How Nagi keeps your words unconnected to your name

Privacy promises in this industry usually take the same shape: we collect a great deal about you, and we promise to be careful with it. You're asked to trust a policy — a document that can change, held by a company that can be breached, bought, or subpoenaed. For a shopping app, maybe that's a fair bargain. For the place you go at 2am to say the things you can't say anywhere else, we didn't think it was.

So Nagi makes a different kind of promise, and it's structural rather than behavioural: the promise isn't that we won't connect your words to your name. It's that the connection was never built.

Two systems that never meet

When you subscribe to Nagi on the web, two entirely separate systems come into existence, and the design rule that governs everything else is that they are never joined.

The first system handles money. Our payment processor knows the things payment requires — an email for receipts, a card, the fact that they pay for a subscription. The second system is your Nagi account: your conversations, your mood diary, your check-ins, your scores. That account has no name on it, no email, no phone number. It isn't "anonymised" — a word that usually means identifiable, but scrubbed. It was simply never identified. There is no field where your name would go.

What connects you to that account isn't your identity. It's your Nagi code — the word-chain you saved when you joined. The code is the only key: it's how you open your account on a new device, and it's yours alone. It never appears on a receipt, never travels through email, never passes through any system that knows who you are. That's not an oversight; it's the rule the whole design hangs on.

What this means in practice

It means the question "show us what this person said to Nagi" has no lookup that answers it. The payment side can only say: this email pays for a subscription. Which account? It can't see one — no conversations, no diary, no scores, no door into any of it. And Nagi's side holds an account full of words with no one's name attached, and no email ever stored. A breach of the payment system exposes billing details, the same as any subscription you have — but not one sentence you've written. A breach of Nagi's side would expose text belonging to no findable person. No single system anywhere contains both who you are and what you've said — and we never join them. That includes us: our own support staff can't "look you up" from your email, because there's nothing on the other end to find. It's why our honest answer to a lost code is that we can't recover your account — a limitation we've kept on purpose, because an account we could recover from your email would be an account connected to it.

The honest asterisk

We want to be precise, because privacy claims are where companies most love to round up. The payment processor does hold your email while you're subscribed — receipts, renewal reminders, and your right to cancel depend on it, and you should be suspicious of any paid service claiming otherwise. What we've built is the strict separation described above, plus one more thing: when your subscription ends, even the processor deletes your email. Held only while it's needed, connected to nothing, gone when it's not.

That's the whole architecture. No name. No email in Nagi, ever. Your code as the only key. We built it this way because the words you bring here deserve better than a promise to be careful — they deserve a design where carelessness has nothing to find.

— The Nagi team

---

Nagi is a mental health companion, not a medical device, and nothing here is medical advice. If you're struggling, please reach out to a professional or someone you trust.