What "your data stays in your account" means in practice

This post is for anyone who wants to know what “your data stays in your account” means in practice. It explains where files live, who can see them, how sharing and revoking work, and what the promise does not cover.

“Your data stays in your account” is an easy sentence to write and a hard one to check. This post explains what we mean by it, what it concretely changes in how Nubo works, and, just as important, what it does not mean. Everything below describes how the product behaves today; where something is still to be confirmed, we say so.

The short version

When you save a file, a note, a project or a spreadsheet in a Nubo app, it is stored under your account. It does not go into a shared pool owned by the app. Other people can see it only if you share it with them, or if you belong to a team whose administrators have set up a shared drive. You can see who has access, and you can take that access away.

We also state two things in our Privacy Policy: we do not sell your data, and we do not use your content for advertising.

Where things live

Nubo’s apps keep your data in two places that belong to your account: a file store, and a small key-value store for settings and structured records.

• The file store holds documents, spreadsheets, attachments, recordings and backups. Most apps keep one file per document or project, so the unit you work on is also the unit that is stored and shared.
• The key-value store holds small, frequently read items: settings, lists of projects, saved views.

Most Nubo apps do not run a separate database of their own with your records inside it. They read and write through your account. One practical effect is that the same file is available to any app that can open that type of file, and there is one copy of it to back up, share or delete.

A second effect is that quotas are simple. What you store counts against your account’s storage, whichever app stored it. You can see usage across all apps in one place.

Sharing, step by step

By default, nothing you store is visible to anyone else. Sharing is something you do, and the model is deliberately small.

You share with a person, a team or an email address. A share has an owner, an item, a holder (the person or team who gets access) and a mode: read or write. If you share with an email address for someone who does not yet have an account, the share waits for them and attaches when they sign up.

A share on a folder covers what is inside it. If you later add a file to a shared folder, the people it is shared with can see that file too. This is convenient and is also the reason to share narrow folders, not your whole home directory. Nubo does not let you share your home folder at all.

Only the owner can share. Someone you shared a file with cannot pass it on to a third person through Nubo. They can ask you to add them.

The owner’s storage is where the file is. When a person with write access saves a change to a shared file, the change goes into the owner’s storage and counts against the owner’s quota. A person with write access cannot delete the shared root folder itself.

Public links are separate and more limited. A link has a long random token, is read-only, and can have an expiry date (up to one year) and a password. Anyone with the link can open it without an account, so treat it like a key. You can list your links and revoke any of them.

Revoking is immediate. Removing a share removes the access on the next request, not at some later sync.

What you can see about your own sharing

Sharing is only trustworthy if you can look at it afterwards. From your account you can:

• See what you have shared and with whom, and what has been shared with you.
• See who has access to one particular item.
• Read a log of sharing activity, covering grants, changes, revokes, link creation, link opens and edits made through a share. The share log is kept for 90 days.
• Receive an in-app notification when something is shared with you.

An organisation also has an event log. It is kept for 90 days by default, and an organisation admin can set a different period for that organisation.

Teams and organisation controls

A team (organisation) on Nubo has one shared drive that the team owns, not any single member. Files stay when someone leaves, and the storage is pooled across the team. Administrators set the default level of access members get, and can grant folder-level access to guests who are not full members. Removing or disabling a member takes effect on their next request.

Team owners and administrators can also switch off external sharing for the team. When that is on, members can share only with people who share a team with them; sharing by email address, sharing with “anyone”, and public links are refused. This is a useful setting for a team that handles client documents.

Who at Nubo can see your data?

This is the question behind most privacy sentences, so here is a direct answer. Your files are stored on servers in Helsinki, Finland, run by our hosting provider Hetzner and operated by Nubo. The companies that process data for us are listed on our Sub-processors page. Nubo staff who run the service have administrative access to systems. Our policies describe the limited purposes for which we process your data. [Security owner to confirm and add: how staff access is restricted, logged and reviewed.]

What this is not

It is better to be plain about the limits than to let a phrase suggest more than it means.

• It is not end-to-end encryption. We do not claim that only you can read your files. Files and mail are stored so that the service can show them to you, search them and share them. If a use case needs end-to-end encryption, Nubo is not the right place for those particular files today.
• It is not a promise about the law. Like any provider, we may have to disclose information if the law requires it. Our Privacy Policy says so.
• It does not make shared copies disappear. If you share a file and someone downloads it, revoking the share does not delete the copy on their device. This is true of every sharing system.
• It is not automatic hygiene. Sharing a folder with the wrong person works exactly as designed. Review your shares from time to time.

What you can do about your own data

Nubo’s design aims to keep you in control of your own information:

• You can export and back up your data. Many apps offer a plain file or archive export, and some can save a backup straight to your drive.
• You can delete things. Deleted items in several apps go to a trash that is cleared after a set time, then are removed.
• You can close your account. After you close it we delete or anonymise your data within 30 days, as set out in the Privacy Policy, except for records the law requires us to keep.
• You can ask us to do any of the above at support@nubo.email.

A quick self-check

If you want to test the claim for yourself, here are five questions to try on your own account:

1. Can you list everything you have shared, and with whom?
2. Can you see who has access to one specific file?
3. If you revoke a share, does the other person lose access right away?
4. Can you export your data from the apps you use most?
5. Does the Privacy Policy say plainly that your content is not sold or used for ads?

If any answer is no, or unclear, tell us. Part of the reason to write a post like this one is to give you something you can hold us to.

For more on how we protect accounts, see the Security page and the Trust center.