Privacy policy

Controller and purposes

Jonathan Amsellem, sole trader (EI), 124 boulevard de Rochechouart, 75018 Paris, France, is the contact responsible for Nocha’s data processing: [email protected].

Account information, access rights, creations, saved content and requested operations are used to provide the service. Security logs, decisions and reports are used to prevent abuse and handle appeals. Purchase information and supporting records are used to allocate credits and meet applicable accounting obligations.

Legal bases depend on the purpose: performance of the requested service, legal obligations, legitimate interests in securing the service and handling abuse, or consent where required for an optional transfer or permission. Refusing an optional feature does not authorise another transfer.

Data and recipients

Watchirl provides identity, the wallet, provider access and shared assets; Tripirl handles some media. These are platform services. Your public profile contains your opaque identifier and your chosen handle, public name and avatar, never a name inferred from your email address.

Preparation and Studio use OpenRouter with the selected agent and model: Codex with OpenAI, Claude with Anthropic, or OpenCode with Z.AI. Your conversation limit covers discussion, plan preparation, repairs and context compaction. AI and media features use the providers actually selected by Watchirl. Before a transfer requiring your agreement, the Nocha dialogue specifies the data categories, purpose and actual recipients. A relevant change requires renewed confirmation.

Nocha stores your age range (under 16, 16-17, or 18 and over), its origin and the time it was recorded to apply access restrictions; every change is logged. Watchirl derives this range from the private date of birth of your Watchirl account: Nocha does not receive that date, which is not sent to public profiles, experiences or payment providers.

Purchases are verified by Watchirl with the channel provider: Stripe on the web, Apple on iOS and Google on Android, the latter two through RevenueCat, which receives the Watchirl account identifier and the related purchases. On the web, Stripe collects the billing address to calculate VAT. Transaction data is used to confirm entitlements, reconcile operations, process refunds and meet accounting and tax obligations.

A shared experience may show your actions to other participants. Blocking relationships, consent records and billing data are not exposed to hosted content. Avoid including third-party data without permission.

Camera, microphone and location permissions are separate from consent to a transfer and spending authorisation. The consent record does not retain a copy of prompts or media. Revocation blocks the relevant new transfers; it does not recall data already transferred.

The production service is hosted by Hetzner Online GmbH (see the legal notice). The contractual list of processors, processing countries and safeguards for transfers outside the European Economic Area is being documented; no processing location is stated until it has been verified.

Ideas and feedback

The ideas and feedback you submit in Nocha are used to answer you and to improve the app. To group them by topic, an AI model classifies them automatically through OpenRouter, from a reduced text: title, description, category, and the screen and experience concerned, without your email address or account identifier, without conversation excerpt or attachment; addresses and numbers quoted in the text are masked. This classification makes no decision about you.

You follow the status of your request in the app (received, kept or set aside, in progress, delivered) and receive a message when it is delivered.

Feedback that is closed, delivered or set aside is kept for twelve months after its last change, then erased with its messages and attachments. If you delete your Nocha account, the conversation excerpt, your email address and your attachments are erased; the feedback text, detached from your account, remains subject to the same period.

Retention

Experiences and saved content are retained for use, then deleted on request through the erasure process. The initial policy provides for: detailed technical traces for 72 hours; a seven-day withdrawal period for account deletion; security and administration for six months; closed report files for twelve months with data minimisation.

Minimal acceptance records are retained for five years after the relationship ends. Accounting records subject to a retention obligation are kept for ten years under that obligation. Exceptional retention must have a reason, a deadline and an audit trail.

The target for erasing active data is thirty days after the request; backups should expire no later than thirty days after that erasure. These targets require verification of the storage actually deployed. Deleting a logical volume does not certify physical erasure. Processing status and any copies not covered must be distinguished.

General purges remain disabled pending this verification. Requested deletions are tracked separately. Historical copies and backup policies that have not yet been attested prevent these periods from being presented as an already effective guarantee.

Your rights

You may request access, rectification, erasure, restriction and portability where applicable, object to processing based on legitimate interests, and withdraw consent for the future. Contact: [email protected]. Proportionate verification of your identity may be necessary.

You may lodge a complaint with the CNIL, including at cnil.fr. Closing Nocha does not automatically close your access to other products. Legal obligations may justify retaining certain minimal records after content has been erased.