Privacy Policy

1. Information we collect

• Account information: Noctura runs its own sign-in; no third-party authentication service stores your account. When you sign in we keep your email address and a unique user ID so your canvases and credits follow you across devices. For guests, a pseudonymous random identifier is generated in your browser; a guest account that has not been used for 90 days is deleted, with its credits.
• Signing in with Google, Microsoft or GitHub: we request only your basic profile: a stable account identifier, your email address and whether the provider has verified it, your name, and your profile picture (Microsoft does not provide one). We use these solely to sign you in, recognise you on your next visit, and show your name and picture in your profile. We do not receive or store your passwords, contacts, files or any other data from these accounts, and we never post on your behalf. You can disconnect a provider at any time under Profile > Sign-in methods; deleting your account removes these records.
• Email codes and passwords: sign-in codes are sent from noreply@noctura.app, stored only as one-way hashes, and expire after 10 minutes. If you set a password, we store only a salted one-way hash (scrypt), never the password itself. Your signed-in session is a random token in a secure, HTTP-only cookie; we store only a hash of it, and signing out deletes it. Noctura for Word, which can’t keep cookies inside Word on the web, keeps its own session token of the same kind in the add-in’s storage and sends it with its requests; signing out in Word deletes it.
• Canvas data: your cards, their positions, notes, bookmarks and queries are stored in your browser, and in your account's database if you are signed in.
• Anonymous usage counts: we count actions such as starting a canvas, exploring a card or opening a source. Each count carries only the action, an optional number and a random visit identifier that lives in your browser tab and is discarded when the tab closes; it is not linked to your account, guest identity, IP address or device. Topics searched are counted per day in a separate list with no link to any visit or person, and topics searched fewer than three times are never shown. These counts contain no personal data and are kept for at most 13 months.

2. Payments

Payments are processed by Razorpay. Card, UPI and bank details are entered on Razorpay's checkout and are handled by Razorpay under its own privacy policy; Noctura never receives or stores them. We keep the Razorpay subscription and payment identifiers, the plan, amounts, dates and status, so we can credit your account, show your billing history, and handle cancellations and refunds.

3. Opt-in analytics

Noctura does not track you across the web. Engagement analytics (card reading time, exploration depth) are strictly opt-in: until you allow them in the privacy banner, they stay off. You can change this at any time in Settings → Privacy. Error reports contain no personal data.

4. Reading history & suggestions

When you are signed in, your home page suggests your next rabbit holes. The suggestions come from the canvases saved to your account, the interests you pick when the feed is new (you can change them any time from the feed), and, only if you turn on “Remember what I read”, your reading history. Noctura asks once, after you have opened a few cards. Until you say yes, nothing about what you read is kept.

• What is kept: the titles of the cards you open, read, explore, detail or keep reading, how long a card was open, the canvas topic it was on, which sources you opened, and which suggestions were shown to you, opened, explored afterwards, or marked “More like this” or “Not interested”, with the kind of source each came from (an article, a paper, a picture and so on). This is how the feed learns which suggestions work for you.
• What it is used for: your own suggestions, and nothing else. It is never sold, never shared with anyone, never used for advertising, and never used to make suggestions for other people. Suggestions are worked out by Noctura’s own software. Your reading history is not sent to an AI provider.
• Where it stays: in Noctura’s database, linked to your account.
• How long: each entry is deleted after 180 days.
• Your control: turn it off or clear it at any time in Settings → Privacy. Turning it off deletes it. It is included when you download your data and deleted with your account.
• Saved suggestions and interests: suggestions you save for later and the interests you pick are kept with your account until you remove them (they need no reading history). Both are included when you download your data and deleted with your account.
• Often explored together: once a day, Noctura counts which topics appear together on saved canvases. A pair is used only when it appears on the canvases of at least five different accounts, and only the pair and that number are kept, with no account, canvas or device identifier.
• Popular topics: “Something different” can suggest topics many people searched this month, never rare ones. Those counts hold no account, guest or device identifier.
• How well suggestions work: Noctura counts, per day and per kind of source, how many suggestions were shown, opened, and explored after opening. These are three counters, with no account, guest or device identifier, kept for 13 months.

To find suggestions, Noctura’s server searches Wikipedia, OpenAlex, Europe PMC, ClinicalTrials.gov, the Protein Data Bank, NASA’s image library, Open Library and The Metropolitan Museum of Art with a topic title, for example the title of a card you read, and reads the public news feeds of Quanta Magazine, ScienceDaily, The Conversation and NASA. Nothing about you is sent with those requests.

5. Literature sources & AI providers

To find and cite sources, Noctura queries open scholarly and science services (PubMed / NCBI, Europe PMC, arXiv, OpenAlex, Semantic Scholar, Crossref, Unpaywall, Wikipedia and Wikimedia Commons, ClinicalTrials.gov, PubChem, openFDA, UniProt, the Protein Data Bank and the AlphaFold database). These queries contain only the search terms, never your identity. To write summaries, the topic and the retrieved source texts are sent to an AI provider (Google Gemini; when it is slow or unavailable, the same request may go to another AI provider we use for the same purpose). Your account details are not included.

Your PDF library (Pro and Researcher). PDFs you add are read and kept in your browser on your device; they are not uploaded to Noctura. When you make a card from a PDF, ask your library a question, or explore a topic your PDFs cover, only the passages needed are sent to the AI provider to write the answer; Noctura does not store them.

Showing a source inside the app. To show a paper or web page at the cited passage, Noctura's server fetches it on your behalf, so the publisher sees Noctura's server rather than you. Nothing about you is sent with that request.

6. Cookies & browser storage

We use one essential cookie for your signed-in session, and your browser's local storage for your canvases and preferences. We do not use advertising or third-party tracking cookies.

7. Your data: export & deletion

You can export your canvases at any time (Markdown, Obsidian, BibTeX / RIS, Zotero, Notion, JSON and more, depending on your plan). You can delete your account and its stored canvases from your profile, or by emailing privacy@noctura.app. Downloading your data (Settings → Account) includes your reading history; deleting your account deletes it. Payment records may be kept as long as the law requires for accounting.

8. Security

All traffic is encrypted (HTTPS with HSTS). Passwords, sign-in codes and session tokens are stored only as one-way hashes. Access to the database is restricted to the service itself and its maintainers.

Contact

Privacy questions or requests: privacy@noctura.app. Anything else: info@noctura.app.