Privacy Policy

Effective 26 October 2026 · Updated 27 October 2026

Nothing BOT is a small family of open-source tools for open-mic comedy, made by Amrit Dash. This one policy covers all three:

• Nothing BOT Curate: for curators. It sorts spot requests that arrive on WhatsApp, builds lineups and sends replies.
• Nothing BOT Comedy: for comics. It keeps a roster of rooms, watches the WhatsApp groups you choose for spot alerts, sends your spot asks and tracks your spots.
• Nothing BOT Server: the program that runs on your own computer, holds your WhatsApp connection and does the reading. Both apps use it.

They share one sign-in (your Google account), one database project and the same self-hosted server, so what we store about you is described together. The apps are hosted at nothingbotcurate.web.app, nothingbotcomedy.web.app and their matching nothing-bot-, nothingbut- and nothing-but- addresses. The source code is public at github.com/amrit-contour/spot-solutions, so every statement here can be checked.

Who this applies to

• Curators: people who sign in to Curate and link their WhatsApp.
• Comics: people who sign in to Comedy and link their WhatsApp.
• People who message them (for example comics asking a curator for a spot, curators replying to a comic's ask, or anyone who posts in a WhatsApp group a comic watches). They never use the app, but some of their messages are processed on the app user's behalf, as described below.
• Demo visitors: people who try the Curate demo without signing in.

What we collect and why

In Curate, messages that are not spot requests or related to your shows (personal chats, bank alerts, OTPs and so on) are read only to decide that they are not relevant, and are not stored. Chats from before you linked WhatsApp are only read when you run "Scan past messages" yourself. That scan runs on your own server, sends nothing to anyone, and messages that are not spot requests are not stored.

Firestore and Cloud Storage data is hosted by Google Cloud in the asia-south1 (Mumbai) region.

How messages are processed by AI

Where there is a choice, the app first tries plain rules, and uses a model only when the rules are unsure. By default the model is an open-weight Gemma model running on your own computer through Ollama. No cloud AI service sees your messages.

If you add a Gemini API key and choose "Local first, Gemini as backup", then when the local model is unavailable, the text being read may be sent to Google's Gemini API. That is only the text of the one message being read (a group message in Comedy, a request in Curate), a curator's reply to your ask together with the ask's room, date and time, or, for "Your voice", the sample messages being summarised. Whole chats are not sent. Google handles it under its Gemini API terms. If you choose "Local only", nothing is ever sent to a cloud model.

Your messages are not used to train AI models by us.

Your voice (both apps)

"Your voice" is off until you choose "Learn my voice". It then reads only messages you sent. You choose which chats: by default your recent WhatsApp DMs and the groups linked to your shows, or only the chats you pick (the list of your chats is fetched by name from your own server when you open the picker and is not stored; only the ones you tick are saved). Messages from other people are never read for this. Phone numbers and links are removed, and the model writes a short description of your style and picks up to 15 of your messages as examples. Only that description and those examples are stored; the chats themselves are not. The AI model that does this follows your AI models setting: on "Local only" nothing leaves your server.

When it's on, each message to a comic is drafted from the show details, your description and examples, and your own template. A draft that changes or drops a date, time, venue or link is discarded and your template is sent instead. You can switch it off, edit the description, or remove examples at any time.

Messages page (Curate)

The Messages page lets you read and answer your comics' WhatsApp chats inside the app. Chats are fetched on demand from your own server, which reads them from your own WhatsApp when you open the page or a chat, and are never written to our database. The only trace is the short-lived result of that request, which is readable only by you, is deleted by the app as soon as it has been shown, and carries an expiry so Firestore removes it within about a day even if the app is closed first. Only people on your Comics list are listed; personal chats and groups are never opened. A message you send from here is sent the same way as any other reply, from your own WhatsApp.

"Summarise this chat" asks the AI model you chose in AI models (local by default; on "Local only" nothing leaves your server) to read the latest messages of that one chat. It only suggests: nothing is sent or changed until you click, and each suggested change must quote your chat. The summary is shown to you and is not saved.

Google Contacts (Curate)

If you turn on "Save names to Google Contacts", the app asks Google for permission to manage your contacts (https://www.googleapis.com/auth/contacts). It uses that permission only to:

• read the names and phone numbers in your contacts, to find a contact with the same phone number as a comic;
• create a contact (name and phone number) for a comic you add, or update that contact's name when you rename the comic.

It never deletes contacts and never changes anything other than names and phone numbers. Bulk changes (for example "Sync all comics now") are shown to you for confirmation first, and an import of many comics at once is never saved automatically.

There are two ways to connect:

• Keep connected (recommended). You approve once in Google's own popup. Nothing BOT then stores a long-lived access token for your Google account, so your comic names are saved to Google Contacts even when the app is closed. We store: (1) that token, encrypted with AES-256-GCM, with the key held in Google Cloud Secret Manager and not in the database; and (2) the email address of the Google account you connected, and the date. They live in Cloud Firestore in the asia-south1 (Mumbai) region, in documents that no signed-in user, including you, can read or write through the app: the token is never sent back to your browser. Only the app's Cloud Functions, acting for you, can decrypt it, and only to exchange it with Google for a short-lived access token. We check that the Google account you pick has the same verified email as the one you signed in with, and refuse it otherwise.
• For this visit only. The access token is kept in your browser's memory for about an hour and is never stored on our servers.

In both cases your Google contact list is not copied to our database. When names are saved from the server, the list of your contacts' phone numbers and names is read into the function's memory for the few seconds it takes to match numbers and write names, and is then discarded.

Disconnecting. Press Disconnect under Settings, Google Contacts. The app revokes the token with Google and deletes the stored copy straight away. You can also remove access at any time at myaccount.google.com/permissions; the app notices the next time it tries to save a name, marks Google Contacts as disconnected and leaves a note in Updates.

Nothing BOT's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the feature you asked for, and do not allow humans to read it except with your consent, for security purposes, or as required by law.

Nothing BOT Comedy in detail

Watched groups and spot alerts

Comedy reads a WhatsApp group only if you added it to your watched groups. That check comes first, before the text or the author is looked at: groups you did not pick are never read. In a watched group it looks for four kinds of message: a spot offer, a room being full or closed, a curator schedule update, and an opening notice. Anything else is dropped without being stored. What is kept is the parsed fields (room, date, time, who posted) and a short quote, never the chat. Simple rules read the message first; the AI model is used only when the rules are unsure. A new offer can send you a push notification, and group updates change your rooms only if you turned on automatic updates (otherwise each waits for your tap). You can stop watching a group at any time.

Push notifications

If you allow notifications, your browser or phone gives the app a device token through Firebase Cloud Messaging. We store the token, the platform and when it was last used, tagged with the app that asked for it. It is used only to send you the alerts you turned on. You can turn them off in your browser or device settings at any time.

Asks to curators

When you ask a room for a spot, the message is sent from your own WhatsApp, as a direct message to the curator, in your name. It goes out when you send it, or automatically only for rooms you set to send on their own. If you turned on "Your voice" the wording may be rewritten to sound like you, but a rewrite that changes a date, time or link is discarded. After an ask goes out, Comedy reads that curator's replies in that one chat, to work out whether you got the spot, were declined or it is unclear. It reads only the curator's messages after the ask, not the rest of the conversation. Voice notes, stickers and images are not read; an emoji-only reply is understood without a model and flagged for you to confirm. A reply is stored as a short quote and the result. The model never decides alone: its answer has to quote the reply.

My spots, regular spots, notes, ratings and set lists

These are yours. They are stored in your account and only you can read them, apart from the exceptions below that you choose.

Rooms and curators

Your roster of rooms includes the curators you list, with the names and phone numbers (and Instagram handles) that you type or import yourself. Please only enter details you are allowed to keep, and see the Terms.

Community rosters

You can publish a roster of rooms so other comics can follow it. A published roster contains the rooms, their shows and times, and the curators of each room including their names, phone numbers and Instagram handles, and it is visible to every signed-in, approved member of Nothing BOT, not just your followers. Only people the administrators approved to publish can publish. Other things people can do with a roster: suggest a change (the suggestion, its author's name and a note are visible to that roster's maintainers and the author), become a co-maintainer you add, follow it (we store only the follower's name and a date, and the app shows a count), or receive a copy you share with one person. Adding a co-maintainer, or sharing rooms with one person, uses a directory of approved members: it shows each member's name, email address and profile photo so you can pick who you mean. The directory is only shown to signed-in, approved members and is never public. You can unpublish a roster, which deletes it; copies already shared with someone stay in their account.

The agent number

Comics can talk to the agent number about their rooms, spots, asks and alerts. See "The agent number" below: it reads only what you send it, repeats what it understood before changing anything that matters, and any ask still goes out from your own WhatsApp.

Connection status

Comedy shows whether your WhatsApp is connected and which server is running it, using the status your server reports.

Nothing BOT Server

The server is a program you (or an administrator on your behalf) run on a computer you control. It holds the WhatsApp Web connection, reads messages, runs the local AI model and writes the results to the database. Your chats stay on that computer: the apps and our database only ever receive the parsed results described above. Whoever holds the server's credentials can technically read what the server can read, as with any self-hosted software. Running a server records its name, version, status and last-seen time in the database. Your WhatsApp login session is stored on the server and, encrypted, in Cloud Storage so another of your servers can take over (see the table).

The agent number

The agent number is optional and off until you link it. It works for both apps: curators use it for their lineups, and comics can use it to ask about and change their rooms, spots and asks (for example "ask the Tuesday room"). It acts on your Comedy data only, never reads your chats, and the rules below apply to both. It is a second WhatsApp number, linked the same way as yours, that Nothing BOT uses to message you: mic checks, new-request summaries, a morning summary, and answers to what you ask it. You can also ask it to make changes (for example "add Rohan to Tuesday"); it repeats what it understood and does nothing until you reply yes.

• What it reads: only messages sent to it from your own number, in a one-to-one chat. Messages from anyone else, and everything in groups, are ignored: they are not read, not logged and not stored. Optionally it can answer a stranger with one fixed polite line; that setting is off by default, and it keeps only a one-way hash of who it told, never the message.
• What it stores: its own WhatsApp login (encrypted, backed up like yours so another server can take over), what it is waiting for you to answer (for up to 10 minutes), and when it last sent your morning summary. Your messages to it are not kept.
• What it never does: message comics, groups or anyone but you. Anything that goes to a comic still goes out from your own WhatsApp, and only after you say yes.
• AI: your short message to it may be read by the same AI model as the rest of the app, under your AI models setting, only to work out what you meant. The answer is always built from your own data, not written by the model.

You can switch each part off, or unlink the agent number in Settings; that deletes its saved login.

What we never do

• Sell or rent your data, or use it for advertising.
• Send WhatsApp messages without your action. Replies, confirmations and asks go out when you press send, or for the optional automatic features (Curate auto-acknowledgement, Comedy rooms set to send their own asks) only when you turned them on.
• Use your data to train AI models.
• Read a WhatsApp group you did not choose to watch, or a chat other than the one you asked about.

Who can access your data

• You, through the app.
• Other signed-in members, but only for what you choose to publish or share, such as a community roster and its curator details.
• The people who run the servers your account uses. Servers are ordinary computers run by the project's administrators; whoever holds a server's credentials can technically read the project's data, as with any self-hosted software.
• Cloud Functions acting for you, for Google Contacts (Curate): if you pressed Keep connected, the app's own server code uses your stored token, and only for your account, to save the names you add or rename. No person reads it. The people who run the project's Google Cloud could technically reach the encrypted token and its key, as with any hosted service.
• Google, as the provider of Firebase, Google Cloud and (only if you allow it) the Gemini API, under its own terms.

Demo visitors

The demo signs you in anonymously and gives you a private copy of sample data. Nothing you do there touches real WhatsApp accounts, and demo sandboxes may be deleted at any time.

Keeping and deleting data

Your data is kept while you use the apps. You can unlink WhatsApp at any time in Settings, which deletes the login session and its encrypted backup. To have your account and all of its data deleted, ask an administrator or open a request on GitHub; the app has tools to delete everything for an account. You can also revoke the app's Google access, and so stop it saving names to your contacts, at any time at myaccount.google.com/permissions.

Security

Access to data is enforced by Firestore security rules: each curator can read only their own data, and server-only data (such as encryption keys, login backups and the encrypted Google Contacts token) is not readable by any app user. WhatsApp login backups are encrypted before upload. See SECURITY.md for details and how to report a problem.

Children

Nothing BOT is not intended for anyone under 18.

Changes

If this policy changes, the new version will be posted here with a new effective date.

Contact

Questions or requests: open an issue at github.com/amrit-contour/spot-solutions/issues.