Privacy Policy

Who we are

This policy covers noine, the audio clip service at noine.app. noine decides what personal information is collected and why, which makes us responsible for it (the "controller" under the GDPR, the "business" under US state laws). "We" and "us" mean noine.

Questions, requests or complaints: privacy@noine.app.

What we collect

What you give us

• Account. Your email address, a display name and a password. Your password goes straight to our sign-in provider, which keeps only a scrambled (hashed) version, so nobody at noine can read it.
• Google or Apple sign-in. If you choose one, we receive your name, email address and profile picture from it. With Apple's "Hide My Email" we get a relay address instead of your own.
• Clips. The audio you upload or record, and what you add to it: a title, description, tags, who is speaking, where it's from, and whether it's private or public. We also store a transcript of the audio, so clips can be found by what they say. A clip that has been opened for remixing can also keep the words it contains with the time each one is said, which is a second copy of its transcript. A clip made by remixing a public clip keeps a link to the clip it was cut from.
• Libraries and favorites. The libraries you create or join, who is in them, the clips you add, and the clips you've hearted.
• Invitations. When you invite someone by email we use their address once, to send the invitation, and we don't store it. We do store the invite link, so it can be accepted.
• Reports. If you report a clip, we keep which clip, your account and your reason.
• Emails to us. Anything you send us, and our replies.

What we collect when you use noine

• Searches. What you type into search is sent to our search provider to find clips. Your recent searches and recently sent clips are kept on your own device so they're quick to find again, not on our servers.
• Usage analytics. To see what gets used and what breaks, we count page views and a few actions. They are tied to a random anonymous ID in your browser, never to your name, email or account. Each page view records the page's path only, never search text, sign-in codes or invite links. We don't record sessions or clicks. Each event also notes whether you're signed in, and whether noine was opened from the Home Screen or a browser tab. The actions are:
  • A search you ran: the words you typed (the first 80 characters), how many clips it found, and whether it covered all clips or only public ones.
  • That a clip was played, with the clip's ID.
  • That a clip was sent, with its ID and whether you used the share sheet or copied the link.
  • That a clip was hearted, with its ID.
  • That a clip was added, and whether it was uploaded, recorded or remixed from another clip.
• Error reports. When something breaks we receive the error message, a technical trace, the kind of page (not its address), and the request's method and status.
• Device and connection. Like any website, our servers and providers see your IP address, browser and device type, the pages and files requested, and when. We use these logs to run noine, keep it secure and spot abuse. Our analytics provider also receives your IP address, which it may use to estimate your general location.
• Microphone. If you tap record, your browser asks for microphone access. Recording happens in your browser.

How your audio is handled

• Transcription. When you pick or record audio for a clip, noine trims it in your browser and sends the trimmed audio to OpenAI to turn into text. That is how it suggests a title and makes the clip searchable by quote. It happens as soon as you choose the audio, even if you never save the clip, and for private clips as well as public ones. We don't keep that copy: we store audio only when you save a clip. Replacing a clip's audio does the same, and clips saved before transcripts existed are sent the same way when a noine administrator runs a catch-up, private ones included.
• Remixing. When someone opens a clip to cut a new clip from its words, noine sends that clip's stored audio file to OpenAI to time each word, all of the file even if the clip plays only part of it, private clips included, for anyone who has access to the clip. The words and their timings are saved with the clip when its owner or a noine administrator does this, and are otherwise thrown away after use. We don't keep that copy of the audio.
• No voiceprints. We turn speech into text. We don't create voiceprints or identify who is speaking, and we don't use your clips to train AI models.
• Private clips. A private clip is hidden from everyone else in noine: it doesn't appear in search, Discover or anyone's library, except libraries you add it to. But sending a clip works by link, and anyone who has a clip's link can play it, private or public. The audio file itself sits at a long, random web address, and anyone who got hold of that exact address could play it too.
• Cutting clips from other clips. Anyone who can play a clip, including the members of a library it is in, can cut a new clip from its words. The new clip is theirs: they choose who can find it, including everyone, and it is not linked to a private clip it came from.

How we use it

We use your information to:

• Run noine: create your account, store and play your clips, power search, libraries, favorites and invitations, and send the emails that go with them, like confirming your address or resetting your password. GDPR basis: performing our contract with you.
• Keep noine safe: block bots, review reports, fix security problems and stop abuse. GDPR basis: legitimate interests, and legal obligation where it applies.
• Improve noine: see which searches come up empty, which clips get played and where things break. GDPR basis: legitimate interests.
• Answer you: reply when you write to us. GDPR basis: contract and legitimate interests.
• Meet legal duties: respond to valid legal requests and protect people's safety and our rights. GDPR basis: legal obligation and legitimate interests.

We don't send marketing emails, we don't make automated decisions about you with legal or similarly significant effects, and we don't sell your information.

Who we share it with

Other people on noine

• Public clips appear in search and Discover for everyone, including visitors without an account. A clip's page shows the clip, not who uploaded it.
• Libraries. Members of a library you create or join can see your display name, the clips in it and who added them. A public library's page shows its name, its clips and its creator's display name to anyone.
• Link recipients. Anyone you send a clip or an invitation to can open it.
• Your email address is never shown to other people on noine.
• Administrators. A few noine administrators can see account email addresses and every clip, including private ones. They use that only to review reports, help people and keep noine running.

Companies that help us run noine

These providers handle information for us under their own terms and privacy policies. Each is listed with what it does and what reaches it.

• Supabase

  Accounts and sign-in, our database, and storage for audio files. It also sends our sign-up confirmation and password-reset emails.

  Receives: Everything in your account and your clips, including the audio files, plus the connection details its servers log, such as your IP address.

  Supabase privacy policy

• Vercel

  Hosting. It runs the website and the server code behind it.

  Receives: Every request to noine: your IP address, browser, the page or file requested and the time, kept in its logs.

  Vercel privacy policy

• Algolia

  Search.

  Receives: A searchable copy of each clip's title, description, tags, who is speaking, source and transcript (private clips included; noine only shows them to people who have access), and the words you search for.

  Algolia privacy policy

• OpenAI

  Turns audio into text (transcription).

  Receives: The audio of a clip when you add or replace it, as soon as you choose it and before you save. Older clips that have no transcript yet are sent the same way when an administrator runs a catch-up. When someone opens a clip to remix it, that clip's whole stored audio file is sent too, so each word can be timed.

  OpenAI privacy policy

• PostHog

  Usage analytics and error reports.

  Receives: The page views, events and error reports described above, an anonymous random ID, and technical details such as your IP address, browser and device.

  PostHog privacy policy

• Resend

  Delivers our library invitation emails.

  Receives: The invited person's email address, the library's name and the display name of whoever invited them.

  Resend privacy policy

• Cloudflare

  Bot protection (Turnstile) on the sign-up, log-in and password forms.

  Receives: Technical details about your browser and connection, which it uses to tell people from bots.

  Cloudflare privacy policy

• Google Fonts

  The typefaces in our invitation emails. The noine website serves its own fonts.

  Receives: Your IP address and email app details when you open an invitation email, which tells Google the email was opened.

  Google Fonts privacy policy

• Google

  Sign-in, only if you choose to continue with Google.

  Receives: Your sign-in request. It sends us your name, email address and profile picture.

  Google privacy policy

• Apple

  Sign-in, only if you choose to continue with Apple.

  Receives: Your sign-in request. It sends us your name and email address (or a relay address).

  Apple privacy policy

Other disclosures

• The law. We may disclose information to respond to a valid legal request, or to protect people's safety or our rights.
• Business changes. If noine is sold, merged or restructured, your information may move to the new owner, who must honor this policy or give you notice and a choice.

We don't sell your personal information, and we don't share it for advertising, as California and other US state privacy laws use those terms. There are no ads on noine.

Cookies and local storage

noine saves small pieces of information in your browser. None of it is for advertising, and noine has no advertising or cross-site trackers.

Signing in

• sb-…-auth-token

  Keeps you signed in.

  Cookie. Until you log out or your session expires.

• noine-next

  Remembers where to take you after you confirm your email or sign in with Google or Apple, such as a library invite.

  Cookie. Up to 48 hours, and deleted as soon as it has been used.

Your settings and recents

• drops-theme

  Your light or dark theme choice.

  Local storage. Until you clear it.

• noine-recent-sent

  The clips you sent recently, so they are one tap away. It never leaves your device.

  Local storage. Until you clear it.

• noine-recent-searches

  Your recent searches. It never leaves your device.

  Local storage. Until you clear it.

• noine-install-dismissed

  Remembers that you closed the tip about adding noine to your Home Screen.

  Local storage. Until you clear it.

• noine-upload-visibility

  Your last choice of private or public when adding a clip.

  Local storage. Until you clear it.

Analytics

• ph_…_posthog

  A random ID that lets analytics tell one browser from another. It is not linked to your account, and it is never created if your browser sends Do Not Track.

  Local storage. Until you clear it.

You can clear all of this in your browser settings (you'll be signed out and lose your recents). Turn on Do Not Track in your browser to keep analytics off. The Cloudflare check on the sign-up and log-in forms may also use its own browser storage.

How long we keep it

• Your account and clips: until you delete them or your account.
• Unconfirmed sign-ups: deleted automatically after 48 hours if the email is never confirmed.
• When you delete your account, we remove your profile, your clips and their audio files (including clips you added to other people's libraries), the libraries you created (for everyone in them), your memberships, favorites, reports and invites, and we take your clips out of search. That happens right away and can't be undone. Clips other people have cut from yours are their own clips, with their own audio files, so they stay. Our providers may keep backups or logs for a limited time afterwards.
• Reports: until the clip they're about, or the account that filed them, is deleted.
• Analytics and error reports: only as long as they're useful for improving noine. They aren't linked to your account, so deleting it doesn't remove them.
• Logs and emails at our providers: for the periods in their own policies.
• Emails to us: as long as needed to deal with your request.

Your choices and rights

In the app

• Change your display name or password in Settings.
• Edit, re-trim, make private or public, or delete any of your clips.
• Delete your account in Settings, under Delete account.

Requests

Wherever you live, you can email privacy@noine.app from the address on your account (so we know it's you) to:

• get a copy of the personal information we hold about you, in a portable format,
• correct it,
• delete it,
• limit or object to how we use it, or withdraw consent where we rely on it.

We reply within 30 days. If we can't do what you ask, we'll say why, and you can reply to appeal.

If you're in the EEA, UK or Switzerland

You have the rights above under the GDPR (access, correction, erasure, restriction, portability and objection), and the legal bases are listed under "How we use it". You can also complain to your local data protection authority; in the UK that is the Information Commissioner's Office.

If you're in California or another US state

You may have the right to know what we collect, and to access, correct and delete it, and not to be treated differently for using these rights. In the past 12 months we collected identifiers (email address, display name, anonymous ID, IP address), internet activity (searches, plays), audio recordings, and profile details from Google or Apple sign-in, and we disclosed them to the providers above for business purposes. We don't sell or share personal information, and we don't use sensitive personal information to infer anything about you. An authorized agent can make a request for you; we may ask them for proof.

Do Not Track

If your browser sends Do Not Track, noine's analytics stay off and no analytics ID is created.

Security and where data goes

Connections to noine are encrypted with HTTPS. Passwords are hashed by our sign-in provider, and the database itself decides who can read what, so people reach only what they're allowed to. Administrator access is limited. No online service is perfectly secure, though. If a breach affects you, we'll tell you and the authorities as the law requires.

noine and its providers work from the United States and other countries, so your information may be processed outside the country where you live, where data protection laws can differ. Where the law requires it, we rely on safeguards such as the EU-US Data Privacy Framework or the standard contractual clauses our providers offer.

Children

noine is for people 13 and older. It isn't aimed at children under 13 and we don't knowingly collect their personal information. If you think a child under 13 has given us information, email us and we'll delete it. If your country sets a higher age for using online services without a parent's consent, you must meet that age to use noine.

Changes and contact

When we change this policy we'll update the date at the top and mention meaningful changes on What's new. Where the law requires it, we'll ask for your consent or tell you before a change applies to information you've already given us.

Contact us at privacy@noine.app with any question about this policy or your information.