How we handle your data

Noord Ark AB, company registration number 559546-8348, Mailbox 2347, 111 75 Stockholm, Sweden. Write to us at hello@noorddarkness.com. Noord has not appointed a data protection officer.

Your choices, your evening answers and your survey answers are saved in this browser only. They are never sent to Noord. “Start a new day” clears them, and so does signing out. Your light or dark theme is saved in the browser too.

One exception: if you add your next pause to Apple Calendar or Outlook, the time you chose is sent to us to make the calendar file. We do not store it, apart from request logs. If you choose Google Calendar, your browser sends the time to Google.

Your account holds your email address, your name, whether the address is verified, and when the account was created and last changed. If you use Google, it also holds your Google account ID and the link to your Google profile picture. We do not keep any Google access tokens.

A sign-in code is stored as a hash, together with your email address, until it is used or cleaned up. It works for 5 minutes and 3 tries, and is removed once it is used. Expired codes are cleaned up the next time anyone signs in.

When you sign in, a session cookie keeps you signed in. It is strictly necessary. We store your IP address and your browser's user agent with the session. A session lasts 30 days, renews daily while you use it, and is deleted after it expires, the next time anyone signs in.

We send you the sign-in codes and one welcome email, from noreply@noorddarkness.com, using Cloudflare Email Service.

To stop abuse we count requests by IP address, and for a short time only. When someone asks for a sign-in code, for the per-address limit we keep only a one-way hash of the email address. The hash is deleted after 24 hours, the next time anyone signs in or asks for a code.

The sign-in page uses Cloudflare Turnstile to tell people from bots. It looks at signals from your browser and device to do that.

We do not use analytics, advertising or tracking cookies, and we do not sell data.

The app runs on Cloudflare Workers. The database is in Cloudflare's EU jurisdiction. Cloudflare keeps request logs for the app for 7 days. The app's own logs are written to hold error messages, not names, email addresses or sign-in codes. The database also keeps a point-in-time history for 30 days, so data you delete can stay in those backups for that long.

Cloudflare is our processor for hosting, the database, email, Turnstile and logs. Google receives data only if you choose Google sign-in or Google Calendar. Both may process data outside the EU/EEA. When they do, it is under the EU–US Data Privacy Framework and standard contractual clauses.

To give you an account, sign you in and send the service emails, we rely on contract (GDPR Art. 6(1)(b)). For security, abuse prevention and logs we rely on legitimate interests (Art. 6(1)(f)).

Your account is kept until you ask us to delete it. Sessions, codes, request counters and email hashes are kept as described above.

You can ask for access to your data, for correction, for erasure, for its use to be restricted and for a copy you can move. You can also object to how we use it. Email hello@noorddarkness.com and we will reply within one month. You can also complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se.