Privacy Policy

Code Crafted Nexus LLC ("we," "us," or "our") makes N.O.V.A. (the Neural Operating & Visual Assistant), a voice- and chat-driven business assistant. This Privacy Policy describes how N.O.V.A. handles data, and is separate from our general Privacy Policy for our other desktop applications, because N.O.V.A. works very differently from those apps: it connects, with your explicit permission, to real business accounts you choose to link, and it uses cloud AI services to understand and respond to you.

N.O.V.A. only accesses the specific third-party accounts you choose to connect (such as Gmail or Google Ads). Connection credentials are stored securely on our servers, never on your computer. Your requests, and the account data needed to answer them, are sent to Anthropic's Claude API to generate N.O.V.A.'s replies and decide what to do next; if you use voice features, your speech is sent to OpenAI's API to transcribe or speak it. N.O.V.A. is built to never send money, spend advertising budget, send a message on your behalf, or change a live account setting without you explicitly confirming that specific action in the conversation first — reporting and read-only questions never require confirmation.

N.O.V.A. can connect to the following third-party accounts, only after you complete that provider's own sign-in and consent screen, and only for the scopes listed:

• Gmail — read-only access to recent messages, plus the ability to create drafts. N.O.V.A. cannot send email; every draft is left for you to review and send yourself.
• Google Ads — read access to campaign and performance data, plus the ability to pause or re-enable a specific campaign, and only after you explicitly confirm that exact change. N.O.V.A. never creates ads, changes bids or budgets, or takes any Google Ads action without that confirmation.
• TikTok Ads — read access to campaign and performance data, plus the ability to pause or re-enable a specific campaign, only after your explicit confirmation of that exact change, on the same terms as Google Ads above.
• Apple App Store Connect — read access to app listings, sales, and financial reports, plus the ability to reply to a customer review, only after your explicit confirmation of that specific reply.
• Paddle — read access to transaction and subscription data, plus the ability to issue a refund, only after your explicit confirmation of that specific refund.
• Google Play — read-only access to sales and earnings reports.
• Google Calendar — read access to your upcoming events, plus the ability to create an event on your primary calendar when you ask N.O.V.A. to schedule something.
• Google Search Console — read-only access to your website's search performance data.
• Google Sheets — read access to spreadsheets you choose, plus the ability to add rows, only when you ask.
• Google Drive and Google Docs — read-only access to find and summarize your own documents, and the ability to save a document you ask N.O.V.A. to create.
• Google Business Profile — read access to your business listing and reviews, where you connect it.
• Meta Ads (Facebook and Instagram) — read access to campaign and performance data, plus the ability to pause or re-enable a specific campaign, only after your explicit confirmation of that exact change.
• HeyGen — use of your own HeyGen account to create a video you ask for.

You can disconnect any of these accounts at any time; doing so immediately stops N.O.V.A. from accessing that account.

When you connect an account, we store the resulting access credentials (OAuth tokens) in our own database, protected so that only N.O.V.A.'s own backend can read or use them — they are never included in, or accessible from, the N.O.V.A. application itself, and are never shared with any other Code Crafted Nexus product. We do not store your third-party account passwords; the connection is made entirely through that provider's own OAuth sign-in flow, which we never see.

N.O.V.A.'s core assistant runs on Anthropic's Claude API. To answer your requests, N.O.V.A. sends your conversation, and any account data it retrieves through the connections above (for example, an email's contents, or a campaign's performance numbers), to Claude for processing. Per Anthropic's commercial API terms, you retain rights to what's sent and Anthropic does not train its models on this data. If you use N.O.V.A.'s optional voice features, your spoken audio is sent to OpenAI's API to be transcribed, and N.O.V.A.'s spoken replies are generated through OpenAI's text-to-speech API. Both providers act as our data processors for this purpose, governed by their own privacy policies:

• Anthropic's Privacy Policy
• OpenAI's Privacy Policy

N.O.V.A. is designed around one hard rule: it never sends money, spends advertising budget, sends a message on your behalf, issues a refund, or changes a live account or campaign setting unless you explicitly confirm that specific action, by name, in the conversation first. Asking N.O.V.A. a question, or asking it to look something up or draft something for your review, never requires this confirmation and never has any real-world effect on its own.

N.O.V.A. can open other applications on your computer and, if enabled, read or modify code in a project folder you designate, using Anthropic's Claude Code tool. Opening an application happens locally on your device and is never sent to us. Code changes are either made in a disposable preview copy (never touching your real files) or, for a real change, only after your explicit confirmation — the same confirmation-gated pattern described above.

N.O.V.A.'s "Hey N.O.V.A." wake-word listening, its window/appearance settings, and (when you choose your operating system's built-in voice instead of OpenAI's) its text-to-speech all run entirely on your own computer. None of this is sent to us or to any third party.

Smart home and machines. If you choose to connect Home Assistant, LightBurn, or a 3D printer (OctoPrint or Moonraker), the address and access token you enter are stored only on your own computer, in N.O.V.A.'s local settings. They are not uploaded to our servers. N.O.V.A. talks to those devices directly from your computer over your own network. When you ask about or control a device, the device names and states involved are included in that conversation and so are processed by Anthropic as described above. Actions that could be unsafe or hard to undo (unlocking a door, opening a garage, disarming an alarm, starting a laser or a print) always require an on-screen confirmation from you.

Camera gestures. Camera gestures are off until you turn them on in Settings. When on, your webcam image is analysed on your computer to recognise a hand pose. The video is never recorded, saved, shown, or sent to us or anyone else. The camera stops when the N.O.V.A. window is hidden, and you can turn the feature off at any time. Gestures never approve a send, a post, a payment, a lock, or a laser.

Screen vision. N.O.V.A. only looks at your screens when you ask it to (by voice, by typing, or with the monitor button), and only after you accept an in-app privacy notice, which is asked again each time N.O.V.A. is opened. When you ask, it takes one picture of each monitor (or only the one you name), shrinks and compresses it, and sends it with your question through our server to Anthropic's Claude API, using your own Anthropic API key. Our server passes the images along to answer that one question; we do not save, log or look at them, and N.O.V.A. does not keep them on your computer. Anthropic handles them under the terms of your own API account. The pictures include everything visible on those screens, which may be private or belong to other people. N.O.V.A. never watches your screens in the background, and it can only look: it cannot click, type or change anything.

Hand control and swipes. The camera gesture feature above also powers pinch-to-turn control of 3D models and open-hand swipes inside N.O.V.A.'s own windows. It works on the same on-device hand tracking: no video is recorded, saved or sent anywhere.

Parametric CAD and Stress Analysis. The part or structure you describe is processed by Claude like any other request. The shapes, sizes and loads are stored only in that conversation's document on your screen, and the geometry and stress calculations run on our server or your computer to produce the result. Stress results are estimates only and not engineering advice.

Stock watchlist. If you ask N.O.V.A. to watch a stock, the ticker symbol and your alert price are stored with your license so alerts can be checked while the app is open. Price data comes from public sources and is provided for information only. It is not investment advice.

N.O.V.A.'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we use it for. We use Google user data only to provide and improve the user-facing features you ask for inside N.O.V.A., such as reading and summarizing your inbox, drafting a reply for your review, showing your calendar, or reporting on your search performance.
• No sale, no advertising. We do not sell Google user data, and we do not use it for advertising, including retargeting, personalized or interest-based advertising.
• No humans reading it. We do not allow people to read your Google user data unless you give us your affirmative consent for specific messages or files, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.
• AI processing. To answer your request, the specific data needed for that request is sent to Anthropic's Claude API as our service provider. Anthropic does not train its models on it, and it is used only to produce your answer. We do not use Google user data to develop or train generalized AI or machine-learning models.
• Storage and deletion. Your sign-in tokens are encrypted on our servers. We do not keep copies of your email or files beyond what is needed to answer a request. When you disconnect an account, we delete its tokens immediately, and you can also revoke access at any time at myaccount.google.com/permissions.

Your conversation history is kept on your own device by the N.O.V.A. application, not stored permanently on our servers. Connection credentials for an account you've linked are kept until you disconnect that account or stop using N.O.V.A., at which point we delete them. We keep only what's needed to operate N.O.V.A. for you and to meet our own legal and recordkeeping obligations.

• We don't sell your data or your connected-account data, to anyone, for any purpose.
• We don't use your business data to train our own models, or grant any third party rights to train on it beyond the ordinary processing needed to answer your request.
• We don't take any action that spends money, sends a communication, or changes a live setting without your explicit, specific confirmation first.

N.O.V.A. is available to business Customers under the pricing options described in our Terms of Service, including a one-time license and a Managed Subscription. Customers on the Managed Subscription connect their business accounts through developer applications we register with each provider, rather than setting up their own — even so, your account data is used solely to operate N.O.V.A. for you. Each Customer's connected-account data, regardless of pricing option, is never shared with or made visible to any other Customer, and is never used for any purpose beyond providing the service to that Customer, consistent with this Policy.

You can disconnect any connected account at any time from within N.O.V.A. You may also request access to, correction of, or deletion of any connection data we hold about you by contacting us at the email below.

N.O.V.A. is a business tool, not directed at children, and we do not knowingly collect information from children.

We may update this Privacy Policy as N.O.V.A. adds new integrations or features (for example, additional ad platforms). We'll update the effective date above whenever we do, and material changes affecting how your data is handled will be called out clearly.

• support@codecraftednexusllc.com
• 160 Harris St, Grand Rivers, KY 42045

This policy is provided for general informational purposes and does not constitute legal advice. If you have questions about how it applies to your specific situation, or about data protection rules in your country or state, we recommend consulting an attorney licensed in your jurisdiction.