Legal
Privacy Policy
Your privacy matters to us. This policy explains what data we collect, how we use it, and the controls you have over your information.
Last updated October 21, 2026
01Information We Collect
Account Information
When you create an account, we collect your name, email address, and password (hashed with bcrypt). If you sign in via OAuth (Google, GitHub), we receive your profile information from the provider.
Database Credentials
When you add a database connection, we store the host, port, database name, username, and password. Passwords are encrypted using AES-256-GCM before storage and are never logged or exposed in plaintext.
Usage Data
We collect information about how you use the Service, including queries submitted, features used, error reports, and performance metrics. This data helps us improve the Service.
Technical Data
We record IP addresses, browser type, device information and access times in our audit log, for security. Our error-tracking and analytics services do not store IP addresses.
02How We Use Your Information
- Service deliveryExecute queries, generate SQL, export results
- Account managementAuthentication, billing, support
- SecurityAudit logging, rate limiting, abuse prevention
- ImprovementAnonymized analytics to improve AI accuracy and UX
- CommunicationService updates, password resets, team invitations
03Data Storage & Security
Your data is stored in PostgreSQL databases with encryption at rest. Database credentials are encrypted with AES-256-GCM. We use HTTPS for all data transmission. API keys are stored as SHA-256 hashes.
04AI Processing
To write queries, your questions and details of your database structure (table and column names and types (including the allowed values of columns limited to a fixed list), keys, relationships and approximate row counts) are sent to our third-party AI inference providers. Explaining or fixing a query also sends the query text, and fixing it sends the database's error message. The data stored in your tables is not sent, except by three features that you choose to use: AI Insights on the website sends column statistics and up to 5 rows of the result; NatureQuery Analyst on the website sends up to 20 rows of the result of each read-only query it runs, so the AI can investigate your question and check its answer; and Summarize in NatureQuery Desktop sends up to 50 rows of the result, but only after you turn on "Let AI summaries use result rows" (off by default). For NatureQuery Analyst we keep how many questions you asked, the AI model used and what each question cost, to apply the limit of your plan, but not the questions, the queries or their results. We may change AI providers over time to keep quality and performance high.
05NatureQuery Desktop
On your computer
Your database connections, query results, query history, saved queries, settings and log files stay on your computer. Passwords, keys and tokens are encrypted with your Windows account and are never sent to NatureQuery. Log files have passwords and tokens removed.
Signing in
You sign in through your web browser, so the app never sees your NatureQuery password. For each computer that signs in, we keep its device name, operating system, app version and when it was last used. You can see and sign out each computer under Settings, Security on naturequery.app.
AI features
Ask, Fix with AI, Explain and Summarize send only what each feature needs, as described in AI Processing. We count your AI questions for your plan, but we do not store the questions, the queries or the details of your databases.
Reporting AI answers
If you report an AI answer as wrong or inappropriate, we keep what the AI was asked, its answer, your comment and your account email, so our team can review the report and reply to you.
06Data Sharing
We do not sell your personal information. We share data only with trusted parties for specific purposes:
- Lemon SqueezyPayment processing and merchant of record (name, email, billing info, transaction data)
- AI providersWriting, explaining and fixing queries, AI Insights, NatureQuery Analyst and summaries (see AI Processing)
- Email delivery providerSending account emails, and delivering contact messages and AI answer reports to our team
- Hosting providersRunning the website and storing account data and uploaded files
- Error tracking and analyticsError reports and usage statistics, without IP addresses or screen recordings
- Law enforcementWhen required by valid legal process
07Data Retention
- Account dataRetained while your account is active
- Query historyOn the website, retained per your plan (30 days for Free, unlimited for paid). In NatureQuery Desktop, kept on your computer until you clear it
- Audit logs and AI answer reportsRetained while your account is active
- Deleted accountsData purged within 30 days of deletion
08Your Rights
You have the following rights regarding your personal data:
- Access your personal data
- Correct inaccurate data
- Delete your account and associated data
- Export your data (queries, connections, settings) with Download my data in Settings, Security
- Withdraw consent for optional data processing
09Cookies
We use essential cookies for authentication (session tokens) and preference storage (theme). We do not use third-party tracking cookies or advertising pixels.
10Children's Privacy
NatureQuery is not intended for users under 16 years of age. We do not knowingly collect data from children.
11Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 30 days before they take effect.
Questions about this page?
Write to us and a person will answer, including requests about your data.
hello@naturequery.app