Self-hosting nanoodle
The hosted site and the repository are the same files. If you'd rather not take our word for the privacy claims, don't — run it yourself.
Hosted vs. self-hosted
nanoodle.com serves exactly the files in the
public repo
(MIT) as a static site on Cloudflare — see wrangler.jsonc,
_headers, _redirects and sw.js in the repo. There
is no server-side code; hosting adds nothing but HTTPS and security headers.
Run it yourself
git clone https://github.com/nanoodlecom/nanoodle.git
cd nanoodle
python3 -m http.server 8000
# http://localhost:8000/ → the editor
# http://localhost:8000/play.html → the app builder
Any static file server works — there is no build step. Edit the HTML files, refresh the browser.
Notes
- Sign-in: NanoGPT OAuth needs an
http(s)origin; pasting an API key also works from plainfile://. - Headers:
_headersand_redirectsare Cloudflare conventions. On another host, reproduce the CSP headers yourself or skip them — the app works without, you just lose the browser-enforced guarantee. - Exported apps: the standalone
.htmlfiles nanoodle exports need no hosting at all.
Referral codes
The default config routes 10% of usage as referral credits to the maintainer —
NanoGPT pays this out of their side, and per their program, signing up through a referral
link gives you a 5% discount. If you self-host and would rather not, two things carry the
code: invitation_code in the OAuth authorize URL (search
index.html / play.html for invitation_code) and the
"create an account" links to nano-gpt.com/r/…. Replace the code with your
own, or delete the parameter and use bare nano-gpt.com links.
Why the repo is the privacy proof
nanoodle's privacy story isn't a policy, it's an architecture — and every piece of it is inspectable in the repo you just cloned:
- No analytics, no tracking, no third-party scripts. The only
dependency that isn't hand-written is vendored into
vendor/and served from the same origin — no CDNs. - Model calls go directly from the browser to nano-gpt.com on your own key. There is no nanoodle server to see your prompts, outputs, or key.
- Keys and workflows live in localStorage, on your machine.
- A per-path Content-Security-Policy (
_headers) pins which origins each page may talk to, so "no tracking" is enforced by the browser, not just promised in a README.
The privacy page states the same things in plain terms.