Privacy

The short version: the tools collect nothing, and noc connects only where you point it. This page says exactly what that does and does not mean, without rounding it off in either direction.

The tools collect nothing

Files and pasted text are processed entirely in your browser. There is no server that receives them — there is no server behind these pages at all. Every tool page ships a Content-Security-Policy with connect-src 'none', which means your browser itself refuses to transmit anything from the page, to us or to anyone. You don't have to take our word for it: open DevTools, watch the Network tab while you use a tool, and see that after the page loads nothing leaves your device.

noc connects only where you point it

noc — the metrics board at /noc — is the one part of this site that makes network requests on your behalf, so it gets its own paragraph rather than being folded into the sentence above. A noc page contacts the endpoint you configure, and only that endpoint: every query goes straight from your browser to the URL you typed, and nocternal never receives one. There is still no server of ours anywhere in that path, and nothing of yours is stored on one, because there isn't one.

The proof is weaker than the tools', and that difference is the part worth reading. A tool page's connect-src 'none' is a promise your browser keeps for you. noc cannot ship that directive — a board has to be able to reach whatever endpoint you point it at — so noc's pages carry a deliberately wider policy: connect-src 'self' https: http://localhost:* http://127.0.0.1:*. What that policy proves is that noc never talks to a third party; it cannot prove that the endpoint you configured is the only address noc could reach, because no policy can express "the URL the user typed". So the narrower claim is carried by this copy and by things you can check: no third-party origin appears anywhere in public/_headers, and you can open your Network tab while a board polls and see for yourself that every request goes to the endpoint you configured, and nothing else.

No accounts, no analytics, no cookies

There is no signup, login, or email capture. There are no analytics scripts, no advertising scripts, no telemetry, and no cookies on the tool pages or the noc pages. Nothing reports your usage back to us, because there is nothing here to report it to. Nothing follows you between visits.

What is stored on your device

A few small things are saved in your browser's localStorage, so the site and your board come back the way you left them. Each one is written on your device, by your browser, and none of them is transmitted to us — there is nowhere to transmit them to. Clearing your browser storage for this site removes all of them.

• nocternal-theme — the theme you picked, if you picked one.
• noc.endpoint — the metrics endpoint you configured for noc: the base URL, any query parameters it needs, and — stated plainly, because it is the one item here that can be a credential — the Authorization header value, if you enter one. It is stored as you typed it, and it is sent to the endpoint you typed — that is what it is for — and to nowhere else. Anything able to run JavaScript on nocternal.net could read it, which is how browser storage works everywhere; the scripts able to run here are only the ones this site ships, and no third-party script is loaded on any page. Removing the endpoint on /noc removes the stored copy.
• noc.wall — whether a board is in wall-display mode, and how many panels you chose.
• noc.pack — which board pack you picked, by name.

Hosting and server logs

The site is hosted on Netlify. Like any web host, Netlify keeps standard server logs of the requests it serves — things such as your IP address, the URL requested, and your browser's user-agent string. That happens at the hosting layer, the same as for any website, and is separate from the tools, which still receive and store none of your file contents. Netlify's handling of that data is covered by Netlify's privacy policy.

If this ever changes

There are no analytics today. If analytics are ever added, they will be cookieless and aggregate, and this page will be updated to say so before they ship.

Terms →  ·  Browse the tools →