Last updated: 2026-09-07
This is a plain-language summary of Noku's service providers and data flows. It is not a signed data-processing agreement. The Privacy Policy describes user controls, retention and deletion limitations.
Arman Aralbayev, Almaty, Kazakhstan. Contact t3ch1ee@gmail.com.
| Provider | Role and information involved |
|---|---|
| Supabase / PostgreSQL | Structured synchronized library, study records, account-scoped operational records; legacy attachment storage cleanup |
| PowerSync | Synchronization of supported records between devices and the database |
| Cloudflare | Workers API processing, private R2 attachments and large-text objects, temporary podcast job/result storage, queues and quota state |
| Anthropic | Text generation and assessment inputs and outputs |
| OpenAI | Configured text assistance, audio transcription, speech synthesis and embeddings |
| AssemblyAI | Podcast audio URLs, audio fetched for asynchronous transcription and transcript artifacts |
| TranscriptAPI | Requested YouTube video IDs, transcript language and transcript retrieval |
| Google YouTube Data API | Requested video IDs and returned metadata |
| Firebase | Named and anonymous authentication, app usage and crash diagnostics |
| RevenueCat | Subscription identifiers, app-user identifiers and entitlements |
| Apple / Google stores | Store accounts, purchases and payment processing under their own terms |
| User-selected sites, feeds and connected import services | Requested URLs, network metadata and authorized imported content |
Named sign-in, anonymous service authentication, AI processing, online imports and Premium library sync are different flows. A guest can use an online feature without enabling library sync. Tutor turns and interview audio can be sent for feature processing even though they are excluded from library sync.
The operator is in Kazakhstan and providers operate internationally, including in Europe and the United States. Noku does not make an EU-only storage or processing promise. Cloudflare can hold content at rest; it is not merely a stateless routing service.
Depending on applicable law and the processing purpose, relevant grounds may include consent, provision of the requested service, legitimate security/reliability interests and legal obligations. International transfers require the applicable safeguards and agreements. A published vendor DPA or an in-app consent toggle alone does not establish that every configuration and regional requirement has been satisfied.
Provider references include Anthropic, OpenAI, Google, and RevenueCat. Contact us for the safeguards applicable to your data request.
Noku does not train its own models on your learning content. Provider commercial data-use terms and account controls apply separately. OpenAI/Anthropic API terms must not be presented as assurances about AssemblyAI or every other service. Model-training controls are also separate from retention for delivering a service, diagnostics or safety.
In particular, Noku's podcast processing cache expires 24 hours after its latest write; that does not delete an AssemblyAI transcript. Asynchronous provider artifacts can persist until deletion or a configured expiry. Voluntary AI-output reports have a 90-day developer review window followed by scheduled purge, subject to outage delays. Neither uninstalling Noku nor expiring a cache guarantees deletion of all external copies.
See the Privacy Policy for provider references and retention details.
Use Settings → Account → Export my data or Delete account where available. Contact t3ch1ee@gmail.com for access, correction, deletion, restriction, portability, objections, withdrawal of consent or records associated with anonymous processing. An offline device may keep a local copy until it runs online and receives a confirmed deletion signal. Provider logs, backups and exported copies need separate consideration; deletion is not a universal instant-erasure guarantee.
Rights and available complaint procedures depend on applicable law. You may have the right to complain to your local data protection authority.