Privacy policy

Noirly Identity (noirly.identity.aneesh-pissay.in) is run by Aneesh Pissay, based in India, who is responsible for your account data (“we”, “us”).

This policy covers only your account and sign-in. Each Noirly app you use with your account keeps its own data and has its own privacy policy:

• Noirly Flow privacy policy (tasks, boards and workspaces)
• Noirly Ledger privacy policy (budgets, expenses and shared spending)

• Your account: email address; first, last and display name; and, if you add them, a phone number and profile picture.
• Your password, if you set one, stored only as a one-way hash (Argon2), never the password itself.
• Google sign-in, if you use it: your Google account ID, email, name and picture from Google, and the link between that Google ID and your account.
• Sign-in records: for each session, when it started and was last used, its expiry, and the IP address and browser or device description (user agent) it came from.
• Short-lived codes for email verification and password resets, stored hashed.
• App connections: which Noirly apps you have signed in to and the permissions (scopes) you approved for them.

We do not collect your location, contacts, advertising IDs or usage analytics.

• To create your account, sign you in, and keep your sessions secure.
• To sign you in to Noirly apps without a separate password for each.
• To send account emails: verification, password resets and security notices. We do not send marketing email.
• To prevent abuse, for example by rate-limiting sign-in attempts.

We do not sell your data, use it for advertising, or build profiles of you.

• Noirly apps you sign in to receive your account ID and, for the permissions you approve, your name, email and picture. What each app then does with it is set out in that app's own policy.
• Service providers that run Identity for us and process data only on our instructions: server and database hosting, and an email delivery service for account emails.
• Google, only if you choose “Sign in with Google”, under Google's own privacy policy.
• Authorities, only if the law requires it.

We do not share your data with anyone else.

Identity uses only strictly necessary cookies: a session cookie that keeps you signed in and a security (CSRF) cookie. It also remembers your theme and the emails you recently signed in with in your browser's local storage, which never leaves your device.

All traffic is encrypted in transit (HTTPS). Passwords are hashed with Argon2, and sessions, access and refresh tokens are stored only as hashes. Access is limited to what is needed to run the service.

• Your account: for as long as you keep it.
• Sessions: until you sign out or they expire (14 days without use on the web; app sign-ins renew for up to 30 days).
• Email verification and password-reset codes: until used, or at most 24 hours.
• When you delete your account, we delete it straight away (see below). Copies in our hosting provider's backups are overwritten on their normal backup cycle.

You can delete your Noirly account at any time at noirly.identity.aneesh-pissay.in/delete-account, or from inside a Noirly app that offers it (Noirly Flow: Menu → Delete account; Noirly Ledger: Settings → Delete account).

This removes your account, your password hash, your Google sign-in link, and all your sessions and app sign-ins. Every device is signed out. We also tell the Noirly apps you used (such as Noirly Flow and Noirly Ledger) that the account is gone, so they delete the data they hold for it as their own policies describe. This cannot be undone.

You can see and correct your details on your account page, change your password, and delete your account as described above. Depending on where you live (including under India's Digital Personal Data Protection Act, 2023), you may also have the right to request a copy of your data, to have it corrected or erased, and to complain to a data protection authority. To make a request, email contact@aneesh-pissay.in.

Noirly accounts are not meant for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

If we change this policy, we will update the date at the top of this page. For significant changes we will tell you by email before they take effect.

Questions about your Noirly account and privacy? Please email contact@aneesh-pissay.in.