This policy says what Nenya does with the data in your projects: your model key, what stays on your device, what our servers keep, where it is held and how it is deleted. It sits alongside our Privacy Notice and Terms.
Nenya is run by GrantX Inc., a Delaware corporation doing business as Durable Intelligence and Durable Intelligence Labs. Questions go to contact@qwntl.com.
Your model key
- You bring your own key from OpenAI, Anthropic or Azure OpenAI. Nenya does not supply model access. When Nenya calls a model for your project, it sends the request from our servers to your provider with your key, and your provider bills you under its own terms.
- Keys are write-only. Once saved, a key is never shown again by the account page, the command line or the API. You see it as "OpenAI key ending 1234".
- The key itself is stored in Google Secret Manager, replicated in europe-west4 (Netherlands) and europe-west1 (Belgium). Our database keeps the label with the last four characters and keyed digests, not the key.
- Only the service that makes model calls can read a key: once to check it with your provider when you add it, and then for the calls your project's work needs.
- Removing a key revokes it at once and disables the stored copy. The stored copy is destroyed when its project is deleted.
What stays on your device
Setup adds Nenya's hooks and status line to the coding tools it finds, such as Claude Code and Codex. Those tools keep talking to their own model providers; Nenya does not route that traffic.
Hook events are written to a local journal in your user configuration folder (for example ~/.config/nenya on Linux). Unless you agree to share session data, hook events stay on your device.
What our servers keep
- Your account: email address, display name, the sign-in identifier from Auth0, and the revisions of the terms and privacy notice you accepted.
- Workspaces and projects: names, members and roles, and the revision of this policy each project was created under. Every project is created with EU processing and with cross-project learning off. The service accepts no other setting.
- Work: the work you set up, its criteria and allowances, decisions, results, receipts, briefings and cost records.
- Access: the devices and sign-in sessions you use.
- Product usage: events such as sign-ins, setup steps, sessions, feature use, errors and usage counts, linked to your account and used to improve Nenya. Never prompts, code, file paths or project content.
- Bug reports: when you choose to send one, your note and Nenya's own diagnostic logs with personal details removed, used to find and fix the problem.
- Session data, only if you agree to share it, at one of three levels:
- Metadata: session, folder, event and tool names and IDs.
- Session detail: also the tool kind, a summary of its arguments (at most 512 characters), paths within the project, outcome and exit code, and the Git commit, new commit IDs and changed file names.
- Prompts: also your prompts, cut to 4,096 characters.
Before anything is sent, your device removes credentials, tokens, email addresses and home-folder paths it recognises from that text. This matching works on known patterns and can miss things. File contents, tool output and transcripts are never sent.
For content in your projects, we act as your processor, as the Privacy Notice describes. We don't sell it and don't use it to train general-purpose models.
Keeping projects apart
Every table in our database has row-level security switched on and enforced. Each request runs as the signed-in person and can read only the workspaces and projects they belong to. Our application's database accounts cannot bypass these rules, and our services refuse to start if any table is missing them.
Where data is held and who processes it
| Provider | What it does | Where |
|---|---|---|
| Google Cloud | Application servers, PostgreSQL database (Cloud SQL), key storage, backups | europe-west4 (Netherlands); keys and backups also in europe-west1 (Belgium) |
| Temporal Cloud | Runs background workflows; keeps workflow history for 7 days | Google Cloud europe-west3 (Frankfurt) |
| Auth0 (Okta) | Sign-in | EU tenant |
| Product analytics provider | Product usage events | United States |
| Your model provider | Receives the model calls Nenya makes with your key | Chosen by you, under your agreement with them |
How long we keep it
- Shared session data: 90 days. After that it is deleted and replaced by a daily tally (event counts by type, times and a checksum). Data still needed for a project deletion in progress, a pending publication or a learning case in that project is held until that finishes.
- Everything else in a project: until you delete the project or your account.
- Backups: up to 30 days.
Deleting your account
Run nenya account delete. It lists what will be removed and asks you to type "delete my account".
- At once: your access, sessions, devices, tokens and worker bindings are revoked. Projects in workspaces where you are the only member are deleted.
- Within 24 hours: that primary data is erased, including project records, session data, results, receipts, briefings, the keys stored for those projects, your email address and your sign-in link.
- Within 30 days: the same data is gone from backups.
Some records are kept:
- An account tombstone: the account ID, its deleted state and these dates, so the ID is never reused. It holds no email, name or sign-in link.
- Work you created in workspaces you leave stays with those workspaces, attributed to the account ID only.
- Minimal service cost records and unresolved external effect identities stay for accounting and reconciliation. They hold no project content or provider key values.
You can read a deletion receipt with nenya account delete --status until primary erasure. Your Auth0 sign-in record is not removed automatically yet; email contact@qwntl.com and we will delete it.
Changes
When this policy changes, we publish a new revision here with its date. The account page shows the current revision when you add a key.
Contact
GrantX Inc. d/b/a Durable Intelligence Labs, San Francisco, California, United States