Privacy Policy

Overview

Nocturne Labs, Inc. ("Nocturne", "we", "us") builds privacy-first study intelligence for students. This Privacy Policy explains what we collect, how we use it, and — just as importantly — the categories of data we have deliberately engineered ourselves to be unable to read.

Nocturne is built on a zero-knowledge architecture. Your uploaded lectures, slides, transcripts, and study guides are encrypted on your device before they ever reach our servers. We store the resulting ciphertext, never the contents.

Information we collect

When you create a vault we collect your email address, your authentication provider identifier (for example, your Google account ID if you sign in with Google), and an optional display name. This is the minimum required to authenticate you and associate your encrypted data with your account.

Lecture audio, slide decks, transcripts, study guides, and the keyword rankings derived from them are encrypted client-side with AES-GCM 256 and uploaded as opaque .bin blobs. We can see that a blob exists and its size — never what it contains.

We collect limited information needed to operate and secure the service:

• Device and browser type, operating system, and approximate region derived from IP
• Aggregate, non-identifying feature usage — for example, how many sessions were created, without their contents
• Error and crash diagnostics, scrubbed of any vault content

What we can never access

The following are structurally inaccessible to Nocturne. This is not a policy we could quietly reverse — it is enforced by the cryptography itself:

• Your vault passphrase — it never leaves your device, not even in hashed form
• Your Master Key, which is created as a non-extractable key and cannot be exported
• The decrypted contents of any lecture, slide, transcript, or study guide
• Your Recovery Kit, which only ever exists on devices where you choose to save it

How we use information

We use the limited information we can access only to:

• Authenticate you and maintain your session
• Store and sync your encrypted blobs across your devices
• Operate, secure, debug, and improve the service
• Send essential service notices, and — only if you opt in — product updates
• Comply with legal obligations and enforce our Terms of Service

Local-first processing

On the Free tier, speech-to-text (Whisper) and keyword modeling (BERT) run entirely in your browser via WebAssembly. Your lecture audio and transcript text are processed locally and are never transmitted to our servers or any third party for that processing.

Third parties and subprocessors

We rely on a small set of vetted subprocessors. They process only the limited data described below, and never your decrypted content:

• Supabase — authentication, database, and encrypted blob storage
• Google — OAuth sign-in, if you choose it
• YouTube Data API — only when you explicitly connect a video, to match Red Zone keywords against captions over HTTPS
• Stripe — payment processing for paid plans; we never receive your full card number
• Vercel — application hosting and content delivery

Cookies

We use a minimal set of strictly necessary cookies for authentication and vault state. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for specifics.

Data retention

We retain your account record and encrypted blobs for as long as your account is active. When you delete a session, its blobs are removed from storage. When you delete your account, your encrypted content is permanently deleted and your authentication record is removed within 30 days, subject to any legal retention obligations.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Because your content is encrypted under a key only you hold, you already hold the strongest possible form of access control over it.

To exercise any right, contact privacy@nocturne.app. We will respond within the timeframe required by applicable law, including the GDPR and CCPA.

International transfers

Nocturne is operated from the United States. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses. Because your content is encrypted in transit and at rest, its confidentiality does not depend on the jurisdiction in which a blob happens to be stored.

Children's privacy

Nocturne is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy as the product evolves. Material changes will be announced in-app or by email before they take effect. The "Last updated" date above always reflects the current version.

Contact

Questions about this policy or your data can be sent to privacy@nocturne.app.