Privacy Policy
Noctorio is built privacy-first: no ads, no ad-tracking, no selling your data. This policy explains what we collect, why, and the choices you have.
Who is responsible for your data
Noctorio is operated by Alexandro Georgiev, an individual based in the European Union, acting as the data controller for the purposes of the GDPR. You can reach us at hello@noctorio.com for any privacy question or request.
What we collect
- Your email address — to sign you in (magic link). We don't use passwords.
- Your setup — the country and streaming services you choose.
- Your taste signals — the favorites you seed, and your thumbs / “picked” / “not tonight” feedback.
- Recommendation logs — the picks we serve and their context (mood, time, company), so we can improve the engine.
What we deliberately don't store
When you type a mood in your own words, that free text is sent to our AI provider to interpret your request and is not stored on our servers. We keep only the mood category you selected. We collect no advertising identifiers and set no tracking cookies — the only cookie we use is the one that keeps you signed in.
Why we're allowed to hold it (legal basis)
We process your account and taste data to perform the contract you enter into by using Noctorio — it is what makes a personalised recommendation possible (GDPR Art. 6(1)(b)). We don't send marketing email, and we would ask for your separate consent before ever doing so.
Who processes your data
We use a small number of processors, strictly to run the service:
- Supabase — authentication and database, hosted in the EU (eu-west-1).
- Anthropic (Claude) — interprets your mood and writes the reason for a pick. Your inputs are sent per-request and are not used to train models.
- Resend — delivers your sign-in emails.
- TMDB / JustWatch — the source of title metadata and streaming availability. We query them; we don't send them your identity.
Anthropic and Resend are based in the United States, so using them involves transferring data outside the EU. Those transfers are covered by the data-processing agreements and standard contractual clauses we have in place with each provider.
Your rights
Under the GDPR you can access, export, correct, or delete your data, object to or restrict its processing, and complain to your national data protection authority. Two of these are built into the app, so you never have to ask:
- Download my data — a full JSON export from your account page (portability, Art. 20).
- Delete your account — a permanent, immediate erasure from the Danger Zone on your account page (erasure, Art. 17). It removes your profile and name, watchlist, every rating, and your whole pick history.
For anything else, email hello@noctorio.com and we'll respond within one month.
Retention
We keep your data for as long as your account exists. Delete the account and it is erased immediately — there is no soft delete and no recovery period. Shared pick pages you created contain only the film or show and its reason, with nothing linking them to you, so they remain available.
Contact
Privacy questions or requests: hello@noctorio.com.