Loading…
Loading…
Last updated: March 2026
When you sign in with Google, we receive your email address, display name, and profile identifier via Supabase Auth. Story configurations, conversation content, and session state you create are stored for syncing and restoring stories across devices.
You can join shared story sessions without creating an account. When you do, we generate a random guest identifier and store it in your browser's local storage along with your chosen nickname. No email, real name, or device fingerprint is collected from guest users.
If you subscribe or purchase credits, payment is processed entirely by Stripe. We receive only a transaction confirmation and subscription status — we never see or store your card number, CVV, or billing address.
We collect anonymous, aggregated usage data (page views, feature interactions) via Vercel Analytics. This data contains no personal identifiers and cannot be traced back to individual users.
We use your browser's local storage (not cookies) for functional purposes only:
We use Google Analytics 4 (GA4) to collect anonymous usage statistics such as page views, session duration, and general device/browser information. GA4 may set cookies on your device for this purpose. For visitors in the European Economic Area (EEA) and the United Kingdom, we display a cookie consent banner and only load GA4 after you explicitly grant consent. Visitors outside the EEA/UK are covered by GA4's standard data processing terms. You may decline analytics cookies at any time; declining does not affect your ability to use the service. We do not use advertising cookies or third-party tracking pixels.
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
Story narratives, character dialogue, and images are generated by AI models (OpenAI). Your story inputs (descriptions, messages) are sent to these providers for processing and are subject to their respective data policies. AI-generated outputs may be inaccurate, fictional, or unexpected — they do not represent the views of Noctveil.
Your story choices, messages, and inputs are processed by our AI providers to generate narrative content. Your display name is associated with your account data. Please do not share sensitive personal information within stories.
We rely on the following third-party services, each governed by their own privacy policy:
Your data is processed and stored on servers located in the United States through our service providers (Supabase, Vercel, OpenAI). If you are located outside the United States, including in the European Economic Area (EEA), your data will be transferred to and processed in the United States. We rely on standard contractual clauses and our providers' compliance frameworks to ensure adequate protection of your data during such transfers.
We retain your account data and story content for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g. payment records). Guest data (random IDs) stored in our database is retained for the lifetime of the story session and may be purged when the story is deleted by its owner.
We implement industry-standard security measures including encrypted connections (HTTPS/TLS), secure authentication via OAuth 2.0, row-level security policies on our database, and server-side access controls. However, no system is 100% secure. If you discover a vulnerability, please contact us immediately.
You have the right to access, correct, or delete your personal information at any time. Contact us to request data export or account deletion.
If you are in the EEA, you have additional rights under the General Data Protection Regulation, including:
Our legal basis for processing your data is: (a) performance of a contract (providing the service you signed up for), (b) legitimate interest (improving the service, preventing abuse), and (c) your consent (where applicable).
If you are a California resident, you have the right to:
We do not sell your personal information. We do not share personal information with third parties for their own marketing purposes. To exercise any of these rights, contact us at the email below.
Noctveil is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us.
We may update this privacy policy from time to time. Material changes will be noted by updating the “Last updated” date at the top. Continued use of the service after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.
For privacy-related questions, data access/deletion requests, or concerns, contact us at info@noctveil.ai.