Privacy & Security

What we hold, where it lives, and the two buttons that prove it

Effective 2026-08-24 · v3

Niobe works because it knows you. That only holds if you can see exactly what it knows, take a copy, and destroy it — so this page ends with working buttons, not a promise to email someone.

What is stored, and where

Data	Where	Why
Account (email, sign-in)	Supabase (managed Postgres, encrypted at rest)	authentication
Onboarding answers	Supabase, row-level security — your rows are readable by your session only, enforced by the database (Postgres row-level security), with an automated probe checking the API's behavior hourly	they become your Niobe's brain
Notes, tasks, job history	Supabase, same row-level security	the work Niobe does for you
Your instance brain files	our operations server, isolated per customer directory	your Niobe's working memory
Chat messages	processed to answer you; the model provider (OpenRouter) processes but does not train on them per their zero-retention routing	conversation

What is NOT done

No selling or sharing of your data with advertisers or brokers — there is no ad layer here.
No training of any model on your content — not a shared model, and not a private one. Your instance is dedicated to you; what makes its answers yours is your own library, your profile and your corrections, used only for your instance.
Connected accounts are read with the narrowest scope that works (a mailbox is read-only: Niobe cannot send from it or delete in it), and every consequential action waits for your approval — the approval ledger is on your desk page.

Security, concretely

Transport is TLS everywhere; data at rest is encrypted by the storage providers.
Every code change ships through a gated pipeline: secret scanning (tree and full history), accessibility audit, workflow static analysis, dependency auditing, a signed SBOM with build provenance, and hourly behaviour checks against production — including a check that tries to read another tenant's data and must fail.
Security disclosures: email hello@heyniobe.ai with SECURITY in the subject — acknowledgement within 2 business days.

Who else processes it

Everyone below receives some of your data because a part of the product needs them to. Nobody else does, and this list is derived from the code that runs this site rather than written from memory — every name is a host something here actually calls.

Who	What they get	Why
Cloudflare	every request to this site, and the counters described above	hosting, and the cookieless analytics on this page
Supabase	your account, and the rows described above	the database and sign-in
Anthropic	the messages you send Niobe, and what it retrieved to answer them	the model that composes the answer
fal	the text of an answer you asked to hear aloud	speech synthesis
Google	only what you authorise when you connect a Google account, at the narrowest scope that works	connected accounts

None of them is permitted to train on your content, and none of them is sold access to it. We do not sell or share your data with advertisers or brokers, because there is no ad layer here to sell it to.

How long it is kept

Your account data is kept while your account exists. Delete the account and it goes in one cascading operation, with your instance files reaped on the next reconcile pass. There is no archive we keep afterwards and no soft-delete you cannot see.

Children

This is a product for work. It is not directed at children, and we do not knowingly collect anything from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

Changes to this policy

The version and date are at the top of this page. If we change what we do with your data in a way that matters, the version changes with it, and we will not apply a new version retroactively to data we already hold under the old one.

Asking us anything

Privacy questions, deletion requests, or a complaint go to hello@heyniobe.ai and reach a person. Hey Niobe LLC is a Texas limited liability company and is the one responsible for the data described here.

The short version, spoken: your data is yours, you can take it or destroy it, and Niobe only touches what you allow.

Your copy, your delete

Signed in? These act on your account immediately.

Deletion removes your account and every row keyed to it in one cascading operation, and your instance files are reaped on the next reconcile pass. It cannot be undone. If a button fails, email hello@heyniobe.ai and a human does it.