Naget Privacy Policy

Last updated: October 24, 2026

Naget is an AI-assisted search and research service that helps you find sources, generate answers, and organize results. It is a project by the Artificial Intelligence Research Translation Initiative (AIX) and the Center for Intelligent Information Retrieval (CIIR) at the University of Massachusetts Amherst. This policy explains how Naget collects, uses, stores, and shares information when you visit our website, request early access, sign in, or use our search application and APIs.

For privacy questions or requests concerning your information, contact the Naget team at info@naget.com.

1. Information we collect

• Account information: your email address, display name, sign-in provider and provider account identifier, and any profile details you choose to add. If you register with a password, we store a password hash, rather than your password in readable form.
• Early-access and support information: the contact details, affiliation, research interests, intended uses, and other information you submit through our waitlist or in messages to us.
• Search and research content: your queries, follow-up messages, uploaded files, datasets, saved searches, agent and search-tool settings, generated answers, and results. This includes content you submit through our APIs.
• Technical and usage information: account and session identifiers, IP addresses, browser information, request times, errors, API usage, and credit or usage records. Our activity logging can also record submitted queries and interaction metadata, such as clicks, pointer and keyboard interactions, scrolling, time spent hovering over results, navigation, and interactions with tables. The interaction collector does not record passwords, general form-field values, clipboard contents, or the text of individual character keys; submitted search queries are recorded separately.

2. Google sign-in and Google user data

If you choose “Continue with Google,” Naget requests the openid, email, and profile permissions. Google provides your Google account identifier, email address and its verification status, name, and profile picture URL, where available. Naget uses this information to verify your identity, check your early-access eligibility, create or link your Naget account, and sign you in. Your name may become your initial Naget display name.

We store your Google account identifier and account email to recognize your linked account, and store your name when it is used to create your Naget profile. The current sign-in flow reads, but does not save, Google's profile picture URL. Google OAuth tokens are used during sign-in and are not saved in Naget's account database; Naget issues its own session credentials. We do not receive your Google password. These permissions do not give Naget access to Gmail messages, Google Drive files, calendars, contacts, or other private Google Workspace content.

Google sign-in information is used for account access and the associated account features described here. We do not sell this information, use it for advertising, or use it to train generalized AI or machine-learning models. We do not send your Google sign-in profile to AI providers as part of signing you in. Information you independently include in a search or upload is processed as search content, as explained below.

Naget follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring information received from Google APIs.

3. How we use information

• Provide sign-in, account management, early access, and customer support.
• Run searches, process uploads and datasets, generate answers, and save the research history and tools you use in Naget.
• Manage API access, usage limits, credits, and service costs.
• Diagnose failures, prevent abuse, protect accounts, and understand how search features and results are used so we can improve the service.
• Respond to requests and communicate about your account or early access.

Authorized Naget team members can access account information, search content, and diagnostic or activity records when needed to operate the service, investigate problems, or respond to support requests.

4. When information is shared

We do not sell your personal information. Information may be disclosed in these circumstances:

• Service infrastructure: providers that deliver our website, host or store service data, and support operation of the application may process account, content, and technical information needed for those functions. This includes website delivery through Cloudflare and our database, compute, and object-storage infrastructure. Google account information stored by Naget is handled by the account and hosting systems used to provide sign-in and account features.
• AI and search processing: to carry out your requests, we send relevant queries, conversation context, uploaded content, and retrieved sources to the model, search, and processing providers used for the selected feature. These can include OpenRouter and the model providers it routes to, DeepInfra, other hosted inference services, and external web-search providers. A search-tool or connector you choose may receive the inputs needed to run that tool. Those providers process information under their own applicable terms and privacy policies.
• Content you publish: when you publish an agent or search tool to the marketplace, its published details and your associated public profile, including your display name, are visible to other users. Consider what you include before publishing.
• Security and legal requirements: we may disclose information when necessary to investigate abuse, protect the service or its users, or comply with applicable law or a valid legal request.

External websites you open from search results receive information directly from your browser and follow their own privacy policies. Loading externally hosted resources, such as fonts or site icons, also sends the resource provider technical information such as your IP address.

5. Storage, security, and retention

Account and service records are stored in our databases. Uploaded content, datasets, and generated artifacts may also be stored in object storage or on the systems that process your request. Our public website uses HTTPS. We use authentication and access controls to restrict access to accounts and administrative features. No method of storage or transmission is completely secure.

We retain account records, including your linked Google identifier, email, and saved display name, while your account remains open. Saved research and datasets remain available according to the feature's storage lifecycle or until they are deleted. Diagnostic records, activity logs, temporary files, and usage records have separate retention periods for troubleshooting, service operation, security, and accounting; they do not all expire when you sign out. You can request deletion of your account and associated personal information using the contact details below.

Deletion may not immediately remove every copy from backups. Information necessary for legal obligations, security investigations, or resolving disputes may be retained for those purposes. Revoking Google access alone does not delete information already stored by Naget.

6. Cookies and browser storage

Naget uses cookies and browser storage to maintain sign-in sessions, protect the sign-in flow, remember preferences such as your theme, and maintain application state. Browser storage may also hold pending activity events before they are sent to Naget. You can clear or block cookies and site storage in your browser; doing so may sign you out or prevent features from working.

7. Your choices, access, and deletion

• Access, correct, or delete your information: email info@naget.com with your request, including the email address associated with your Naget account. You can request deletion of your account and associated Google sign-in data, search content, or waitlist submission. We may ask you to verify account ownership before acting. Do not send your password or authentication tokens.
• Revoke Google access: visit your Google Account's third-party connections and remove Naget's access. This withdraws Google's authorization. To end an existing Naget session, also sign out of Naget; to delete your stored Naget information, contact us as described above.
• Control what you submit: choose what you include in searches, uploads, your profile, and published tools. Only submit information you intend Naget and the relevant processing providers to handle for your request.

8. Changes and contact

We will update this page and its revision date when our practices change. If we seek to use Google user data for a new purpose or request additional Google permissions, we will disclose the change and obtain any required consent before doing so.

Contact: info@naget.com. You can also read the University of Massachusetts Amherst's Information Privacy Policy and Site Policies, and Naget's Terms of use.