Privacy policy
Version 1.0 · 29 October 2026
In short
- Your circles are end-to-end encrypted. Photos, videos, messages and circle names are encrypted on your phone. Only the phones in that circle can open them. Not Noo.
- Places are not. What you post in a place (your building) or on a shop's page is readable by Noo's server. Every place says so at the top of its screen.
- No tracking, no ads, nothing sold. Noo doesn't record what you look at, tap, or for how long. Your For you feed is ranked on your phone.
- No phone number, no contacts. You sign in with your email address and a six-digit code. The server doesn't keep your address, only a keyed fingerprint of it.
- Everything has an end date. Delete a message, leave a circle or delete your account: the server's copy goes at once, backups within 30 days.
- Noo is for people aged 15 and over.
- Questions: privacy@joinnoo.com. You can also complain to the CNIL.
Who is responsible
Noo is published by Noo, joinnoo.com, France: the controller under the GDPR. Contact about your data: privacy@joinnoo.com. We answer within one month. No data protection officer (not required at this size).
What we keep, where, and for how long
On your phone only. Your interests, what you've already seen (90 days), your ranking settings, the ranking itself and its explanations (Why?). Your encryption keys and your email address stay in this phone's keychain (never in iCloud or a backup). Decrypted photos stay in memory, never on disk.
On Noo's server, encrypted: we can't read it. Your circles' photos, videos, messages and names. Kept until the author or the circle deletes them, or until they expire (24 hours or 7 days if you chose that).
On Noo's server, readable by us.
| What | Why | How long |
|---|---|---|
| A random account number, the day the account was made | To run your account | Until you delete your account |
| A keyed fingerprint of your email address (HMAC), never the address itself | To find your account when you type your address | Until you delete your account |
| Your email address, encrypted, only if you ask for deletion on /delete-account | To send you the email saying "your account is deleted". Never logged, never in an export | The 7 days before the deletion, then deleted (at once if you sign in and cancel) |
| The sign-in code, as a fingerprint | To check the code you type | 10 minutes at most, single use |
| "15+ confirmed": the day you answered, never your date of birth | Noo is for people aged 15 and over | Until you delete your account |
| Your name, if you add one | So your circles and places know it's you | Until you change it or delete your account |
| Your phones' public keys, your session tokens (as fingerprints) | To sign you in and give circle keys to the right phones | Until the phone is removed; sessions 30 days |
| Who is in which circle, and the circle's signed log of devices | To deliver messages and keys to the right phones | Until you leave or the circle is deleted |
| The time, size and author of each circle message (not what it says) | To deliver it and delete it on time | As long as the message |
| "Delivered to 4 phones" | To tell the author their message arrived. Never who opened it | 30 days, then only the number |
| What you post in a place (title, text, tags, an event's date) | To show it in the place | Until it is deleted, by you or an organiser |
| The places you're in or follow, your requests to join a place | To show you their posts. A shop sees a number of followers, not who | Until you leave or unfollow; a request 30 days at most |
| The last day each phone used Noo (one date) | To count active phones, as daily totals | 35 days |
| Daily totals for the whole server (messages sent, invites, errors). No name, no account, no number under 5 | To know whether Noo works | 2 years |
| Error logs (no IP address, no content) | To fix bugs | 14 days |
| Encrypted backups of all of the above | To recover from a failure | 30 days |
Kept nowhere. What you look at or tap, your contacts, your location, your phone number, your IP address (at our end), the GPS data of your photos (removed on your phone before sending).
Notifications
If you allow notifications, your phone gives Noo's server a push address from Apple (a "device token"). When someone posts in one of your circles, answers you, asks to join, or lets you in, the server asks Apple to wake your phone. That push contains no text, no names and nothing about your circles: only a random number that means something to Noo's server for 24 hours. Your phone then fetches what happened, decrypts it, and writes the notification itself, for example "Claire posted a photo in Family". It never shows the message.
| What | Why | How long |
|---|---|---|
| The push address of each phone that allowed notifications, and when it was last sent to | Wake that phone, and only that phone | Until you turn notifications off in Noo, sign out, remove the phone or delete your account, Apple tells us it no longer works, or the account is suspended |
| Your circles set to "Mentions and replies" or "Off", for each phone | Send only what you chose | Until you change it, leave the circle or remove the phone |
| In memory only: what each push stands for (the circle, the post, who asks to join) | So your phone knows what to fetch | 24 hours, or until the server restarts. Never on disk, in a backup or a log |
Apple (Apple Inc., USA) delivers the push. It sees your phone's push address and when each push is sent, so over time it can see when your circles are active. It never sees who posted, where, or what. Apple Inc. is certified under the EU-U.S. Data Privacy Framework.
You choose. For each circle: All, Mentions and replies to me (these may arrive late), or Off. Quiet hours make notifications silent; they stay on your phone and are never sent anywhere. Turning notifications off in Noo deletes your push address from the server. People you blocked never wake you: the server sends you nothing for them, and your phone would drop anything from them anyway. Noo never sends reminders, "you missed" messages or badges. All of it is in your export.
Blocking and reporting
Noo can't read your circles, and reporting doesn't change that: a report holds only what your phone chose to send.
| What | Why | How long |
|---|---|---|
| The people you blocked (who, since when). They are never told | Hide their posts on your phones, stop them inviting you or asking to join your places, drop their notifications | Until you unblock them or either account is deleted |
| Your reports: the reason, a note if you write one, and for a circle post the copy your phone sends (the words, and a small photo only if you tick "include the photo"). For a place post, only a reference to it | Let Noo's publisher act (EU Digital Services Act, Art. 16) | Until decided, then 6 months |
| Moderation decisions (what was done, why, when). You see those about you, never who reported you | Accountability, and explaining the decision to you (Art. 17) | 6 months; a suspension, while it lasts |
| An account's suspension | Carry out a decision | Until lifted or the account is deleted |
The publisher gets a "new report" email with no content and no names. Details, appeals and reporting without an account: /terms and /report.
Why we're allowed to (legal bases)
- To provide Noo (the contract between us, GDPR Art. 6(1)(b)): account, sign-in, circles, places, delivering messages, and the notifications you allow.
- Our legitimate interest in keeping Noo safe and working (Art. 6(1)(f)): error logs, backups, abuse limits, daily totals, the age check. You can object (see your rights).
- The law (Art. 6(1)(c)): answering lawful requests, keeping the breach register.
We never use your data for ads, never build a profile of you, never sell or rent it.
Who else sees something
- People you share with: your circles, your places (as each place says).
- Apple distributes the app (App Store, TestFlight). If you test Noo through TestFlight, Apple shares with us the email address you were invited with (none if you joined through a public link), your phone model, its iOS version, crash reports and the feedback you choose to send. If you allow notifications, Apple also delivers them (see "Notifications"). Apple is a US company.
- Hosting. Since 29 October 2026, the server runs at Scaleway SAS (Paris, France), on a DEV1-S instance in its Amsterdam datacentre (AMS1, the Netherlands). Backups: encrypted backups, stored in Paris (Scaleway), will be set up before Noo opens to the public; this page will be updated at that time. Scaleway is our processor (data processing agreement); it could technically read the disk as we can, never your circles in clear. OVH SAS (France) only keeps our domain name and its address book (DNS): it sees nothing of what you do in Noo.
- Sign-in emails go through Scaleway Transactional Email (Scaleway SAS, France), our processor, under the same data processing agreement as the hosting. It sees your address and the code while it delivers them, from
noreply@joinnoo.com, and may keep a technical record of the send (address, time, delivery status). The message has no images, no links and no trackers. Until this is set up, no code is sent by email. - Server monitoring (Healthchecks.io, Latvia; Better Stack, Czechia) only receives "the server answers" signals, no personal data.
- Noo's admin (today, one person) can read what the server can read, only to run the service.
- The authorities, only when the law requires it. For circles, we can only hand over encrypted data and the list of members.
Outside the European Union: Apple (US), under the EU–US Data Privacy Framework or standard contractual clauses. Hosting, backups and monitoring stay in Europe.
Your rights, in the app
On a signed-in phone, in You:
- See and take your data: Your data › Export everything saves on your phone a copy of everything the server keeps about you (Art. 15 and 20).
- Fix your name: Edit your name (Art. 16).
- Erase: a message (long-press › Delete for everyone), a post in a place, leave a circle or a place, unfollow, or Delete my account and data: the server erases it at once, backups within 30 days (Art. 17). Without a phone: /delete-account (or Delete my account on the sign-in screen), with a code sent to your address; the account is deleted 7 days later unless you sign in meanwhile, and we email you at the start and at the end.
- Object, restrict, or anything else: write to privacy@joinnoo.com (Art. 18 and 21).
It's free. Noo makes no automated decision with legal effect about you: ranking happens on your phone, and a ban is decided by a person.
Complaints. You can complain to the CNIL, France's data protection authority: cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Age: 15 and over
Before your account is made, Noo asks one question: are you 15 or older? If not, nothing is saved and no account is made. If so, the server keeps the day you answered, nothing else. If you think a child under 15 has an account, write to us and we'll delete it.
Security
Circles are end-to-end encrypted. No passwords: a single-use code by email, and a new phone gets nothing from a circle until a member has compared its safety code. HTTPS connections, an encrypted disk, encrypted backups. If your data is breached, we tell the CNIL within 72 hours, and you if you're at risk.
Changes
If this policy changes in a way that matters, Noo tells you in the app before the change applies.