption parameters) is checked by automated tests: if the code changes, they fail until the page is corrected.
#; images are encrypted in them with the same key.