Your privacy stays yours.
NovuHub is built local-first. This policy explains what stays on your device, what has to reach our services for an account or a subscription to work, and what only leaves your device because you chose to connect something.
Last updated 30 August 2026
Draft — not yet in force. 20 points in this document depend on facts that could not be established from the project and are marked below for review.
Scope of this policy
This Privacy Policy covers the novuhub.eu website, the Novu Account, and the NovuHub platform together with the NovuApps built on it — currently NovuAI, NovuExplorer, NovuSpace and NovuVoice, along with the modules distributed through them.
NovuHub is developed by Novusion. NovuHub is in active development and the Public Beta has not been released, so parts of this policy describe how information will be handled once the corresponding service is available rather than processing that is happening today. Section 03 sets out exactly what is live at the moment.
Legal reviewcontroller legal identity — the registered name, address and, if applicable, company registration number of the entity operating NovuHub. No legal entity details exist anywhere in the project.
Legal reviewwhether a Data Protection Officer or an EU representative has been appointed, and their contact details.
Local-first, and what that does and does not mean
NovuHub is designed so that the material you actually work on stays on the device you work on. Workspace data, files, mailboxes, sessions and credentials are held in local storage under your control rather than being uploaded to us as a condition of using the software.
That principle has limits, and we would rather state them than let the word “local-first” do work it cannot do:
- An account and a subscription cannot exist without a service to hold them. Account and billing information is processed by our infrastructure.
- Features that are explicitly about reaching somewhere else — cloud sync, cloud AI models, connected online services, shared workspaces — send data outside your device by design. They are optional and you turn them on.
- Software distribution and updates involve a connection to a server, which necessarily reveals technical information such as an IP address.
So: local by default, connected where you ask for it. We do not claim that nothing ever leaves your device.
What is live today
At the time of writing, the public novuhub.eu website is a static site. It runs no analytics, sets no cookies, and has no backend that receives form submissions. The sign-up page is a preview of the flow: it validates what you type in the browser and does not transmit it anywhere.
This means that, today, visiting the website does not create an account, a profile or a record with us. The sections below describing account, billing and service data apply from the point those services actually launch.
Information stored locally on your device
The following is held on your device by NovuHub and the NovuApps, and is not sent to Novusion as part of normal use:
- Workspace content — projects, documents, notes and the structure you organise them in.
- Files and digital assets managed through NovuExplorer, including previews and organisational metadata.
- Mailboxes, drafts and the outbound queue in Novu Mail, which is local by default.
- Credentials, passwords and identity information stored in the Novu Vault and the NovuSpace data store, which are held in a locally encrypted database.
- Browsing sessions and isolated tab contexts in NovuSpace, including authentication state for the online services you sign in to.
- Application settings, layout and per-workspace preferences.
Because this data is local, it is also your responsibility to back it up. See the Terms of Service for what that means in practice.
Novu Account information
A Novu Account is required for plans, licences and any connected capability. Based on the current sign-up flow, creating an account involves:
- Your first and last name.
- Your email address.
- A password, which is used to authenticate you.
- Confirmation that you are at least 16 years old.
- Your acceptance of the Terms of Service and this Privacy Policy.
- Optionally, your consent to receive product updates by email. This is opt-in and can be withdrawn at any time.
The account also carries your plan or subscription status and the licences and seats associated with it, because NovuHub uses that to decide which applications and capabilities are available to you.
Legal reviewthe site elsewhere states “Account data is email and plan only”, while the sign-up form also asks for first and last name. One of the two has to change — either the form drops the name fields, or the claim is corrected across the site.
Information processed by NovuHub online services
Some capabilities require our infrastructure to be involved. Where you use them, the following is processed:
- Authentication — verifying your account when you sign in and keeping that session valid.
- Licensing — checking which plan an installation is entitled to, and how many seats a plan covers.
- Cloud Sync, available from the Plus plan — the workspace content you choose to synchronise between devices.
- AI credits — the usage counted against the allowance included in your plan.
- Realtime communication in NovuVoice — chat, voice, video and screen sharing depend on a dedicated signaling service, which is how two participants find each other and open a session.
- Shared workspaces and collaboration, once released — the content shared with the people you share it with, and the membership and roles that govern access.
Where a capability is not enabled, its data is not processed. Cloud Sync on a Free plan, for example, does not exist to be processed.
Legal reviewthe concrete technical detail of each service above — what exactly is transmitted, in what form, and whether synchronised content is encrypted in transit and at rest — is not established anywhere in this repository and needs to be confirmed against the actual server implementation before publication.
Legal reviewfor NovuVoice specifically: whether audio, video and screen content travels directly between participants or is relayed through a server, and whether message content is stored or only passed through. The project records that a signaling service exists but not the media path or any retention.
Subscription and billing information
Paid plans are billed as monthly subscriptions in euro. Individual plans are Plus at €9.99 per month and Pro at €24.99 per month; business plans are Team at €49.99 per month and Business at €99.99 per month. Enterprise is priced by agreement. The Free plan requires no payment details.
Taking a paid plan involves processing the information needed to bill you and to keep a record of the transaction. Payment card details are handled by a payment provider rather than stored by us.
Legal reviewthe payment provider has not been chosen or is not recorded in the project. Its identity, the data it receives, and its role as a processor or independent controller must be named here.
Legal reviewinvoicing and tax-record retention. Statutory retention periods for accounting records apply and depend on the country of establishment, which is not established.
Authentication and account security
Your password authenticates you to your Novu Account. Keep it to yourself; the Terms of Service ask you not to share account credentials.
Business plans include single sign-on, an audit log and device management. Where an organisation enables these, the organisation administers the accounts within it and can see the activity those features record.
Legal reviewhow passwords are stored and verified, whether multi-factor authentication is offered, and what the audit log actually records. None of this is determinable from the repository.
Website usage and technical data
The website carries no analytics, no advertising identifiers, and no third-party tracking pixels or beacons. We do not build a profile of visitors.
As with any website, the server that delivers the pages necessarily receives the technical information a browser sends in order to be served — including your IP address, the page requested and your browser's user agent.
The site loads its typefaces from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com and those services receive your IP address. This is a build-time convenience; the intention is to self-host the fonts in production, at which point that request disappears.
The site also links out to a Discord community. Following that link takes you to Discord, whose own privacy terms then apply.
Legal reviewthe hosting provider serving novuhub.eu, what its access logs contain and how long it keeps them. The site is deployed as a static export over FTP; the provider is not recorded in the project.
Cookies and local storage
The website sets no cookies.
It uses one item of browser local storage, under the key nv-hub-theme, to remember whether you chose the light or the dark theme. It holds nothing else, it is not an identifier, and it never leaves your browser. Clearing your site data removes it and the theme simply follows your system preference again.
The desktop applications store their working data locally as described in section 04. That is application storage, not web tracking technology.
AI features
NovuAI is an AI environment rather than a single assistant, and how your content is handled depends entirely on which model you point it at. The distinction matters, so it has a section of its own below.
Independently of which model runs, your plan includes an allowance of AI credits — limited on Free, larger on Plus, full on Pro, shared across members on Team and above. Counting that usage requires our service to know that a request was made and how much of the allowance it consumed.
Legal reviewwhat a credit-accounting record contains — in particular whether it is limited to counts and timestamps, or whether any part of a prompt or response is retained. This must be confirmed against the implementation.
Local AI models and external providers
NovuAI can run local models on your own hardware and can also use models from supported cloud providers, switching between them inside the same workspace.
When you use a local model, the prompt and the content it works on are processed on your device.
When you choose a cloud model, the content of that request is sent to the provider you selected in order to be answered. It is handled under that provider's terms and privacy policy, not this one. On the Pro plan you can supply your own provider API keys, in which case the relationship with that provider is directly yours.
Choosing a cloud model is a decision you make per task. NovuHub does not silently route local work to an external provider.
Legal reviewwhich cloud AI providers are supported, and whether requests reach them directly from your device or pass through NovuHub infrastructure. The two have materially different privacy consequences and the architecture is not established in this repository.
Connected third-party services
NovuSpace exists to let you work with online services you already use, keeping accounts and sessions isolated from one another. NovuAI can connect to source control and other developer tooling. Novu Mail connects to your mail provider.
When you connect a service, you are using your own relationship with that provider. The data exchanged goes between your device and them, under their terms. Your credentials for those services are held in the local encrypted store described in section 04.
Novu Mail keeps remote images and read receipts switched off until you opt in, so simply opening a message does not signal anything to the sender by default.
Collaboration and shared workspaces
Shared workspaces, roles and permissions are part of the Team plan and above. The shared workspace foundation exists today; shared workspaces themselves, collaboration and cross-application context are in development and are published on the public roadmap.
When these are available and you share a workspace, the content you share becomes visible to the people you share it with, and membership and role information is processed so that access can be enforced. Sharing is something you initiate.
Legal reviewwhere shared workspace content is stored and whether it is encrypted in a way that prevents Novusion from reading it. Until the implementation is confirmed, no claim either way should be published.
Sharing and disclosure
We do not sell personal data, and we do not share it for advertising or profiling.
Information is disclosed only in these situations:
- To service providers that operate parts of the service on our behalf, under contract and only for that purpose.
- To a third-party service or AI provider that you connected or selected, as described in sections 12 and 13.
- To people you deliberately share a workspace with.
- Where we are legally required to, for example in response to a valid legal order.
- To an acquirer, if the business or part of it is transferred — with notice, and this policy continuing to apply until it is replaced.
Service providers and infrastructure
Running an account service, a sync service and a billing flow requires infrastructure providers.
Legal reviewthe list of processors and subprocessors — hosting, database, email delivery, payment, error reporting — with their roles and locations. None are recorded anywhere in the project, and this list is required for a GDPR-compliant policy.
How long information is kept
Local data lives on your device for as long as you keep it there, and is deleted when you delete it.
Account and service data is kept while the account exists, and afterwards only where a legal obligation requires it — accounting records being the usual case.
Legal reviewconcrete retention periods for account data, service logs, credit-usage records and backups. These cannot be invented; they have to reflect what the systems actually do.
Deleting your account and your data
You can stop using NovuHub at any time, and you can delete data held locally by deleting it in the application or removing the application's data directory.
For account and service data, you can request deletion of your Novu Account at support@novuhub.eu. Deleting the account does not delete the data on your device, and deleting data on your device does not delete the account.
Legal reviewwhether self-service account deletion exists in the product, and how long deletion takes to propagate through backups.
Security
Sensitive local data — credentials, passwords and vault contents — is stored in a locally encrypted database rather than in plain application storage.
For anything reaching our services we use the protections appropriate to that service, and we design so that the amount of personal data leaving your device is as small as the feature allows.
No system is perfectly secure, and we will not claim otherwise. Keeping your account password private and your device secure is a necessary part of this.
Legal reviewthe encryption used for local stores, for data in transit and for data at rest on the service side, together with any breach-notification process. Specific security claims should only be published once they can be substantiated.
International processing and transfers
NovuHub is intended for public use in Europe. Where a provider processes data outside the European Economic Area, a valid transfer mechanism is required.
Legal reviewwhere account, sync and billing data is actually processed, and which transfer mechanism applies to any provider outside the EEA. This is unresolved until the providers in section 16 are chosen.
Your rights
If you are in the European Economic Area, data protection law gives you the right to ask for access to the personal data held about you, to have it corrected, to have it deleted, to restrict or object to how it is processed, and to receive it in a portable form. Where processing rests on your consent — the optional product-update emails, for example — you can withdraw that consent at any time without affecting what was done before.
You also have the right to complain to a data protection supervisory authority.
To exercise any of these, write to support@novuhub.eu.
Legal reviewthe legal basis for each processing activity, and the competent supervisory authority. Both follow from the controller's country of establishment, which is not established.
Age
A Novu Account requires you to be at least 16 years old, and the sign-up flow asks you to confirm this. NovuHub is not directed at children, and we do not knowingly create accounts for people below that age. If you believe an account has been created by someone younger, write to support@novuhub.eu and we will look into it.
Legal reviewwhether 16 is the correct threshold in every market served, since the digital-consent age varies between EU member states.
Changes to this policy
This policy will change as NovuHub develops — particularly as the Public Beta and the account services launch. When we make a material change we will update the date at the top of this page and, where the change matters to you, tell you through the product or by email.
Contact
Questions about this document, or about how NovuHub handles your information: support@novuhub.eu
Legal reviewa postal contact address for the controller, which a published privacy policy is normally expected to carry.