Privacy Policy - Not-Meta

Not-Meta is an independent modular platform environment operated by an independent solo developer through not-meta.com (“we”, “us”, “our”). This privacy policy explains how we collect, use, share, secure, retain, and delete information when you use Not-Meta, sign in with Google, or use connected Not-Meta features. Not-Code Studio and Not-Code mobile native are parts of the wider Not-Meta environment and not the primary public brand.

Not-Meta is an independent modular environment that combines developer tools, AI workflows, cloud virtual-machine dashboards, creator profiles, STARS, Channels, Aphantasia workflows, Sigma Gaming experiments, Not-Code tools, and creator-support features such as LOVE.

Not-Meta is operated by an independent solo developer through not-meta.com.

• Google account email - used for authentication and account identification.
• Email address - the Google account email address, used to identify the correct Not-Meta account.
• Google account name or display name - collected if provided by Google.
• Display name - the Google profile display name, collected if provided by Google.
• Google account profile image - collected if provided by Google.
• Profile image - the Google profile image URL or avatar, collected if provided by Google.
• Google account identifier - the unique Google account identifier required for authentication.
• OAuth session data - used only when required to keep the user signed in or provide user-requested Google-authenticated functionality.

For normal Google Sign-In, Not-Meta does not retain Google OAuth access tokens or refresh tokens.

• Account and profile information - account settings, dashboard state, profile data, XP progression, creator features, and related platform preferences.
• GitHub OAuth data - collected only when you choose to connect GitHub for Copilot, Git, or development workflows.
• Email login data - collected when you sign in using email-based authentication through not-meta.com.
• User-provided API keys or tokens - used only for the integrations or features you configure.
• Local workspace data - Not-Code workspace files, code, and repositories are handled according to the specific Not-Code feature you use.
• Usage, security, and diagnostic data - logs, crash reports, Play Integrity attestation, and operational data used to secure and improve Not-Meta.

• Authenticate users with Google Sign-In.
• Create, identify, and secure user accounts.
• Identify the user inside Not-Meta.
• Provide dashboard, profile, and platform access.
• Prevent abuse and protect sessions.
• Enable user-requested Not-Meta functionality across connected modules.

• We do not sell Google user data.
• We do not use Google user data for targeted advertising, retargeting, interest-based ads, credit-worthiness, lending, data brokerage, or information resale.
• We do not use Google user data to train AI models.
• We do not transfer Google user data to third parties except when necessary to provide, secure, or enable user-requested functionality.

We share or process data only as needed to operate, secure, and provide Not-Meta features:

• Google - used for authentication and Google Sign-In.
• Infrastructure, security, and diagnostic providers - may process limited operational data only to operate, secure, or improve Not-Meta.
• Third-party AI providers - contacted only when you configure or request those integrations.
• User-provided API keys and tokens - handled according to the specific feature or integration you choose to use.

• Encryption in transit through HTTPS.
• Access controls for account and operational systems.
• Session protection and abuse-prevention controls.
• Limited internal access to personal or operational data.
• Secure storage practices where applicable for tokens, sessions, and account data.

We retain data only as needed for account access, security, legal compliance, and platform operations.

• You can request account or data deletion by contacting privacy@not-meta.com.
• You can revoke Google OAuth access from your Google Account security settings.
• Account deletion removes or anonymizes account-associated data unless retention is required for security, abuse-prevention, legal, or operational reasons.

Our desktop-first application, Not-Code Windows, operates on a local-first model to respect your privacy and secure your intellectual property:

• Local Code Isolation: Your source code, terminal sessions, Git repositories, and local configurations are stored and processed exclusively on your local machine. They are never uploaded, analyzed, or stored on our servers.
• Secure Local Storage: Session tokens and GitHub access credentials obtained via GitHub OAuth are saved securely in your operating system's native credentials keystore and are only used locally to access the GitHub and Copilot APIs on your behalf.
• Opt-In Secure Pairing (Host Mode): When pairing your Windows PC with our mobile native application, connections require verification of a random 6-digit PIN and enforce a strict same-account check, allowing connection only between devices logged into the exact same Not-Meta account.
• Gateway Relay Security: Session traffic bridged over our Not-Meta Gateway Relay is fully encrypted end-to-end. We do not inspect, log, or persist any of the command execution or session data that passes through the relay servers.
• Local Audit Logs: An offline, append-only audit log of all remote host activities is kept on your computer. This file is local, never uploaded, and is automatically capped at 1,000 entries.

For privacy-related inquiries, contact us at privacy@not-meta.com.