Privacy

Who we are

nth Labs is in beta. The operator of nth Labs is the data controller for everything described below, and the way to reach them is hello@nthlabs.dev. There is no registered company name or postal address to print here yet. When there is one, it will be published here.

There is no data protection officer, because the law does not require one at this size. The address above reaches whoever decides what happens to your data.

What is stored, and where

Self-hosted or local: everything stays on your machine or your server. Your account email, a scrypt hash of your password and never the password itself, your API key, and every finding, verdict, guard and screenshot. We never see any of it. There is no telemetry and no analytics.

The sign-in recipe is also stored. If you configure agents to test past your product’s login, the test account’s email and password you typed are saved with that project, as they have to be for a browser to sign in with them on every run. Give that recipe a disposable test account, never a real user’s. Deleting the project deletes the recipe.

On a hosted console: the same data lives on that console’s disk, one directory per account, which is a boundary rather than a database row. Other accounts cannot read yours. The hosted beta runs on Railway, so that disk is a Railway volume, held under Railway’s own security terms, as this website is held under Vercel’s. The hosted console also keeps usage statistics about how it is used, and records whether you chose research use.

In a shared workspace: the projects, findings and stored keys belong to the workspace rather than to whoever typed them. Every member can see them at the level their role allows, and a run any member starts spends the workspace’s plan, not their own. If that is not what you want, stay in a personal workspace, which is what you get by default and what you have unless somebody invites you.

What is sent to AI providers

When a check needs judgement, screenshots and page text of the product you configured are sent to a third-party AI provider’s API, such as OpenAI’s, under that provider’s data terms: on the hosted console, the provider we route the check to, on our key; on a copy you run yourself, the provider of the model you picked, on your key. Page health and Regression check call no model at all: they measure in a real browser.

The report is always free to run, but it can still send data. Inside the free Quick check it calls nothing. Run on its own with a model key in reach (ours, on the hosted console), it adds a written review on top, and that call sends a digest of what it reviews: your finding titles and severities, each check’s score and headline, and the titles of the ones you fixed. No screenshots and no page text. A finding’s title was written by a model that had just read your pages, so it carries some of that with it.

The product reading is the short description of your product that the console keeps. After a run with a model key in reach, when what the runs recorded has changed, one call rewrites it from that record: your product’s description, page paths and titles, finding titles and run headlines. No screenshots. The free Quick check never makes that call.

The Deploy gate is not on that list. The gate runs other checks on your behalf, and by default those are Site review and the launch readiness check, both of which call a model.

On the hosted console we choose which AI provider and model handle each kind of check; it is not a setting on your account. Today that is OpenAI. Whichever it is, what is sent is your product, not information about you. If a run is signed into your product, whatever that test account can see may be in a screenshot, so point runs at staging and give them a test account with limited permissions.

If you connect an editor or an assistant

nth Labs can be added to Claude Code, Cursor, Codex, or Claude in a browser, as an MCP connector. When you do that, you are pointing another company’s assistant at your ledger. This section describes that data flow.

A connected assistant acts as your account: reading what you can read (your findings, your run history, your readiness scores, the fix prompts) and starting runs, which spend whatever your runs spend. Everything a connector reads travels to whoever operates that assistant and is handled under their terms, not ours: Anthropic for Claude, the vendor of whichever editor you chose otherwise. We are not a party to that transfer and cannot see it.

What a connector cannot reach: your password, your stored secrets, your product’s stored test-account sign-in, and any other account’s data. None of these is on the connector’s surface: the tools cannot return them at all.

The credential is a token you create yourself in Settings → Editor, or an authorisation you grant on a consent screen that names the app and where it will send you. Either can be revoked in the same place, and revoking stops it working from the next request. If you would rather no third-party assistant saw a particular product’s findings, keep that product in its own project and do not connect an assistant while it is the active one.

There is one narrow exception, for Chat. If the console operator has configured a chat model that costs nothing to run, the questions you type into Chat are answered by that model, and the text of the question goes to whoever hosts it, which is another third-party AI provider. Runs never take that path, because a run sends screenshots of an unreleased product.

Paying for a plan or a top-up involves one more party. The payment happens on Stripe’s own checkout page, so your card details go to Stripe and never touch this console. What is stored here is the ledger entry your payment authorised: an amount, a time, and which account it belongs to.

Who else processes your data

This is the complete list for the hosted service. An AI provider only receives anything when a check that needs a model runs.

The last column is where each company is based, not where a particular piece of data is stored. A host’s region is a deployment setting; where the company is based decides whose law reaches it.

Two more parties are involved only if you choose them. Signing in with Google or GitHub tells that provider you are signing in here, and tells us your email address and whether the provider has verified it. We receive nothing else, and get no access to anything else in your account there. If you sign in with a password instead, neither is involved.

If you run the software yourself, the only party in this table is your model provider, because no console of ours is in the path.

Usage statistics, on the hosted console

To see which parts of the product work and to report honestly on how the business is doing, the hosted console counts how it is used. For each account: the days it was used, and for each day how many checks ran, who started them (you in the console, your coding agent, the schedule or a deploy) and which checks they were. That is all. Never page text, findings or screenshots, never the address of what you test, never your IP address or browser, and never your email: the statistics file holds an account number and those counts.

• Only after you agree. Nothing is counted for an account until it has agreed to the current version of these terms, at sign-up or from the notice the console shows once.
• Off when you say so. Settings, then Account, then Your data. Switching it off deletes what was counted, at once.
• Counted on our own server. No analytics company, no tracking script and no cookie is involved, and the counts are shared with nobody.
• Kept 13 months, then deleted, and deleted at once with your account.
• Never on a copy you run yourself. Self-hosted and local copies count nothing and send nothing.

Research use, only if you opt in

A separate box at sign-up and in Settings lets you allow nth Labs to use anonymised results from your checks to measure how accurate it is and to make it more accurate: which kinds of problems were found, how serious they were, whether fixes held, and, if you connect your revenue or analytics, how the forecasts compared with what happened. Your product’s name, addresses, page text, screenshots and any personal details are removed first.

• Off unless you tick it. Research use is never part of agreeing to these terms, and saying no changes nothing else about the product.
• Yours to withdraw in Settings at any time, and nothing new is used after that. Results already anonymised and folded into accuracy figures cannot be traced back to you, so they stay in those figures.
• Never sold, never shown to anyone in a way that identifies you or your product, and never handed to an AI provider to train its models.
• What is used today. For accounts that opted in: the forecasts sealed in the Lab and the real months scored against them, reduced to counts (how many months landed inside each range, and how far ahead each forecast was sealed) and added up across accounts. Only the operator sees those totals for now. Nothing about your product, your figures or you leaves your account, and anything else will be listed here before it is used.

Cookies

This website sets no cookies at all, first-party or third-party.

The console sets the ones below, and only while each is needed. Each is first-party, strictly necessary and HttpOnly, so no script can read it. There is no analytics cookie, no advertising cookie and no third-party cookie anywhere in the product.

• nth_sid: your session. SameSite=Strict, and Secure on any connection served over HTTPS, which the hosted console is. Twelve hours, extended while you are using it. Set when you sign in, cleared when you sign out.
• nth_oauth: set only while you are signing in with Google or GitHub, for ten minutes, scoped to the sign-in routes alone. The cookie holds a random value that is compared when the provider sends you back; without it, somebody could complete a sign-in in your browser as themselves.
• nth_join: set only when you follow an invite link to a shared workspace, for thirty minutes. The cookie carries the invite across the sign-in you have to do first.
• nth_agreed and nth_research: set only while you sign up with Google or GitHub, for ten minutes, scoped to the sign-in routes. They carry the boxes you ticked across the trip to the provider and back, so your agreement lands on the account that is created.
• nth_link: set while a Google or GitHub sign-in is under way, for ten minutes, scoped to the sign-in routes. When you are already signed in, it connects the provider to your account instead of creating a new one.

There is no cookie banner because there is nothing to ask you about. Every one of these is needed to do the thing you just asked for, which is the exception the rules already make.

What is never collected

No tracking pixels, no third-party analytics, no session recordings of you, and no sale or sharing of data with anyone. Your product’s findings are not training data, and they are used for research only if you opt in.

Legal basis for processing

Under the UK and EU rules, processing needs a lawful basis. Three are used here.

• To do what you asked: your account, the runs you start, the findings they produce, any key you stored so they can run, your plan and your invites. This is the contract between us, and refusing it would mean refusing the product.
• Because the law requires it: the billing ledger. A record that a payment happened has to survive for bookkeeping, whatever it paid for.
• To keep the service running and secure: sessions, a count of failed sign-ins against an address, the server’s error log, and the audit line written when something happens that cannot be undone by looking at it. Our legitimate interest is keeping other people out of your account. Weighed against you it is narrow: none of it profiles you, none of it is sold, and the audit log refuses by field name to record a password, a hash, a token or a key.
• To understand how the product is used: the usage statistics above. Our legitimate interest is seeing which parts of the product work, fixing the ones that do not, and reporting honestly on how the business is doing. Weighed against you it is narrow: counts only, no content, shared with nobody, kept 13 months, and switched off in one click, which deletes them.

Consent is used for one thing: research use, which is off unless you tick its box and which you can withdraw at any time. There is no marketing list and no cookie that needs asking about.

How long it is kept

• Your projects, findings, verdicts, guards, screenshots, stored keys and sign-in recipes: until you delete them. There is no time limit, because your findings history is the product’s memory of your product.
• A deleted account or project: the record goes at once; the files wait thirty days. See below, because this page used to say otherwise.
• Sessions: twelve hours, extended while you are using the console. Signing out ends the session immediately.
• Failed sign-ins: the email address that failed and a count, kept until an hour has passed since the last failure or since a lockout ended, which is what makes guessing a password slow.
• Your IP address, for two jobs: rate-limiting failed sign-ins and throttling sign-ups, both of which need to know that many attempts came from one place. The address is written to the console’s sign-in records, beside the email address a failed sign-in typed, and removed once an hour has passed since its last attempt or lockout, the next time the console updates those records. Nothing else uses it. A correction: this page used to say the address was held in memory only and never written to disk. The code writes it, so the page now says so. Under GDPR an IP address is personal data.
• The server’s error log: the last hundred errors, each a time, a place in the code and a message. No account, no address, no request body.
• The audit log: kept with the console’s state, rotated at 4 MB with one previous generation. The log records who did what and when, by email, and refuses secrets.
• Backups, where the operator has configured them: encrypted before they leave the box, the last thirty nights plus one a month for a year.
• The billing ledger: seven years after the payment, the outside edge of the bookkeeping rules that could apply. An amount, a time and an account. Never a card number, because we never have one.
• Usage statistics: 13 months, then deleted. Deleted at once when you switch them off or delete your account.
• Your research choice: whether you ticked the box, and when, kept with your account for as long as the account exists.
• Email you send us: until you ask us to delete it.
• This website’s request logs: Vercel’s, under Vercel’s retention rather than ours.

Deleting everything

Settings, then Danger zone, then “Delete my account” removes your account record, every project, and anything stored on it. The record is removed from every live path at once, and every session signed in as you stops working. Single projects can be deleted the same way.

A correction: this page used to say “immediately and unrecoverably”, and the software has since changed. The files are not erased at once. They move to a bin on the console’s disk and are deleted thirty days later, so that a deletion made by mistake can be undone. Nothing reads them while they wait, and labs undelete is the only thing that can bring them back. If you want them gone sooner than thirty days, ask and they will be.

The bin is not the last copy. Backups are taken nightly, and the retention on them is the last thirty nights plus one a month for a year. So for up to a year after you delete something, a copy of it exists inside a backup archive: not readable by the console, not restorable to your account selectively, and only touched if the whole service has to be rebuilt after a disaster. Those archives age out on the schedule above, and that is when the last copy goes. If you need a deletion that reaches the backups too, ask, and it will be done by hand.

Until you delete it, data is kept, and there is no automatic retention window. The one thing that outlives an account is its billing ledger: a record that a payment happened has to survive for bookkeeping, though everything it paid for is gone.

Where data is stored and transferred

If you run nth Labs yourself, the only transfer is the call to your model provider. The findings are files on your disk, in whatever country your disk is in.

Use the hosted console and your data is on Railway, model calls go to whichever provider the run’s model belongs to, payments go to Stripe, and these pages come off Vercel. Every one of those is American except Mistral, which is French. nth Labs is operated from Toronto, Canada, so for Canadian users this is the disclosure PIPEDA asks for: your data is stored and processed outside Canada, in the United States, and while it is there it is subject to the laws of that country, including lawful access by its authorities. If you are in the EU or the UK, work on the same basis.

The lawful route for those transfers is each provider’s own published data processing terms, which incorporate the European Commission’s Standard Contractual Clauses, and in some cases that provider’s certification under the EU–US Data Privacy Framework. There is no separately negotiated agreement with any of them. If your organisation needs one, check this before you sign up.

Your rights, and how to use them

You can exercise two of them yourself, at any time. Reports export as a single HTML file from the console, and labs contracts export writes your guards out as standalone Playwright specs from the command line, so you can take a copy without asking us. To delete everything, go to Settings, then Danger zone; no request is needed.

Nothing here is ever sold, and nothing is shared for advertising. There is no advertising relationship to share it with.

In the EU or the UK

• Access: a copy of everything held about you.
• Rectification: anything wrong, corrected.
• Erasure: all of it deleted. The Danger zone does this; asking works too.
• Restriction: we hold it and stop using it while something is in dispute.
• Portability: the data you gave us, in a form a machine can read. The exports are already that; ask and you get the rest.
• Objection: to anything done on legitimate interests, which are listed above.
• Withdrawing consent: nothing here runs on consent, so there is nothing to withdraw. Consent is listed for completeness.

No automated decision-making produces a legal effect on you. The models judge software, not people.

In California

• Know: what is collected, why, and who it reaches. This page is that answer and the table above is the list.
• Delete: the Danger zone, or an email.
• Correct: anything inaccurate.
• Opt out of sale or sharing: there is nothing to opt out of. No personal information has been sold, or shared for cross-context behavioural advertising, in the last twelve months or at any point before them. There is no “Do Not Sell” link because there would be nothing behind it.
• Limit the use of sensitive personal information: none is collected for any purpose this right restricts.
• No retaliation: using any of these changes nothing about your account, your price or your access.

How to make a request

Email hello@nthlabs.dev from the address on your account and say which one you want. That is the whole procedure; there is no form. You get an answer within thirty days, and usually the same week. If we ever need to check it is you, it will be something you can already prove from the account itself, never a photograph of your passport.

If you think we have handled your data badly, you can complain to a regulator without asking us first. nth Labs is operated from Canada, so the authority with oversight is the Office of the Privacy Commissioner of Canada (priv.gc.ca). In the EU it is your national data protection authority, in the UK the Information Commissioner’s Office, and in California the Attorney General or the California Privacy Protection Agency. We would rather hear it first at support@nthlabs.dev, but nothing here asks you to come to us before you go to them.

Children

You have to be 13 or older to create an account, which is what the terms say as well. Under 18, the person who agrees to those terms is a parent or guardian. Nothing here is built for children or aimed at them, and we do not knowingly hold anything belonging to someone under 13. If we find that we do, the account and its data go without waiting to be asked.

How your data is protected

The security page covers this in detail. Every measure below is in place today:

• One directory per account, not a row in a table. An account’s data lives under its own path, and the id in that path comes from the system’s cryptographic random number generator and is validated on the way in, so no id can walk out of the accounts root. A boundary, rather than a filter every route has to remember.
• Passwords are salted scrypt hashes, never plain text. scrypt is slow and memory-hard on purpose.
• State files are written owner-only, so nothing else on the box reads them.
• The session cookie is HttpOnly and SameSite=Strict, and carries Secure over HTTPS.
• Both surfaces send a Content-Security-Policy, and the console adds HSTS on a secure connection.
• A run cannot point a browser inward. The hostname is resolved first and the addresses behind it are judged, and loopback, link-local, private ranges and cloud metadata endpoints are all refused. The address the browser lands on is checked again.
• Sign-ins are rate-limited, with a lockout that escalates.
• The audit log refuses secrets by field name. A password, hash, token, key, cookie or session handed to it is dropped and the refusal written in its place.

We do not yet have a SOC 2 report, an ISO certificate, an independent penetration test, or a third-party audit of any of the above.

If something goes wrong

If your personal data is exposed, we email the address on your account with what happened, what of yours was in it, what has been done, and what you should do. Where the law sets a deadline (seventy-two hours to the relevant authority under the UK and EU rules) we work to that deadline, and we would rather send you an incomplete account inside it than a complete one afterwards.

To report a way into somebody else’s data here, write to hello@nthlabs.dev.

This website

The page you are reading is static HTML. There is no analytics script, no tag manager, no session recorder, no advertising pixel and no cookie of any kind. Nothing on it contacts a third party while you read it, and the fonts are served from this domain rather than a font CDN. There is no account and no login here.

The site is hosted on Vercel, which keeps ordinary server request logs the way any web host does. Those logs are Vercel’s, made in the course of serving the page, and we do not join them to anything or use them to build a profile of you.

If you email us

Writing to hello@nthlabs.dev, including to ask for beta access, means we hold your message and your address in our mail. We use it to reply to you and to run the beta. We do not sell it, rent it, or add you to a marketing list you did not ask for. Ask us to delete it and we will.

Changes to this policy

The date at the top shows when this policy last changed. If something material changes, whether that is a new party in the table above, something new collected, or a retention period moving in either direction, account holders are emailed before it takes effect. Corrections, like the one about the recycle bin, get a new date and no email.