Privacy Policy

This Policy applies to nostr.build’s website, API, AI tools, and connected applications (the “Service”). It does not apply to the Nostr network itself, to relays you choose, or to third-party clients and websites that integrate with us — those have their own privacy practices.

Account information. We identify your account by your Nostr public key (npub) and an internal stable account identifier. We do not require your real name or email to create an account. When you log in with Nostr, we may read public profile data (such as your display name and avatar) from the Nostr network to display it back to you.

Media and content. We store the images, videos, and files you upload, along with technical metadata about them (such as file type, size, dimensions, duration, content hashes, and the time of upload). Files you upload may also contain metadata you have embedded in them.

Payment information. Paid plans are purchased through our payment processors - in Bitcoin via our self-hosted payment server, by card via Stripe, or in other currencies via a payment swap provider. We receive the transaction and subscription details needed to provision and renew your account (such as amount, plan, dates, and payment status). Card details are processed by Stripe and never touch our servers; we do not collect or store card numbers.

Usage and analytics. We collect aggregated and per-account usage data — for example, view and request counts, bandwidth, storage used, and feature usage — to operate the Service, show you analytics about your own media, enforce limits, and prevent abuse.

Technical and security data. Our infrastructure and CDN automatically log technical data such as IP address, user agent, request paths, and timestamps. We use this for delivery, security, rate-limiting, fraud and abuse prevention, and to block Tor, VPNs, or specific IP ranges where necessary to protect the Service.

Upload logs. For each upload, we create and keep a log entry that links the uploaded file and its URL to the uploader’s IP address (both the originating address and any forwarding-proxy address), Nostr public key (npub), browser user agent, and referring page. We retain these upload logs indefinitely so that we can identify content and respond to — and report it to — law-enforcement and other authorities when legally required.

Cookies and local storage. We use a small number of strictly functional cookies and similar local storage — for your login session and to remember your language preference. We do not use advertising or cross-site tracking cookies.

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Host, process, and deliver your Media, including through our content-delivery network;
• Authenticate you, provision paid plans, and process renewals and downgrades;
• Show you analytics about your own account and media;
• Detect, prevent, and respond to abuse, fraud, security incidents, and violations of our Terms;
• Scan for and respond to illegal content as described below; and
• Comply with legal obligations and enforce our agreements.

When you use AI Studio or other AI features, the prompts and Media you submit are processed by us and by third-party model providers (including Cloudflare, Stability AI, Modal, and RunPod) to generate or edit content. We track AI usage and credits associated with your account. Your use of these tools is also subject to the providers’ own terms and privacy policies.

We maintain a zero-tolerance policy for Child Sexual Abuse Material (CSAM). Media may be automatically scanned (for example, by Cloudflare AI) solely to detect CSAM. If CSAM is detected or reported, we will remove it, preserve evidence as required, report it to the National Center for Missing & Exploited Children (NCMEC) at missingkids.org and to law enforcement, and cooperate with investigations. For paid accounts, our staff do not manually view Media except as necessary to confirm an automated detection.

We do not sell your personal information. We share information only as follows:

• Service providers (subprocessors) that operate the Service on our behalf — see the list below;
• Public sharing that you initiate — for example, Media you make public or post to Nostr, and free uploads that may appear in public galleries;
• Law enforcement, regulators, or others when required by law, to respond to legal process, or to protect the rights, safety, and property of users, the public, or nostr.build; and
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We rely on a small set of providers to run the Service:

• Cloudflare — hosting, content delivery, storage, security, and automated CSAM scanning;
• Amazon Web Services (AWS), Hetzner, and iDrive e2 — servers, cloud infrastructure, and object storage for your Media;
• Stability AI, Modal, and RunPod — AI image generation, editing, and model inference for AI Studio;
• Microsoft Azure (Office 365) — our business email;
• our payment providers - Stripe, Inc. (card payments) and MakePay (payments in other currencies), alongside our self-hosted Bitcoin payment server - processing payments for paid plans; and
• NCMEC and law enforcement — only for mandatory child-safety reporting.

This reflects our principal providers; we may add or change providers to operate the Service.

We operate from the United States, and our providers process data in the United States and other countries. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States and other jurisdictions, which may have different data-protection laws than your own. Where required, we rely on appropriate safeguards for such transfers.

We keep your information for as long as your account is active and as needed to provide the Service. You can delete your Media at any time, and you can request deletion of your account. An account scheduled for deletion enters a 30-day period during which you can cancel it by renewing or upgrading; after that period, we purge your stored Media from our object storage. Some data is retained longer where necessary — for example, to comply with legal obligations, resolve disputes, enforce our agreements, or preserve evidence of illegal content (such as CSAM) as required by law. Residual copies in backups, caches, or CDNs may persist for a limited time until they expire or are overwritten.

Upload logs (described under “Information We Collect”) are an exception to the above: we retain them indefinitely — including after you delete the associated Media or your account — so that we can meet legal obligations and respond to law-enforcement inquiries.

We use technical and organizational measures designed to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your Nostr keys secure — anyone with access to your keys can access your account.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly in your account (for example, deleting Media, downloading a backup, or requesting account deletion), or by contacting us.

EEA / UK (GDPR). If you are in the European Economic Area or the United Kingdom, our legal bases for processing are: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service and prevent abuse); compliance with legal obligations (including child-safety reporting); and your consent where applicable. You have the right to lodge a complaint with your local supervisory authority.

California (CCPA / CPRA). If you are a California resident, you have the right to know, access, correct, and delete personal information, and to be free from discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

To make a request, contact us at admin@nostr.build or by Nostr DM. We may need to verify that you control the account (for example, via your npub) before acting on a request.

The Service is intended for adults (18+). We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

We may update this Policy from time to time. We will revise the effective date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect constitutes acceptance.

This Policy is drafted in English. We may provide translations for your convenience, but the English-language version is the sole authoritative and legally binding version, and it governs in the event of any conflict, inconsistency, or ambiguity between it and any translation.

Questions about this Policy or your data? Contact us at admin@nostr.build or by Nostr DM.