Privacy Policy

1. Data We Collect

1.1. Account data: email address, display name, password hash, role, and user identifier.

1.2. Library data: uploaded audio files, covers, track metadata, playlists, listening history, likes, and player settings.

1.3. Payment data: payment status, subscription plan, billing cycle, and transaction identifiers. Card numbers are processed by the payment provider and are never stored on Noct servers.

1.4. Technical data: IP address, User-Agent, session cookies, usage events (plays, uploads), and diagnostic logs required for security and service reliability.

2. How We Use Data

• Account creation, authentication, and account recovery.
• Storing, organizing, and playing back your media library.
• Processing subscriptions, payments, promo codes, and referrals.
• Security, abuse prevention, and plan limit enforcement.
• Product improvement through anonymized usage analytics.

3. Cookies & Local Storage

3.1. We use strictly necessary cookies (auth-token) for session continuity, plus localStorage / IndexedDB for client-side UI preferences on your device.

3.2. We do not use third-party advertising trackers and do not sell behavioral data to ad networks.

4. Retention & Security

4.1. Passwords are stored only as cryptographic hashes (bcrypt). Sessions are protected with signed tokens and hardened cookie flags (HttpOnly, SameSite).

4.2. Access to personal data is limited to authorized platform operations and is not shared with third parties except where required by law.

4.3. We apply reasonable technical and organizational measures, but cannot guarantee absolute security of internet transmission (see also the warranty disclaimer in the Terms of Use).

5. Third-Party Sharing

5.1. Payment providers — to process transactions and invoices.

5.2. Infrastructure providers (hosting, databases, file delivery) — solely to operate the service.

5.3. Authorities — only under binding legal obligation. We do not sell or rent personal data.

6. Your Rights

• Request a copy of personal data linked to your account.
• Correct inaccurate data via profile settings.
• Delete your account and related data (files, playlists, history).
• Withdraw consent by discontinuing use of the service.
• For EU/EEA residents — exercise GDPR rights (including data portability).

7. Children's Data

The service is not directed at individuals under 13 (or the digital consent age in your jurisdiction). If we learn that data was collected from a child without proper consent, it will be deleted.

8. Policy Changes

We may update this Policy. Material changes are posted on this page with an updated version date. Continued use after publication constitutes acceptance. Registration requires explicit acceptance of the current version.

9. Contact

For privacy requests and data-subject rights, use the in-app support channel or the contact address published on the official Noct project page.