Legal

Nym Privacy Policy

Metonymous, Inc.
Effective date: September 2, 2026
Version: 2026-09-02

This Privacy Policy explains what information Metonymous, Inc. ("Metonymous," "we," "us") collects when you use Nym — our software, applications, browser extension, APIs, and related services (the "Service") — how we use and share it, and the choices you have. It is part of our Terms of Service. Capitalized terms not defined here are defined there.

Nym is unusual: your Nym is an AI agent that has its own email address, browser, and accounts, and that reads and acts on information at your direction. That means the Service handles more of your data, and more data about other people, than a typical app. This Policy tries to be specific about that.

1. Information we collect

Account information. Name, email address, password or passkey credentials, your mobile phone number if you use your Nym's phone features, and billing details handled by our payment processor (we do not store full card numbers for billing).

Your instructions and content. Messages you send to your Nym, files you upload or that your Nym creates, settings, permissions and approvals, and the "Soul" and other configuration you give your Nym.

Your Nym's activity. Because your Nym acts on your behalf, we collect and store records of what it does: task transcripts and reasoning summaries; emails sent and received at your Nym's own email address; web pages it visits and the content of those pages as needed to complete a task; actions taken in its browser or computer session; text messages sent and received at your Nym's own phone number, and written transcripts of phone calls it takes (calls are transcribed, not recorded); memory and notes it keeps to carry context between tasks; and approval requests it sends you.

Credentials and payment cards (Nym Vault). Login credentials you add or that your Nym creates for you, and payment cards you add, stored encrypted. See Section 5.

Purchase records. For purchases your Nym makes: merchant, items, amounts, delivery details, order identifiers, approval history, and outcomes. We do not store card security codes (CVV) after a purchase.

Connected accounts. If you connect a third-party account (for example Google Gmail, Calendar, Drive, or Sheets), we receive the data those services provide under the permissions you grant, and your Nym reads or acts on it only at your direction. See Section 4 for Google-specific commitments.

Location. During setup you may share your device location or an address so your Nym can use it for local tasks. You can skip this or change it later.

Device and usage information. Device type, operating system, app version, push-notification tokens, IP address, browser type, timestamps, feature usage, and diagnostic and error logs.

Information about other people. Your Nym's inbox receives email from third parties, and its browsing and tasks may involve names, contact details, or other information about people who are not our users. We process that information only to provide the Service to you and do not use it for any other purpose.

2. How we use information

To provide and operate the Service, including running your Nym's tasks, storing its memory, sending and receiving its email, and filling credentials and cards at your direction.
To send you approval requests, notifications, and service messages.
To process payments for the Service.
To secure the Service, prevent fraud and abuse, and audit sensitive actions such as credential release.
To debug, maintain, and improve the Service, including training and evaluating our own systems on aggregated or de-identified data. We do not use your content or your Nym's activity to train third-party AI models, and our AI providers are contractually restricted from doing so (Section 3).
To comply with law and enforce our Terms.

We do not sell personal information, and we do not use it for targeted advertising.

3. Who we share information with

We share information only with service providers that process it on our behalf under contracts restricting their use, and in the other limited cases below.

AI model providers. Your instructions, your Nym's context, and relevant content are sent to third-party AI model providers to generate your Nym's responses and actions. As of the effective date these include Anthropic (language models), OpenAI (embeddings for search over your Nym's memory and files), and Google (image generation for Nym avatars). We use these providers under business terms that prohibit them from training on your data and limit retention to what is needed to provide the service and enforce their policies.

Infrastructure and hosting. OVHcloud (dedicated servers in the United States that run the Service and your Nym's computer sessions), Google Cloud (database backups and file storage), Amazon Web Services (email delivery), and a cloud-browser provider (Kernel) that runs your Nym's browser sessions. Browser sessions may use third-party network proxies so that your Nym's traffic originates from a consistent, ordinary residential location.

Email, texts, and calls. Your Nym's email address is operated through transactional email providers (Resend and Amazon SES). Your Nym's phone number, its text messages (SMS, MMS, and iMessage), and its phone calls, including live speech-to-text transcription and text-to-speech, are provided by AgentPhone (Relay Innovations, Inc., New York), which does not use message or call content to train shared AI models. Messages and calls pass through that provider and the carriers so they can be delivered.

Connected-account integrations. When you connect a third-party account, an integration provider (Composio) and/or a credential broker (Keycard) may hold the authorization token and relay requests to that service on your Nym's behalf.

Payments. Stripe processes payments for the Service. Stripe's handling of your payment information is governed by Stripe's privacy policy.

Notifications. Push notifications are delivered through Expo, Apple, and Google push services using device tokens.

Merchants and websites your Nym uses. When your Nym creates an account, logs in, fills a form, or makes a purchase on a website at your direction, that website receives the information your Nym enters — which may include your name, address, a Nym-created or your own email address, credentials, and payment card details — and treats it under its own privacy policy. We do not control those sites.

Legal and safety. We may disclose information to comply with law, respond to lawful requests, protect the rights, safety, or property of Metonymous, our users, or others, or investigate fraud or security issues.

Business transfers. If Metonymous is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

With your direction. Whenever you tell your Nym to send or share something, we share it as directed.

We do not share personal information with third parties for their own marketing. No third party collects personal information about your activity across different websites through the Service, and the Service does not serve third-party advertising or tracking.

Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the sharing described above excludes text-messaging originator opt-in data and consent; that information will not be shared with any third party, other than the provider that delivers the messages and only to deliver them.

4. Google user data

If you connect a Google account, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data (such as Gmail messages, Calendar events, and Drive or Sheets files) only to provide and improve the user-facing features of the Service that you have chosen to use, at your direction.
We do not transfer Google user data to others except as necessary to provide those features (for example, to our AI model providers to generate your Nym's response to a message you asked it to handle), to comply with law, or as part of a merger or acquisition with notice to you.
We do not use Google user data for advertising, and we do not sell it.
Humans at Metonymous do not read your Google user data except with your consent, for security or abuse investigation, to comply with law, or on aggregated, de-identified data for internal operations.
We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

You can revoke our access at any time from your Google Account security settings or by disconnecting the account in the Service.

5. Credentials and payment cards

The Nym Vault stores login credentials and payment cards so your Nym can use them on your behalf without you retyping them.

Encryption. Stored secrets are encrypted at rest with keys that are themselves protected by keys managed outside the database.
The AI never sees them. Our architecture is designed so that the AI model never receives a stored password or card number. Secrets are released only for a specific, approved action, only into the browser page where they are needed, and are not written to logs, transcripts, screenshots, or analytics.
Card security codes. If a purchase requires a card security code (CVV), we collect it from you at the time you approve that purchase and do not store it afterward.
Access and deletion. You can see, label, and delete stored credentials and cards in the Service at any time. Revealing a stored password to you requires a fresh passkey or password confirmation, and every reveal is logged.
Audit. We keep an audit record of when a stored secret was created, released, revealed, rotated, or deleted, without recording the secret itself.

6. Security

We use encryption in transit and at rest, access controls, audit logging, and passkey-based authentication for sensitive actions. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you as required by applicable law, including Delaware's data-breach notification statute (6 Del. C. ch. 12B) and the laws of the state where you live.

7. Retention

We keep information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Your Nym's transcripts, memory, and email are retained so it can carry context across tasks; phone-call transcripts and message delivery records are kept for limited periods (currently 30 and 90 days respectively) unless you save them; you can delete individual items, and closing your account deletes your account data on our normal schedule, subject to backups that are purged on a rolling basis and to records we must keep by law. Audit records of sensitive actions may be retained longer in a form that does not include the underlying secret.

8. Your choices and rights

Access, correct, delete, and export. You can view and edit most of your information in the Service. You can delete stored credentials, cards, files, and conversations directly, and you can request a copy of your data or deletion of your account by contacting us at the address in Section 14. We will verify your identity before acting on a request and respond within the time required by applicable law.
Connected accounts. Disconnect any third-party account in the Service or from that provider's settings.
Notifications. Manage push and email notifications in the Service or your device settings.
Location. Remove or change your location in settings.
State privacy rights. Depending on where you live, you may have rights under state privacy law (for example, in Delaware, California, Colorado, Connecticut, Virginia, and others) to access, correct, delete, or obtain a copy of your personal information, to opt out of sales, targeted advertising, or profiling, and to appeal a denied request. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of; the other rights are available to every user through the process above, regardless of where you live. If we deny a request, you may appeal by replying to our response, and we will explain the outcome within 45 days.
Do Not Track. Some browsers can send a "Do Not Track" signal. Because the Service does not track users across third-party websites, we do not change our behavior in response to those signals. We honor Global Privacy Control signals as an opt-out of sale or sharing where applicable law requires it; because we do not sell or share personal information for advertising, this has no practical effect on how we treat your data.

9. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18, and anyone under 13 may not use the Service under any circumstances. If you believe a child has provided us personal information, contact us and we will delete it.

10. Where data is processed

We are based in the United States and process and store information there. The Service is offered only to users in the United States.

11. Third-party sites

Websites and services your Nym interacts with, and services you connect, have their own privacy practices. This Policy does not cover them.

12. Your Nym's phone number, texts, and calls

You can give your Nym its own phone number. It is a real number, allocated to your account and assigned to one Nym at a time; you can reassign or release it in the Service. With it, your Nym can text you and you can text it back, and it can answer or place phone calls.

Texting. The messaging program is Nym, operated by Metonymous, Inc. Messages between you and your Nym are one-to-one, conversational, and sent at your direction: task updates, answers to your questions, approval requests, reminders you asked for, and replies to what you send. They are not marketing messages, and Metonymous does not send promotional texts. Depending on your device, messages travel as iMessage or as SMS/MMS.

Starting. You start by texting your Nym's number, or by entering your mobile number in the Service and turning texting on. Agreeing to texts is never a condition of buying anything from us.
Frequency and cost. How often your Nym texts you depends on what you ask it to do. Message and data rates may apply.
Stopping. Tell your Nym to stop texting you in plain language, reply STOP to any message, or turn texting off in the Service. Your Nym will confirm once and will not text you again until you turn texting back on. Reply HELP, or contact us at the address in Section 14, for help.
Other people. Anyone can text or call your Nym's number, and your Nym texts other people only when you direct it to. Your Nym identifies itself, and anyone it texts can tell it to stop or reply STOP, and it will.

Calls. When your Nym takes or places a call, the audio is transcribed to text in real time so your Nym can respond, and its replies are converted to speech. We do not record call audio. The transcript is stored with your Nym's activity for a limited time (currently 30 days) unless you save it, and is handled as described in this Policy.

What we keep. Your Nym's number and its assignment history, your mobile number and when you turned texting on or off, the messages themselves, call transcripts, and delivery records with timestamps. Numbers you release are quarantined before reuse and are not reassigned to another customer immediately.

13. Changes to this Policy

We may update this Policy. We will post the revised version with a new effective date and, for material changes, notify you through the Service or by email before the change takes effect. Continued use after the effective date means you accept the revised Policy.

14. Contact

Metonymous, Inc. Email: privacy@usenym.com