1. Controller and scope
StorkLogic, established in Brazil, is responsible for processing personal data to operate Noence. Contact storklogic@gmail.com about privacy and your rights.
This Policy covers the app and related pages. The service is for people aged 18 or older. Report possible underage accounts for assessment and action. Acknowledging this Policy is not blanket consent: we use an appropriate legal basis for each purpose.
2. Data we process
Account and profile: email, a password protected by hashing, verification, username, display name, biography, avatar and data necessary for authentication, recovery and deletion.
Content and relationships: photos, Now, messages, replies about moments, connections, Circles, audiences and interactions needed for features. Content may reveal personal information about you and others; share only what you are entitled to share.
Device and operation: pseudonymous installation and session identifiers, platform, app and system versions, technical request information, IP addresses and user agents in infrastructure logs, security records, and error and performance diagnostics when enabled. Hashing does not anonymise all other data.
Notifications and support: delivery identifiers, preferences, requests, reports, responses and information needed for assessment.
Acknowledgements: document, version, language, date, time, and HMAC hashes of the IP and user agent for evidence of acceptance and security.
3. Purposes and legal bases
We process data to create and authenticate accounts, deliver content to selected audiences, maintain connections and messaging, and provide export and deletion, relying on contractual performance and steps related to requested services where applicable.
We may rely on legitimate interests for security, fraud prevention, abuse investigation and maintenance where permitted and compatible with people’s rights. Other purposes include legal obligations and establishing, exercising or defending rights.
Camera, photo library and notification features request operating-system permissions as needed. You control them on your device. A system permission does not replace separate consent required by law. Sensitive information is not required for a profile; avoid sharing it without appropriate grounds and understanding the audience.
4. Access, providers and website
Authenticated users may find your username, display name, biography and avatar; your email is not part of that profile. Posts follow the selected audience and messages are available to participants. Recipients may make copies beyond our control.
Authorised people may access data when needed for support, safety, reports, maintenance and legal duties. We do not promise end-to-end encryption.
Depending on services used, providers include Resend for email; Expo, Apple and Google for notifications; Datadog for diagnostics when enabled; DigitalOcean for infrastructure; and Cloudflare for website delivery and protection and object storage where configured. Databases, cache and storage also form part of the infrastructure.
The website stores language and theme preferences in browser local storage. You can clear them in browser settings. Infrastructure and page delivery may generate technical access logs. The processing described here does not include selling personal information or sharing it for cross-context behavioural advertising.
5. International processing
Data may be processed in Brazil and countries where providers and infrastructure operate, with different legal protections and authorities’ access powers. Where required, transfers depend on a valid mechanism, such as adequacy or recognised contractual safeguards. You may request destinations and applicable mechanisms.
We may disclose information necessary for valid obligations, protecting people or exercising rights, respecting the law and limiting disclosure to what is needed.
6. Retention and deletion
Retention depends on purpose, account activity, sensitivity, risk, pending reports, legal obligations and claim periods. Convenience alone does not justify indefinite retention.
Now expiry after 24 hours ends ordinary audience availability; media, technical copies and evidence are not necessarily erased at that instant. Unverified accounts are subject to periodic cleanup.
The app displays the scheduled deletion date. The request disables access and schedules anonymisation of account identity. Deactivation ends ordinary post availability, but this process does not automatically erase every media file or associated record. Requests concerning remaining data can be sent to our privacy contact. Some messages may remain for recipients with reduced identification. Report, security and acceptance records may remain where legitimately justified. Backups follow their own technical cycles, with use limited to the purposes justifying retention.
7. Your rights
Depending on applicable law, you may request confirmation and access, correction, sharing information, portability, objection, restriction, anonymisation or deletion, and decision review where applicable. Consent may be withdrawn for the future without affecting earlier lawful processing.
In the European Union and United Kingdom, you may object to legitimate-interest processing because of your particular situation; we will assess the relevant grounds. Where US state laws apply, additional rights concerning sale, targeted advertising, appeal and non-discrimination may exist. Processing described here does not include sale or cross-context behavioural advertising.
Use app export and deletion tools or contact privacy support. Protect export files and temporary links. We may verify identity proportionately. We will respond within legal deadlines, explaining permitted extensions or refusal grounds. You may complain to Brazil’s ANPD or your region’s competent authority.
8. Security and updates
Technical and organisational controls reduce unauthorised access, loss and abuse without eliminating all risk. Material changes will be communicated appropriately; fresh acknowledgement or consent will be requested where needed. Updates do not automatically authorise incompatible uses of previously collected data.