Nucleus Sign in Create account

Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for data processing on this website (“Nucleus”) is:

Dominik Zastrow
Ostpreußenstraße 30
22941 Bargteheide, Germany
Email: contact@nucleus-ai.de

2. What data we process and why

a) Registration and sign-in

Registration: username, email address and password. Passwords are stored only as a salted hash (Argon2id) – we can neither see nor recover your password. Your email address is stored encrypted (AES-256). Legal basis: Art. 6(1)(b) GDPR (providing the service).

Sign-in codes: when you register and every time you sign in, we send a 6-digit confirmation code (valid for 10 minutes). Optionally you can use an authenticator app instead or in addition; its secret key is stored encrypted. Codes are deleted automatically after use or expiry. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in account security).

Password reset: if you forget your password, we send a one-time link to your email address (valid for 60 minutes). Legal basis: Art. 6(1)(b) GDPR.

Sessions: while you are signed in (at most 14 days) we store your IP address (encrypted) and browser identifier with the session to detect misuse. Legal basis: Art. 6(1)(f) GDPR.

Age: when registering you confirm that you are at least 16 years old. This confirmation is a requirement for using the service.

Invite codes: while registration is invite-only, you sign up with a code. We store which code you used and who created it. If a member invited you, you automatically follow them (you can stop at any time) and they get a message that you joined. Legal basis: Art. 6(1)(b) GDPR.

b) Contributions and AI training

The texts you submit to tasks are stored linked to your account and go through a review (automatic checks, then the team). The automatic checks (garbage, spelling, copies, AI-generated text) run exclusively on our own server; your texts are not sent to any external AI provider. Clearly meaningless or demonstrably copied contributions are rejected automatically; you receive the reason and can revise. All other decisions are made by a person.

While you write in the editor, we record how many characters were pasted instead of typed, the number of keystrokes and the active writing time (not the individual keys). These values help to detect copied or AI-generated texts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in clean training data).

Accepted contributions are added to our learning file without your name and used to train the AI model “Nucleus”. You give your explicit consent to this with a checkbox for every submission. Legal basis: Art. 6(1)(a) GDPR (consent).

Points are calculated automatically from your accepted contributions and shown on the leaderboard with your username.

c) Profile, following and friends

You can add a profile picture and a short bio. Both are optional. Before storing it we reduce the picture to 256 × 256 pixels in your browser and save a newly created image file, so location data and other hidden information from the original file are not kept. Your picture, bio, points and the number of your followers are shown to signed-in members on your profile, on the leaderboard and in friends lists; visitors without an account see neither pictures nor profiles. Members who follow each other are shown as friends on both profiles. You can change or remove your picture and bio, unfollow anyone and remove followers at any time. The team can remove pictures or bios that break the terms of use. Legal basis: Art. 6(1)(b) GDPR.

d) Chat and messages

Your chat messages to the AI and its answers are stored so you can continue chats, and are counted for the daily token limit. When you regenerate an answer or edit your last message, the earlier version is kept in the chat (hidden) so you can say which answer was better. You can delete chats at any time. Messages from the team to you are stored encrypted and additionally sent by email. Legal basis: Art. 6(1)(b) GDPR.

Ratings. If you rate an answer (“helpful” / “not helpful”, optionally with a reason) or say which of two answers was better, a copy of your question, the answer(s), up to six earlier messages of the chat and your rating is shared with our team – also after you delete the chat. The team uses it to improve Nucleus: to write new tasks, to add test questions, and – only after checking that it contains no personal data – to add pairs of better and worse answers to the learning file without your name. Rating is voluntary; please don't write personal data in the chat. Legal basis: your consent by rating (Art. 6(1)(a) GDPR); ratings are deleted with your account.

Safety filter. Questions and answers that contain terms the team has blocked, or that our local checker model rates as harmful, are stopped. The stopped text (shortened, with contact data removed) is stored for the team for 90 days and then deleted automatically. Email addresses, phone numbers, IBANs and card numbers in the AI's answers are hidden. The checks run on our own server. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in preventing harmful content).

e) Cookies and local storage

We only use technically necessary cookies: a session cookie (nc_session) that keeps you signed in and protects forms against misuse, and during code confirmation a cookie (nc_chal, 15 minutes). Under § 25(2) no. 2 TDDDG no consent is required for strictly necessary cookies; no advertising, tracking or analytics cookies are used. Without an account, your dark-mode setting is stored only in your browser's local storage; drafts of your answers are kept there too until you submit them. Neither is transmitted to us.

f) Server logs, audit log and encryption

When you visit the website, usual web server logs (IP address, time, page requested, user agent) are processed and kept briefly for security and troubleshooting. In addition, we record security-relevant actions (e.g. sign-ins, submissions, team decisions, bans, team messages) in an audit log that only the operator can view. Legal basis: Art. 6(1)(f) GDPR. The entire connection is encrypted with TLS (“HTTPS”).

g) Backups

We back up the database and the learning file regularly. Backups are encrypted before they are stored, both on the server and as a second copy in a private Discord channel. Discord cannot read the encrypted content.

3. Recipients and transfers to third countries

Discord Inc. (USA): entries of the audit log (username, action, time and, for team messages, their content – no email or IP addresses) are transferred to a private channel on our Discord server, as are the encrypted backups. Data may be transferred to the USA in the process; according to its own statements Discord is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR). See Discord's privacy policy. Legal basis: Art. 6(1)(f) GDPR (traceability and resilience).

Email delivery: sign-in codes, reset links and notifications are sent through our own mail server on the same server in Germany (sender noreply@nucleus-ai.de); no external email service is used.

Hosting provider mc-host24 (Germany): the website runs on rented server infrastructure; the provider can technically access the hardware.

Donations: the “Donate” button on the Support page leads to an external payment provider. Only when you click it and pay there does the provider process your payment data under its own privacy policy. We receive from the provider only what it passes on to recipients (usually the amount and, depending on the provider, your name, email address and message) and use it to record the donation. Legal basis: Art. 6(1)(b) and (c) GDPR (retention duties under tax law).

We do not sell data and do not share it with advertisers.

4. Storage period

We keep your account and contributions until you delete your account or our team removes a contribution. Sign-in codes and reset links expire automatically, unconfirmed registrations are deleted after 48 hours, sessions after 14 days at the latest. Server logs are kept only briefly. Backups remain on the server for 90 days.

What “Delete account” actually does: when you delete your account, your personal data is removed – email address, password, authenticator key, messages, chats, ratings, entries of the safety filter, open sign-in codes, profile picture, bio, follows and your unused invite codes; your username is replaced with “deleted_<number>”. Your submitted contributions remain in the system and are assigned to this deleted account so that the review pipeline and the training data stay consistent. If you also want the content of your contributions removed, contact us at the email address above and we will remove it manually.

Technical limitation of AI training: once a contribution has been used in a completed training run, its content has become part of the parameters of the trained model and can no longer be extracted or removed from it. A later deletion therefore only affects future training runs. We point this out before every submission.

5. Withdrawing your consent

You can withdraw consent you have given (e.g. to the use of your contributions as training data) at any time with effect for the future (Art. 7(3) GDPR) by contacting us or asking for the contribution to be removed. The lawfulness of processing carried out until the withdrawal remains unaffected.

6. Your rights

You have the following rights regarding your personal data:

You can download a copy of all your data yourself at any time under Settings → Your data (a JSON file).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.

7. Obligation to provide data

You can use the website without an account (start page, leaderboard and legal texts) without providing personal data. Active participation (submitting contributions, using the chat) requires an account; without the data needed for it we cannot provide these functions.

8. Changes to this policy

We update this privacy policy when the website or the legal situation changes. The version published here applies.