Legal
Privacy Policy
Last updated August 19, 2026
This page explains what Nucleus collects, why we need it, and who else sees it. We have tried to write it plainly rather than defensively.
What we collect
Account information
Your name, username, and a hashed version of your password. Passwords are hashed with bcrypt — we never store or see the original. You may optionally add a bio, location, website, company, and avatar; those are shown on your public profile.
Nucleus does not require an email address to sign up, and does not ask for one.
Your content
The repositories you create: source files, commit history, issues, discussions, wiki pages, and project boards. Public repositories are visible to anyone. Private repositories are visible only to you and collaborators you add.
Secrets and environment variables
Values you store as repository secrets are encrypted before being saved and are never displayed back to you in full. They are decrypted only when injected into a build or deployment for that repository.
Technical data
A session cookie to keep you signed in, and standard server logs (request paths, timestamps, error traces) used to operate and debug the platform.
Who your data is shared with
We do not sell your data and we do not use it for advertising. Data leaves our systems only in these cases:
| Service | What it receives | When |
|---|---|---|
| Anthropic (Claude) | The prompt plus the repository content included as context | Only when you use an AI feature with Claude selected |
| xAI (Grok) | The prompt plus the repository content included as context | Only when you use an AI feature with Grok selected |
| Cloudflare | The built output of a project, and any custom domain details | Only when you deploy a repository |
| MongoDB Atlas | Account records and repository metadata | Continuously — this is our database |
Each of these providers handles data under its own privacy terms. If you never use an AI feature, no repository content is sent to an AI provider. If you never deploy, nothing is sent to Cloudflare.
Why we hold each thing
- Account data — to sign you in and attribute your work to you.
- Repository content — this is the product; hosting it is the service.
- Secrets — so builds and deployments can access the credentials your project needs.
- Logs — to keep the platform running and investigate faults and abuse.
Cookies
Nucleus sets a single session cookie so you stay signed in. There are no advertising cookies, no analytics trackers, and no third-party tracking pixels.
Your choices
- Edit or clear your profile details at any time from account settings.
- Make a repository private, or delete it, from its settings page.
- Choose whether to use AI features at all — they are opt-in per request.
- Request deletion of your account and its contents through the contact page.
Security
Passwords are hashed, secrets are encrypted at rest, and access to every repository is checked on the server for each request — private repositories are not readable by other users or by anonymous visitors. No system is perfectly secure, so please keep your own backups of important work.
Children
Nucleus is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes materially, we will update the date at the top of the page. Significant changes to how data is shared will be called out clearly.
Contact
Questions, or want your data removed? Get in touch through the contact page.