Privacy Policy
1. Who we are
Nocturne is a reply assistant for chatters who work for content creators. It is made up of the website at nocturne.host, the customer portal at app.nocturne.host, and the Nocturne desktop app for Windows.
Nocturne is run by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], registered under number [COMPANY / REGISTRATION NUMBER] ("Nocturne", "we", "us"). For anything in this policy, write to [email protected] [or a dedicated privacy address].
2. Our two roles
Data protection law treats us differently depending on whose data it is.
- We are the controller for data about our customers and their team members (chatters, agency owners and admins), about people who join our waitlist, and about visitors to our website and portal. This policy explains how we handle that data.
- We are a processor for the content our customers put into Nocturne about the creators they work for and the fans they talk to: creator profiles, fan names and notes, the fan messages they paste or capture, and the drafts we write from them. The agency or creator who uses Nocturne decides why that data is processed, and we only process it on their instructions to provide the service. Our [Data Processing Agreement, link] with customers sets out the terms.
3. What we collect
When you create and use an account
- Account details: first name, email address, password (we store only a salted hash, never the password), your role (owner, admin or chatter), the agency you belong to, and the activation key you used.
- Plan details: your plan, how many drafts you have used this month, and when your plan or seat ends.
- Sign-in and security data: email verification codes (stored as hashes and deleted once they expire), session tokens (stored as hashes), and, if you turn on two-factor sign-in, your authenticator secret (encrypted) and recovery codes.
- Your PC: each seat is locked to one PC. The app sends a salted hash of the PC's hardware ID (never the ID itself), the Windows version and the app version. We keep a keyed hash of the IP address used to sign in from that PC, to spot a seat copied to another machine. If you ask to move your seat to a new PC, we keep that request, including its IP address, until staff decide on it.
- Security log: important account events (sign-ins and failed sign-ins, codes issued and redeemed, PC changes, profile changes, fans erased) with the time and, for some events, the IP address.
Content you put into Nocturne
Customers add this content, usually about other people. We process it for them (see section 2).
- Creator profiles: the persona, voice, content menu, prices, limits and other notes you write for each creator, and the confirmation that the creator is 18 or older.
- Fan library: fan names or handles and the notes you keep about them.
- Messages and drafts: the fan messages you paste or capture, the instructions you add, and the drafts and rewrites Nocturne writes.
- Playbooks and snippets: scripts, sample lines and text-expander snippets you import or write.
- Screen captures: when you use capture, the app sends only the part of the screen you select. It is read to pull out the fan's message and draft a reply, then discarded. We do not store capture images.
Fan messages, especially in sexting mode, can reveal details about a person's sex life or sexual preferences. This is sensitive data under data protection law. We use it only to write the drafts you ask for, keep drafts for 7 days, and never use it for anything else.
Usage and quality data
- Counts of drafts, captures, rewrites and translations per day, how long drafts took, and which features were used.
- When a draft is rewritten or replaced because it broke one of our content rules, a record of which rule it was. These records do not contain the draft text.
- Thumbs up or down you give a draft, and problem reports you send from the app. Please do not paste fan messages into a problem report.
- Error reports from our servers (the route and error code, not the content of your request).
Payments
We do not take card payments. If you pay by invoice or cryptocurrency, we keep the invoice details (name, business name, address, tax number where given), the amount, the date, and the payment reference or transaction ID.
Discord
If you choose to link your account to our Discord server, we store your Discord user ID and username and which member role we gave you. We do not keep your sign-in token for that service.
Website and waitlist
- If you join the waitlist: your email, the role and team size you choose, the plan you're interested in, which form you used, and the country our hosting provider derives from your IP address.
- Our hosting provider processes your IP address and basic request data to deliver pages and protect the site against abuse.
- Our pages load fonts from a third-party font service, which receives your IP address when the page loads. [Or: we host our fonts ourselves.]
4. Why we use it
| What we do | Data used | Legal basis (EU/UK GDPR) |
|---|---|---|
| Create your account, check your activation key, run your plan and its limits | Account, plan, PC | Performing our contract with you |
| Write drafts, read captures, translate, keep your fan library and profiles | Content you put in | Performing our contract with the customer; for fan and creator data, the customer's instructions (we are their processor) |
| Keep accounts and seats secure, stop key sharing and abuse, investigate problems | Sign-in and security data, PC data, security log | Our legitimate interest in a secure service, and our contract with you |
| Apply our content rules (no minors, no meeting in person, no false claims and similar) | Content you put in, rule records | Performing our contract; our legitimate interest in preventing illegal and harmful use |
| Send sign-up codes and service emails (plan ending, important changes) | Email, first name | Performing our contract |
| Improve Nocturne: fix bugs, tune drafts and rules | Usage data, feedback, and drafts within their 7-day life | Our legitimate interest in improving the service |
| Invoices, accounting and tax | Payment data | Legal obligation |
| Tell waitlist members when access opens | Waitlist data | [Consent, or legitimate interest] |
| Discord member roles | Discord user ID | Your request, as part of our contract |
We do not sell personal data. We do not use it for advertising. We do not use your content, or fan messages, to train AI models. [CONFIRM: our AI processing providers' terms also forbid training on and keeping API data.] We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our content rules change or replace drafts automatically, but you always decide what to send.
5. How drafts are made, and where
To write a draft, Nocturne sends the relevant text (the fan's message and recent turns, your instructions, the creator profile and any fan notes you use) to AI processing services that act for us under contract. They return the draft, and we check it against our content rules before you see it.
| Feature | Where it is processed |
|---|---|
| Normal reply drafts and rewrites | EU. If the EU service is down, a backup in the US answers instead. |
| Screen captures in reply mode | EU, with the same US backup. |
| Sexting drafts and sexting screenshots | US |
| Translations | US |
| Drafts made with the Best quality switch on | US |
Your account data, creator profiles, fan library and drafts are stored in our database in the EU.
6. Who we share it with
We share personal data only with:
- Discord, only if you link your account, to give you the member role for your plan.
- Service providers acting for us: hosting and database (EU), website and portal hosting and delivery, email delivery for sign-up codes, and AI processing (EU and US, see section 5). They may use the data only to provide their service to us. Agencies can get the list of these providers, by name, in our Data Processing Agreement.
- Your agency: if you are a chatter, your agency's owners and admins can see your name, email, which PC your seat is on, your plan and seat dates, and your usage counts. They cannot see your password.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Authorities when the law requires it, or to report content involving the abuse of minors.
- A buyer or successor if Nocturne or its business is sold or merged, under this policy.
Nocturne never connects to or sends anything to the platforms you chat on. You copy and send every message yourself.
7. Transfers outside the EU
Some processing happens in the US (see section 5). When personal data leaves the EU or UK, we protect it with [the European Commission's Standard Contractual Clauses / the EU-US Data Privacy Framework, as applicable]. You can ask us for a copy of the safeguards we use.
8. How long we keep it
| Data | How long |
|---|---|
| Drafts, rewrites and the fan text they quote | 7 days, then deleted automatically |
| Screen capture images | Not stored. Discarded once read. |
| Unfinished sign-ups and email codes | Deleted once they expire (codes work for 10 minutes) |
| Fan library entries and notes | Until your agency deletes them. An agency owner can erase a fan completely, which deletes the fan, every note and every draft written for them. |
| Creator profiles, playbooks and snippets | Until deleted, or [30] days after the agency's plan ends |
| Account and seat data | While the account is active, then [90 days] after the plan ends |
| Usage counts, rule records and feedback (no message text) | [24 months], then kept only as totals that identify no one |
| Security log, including IP addresses | [12 months] |
| Invoices and payment records | As long as tax law requires [e.g. 10 years] |
| Waitlist | Until you get access or ask us to remove you, and no longer than [12 months] |
9. How we protect it
- Creator profiles, fan names and notes, drafts, playbooks and authenticator secrets are encrypted at rest with a separate key for each agency.
- Each agency's data is kept apart from every other agency's at the database level.
- Passwords are stored only as salted hashes. Agency owners and admins must use two-factor sign-in.
- Each seat is locked to one PC, and moving it needs approval from our staff.
- Our staff sign in with a password and an authenticator code, and their actions are logged.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
10. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data, or send it to someone else in a usable format;
- correct it if it is wrong;
- delete it;
- restrict how we use it, or object to our use based on legitimate interests;
- withdraw consent, where we rely on it.
Email [email protected] from the address on your account. We may ask you to confirm your identity, and we reply within one month. If the request is about content your agency put into Nocturne, we may pass it to your agency, since they control that data.
You also have the right to complain to a data protection authority, for example in the country where you live or work. Our lead authority is [SUPERVISORY AUTHORITY].
11. If you are a fan
If you chatted with a creator whose team uses Nocturne, your messages and notes about you may have passed through Nocturne. The creator or their agency decides how that data is used, so please contact them first. If you contact us, we will forward your request to the right customer and help them respond. Drafts that quote your messages are deleted after 7 days, and a fan's whole record can be erased on request.
12. Adults only
Nocturne is only for people aged 18 or older, and only for work with creators aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.
13. Cookies and local storage
We do not use advertising or analytics cookies. The website stores a display preference in your browser for the current session. The portal stores your sign-in session in your browser (for 30 days if you tick "Remember me", otherwise until it expires). The desktop app stores your settings and sign-in on your PC. These are needed for the service to work.
14. Changes
We may update this policy. If a change matters, we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.
15. Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Email: [email protected].
[If required: our EU or UK representative is …]