Security.

Our approach.

Novastart is an operating system whose desktop is an infinite canvas. The simplest way to protect what you put on it is to keep it where it is: your canvases, folders, apps and their positions live on your own machine, and nothing is copied to us. Where something has to leave your machine, to share a canvas, to run an AI agent or to install an update, this page says what goes where and why. We do not claim a certification or an audit we have not completed; what follows is what we do today.

Your data stays with you.

Canvas contents never leave your machine until you share a canvas. The app that runs Novastart in a window on Windows or an Intel Mac keeps the same rule inside that window. There is no copy of your canvases on a Novastart server, so there is nothing of yours on our side to lose.

Sharing and who can see what.

When you share a canvas, the people you invite see it, and only that canvas or folder, not your other canvases. Live windows stream directly from your machine to theirs, peer to peer, not through a server in the middle. Access follows the roles you give: only members can listen, and only editors can write. Leave and come back and the room is as the team left it.

AI Agents.

Agents run on OpenAI's computer-use models. To do a job, an agent needs to see the window it is working in, so the screenshots and instructions for that job go to the model provider; nothing else on your canvas is sent. Every agent has its own cursor and never touches yours, you can pause it, steer it or take a window back with a plain click, and every run is logged on your machine, with its steps, clicks and screenshots, so you can audit what an agent did. An independent verifier checks a fresh screenshot against the goal before a run is accepted.

Updates.

Novastart OS installs updates automatically, and each update is signed so that only software from us is installed. The update check tells our update service the address of your network and the version you run, and nothing about your canvases.

Accounts and payments.

If you create an account or buy a plan, we keep the email address you sign up with and your plan. Card numbers are handled by our payment provider and are not stored by us. Choose a strong password and keep it to yourself; there is no way for us to read it.

The website.

novastart.com is served over encrypted connections only, from Cloudflare's network, with headers that stop other sites from framing it, stop browsers from guessing file types, limit what a link carries to the next site, and turn off the camera, microphone and location features the site does not use. The site sets no tracking cookies today; see the privacy policy for the tools we may add and how to opt out. Questions and blog subscriptions are stored in a spreadsheet only the company can open, over an encrypted connection. Downloads are served from a storage service over encrypted connections. The site has no user accounts and stores no passwords.

Reporting a vulnerability.

If you believe you have found a security problem in Novastart, the app, Novastart OS or this website, tell us before you tell anyone else. Email support@novastart.com with "Security report" in the subject line and include what you found, the steps to reproduce it, the version or page involved, and how to reach you. We will confirm that we received your report within 3 business days, keep you informed while we look into it, and tell you when it is fixed. Please give us a reasonable time to fix a problem before you publish anything about it.

We will not take legal action against you for research done in good faith: testing your own installation and accounts, not accessing, changing or deleting anyone else's data, not disrupting the service, not using social engineering or physical attacks, and stopping as soon as you have shown that a problem exists. We do not run a paid bug bounty at this time.

If something goes wrong.

If we learn of a security incident that affects personal information we hold, we will contain it, work out what happened and who is affected, and notify the affected people and the authorities as the law requires, without undue delay. Where the incident is on your machine rather than ours, we will tell you what we know and what you can do.

What you can do.

• Keep Novastart OS and the app up to date; updates carry security fixes.
• Share canvases only with the people who need them, and give editor access only to those who need to change things.
• Look in on your agents and review their run logs, especially for jobs that touch accounts or money.
• Use a strong, unique password for your account, and for the accounts of the apps you sign in to on the canvas.

Contact.

Marketplace Distributors LLC, 319 36th St., Manhattan Beach, CA 90266. Security reports and questions: support@novastart.com, or the contact page.