Privacy Policy

1. Who we are

Nikko is a research-preview AI wellbeing companion built and maintained by Nicholas Dale. This Privacy Policy describes how we handle (or more accurately, do not handle) personal information in connection with your use of Nikko. This policy applies to the Nikko web application only.

As a research preview available to Australian users only, this policy is written in the spirit of Australian privacy norms. Because Nikko operates a zero-retention architecture — described below — there is very little data to govern in the first place.

2. Data we collect — summary

3. Conversation data

When you type a message to Nikko, that message is processed within your browser session. No conversation content is sent to or stored by any server operated by Nikko. Your messages exist solely in your browser's working memory and are irreversibly deleted when you close the tab, refresh the page, or click "Quick exit".

This design is a core architectural commitment, not a configuration option. It is enforced at the system level per our zero-retention model.

4. Session identifiers

When you enter the chat, a session identifier (contextID) is generated in your browser for the duration of the session. This identifier is used to associate messages within a single session only and is destroyed when the session ends. It is not linked to your identity and is not transmitted to any server in the current research preview version.

5. Local storage (browser)

Nikko stores two small items in your browser's localStorage:

• Theme preference (nikko.theme) — records whether you chose light or dark mode. Contains no personal information.
• Tutorial seen flag (nikko.tutorial.seen) — records whether you have completed the first-run tutorial. Contains no personal information.

These items are not transmitted to any server. You can clear them at any time through your browser's developer tools or privacy settings.

6. Mood diary

The Mood Diary panel stores your mood entries in sessionStorage. Session storage is cleared automatically when you close the browser tab or refresh the page. Mood diary data is never transmitted to any server and does not persist between sessions.

7. Personal Memory file (optional feature)

The Personal Memory feature is entirely optional. If you choose to use it:

• Your memory file is created, encrypted, and stored entirely on your own device.
• Encryption uses AES-256-GCM with a key derived via PBKDF2-SHA256 at 310,000 iterations from a password you set. This is performed by your browser via the Web Crypto API — no server is involved.
• The encrypted file is never transmitted to Nikko's servers. Nikko's servers never receive your password, your plaintext memory content, or the encrypted file.
• If you load a memory file into a session, its decrypted content is held only in browser memory and is destroyed when the session ends.
• You are solely responsible for safeguarding the memory file and your password. There is no password reset mechanism — a lost password means the file is unrecoverable.

We recommend you do not include identifying information (full name, date of birth, government IDs, contact details) in your memory file.

8. Third-party services

Nikko's interface loads React and Babel from unpkg.com (a public CDN). This means your browser makes requests to unpkg.com when you first load the application. Unpkg.com's privacy practices are governed by their own privacy policy. No conversation or personal data is transmitted to unpkg.com — the requests are for JavaScript library files only.

No advertising networks, analytics services, or tracking pixels are used.

9. Children's privacy

Nikko is not intended for users under 18 years of age. We do not knowingly collect any information from minors. Access requires a self-attestation of age (18+) before the chat interface is accessible.

If you are a parent or guardian and believe a minor has accessed Nikko, please be aware that no personal data will have been stored — however, the conversation content may have been inappropriate for a minor. We recommend discussing age-appropriate mental health resources with young people.

There is no current plan to develop a minor-adapted access pathway. Nikko remains an adults-only service for the foreseeable future.

10. Your data rights

Because of Nikko's zero-retention architecture, we hold no personal information about you once your session ends. In practice this means:

• There is nothing to access, correct, or request deletion of from our systems — your conversation data was never stored.
• If you wish to remove your theme preference or tutorial flag, clear your browser's localStorage for this site.
• If you wish to delete your Personal Memory file, delete the .nikko-mem.enc file from your own device.

If you have a privacy question not covered above, please contact the developer directly (see §14).

11. Data security

By design, Nikko minimises security risk by not storing data. The primary data security commitments are:

• No server-side storage of conversation content
• Client-side AES-256-GCM encryption for the optional Personal Memory feature
• HTTPS enforced for all connections in production
• No third-party tracking or analytics that could expose usage patterns

As a research preview, Nikko has not undergone formal third-party security auditing. Use it accordingly and do not share highly sensitive personal information.

12. Use of information for AI training

Your conversation data is never used to train AI models — under any circumstances. This prohibition is a hard charter constraint (REQ-000-P01) and is not overridable by configuration, phase, or Director instruction. The AI model used by Nikko is trained exclusively on open-licence, pre-approved corpora with documented provenance.

13. Changes to this policy

This Privacy Policy may be updated as the research preview evolves. The version date at the top indicates when it was last revised. We will not retroactively change the policy in a way that affects data that was collected under a previous version — as we collect no persistent data, this risk is minimal.

14. Contact

For questions about this Privacy Policy or Nikko's privacy practices, please contact the developer:

Nicholas Dale
linkedin.com/in/equinox013 · equinox013.github.io