Privacy Policy

Last updated 20 October 2026

Nocto ("we", "us") runs nocto.app and is responsible for the personal information it holds about you. Your personal study material stays private unless you explicitly publish an eligible copy to an invite-only class. We collect what we need to run the app and take payment. We don't sell your data, and Nocto has no ads or third-party trackers.

What we collect

• Account. Your email address and password. Our sign-in provider stores your password only as a secure hash.
• Your library. The questions and answers you approve and save, quiz titles and subjects, and fingerprints (hashes) of the source PDF, used to check the file hasn't changed. The PDF itself is read on your device and is not uploaded. Lecture slides you add are also read on your device and stay in your browser; the PDF files are never uploaded. Images you add to questions stay in your browser.
• Study activity. Your answers, review ratings, and exam attempts and their timing. This lets us show your progress and mastery.
• Billing. If you subscribe, Stripe collects your payment details. We receive your Stripe customer ID, subscription status and payment dates, never your full card number.
• Technical. Our hosting providers keep standard request logs (IP address, browser type and time) to run and secure the service.
• Lecture matches. If you use lecture matching, which lecture pages go with each of your questions, with a one-sentence reason and the lecture's title, so the matches appear on any device you sign in on. Not the slides themselves.
• On your device. Nocto keeps your sign-in session and a copy of the app in your browser's storage, so it opens quickly and works offline. We use no advertising or tracking cookies.

How we use it

We use your information to:

• run Nocto and keep your library in sync across your devices;
• work out your progress and mastery;
• handle your subscription;
• send account emails, such as confirming your address and resetting your password;
• answer you when you contact us;
• keep the service secure.

We don't sell or rent personal information. We don't use your content for advertising or to train AI models.

Who can see it

Your personal library and study history are private to your account. When you choose to share a course as a class, you first preview the text questions, answers and explanations that will be published. Only that confirmed copy becomes available to authorized class members. Personal lecture PDFs and question images are not shared through this feature.

A class creator can see members’ display names and membership status, but cannot see their email addresses, answers, notes, progress or reveal usage. Each member’s study history stays private. Creators can remove members or close a class. Joining another class does not give another allowance of free reveals.

Content reports and the contact details supplied with them are available to the Nocto review team, not the class creator or other members. We use them to investigate and respond to reports. We access account data only to fix a reported problem, protect the service, handle a rights concern, or meet a legal requirement.

Optional AI features

Lecture matching finds the pages of your own lectures that teach each of your questions. It is optional: nothing is sent until you start it or turn on automatic matching. When you use it, Nocto sends the following to OpenAI through our server:

• the text of each page of the lectures you add, once per lecture;
• the text of each question being matched (stem, options, answer and explanation);
• for each question, the text of the lecture pages most similar to it.

Your PDF files, slide images and study history are never sent. OpenAI uses the text only to return the match. Under its API terms it does not train its models on it, and it keeps it for up to 30 days to detect abuse, or longer only where the law requires. Nocto does not keep the text it sends; it stores only the resulting match. AI repair of imported questions, where it is offered, works the same way and sends only the parts of a question you choose to repair.

Matches are made by AI and can be wrong. Check them against your lectures, and use "Wrong slide" to remove one.

Who processes it for us

• Supabase: database and sign-in. Your account and library are stored in the United States.
• Vercel: hosting.
• Stripe: payments.
• OpenAI: the optional AI features above, only when you use them. Processed in the United States.

These companies process data for us under their own security and privacy commitments. Because your information is stored outside Canada, the authorities of those countries may be able to access it under their laws.

How long we keep it

We keep your information while your account is open. You can delete any saved quiz yourself in Files. If you ask us to delete your account, we delete it, your library and your lecture matches within 30 days. Lectures stored in your browser stay there until you remove them in Files or clear your browser data. The exception is billing records that tax and accounting law requires us, or Stripe, to keep. Hosting logs expire on our providers' schedules.

Deleting a source course or personal bank does not delete an already published class copy. The creator can withdraw shared questions or banks, or close the class, to stop future access. Leaving a class, removal or closure does not reset reveal usage; private outcomes and accounting records are retained without restoring access to withdrawn content. Account-deletion and rights requests also cover shared content and reports; contact us using the address below.

Your rights

You can ask to see the personal information we hold about you, to correct it, or to delete it. You can also withdraw your consent, which means closing your account. Email support@nocto.app from your account's email address, and we'll reply within 30 days.

If you aren't satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

Security

Everything sent between your device and Nocto is encrypted (HTTPS). Database rules keep each account's records separate, and administrative access is limited. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

Children

Nocto is for adult learners. It is not meant for anyone under 16.

Changes

If we change this policy, we'll update the date above. For a significant change, we'll also tell you in the app or by email.

Contact

Privacy questions and requests: support@nocto.app.