Privacy Policy

1. Who we are

DevCave Technologies L.L.C-FZ, Nad Al Sheba, Meydan Road, Meydan Grandstand, Dubai, United Arab Emirates, is the controller of the information described here. You can reach us at legal@noer.tech. Company details are on our Imprint page.

One Noer account works across every Noer product. Information described below is held once at the account level rather than separately per product, unless this policy says otherwise.

2. Account and profile data

When you create a Noer account we store:

• your email address, which identifies the account and must be unique;
• your name, if you provide one or if a sign-in provider supplies one;
• a cryptographic hash of your password, if you set one. We never store the password itself and cannot recover it;
• whether your email address has been verified, and when the account was created;
• the roles and permissions attached to your account, which decide what you can access.

Some of this comes from you or from a sign-in provider; the rest Noer generates about your account. The verification status, the creation date, the roles, and the password hash are ours — no provider supplies them. Sections 3, 4 and 7 say precisely which fields Google, Apple and our payment provider send us and which we produce ourselves.

We use this to create and identify your account, to let you sign in, to send the transactional emails described in section 8, and to enforce access controls.

3. Signing in with Google

If you choose “Continue with Google”, Google asks you to approve sharing a limited set of information with Noer. We request the OpenID Connect scopes openid, email and profile, and nothing else.

What Google sends to Noer. From the identity token Google returns at sign-in, we read and keep:

• Your Google account identifier (the OpenID sub claim) — an opaque string that is stable for your Google account. This is the value we key your sign-in on.
• Your email address, together with Google’s statement of whether it has verified that address.
• Your name, where Google provides it in the profile scope.

We do not retain the identity token itself, and we do not keep any claim from it beyond the three above.

What Noer records about the connection. Separately from what Google sends, we generate and store our own record that the link exists: which provider it is, the date the link was made, and the time of your most recent sign-in through it, taken from our own clock. Google does not supply these, and they describe your use of Noer rather than your Google account. Alongside them we keep the email address and verification status as they stood at the moment you linked, as a historical snapshot — we do not update it if either later changes at Google, and nothing in Noer reads it to decide who you are.

We use Google sign-in data for three purposes and no others:

• Authentication. To verify that you control the Google account and to issue you a Noer session.
• Account creation. If no Noer account matches, we create one using the email address and name Google supplied, so you do not have to fill in a form again.
• Secure account linking. To attach your Google identity to the right existing Noer account. We link a Google identity to an existing account only when Google states that it has verified the email address and that address already belongs to a verified Noer account. Where Google does not vouch for the address, we do not link it.

We do not use Google sign-in data for advertising, profiling, marketing, training machine-learning models, or building a profile of you. We do not sell it. We do not share it with any third party for that party’s own purposes. We do not request access to your Gmail, Drive, Contacts, Calendar, or any other Google service, and we hold no Google access token that could reach them.

The name and email Google supplies are also written to your Noer account as described in section 2. The link record is kept so that you can sign in again, and so support can answer questions about which sign-in methods your account has.

You can disconnect Noer from your Google account at any time through your Google account permissions page. Doing so stops future Google sign-ins; it does not by itself delete your Noer account or the data described above. To delete those, see section 14.

How we store, protect, and delete Google sign-in data

What is stored. The only Google user data Noer keeps is the data listed above: your Google account identifier, your email address and Google’s verification statement for it, and your name where Google provides it. Your email address and name are written to your Noer account; the identifier, together with the email address and verification status as they stood when you linked, is held on the record of the Google connection itself. We keep no Google access or refresh token, no identity token, and no other claim.

How long. Google sign-in data is retained for as long as your Noer account exists, under the retention rules in section 13. We set no separate or longer period for it.

How it is deleted. When your account is deleted under section 14, the record of the Google connection is deleted with it, and so are the email address and name held on your account. The purchase and credit records that section 13 says we retain contain no Google sign-in data: they identify the account only by an internal identifier, and they hold no email address, no name, and no Google account identifier. That identifier continues to refer to the deleted account, which by then holds no email address, no name and no password, and no longer identifies a person.

How it is protected. Google sign-in data is covered by the measures in section 15: encrypted in transit, held in access-restricted production systems, excluded from our request logs, and exposed in our internal administrative tools as read-only — a Google connection cannot be created or altered there, only viewed.

Noer’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Signing in with Apple

Sign in with Apple works the same way and is used for the same three purposes. We request name and email.

What Apple sends to Noer: your Apple user identifier (the sub claim), the email address Apple supplies, Apple’s statement of whether it has verified that address, and your name where Apple provides it. Apple sends the name only the first time you authorize Noer, so we record it then.

What Noer records about the connection: the same link metadata as for Google — which provider, when the link was made, and the time of the most recent sign-in through it, from our own clock.

If you choose Apple’s “Hide My Email”, the address we receive is a private relay address ending in @privaterelay.appleid.com. Whether an address is a relay is a determination we make ourselves — from Apple’s own indication where it sends one, and otherwise from the address — and we store that determination alongside the link. We use a relay address to reach you, and we never treat it as evidence that you are the same person as a Noer account holding any other address: a relay address identifies you only to us and only for Noer.

5. Password and email sign-in

If you sign up with an email address and password, we store your address and a one-way hash of your password, and we send you a verification link that must be opened before the account becomes active. Password reset and email verification links are time-limited — currently 48 hours for a reset and 24 hours for a verification — and each can be used only once.

An account created through Google or Apple has no password at all. If you later want one, you can set it using the password-reset flow, which proves you can read the mailbox on the account.

6. Content you upload and content Noer generates

Noer products take input from you — for example a photograph in Viswap or audio in SpeakMix — and produce output from it. For each job we store:

• the files you upload, and the files produced from them;
• file metadata: original filename, media type, size, a content hash, and the storage location;
• the parameters of the job — which product and transformation you chose, the options you selected, any text you entered, and the resulting status, timing, error messages and credit cost.

We use this to run the job you asked for, to show you your history, to bill the correct number of credits, and to investigate failures you report.

Some Noer features send your content to an external AI provider. Noer runs some AI features on models we host on our own infrastructure, and others on models operated by an external provider. Where a feature uses an external provider, the content you supply for that feature — for example the image you upload — is transmitted to that provider in order to produce the result. OpenAI is the external provider we currently use for image features.

Which route a feature takes is a property of the feature rather than a decision we make per request, and the mix changes as we add and replace models. We keep the list of providers in section 11 current.

If you choose to share a result with a public link, the file and the title and description you give it become accessible to anyone holding the link, and we count how many times the link has been viewed. Sharing is off unless you turn it on, and you can disable a share link at any time.

We do not use your uploaded or generated content to train our own models, and we do not publish it or make it available to other users except through a share link you create yourself.

7. Purchases, credits, and payment data

Payments for credits are processed by a third-party payment provider. The applicable provider is identified at checkout. Your card details are entered on that provider’s checkout and go to the provider, not to Noer. We never receive or store your full card number.

What the payment provider sends to Noer. When a payment completes, the provider sends us a transaction record, which we keep as the receipt behind a credit balance and as the evidence needed to answer a billing dispute, a refund, or a chargeback. It contains the transaction identifier, the amount and currency, the time of purchase, and limited payment-method metadata that the provider includes — the card brand, its last four digits, its expiry month and year, and the cardholder name.

What Noer determines itself. How many credits a purchase grants is decided by our own catalogue, not by anything in the provider’s record: we match the purchase to the pack you bought and record the credits from that. The purchase row also links to your Noer account, which the provider does not tell us — we know it because we created the checkout session and remembered whose it was.

We also store your credit balances and a ledger of every credit movement: purchases, the credits each job consumed, promotional grants, and any reversal following a refund or chargeback. Where a payment is reversed we record the reversal and, if credits from it had already been spent, the resulting outstanding amount, as described in our Terms of Use and Refund Policy.

The payment provider processes your payment data as its own controller for the purposes of taking payment, tax and fraud prevention. Its handling is governed by that provider’s own privacy policy, which is available from the checkout where the provider is identified.

8. Emails we send you

We send transactional email only: email verification, password reset, and messages about your account or a purchase. These are part of operating the service and are not marketing. If we ever send marketing email, it will be separately opt-in and will carry an unsubscribe link.

9. Technical, security, and operational data

Operating the service produces records that are not part of your profile but relate to it:

• Sessions. A record of each active sign-in, stored as a hash of the session token with its issue, expiry and revocation times, so that sessions can be expired and revoked.
• Server logs. Requests to our API, including the path, timing, outcome and error information. Our infrastructure providers additionally log connection metadata such as IP addresses.
• Administrative audit records. Where an administrative action affects an account, we record what was done, to what, when, and the originating IP address.
• Error reports. When something fails we may capture a diagnostic report, which can include the account identifier involved, through our error-monitoring provider.

We use these to keep the service running, to investigate incidents and abuse, and to meet our security obligations. We deliberately exclude sensitive bodies from our request logs, including sign-in requests, provider callbacks and payment webhooks.

10. Cookies and browser storage

Noer does not use analytics or tracking scripts. We load no third-party analytics, no advertising tags, and no cross-site trackers. The cookies and browser storage we do use are limited to keeping you signed in and remembering interface choices you have made:

• Session cookies. Set by Noer and by accounts.noer.tech to hold your signed-in session. They are HttpOnly, so page scripts cannot read them, and their contents are encrypted. They are strictly necessary — sign-in does not work without them.
• Interface preferences. A cookie recording whether the sidebar is expanded, and browser storage recording your light or dark theme. These hold no personal information and are read only by your own browser.

You can block or delete cookies in your browser. Blocking the session cookies will prevent you signing in. See our Cookie Policy for more.

If we introduce analytics in future, we will update this policy before doing so and will ask for your consent where the law requires it.

11. Service providers we use

We rely on the following categories of provider. They process information on our behalf to deliver the service, except where noted:

• Amazon Web Services — hosting, databases, and file storage for uploaded and generated content.
• Payment provider — payment processing, acting as its own controller (section 7). The applicable provider is identified at checkout.
• Google — authentication only, where you choose Google sign-in (section 3).
• Apple — authentication where you choose Sign in with Apple (section 4).
• OpenAI — processing of content for the AI features that use it (section 6).
• Email delivery and error monitoring providers — sending the transactional email in section 8 and capturing the diagnostics in section 9.

12. Sharing and sale of your information

We do not sell your personal information, and we do not share it for advertising or cross-context behavioural advertising.

We share information only in these situations:

• with the providers in section 11, for the purposes stated there;
• where you make something public yourself, through a share link;
• where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim;
• where necessary to investigate suspected abuse, fraud, or a threat to the safety of the service or its users;
• in connection with a merger, acquisition, or sale of assets, in which case we will say so before your information becomes subject to a different policy.

13. How long we keep information

• Account, profile, and sign-in identities — for as long as the account exists.
• Uploaded and generated content, and job history — for as long as the account exists.
• Purchase records and the credit ledger — retained after account deletion where we need them for accounting, tax, or to answer a chargeback. These are financial records and we cannot remove them on request.
• Sessions — access tokens expire after 30 minutes and sign-in sessions after 7 days; revoked sessions are retained briefly for security investigation.
• Sign-in state for Google and Apple — usable for at most ten minutes and once only. The record is retained after it expires. It identifies no user: it is created before we know who is signing in, and holds no name, email address or account identifier.
• Logs and error reports — for a limited operational period set by the relevant provider.

14. Deleting your account and your rights

You can delete your Noer account yourself, at any time, from your account settings. We email a confirmation code to the address on the account first, so deletion always requires access to that mailbox. Instructions, including what to do if you can no longer sign in, are on our account deletion page.

Deletion is ecosystem-wide and takes effect immediately: one Noer account serves every Noer product, so deleting it ends your access to all of them at once. It is irreversible — there is no grace period and no way to restore a deleted account.

On deletion we erase your email address, your name and your password hash, and we delete your linked Google and Apple sign-in records, your sign-in sessions, your uploaded and generated content, your job history and any public share links. Content stops being reachable immediately; erasing the stored files themselves runs as a background task and completes shortly afterwards. Any remaining credits are forfeited.

We retain the purchase and credit records described in section 13, and any record we are required to keep by law. Those records are kept in anonymized form: they no longer carry your email address, your name, or the details of how you paid, and the account they refer to holds no personal information once deleted.

If you cannot reach your account or its mailbox, email legal@noer.tech. We will acknowledge your request within 7 days, complete the deletion within 30 days of verifying it — sooner where applicable law requires — and confirm to you when it is done.

Depending on where you live, you may also have the right to access a copy of your information, to correct it, to restrict or object to certain processing, to receive it in a portable form, and to withdraw consent where processing rests on consent. To exercise any of these, write to legal@noer.tech. We will respond within the time your local law requires, and we will not charge you or degrade your service for asking.

If you believe we have handled your information improperly, you may also complain to your local data protection authority.

15. Security

Passwords are stored only as one-way hashes. Session tokens are stored as hashes, never in readable form, and session cookies are HttpOnly and encrypted. Access to production systems is restricted, traffic is encrypted in transit, and sensitive request bodies are excluded from our logs. Administrative interfaces show provider sign-in records read-only and cannot be used to create or alter them.

No service can promise absolute security, and we do not. If a breach affects your information and the law requires us to tell you, we will.

16. International processing

DevCave Technologies L.L.C-FZ is established in the United Arab Emirates. Our infrastructure runs in Amazon Web Services regions in the European Union, and the providers listed in section 11 — including our payment provider, Google, Apple and OpenAI — operate internationally, including in the United States. Using Noer therefore involves your information being transferred to and processed in countries other than your own, whose data protection laws may differ from those where you live. Where we transfer information out of a region that restricts such transfers, we rely on the transfer mechanisms offered by the provider concerned.

17. Children

Noer is a general-audience service and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, write to legal@noer.tech and we will delete the account and the information associated with it.

Eligibility to use Noer, including any minimum age, is governed by our Terms of Use.

18. Changes to this policy

We may update this Privacy Policy as the service changes. When we do, we will update the “Last updated” date at the top of this page. Where a change materially affects how we use information you have already given us, we will tell you before it takes effect.