diff --git a/src/routes/nook/faq.tsx b/src/routes/nook/faq.tsx index 03d135a..bc3adef 100644 --- a/src/routes/nook/faq.tsx +++ b/src/routes/nook/faq.tsx @@ -1,8 +1,7 @@ /** * `/faq` on the Nook subdomain — answers to the objections that actually - * stop a purchase. Privacy scoping follows marketing/positioning.md rule 3: - * "no prompt or code content leaves the device" (telemetry and the trial - * email do leave — never claim "no data leaves the device"). + * stop a purchase. Privacy is deliberately absent until the egress + * inventory and /privacy make an honest answer possible. */ import { For } from "solid-js"; import { createSignal, Show } from "solid-js"; @@ -17,34 +16,46 @@ interface FaqEntry { const FAQ: FaqEntry[] = [ { - question: "Does The Nook read my prompts or my code?", + question: + "Does it work with my agent — and can I approve from the notch, or only watch?", answer: - "No. The hooks and plugins that connect your agents to The Nook send session metadata only — which agent is running, which session, which event happened, which terminal it lives in. No prompt text and no code content leaves your device. Two things do leave the device, and we'd rather say so plainly: anonymous usage telemetry, and your email address if you choose to give it at trial start. That's the whole list." + "It depends on the agent, and Cursor is the useful example. Cursor is watched, not gated: its sessions, finished turns and errors appear in the island, but when Cursor asks for permission the prompt stays in Cursor. That is deliberate — Cursor blocks the action when a permission hook runs and prints nothing, so gating it would override Cursor's own prompts. Other agents do hand the decision to The Nook, so a tool call waits and you tap Allow or Deny from the card. One limit: cursor-agent -p one-shot runs send no turn end, so they appear but do not get a completion card." + }, + { + question: "What happens when my agent is idle?", + answer: + "Idle means the last turn is over, or the session has not produced anything yet — not that the process is gone. A running process is liveness, not work: a just-opened agent window can show idle until you type. When an agent finishes a turn with a final message, the row stays green for ten minutes, then goes gray. A stale row is different: it means The Nook's integration cannot report for that session, and the row says so instead of pretending it is idle. Nothing is lost when a row goes idle — the next prompt brings it back and flips it to running. The row itself leaves the island 15 minutes after the turn (5 if the turn ended without a reply), so a long-quiet session reappears on its next event instead of sitting there. If a session that is obviously working says idle, that is a bug; tell us." + }, + { + question: + "What permissions does it need — and what does it write into my agent's config?", + answer: + "The app itself runs unprivileged. Fan control and charge limiting go through a small helper that macOS requires to run as root for hardware access; the app registers it on first use and takes you to System Settings › General › Login Items & Extensions, where you switch it on once. For each agent it adds what that agent needs — a hook group per event it listens to, or one plugin link — inside the agent's own config file or directory. It keeps its own files under ~/.nook — the hook binary and one plugin copy per agent — and adds only its own entries to that agent's config. A hook entry you added yourself in the same file survives install and uninstall, and it only touches the records and switches it created. Uninstall removes exactly what it wrote — and switches off what it turned on — with no leftover links or orphaned files." + }, + { + question: "Does it work with my terminal, including tmux?", + answer: + "Yes — it recognises Terminal.app, iTerm2, Warp, Ghostty, kitty, WezTerm and tmux. Four of those take a typed reply; the rest are watched. A session is tied to the terminal that started it. Jump lands in the right window for Terminal.app, iTerm2, kitty and any tmux pane — in tmux, the right pane; on Warp, WezTerm and Ghostty it brings the app forward instead. Replies type straight back into Terminal.app, iTerm2, kitty and any tmux pane; on Warp, WezTerm and Ghostty you answer in the app's own window, and Alacritty takes no typed reply from another app at all." }, { question: "Do I need a Mac with a notch?", answer: - "No. On a notched MacBook the island sits in the notch. On machines and displays without one, it anchors to the display your cursor is on, so a desktop setup with external monitors gets the same treatment. Everything inside the island — agent cards, fan control, the stats strip — works identically either way." + "No. On a notched MacBook the island sits in the notch. On machines and displays without one, it sits at the top centre of the display — the same pill with the same slots. You get one island on every display it is turned on for (all connected displays on first launch), each anchored to the top of its own screen; Settings › Displays trims that list, and the pointer only decides which display's floating controls are live. Everything inside the island — agent cards, fan control, the stats strip — works identically either way." }, { question: "How much battery does it cost?", answer: - "The Nook is a small native UI, not a background agent — it watches the agents you're already running; it doesn't run anything itself. The heaviest thing it does is read and write your Mac's fan and charging controllers, which is a lightweight sensor read. If you're running enough coding agents to need it, those agents dwarf the app's own draw." - }, - { - question: "What permissions does it need?", - answer: - "The app itself runs unprivileged. Fan control and charge limiting go through a small helper component that macOS requires to run as root for hardware access — the app installs it on first use and you approve it once with your password. The hooks live in each agent's own config directory; you can inspect or remove every file it writes." + "It is a native app, not a background agent. It watches the agents you already run and never runs them in the background, so their draw is the number that matters. We do not have a published battery measurement for The Nook alone; when we do, it will be a measurement, not an estimate. If it costs more than it should on your Mac, that is a bug — tell us." }, { question: "Why macOS 14.2 or later?", answer: - "The audio mixer listens to each app's own sound stream, and Apple only shipped that API in macOS 14.2 (Sonoma)." + "The audio mixer listens to each app's own sound stream, and Apple only shipped that API in macOS 14.2 (Sonoma). The app links against it, so 14.0 and 14.1 cannot launch it." }, { question: "Does it work offline?", answer: - "Yes. Everything The Nook does — the agent grid, permission cards, fan and thermal control — works with no network at all, and your agents' hooks talk to the app over a local socket. The network is only used for update checks, license activation, and the optional trial email." + "The Mac app does. The island, agent cards, permission cards and fan control work with no network; the hooks talk to the app over a local socket. The network is used for update checks, licence activation, crash reports and the optional trial email, plus a few things only when you use them: weather (asked for through our relay, with the location you chose), the network panel's IP-and-ISP lookup, the speed test, the changelog in Settings, and a bug report if you send one. The phone link is the exception: when you are away from your Mac, the phone reaches it through our relay, so that part needs a connection." } ]; @@ -56,7 +67,7 @@ export default function NookFaqPage() { diff --git a/src/routes/nook/privacy.tsx b/src/routes/nook/privacy.tsx index da0cc1d..f357ded 100644 --- a/src/routes/nook/privacy.tsx +++ b/src/routes/nook/privacy.tsx @@ -1,9 +1,17 @@ /** * The Nook privacy policy — `nook.freno.me/privacy`. * - * Reflects the actual data The Nook sends when licensing: a masked hardware - * UUID + device name for trial/activation limits, the email used for purchase, - * and Stripe payment processing. + * Every statement on this page is traced to the egress inventory at + * `The-Nook` HEAD (FRE-333, `document-egress-inventory`): eleven internet + * destinations, file:line evidence per row. When the app's egress changes, + * this page changes in the same commit — not later. + * + * The crash-reporting paragraph below describes the build that ships today: + * Sentry starts unconditionally in `Sources/NookApp/main.swift:272-279`, with + * `sendDefaultPii = true`, and there is no off switch in Settings. If an + * opt-in setting ships, paragraph (b) is replaced by the shorter form held in + * `marketing/drafts/privacy-page.md` §"Contingency" in the same commit that + * makes it true. */ import { buildMainSiteUrl } from "~/lib/subdomain-url"; import { PageHead } from "~/components/PageHead"; @@ -21,39 +29,118 @@ export default function NookPrivacyPolicy() {
The Nook's Privacy Policy
-
Last Updated: August 26, 2026
+
Last Updated: October 29, 2026
- Welcome to The Nook ('We', 'Us', 'Our'). - Your privacy is important to us. This policy explains what we collect, - why, and how it is handled. The app itself runs locally on your device - and sends only the minimal data required for trial and licensing. + The Nook runs on your Mac. Your prompts, your code and your agent + sessions are processed on your device. This page lists every + connection the app makes over the network, what each one sends, and + whether you can turn it off.
    - 1. Data We Collect + 1. What leaves your Mac
    -
    (a) Device hardware UUID:
    When you start - a trial or activate a license, The Nook sends a hardware UUID - from your Mac. It is used solely to enforce the 14-day trial and - the 3-device activation limit, and to prevent resetting the - trial by reinstalling the app. +
    (a) Licensing and trial:
    When you start + a trial or activate a license, The Nook sends your Mac's + hardware UUID and device name to our licensing server + (freno.me). The UUID enforces the 14-day trial and the 3-device + activation limit and stops a trial being reset by reinstalling + the app; the device name is so you can recognize the Mac among + your activations. While you are on the trial, this is sent at + each launch. Once you are licensed, each launch re-checks only + that your key has not been revoked. Deactivating a Mac sends the + license key and that Mac's UUID. If you add an email during + the trial, that request carries the email and the UUID, and it + is sent once. All of these calls fail open: with no connection, + the app keeps working, because license verification itself is + offline.
    -
    (b) Device name:
    The Nook sends your - Mac's name so you can recognize the device in your license - activations. It is not used for any other purpose. +
    (b) Crash and error reporting:
    Crash + reports, error events, hang reports and performance traces are + sent to Sentry, our crash-reporting processor, and this is on + for every launch in this version — there is no setting that + turns it off. Each report carries the app version, the macOS + version, the Mac model and what the app was doing when it + failed, and Sentry also receives your IP address and your macOS + username. Reports never include your prompts, your code or your + session content.
    -
    (c) Email:
    The email you provide at - checkout is used to deliver your license key and to look up your - order. +
    (c) Phone connection:
    The phone + connection ships off and is yours to enable. When you turn it + on, your Mac registers with our relay (nook-relay.freno.me) + using a random install ID, and a licensed Mac presents its + license key once at registration. Everything your Mac and your + phone then exchange — session updates, approvals, replies — is + encrypted end-to-end: the relay routes it and cannot read it. + The relay can see which devices are connected, when, and how + much traffic they exchange.
    -
    (d) Payment:
    Payments are processed by - Stripe. We never see or store your card details. +
    (d) Weather:
    If you add the Weather + module, your Mac asks our relay for forecasts using coordinates + rounded to a 0.1° grid — about 11 km — and the rounding happens + on your Mac before anything is sent. The Weather module + registers with the relay for this even if you never turn on the + phone connection, and on a licensed Mac that registration + presents the license key, exactly as the phone connection's + does. "My Location" asks macOS for your + approximate position, and naming or searching for a place uses + Apple's Maps service, so Apple sees those lookups. Neither + feature sends us your precise location. +
    +
    +
    (e) The Network panel:
    While the + Network panel's connection section is on screen, The Nook + asks a third-party IP-lookup service (get.geojs.io, with + ipwho.is as backup) what your public IP address and provider + are — that is how the panel can show them to you. Those services + necessarily see your IP address. The speed-test button measures + against Cloudflare's public speed endpoint and uploads only + zeros, never your data. +
    +
    +
    (f) Update checks:
    Automatic update + checks ship off. If you turn them on, or press "Check for + Updates", The Nook fetches the update feed from freno.me + and the request carries your app version. Like every request on + this page, it also arrives from your IP address. +
    +
    +
    (g) Changelog:
    Opening Settings › + Changelog fetches the release notes from freno.me. +
    +
    +
    (h) Bug reports:
    only what you choose + to send. If you write a bug report, you decide what it says. + Bug reports also include a machine snapshot — macOS version, Mac + model, CPU, memory, free disk, locale, and your displays' + names and resolutions — so the problem can be reproduced. The + optional contact email is used only to reply to you. +
    +
    +
    (i) Your email and payment:
    The email + you give at checkout delivers your license key and looks up your + order. An email you add during the trial is used for one + reminder before the trial ends. Payments are processed by + Stripe; we never see or store your card details. +
    +
    +
    (j) What does not leave your Mac:
    The + hook and the bridge that connect your agents to The Nook talk to + nothing but your Mac — the hook dials the local bridge socket, + and the bridge only listens. Two paths carry agent data across + the network, and both are switched on by you: if you add a + remote machine, the hook on that machine dials this Mac over + SSH; and if you use the phone connection, the session updates, + approvals and replies described in (c) travel through the relay, + sealed end to end. + The privileged helper that controls fans and charging has no + networking code at all.
    @@ -63,9 +150,11 @@ export default function NookPrivacyPolicy() { 2. How We Use It
- Device identifiers, your email, and license records are used only - to operate the trial, deliver purchases, and enforce the 3-device - license. We do not use them for advertising or sell them to anyone. + Device identifiers, install IDs, your email and license records are + used only to operate the trial and the licenses, to run the relay + and the weather service, to answer bug reports, and to deliver + purchases. We do not use them for advertising and we do not sell + them to anyone.
@@ -74,9 +163,11 @@ export default function NookPrivacyPolicy() { 3. Data Security
- License keys are signed and verified with Ed25519. The connection - to our servers uses TLS. Your license key is stored in the macOS - Keychain on your Mac. + License keys are signed and verified with Ed25519 and stored in + the macOS Keychain. Phone traffic is encrypted end-to-end with + keys your own devices generate at pairing; our relay holds no key + that can read it. Every connection described on this page uses + TLS.