Privacy.

We collect what we need to run the workbench, your account and the community, and nothing more. We do not sell your data, and nooks.place has no advertising or tracking pixels. Nooks does not sell or ship kits: you buy parts directly from independent sellers, who handle your order under their own policies.

Who we are

Nooks is run by Byte Universe Corporation, operating as Nooks. We are responsible for your personal data. Contact us at hello@nooks.place.

What we collect

• If you bought a kit before 25 October 2026: your name, your email address, what you bought, and whether the payment went through. Our payment provider, Whop, collected your card details and billing address. We never saw your card number.
• When you email us: your message and your email address.
• When you visit the site: our host, Vercel, keeps standard server logs, such as your IP address, browser type and the pages requested. It uses them to serve the site and keep it secure.
• When you browse nooks.place: we process basic request data to operate the site and prevent abuse.
• If you sponsor a listing: Whop processes your payment details. We keep the public listing creative, a salted hash of the payer email to establish editing rights, and an encrypted copy of that email only to send capped rank-change notices (with an opt-out). We also keep the payment reference, amount, confirmation time and payment state. For listings shown on Nooks, we count impressions and one click per listing per visitor per day using a salted daily address hash; the hash is stored with the daily count, not the address.
• Site metrics: we count page loads across Nooks, and successful player starts, including embedded players and the public kit ID. These aggregate counts contain no account, IP address, cookie or query string. Browsers that request Do Not Track or Global Privacy Control are excluded from these page counts.
• When sets are shared: we count, per day, how sets are shared and visited from shared links: the share options opened, a link copied, an image or video made, a visit from a shared link, a remix or submission begun from one. Each count holds only the set's public id and a few fixed words, such as "photo" or "square". It holds no account, IP address, cookie or other identifier, and nothing is sent if your browser asks sites not to track. Share images and videos are made on your device and are not uploaded to us.
• In the workbench: building needs a Nooks account. Builds you create or edit save privately to your account so you can open them on another computer, with a copy kept on this browser so they open quickly and survive going offline. The workbench also remembers a few settings in your browser's storage.
• If you create an email account: your email address and a salted password hash are stored privately to keep your account secure. We never store your password in plain text. If you request password recovery, we email you a short-lived recovery link and store only a hash of its token.
• If you sign in with Google: your Google account's ID, email address and name, and which kit purchases are tied to your account (the payment's reference from checkout). We use them to keep you signed in, with a cookie that only says who you are, and to keep your builds available across devices. We do not get your Google password or anything else in your Google account.
• If you sign in with X, or link your X profile: your X account's ID, username, display name and profile picture. We use them to sign you in and to show your X profile on your Nooks profile if you link it. We do not get your X password or post anything for you.
• If you save versions of a build, share it or connect an agent (beta): you need to be signed in, and the build is tied to your account. We keep the build's name, every version you or your agent save (the model, its brick script and the change notes), and anything you publish or submit for review, with the name you ask to be credited by. We keep it privately; only what you publish is public. To stop people overloading the service we count requests per address, keeping a salted hash of the address, never the address itself, and only for the current hour or day. If you connect an agent, we show its agent key once and keep only a hash of it; you can replace or revoke it at any time. If you follow other people, we keep who you follow, with when, tied to your account; the people on a profile's follower and following lists are public, like the profile itself. Your own Following feed is only ever shown to you. You can delete a build from the workbench, from your profile, or by asking your agent (typing the build's name to confirm): it, its versions, agent key, agents' calls, source photos, box art and inventories are removed, and kits shared from it are taken down. Its building is left out of every later research dataset. Copies of a taken-down kit already downloaded under CC BY 4.0 cannot be recalled.

Ratings, comparisons, school verification and research

Ratings. When you rate a set's design, we keep your scores tied to a salted hash of your account, never the account itself. A set shows only its averages and how many people rated it. Whether you had credentials when you rated is kept with the rating. You can change or remove your rating at any time.

Comparing sets. When you choose between two sets on Compare, we keep the two sets, your choice, how long it took you, whether you used a mouse or touch, and which credentials you had then, tied to your account privately. Each set's scores from everyone's choices may be shown; your own choices never are.

Your agent's calls. If you connect an agent to a build, we keep every call it makes to Nooks: what it asked for and with what (cut to a few thousand characters), whether it worked, how long it took, and the AI model and tool it says it is. They are kept privately with that build as part of its history, whether or not you share your building for research.

Briefs. If you start a build on a brief, or your agent links a build to one, the build is linked to that brief. Each brief shows how many people and agents have built it, never who.

School or university email. If you verify one, we send a one-time link to it. Once you open it, we keep only the school's domain on your account and a salted hash of the address, so one address can verify one account. We never keep the address itself or use it for anything else. Your profile shows "School verified" but not which school. You can remove it in Settings.

Sharing your building for research. This is on by default when you create an account, as part of the Terms; you can turn it off in Settings at any time. While it is on, we also record how you build in the workbench: each edit, undo and redo, the parts you search for and pick, and when, kept privately with your account. Now and then, just after a choice (another way for a part to fit, swapping a part, taking back a part you just attached, changing a colour after testing gravity), we may ask why, at most once every 20 minutes; your answer, a quick pick and any words you add, is kept with that step. You can say not to be asked again. We may include all of this in a research dataset, with your builds' saved versions, your agents' calls on them, your builds of briefs and how they meet them, and your reviews, comments and comparisons. The dataset never contains your name, username, email or account; builds, makers and raters are replaced by salted hashes that are only used for the dataset. Words you or your agents write, such as a revision's note, a comment or a Why answer, go in with any email address, @username or account id in them taken out, so please don't write other personal details there. You can keep any single build out, and turning sharing off leaves you out of every later dataset; datasets already released cannot be recalled. We use the dataset to teach and evaluate design agents. We may publish a sample of it openly, for anyone to use for non-commercial research, and license the full dataset to research labs and companies, which may pay us for it. Every release forbids trying to identify anyone in it.

The photos and words you start builds from. When your agent builds from what you gave it, it keeps your own words and any photo you gave it privately with that build, so the kit can show what it was made from. Photos are made smaller and their hidden details (such as where and when they were taken) are removed before they are kept. When you share the kit, that photo appears with it on the kit's public page and player; withdrawing the kit or deleting the build removes it. Separately, your words and photo are included in research datasets like your other building by default under the Terms, with any email address, @username or account id taken out; photos go only to research labs that have signed a data agreement with us, never into the open sample. Builds you keep out are left out of research. You can turn either research switch off in Settings; that stops future inclusion and does not delete the kit's own photo; deleting the build does. Only give your agent photos you have the right to share, and of people who have said yes.

Community contributions

What you submit stays private until a reviewer publishes it, unless you choose Share: then anyone with its link can see that set while it waits for review (it is not listed, searchable or open to remixing until a reviewer publishes it, and withdrawing it ends the link). Once published it is shared under CC BY 4.0 with the name you gave, and others can open, download and remix it. You can withdraw a submission before it is reviewed, and ask us to take a published one down at hello@nooks.place. Copies others have already downloaded under the licence cannot be recalled. Your agent runs on your own account with its own provider: Nooks does not send your project to an AI service.

Photo inventory estimates

Your connected agent can submit an image of your bricks for recognition. Nooks removes image metadata and sends cropped regions to an external recognition service for identification. Under the recognition service's terms, submitted images may be stored and reused, including to train machine-learning models, under a perpetual, irrevocable licence. You can request removal from the service, but its licence is not automatically withdrawn. Nooks keeps the resulting private estimate and its alternatives with your build; it does not retain the submitted image as part of this scan. Estimates can be inaccurate. You can delete the scan or build. Your agent's own provider may handle the photo separately under its terms.

Your pictures

If you pre-ordered a kit before 25 October 2026, you could send us the picture you wanted built. We keep it, with your email, only to design and make that kit, store it privately and delete it 90 days after the kit is delivered. We never show your picture or your model publicly. If we would like to feature it, we will ask you directly first, and only do so if you say yes.

Why we use it

• To run the workbench, keep your builds and account, and show what you choose to publish (this is needed to provide the service you signed up for).
• To respond to support requests, and to complete and keep records of kits ordered before 25 October 2026.
• To keep the records that tax and accounting law require.
• To keep the site working and secure.

We will not send you marketing emails unless you ask us to.

Who processes it for us

• Whop: records of previous payments and related support. New parts purchases are made directly with independent sellers.
• Vercel: hosting the site, and storing builds, accounts and the pictures sent with earlier kit orders.
• Resend: sends password recovery emails, if you request them. Resend’s privacy policy.
• Google Workspace: our email.
• Google: "Sign in with Google", if you use it. Google's privacy policy.
• jsDelivr: delivers the 3D viewer's code to your browser, which means it sees your IP address.
• Neon: stores comments and likes on published sets.
• X: "Sign in with X", if you use it.

Some of these providers process data outside your country, including in the United States. Where the law requires it, they do so under standard contractual safeguards.

How long we keep it

We keep records of kit orders for as long as tax law requires, which is seven years, and emails about an order until it is closed. We keep your account and builds until you delete them or ask us to. You can ask us to delete anything we are not legally required to keep.

Your rights

You can ask us for a copy of your data, or ask us to correct it, delete it, or stop using it. Email hello@nooks.place and we will answer within 30 days. If you are in the EU or the UK, you can also complain to your data protection authority. If you are in California, you have the same rights under the CCPA, and we do not sell or share personal information.

Children

The site is not aimed at children under 13.

Changes

If we change this policy, we will update the date at the top. If a change matters to your account or an open order, we will email you about it.