Privacy Policy

Account details.When you create an account we collect your name, email address and password. We never store the password itself, only a one-way bcrypt hash of it. If you choose “Continue with Google”, Google shares your Google account ID, name and verified email address with us. We only ask Google for your basic profile and email, nothing else.

Profile photo. If you upload one, we store the image so it can be shown next to your name.

Your questions and our answers.If you're signed in, each chat is saved as a conversation with your questions, the answers, and the ASRS report numbers each answer cited. If you're a guest, your chat isn't saved as a conversation.

Usage logs.Every question, from guests and signed-in users alike, is recorded in a usage log: the question text, the reworded version we searched with, which reports were cited, and how long the answer took. For signed-in users the log entry is linked to your account. For guests it's linked to your IP address instead, because that's the only way to count a guest's daily questions. We don't store the IP address of signed-in users.

Notifications.Announcements we send you in the app, and whether you've read them.

Sign-in security data. The one-time codes we email you and your session tokens. These are stored only as SHA-256 hashes, never in readable form.

What we don't collect.We don't use analytics, advertising or tracking scripts. We don't collect your location, contacts or payment details.

We use your information to:

• Answer your questions, save your chat history, and understand follow-up questions. To make sense of something like “what was the weather in that one?”, we use the last few turns of the conversation to reword it into a complete question.
• Run your account: verify your email, reset your password, keep you signed in, and protect accounts from abuse.
• Enforce daily question limits, per account for signed-in users and per IP address for guests.
• Keep the service running within budget. Administrators see daily totals of questions asked and AI usage, not who asked what.
• Send you in-app announcements about the service.

We don't sell or rent your information, we don't use it for advertising, and we don't use your conversations to train AI models.

We share information only with the service providers that make Nasight work, and only what each one needs:

• OpenAIreceives the text of your question (and, for follow-ups, the recent turns of that conversation) together with excerpts of the retrieved reports, to search the reports and write the answer. It doesn't receive your name, email or account details. See OpenAI's privacy policy.
• Brevo delivers our emails, so it receives your email address and the email itself (verification and password reset codes). See Brevo's privacy policy.
• Google, only if you choose to sign in with Google. Google tells us who you are, under Google's privacy policy.
• Hosting and database providers store and process data on our behalf, so the service can run.

Inside Nasight, administrators can see your name, email address, role, account status and sign-up date so they can manage accounts. We may also disclose information if the law requires it, or to protect the safety and security of our users and the service.

We only use what's strictly necessary. There are no third-party, advertising or tracking cookies. The two cookies below are only set when you sign in, and both are httpOnly, which means scripts running on the page can't read them.

If you block these cookies you can still ask questions as a guest, but you won't be able to stay signed in.

• Account details and conversations are kept until you delete them or ask us to delete your account.
• Usage logs, including guest IP addresses, are deleted automatically after 90 days. Before that, each day is added to a running total of how many questions were asked. Those totals contain no question text and nothing that identifies you.
• Email codes expire after 15 minutes and can only be used once. Expired codes are deleted automatically.
• Sessions last at most 30 days. Signing out ends yours straight away, and expired sessions are deleted automatically.

When your account is deleted, your account details, profile photo, conversations, messages, notifications, linked Google sign-in and sessions are deleted with it. Usage log entries are unlinked from you and then deleted on the normal 90-day schedule.

• Change your name, or upload or remove your profile photo, on your profile page.
• Delete any conversation from the chat sidebar.
• Sign out at any time, which ends your session on that device.
• Use Nasight as a guest if you'd rather not create an account. Your chats won't be saved.
• Email us to get a copy of your data, correct it, or delete your account. We'll reply within 30 days.

Depending on where you live, data protection law may give you more rights, like objecting to or restricting how we use your information, or complaining to your local data protection authority. Contact us and we'll help.

Passwords are hashed with bcrypt. Sign-in codes and session tokens are stored only as hashes, so a copy of our database wouldn't give anyone a working login. Sessions live in httpOnly cookies that page scripts can't read. Traffic is encrypted with HTTPS, and sign-in routes are rate limited against password guessing.

No system is perfectly secure, so please use a strong password that you don't use anywhere else.

The incident reports Nasight searches come from NASA's public ASRS database. NASA removes identifying details from reports before publishing them, and we store them as published. Nasight is an independent project and isn't affiliated with or endorsed by NASA.

Please don't put personal information about yourself or anyone else in your questions. They're logged and sent to OpenAI as described above.

Nasight isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has given us personal information, contact us and we'll delete it.

If we change this policy, we'll update the date at the top of this page. For significant changes, we'll also let signed-in users know with an in-app notification.

For questions about this policy or your data, email privacy@nasight.app.