Privacy Policy

Who we are

Noctune is provided by [To confirm: registered business name], registered in Kosovo (registration number [To confirm: ARBK registration number]), address [To confirm: registered address]. Contact for privacy questions: [To confirm: privacy email address].

[To confirm: applicable law and whether the EU GDPR applies to customers in the EU; the Kosovo Law on Personal Data Protection (No. 06/L-082) and any registration duty with the Information and Privacy Agency]

The short version

• Noctune is a player. Your IPTV provider login (server, username, password) is stored encrypted on your TV only and is never sent to us.
• What you watch, your favourites, lists, profiles and settings stay on your TV. We don't receive them.
• You only need a Noctune account for Premium. It holds your email, your subscription status and the TVs you've activated.
• We use no advertising, analytics or tracking cookies.

What we collect, and why

Noctune account (website)

• Email address and name: to create your account, sign you in, and send account emails (verification, password reset, security notices). Legal basis: performance of our contract with you.
• Password: stored only as a one-way hash (scrypt) by our authentication software; we can't read it.
• Sessions: a sign-in cookie and a session record with the IP address and browser type, used to keep you signed in and to spot misuse. Ends when you sign out or after 30 days of inactivity.
• Security records: short-lived counters keyed to IP addresses to limit sign-in and activation attempts. Legal basis: our legitimate interest in protecting accounts.

Activated TVs

• For each TV you activate: the name (which you can change), model, Noctune version, when it was activated and when it last checked its subscription. We use a random identifier created by the app, not hardware identifiers.
• Purpose: to enforce the Premium TV allowance and let you manage your TVs.

Payments

• Payments are handled by our payment provider [To confirm: payment provider; Stripe is not currently available for businesses registered in Kosovo]. Your card details go directly to them; we never see or store them.
• We store the provider's customer and subscription identifiers, your plan, its status, and renewal or end dates. Legal basis: contract, and legal obligations for financial records.

Noctune Free without an account

The TV app contacts only your IPTV provider's servers. It doesn't contact Noctune unless you activate Premium or check for updates.

What we don't collect

IPTV provider credentials, playlists, channel lists, viewing history, search history, parental-control PINs, advertising identifiers or location.

Who processes data for us

• Website hosting: Hostinger [To confirm: exact Hostinger entity and data-centre region].
• Database hosting: [To confirm: managed PostgreSQL provider and region].
• Email delivery: [To confirm: email provider, e.g. Resend].
• Payments: [To confirm: payment provider].
• APK downloads: [To confirm: object storage / download host].

[To confirm: international transfer mechanisms (e.g. standard contractual clauses) for each processor outside Kosovo/EU]

How long we keep it

• Account data: until you delete your account.
• Removed TVs: kept with your account until you delete it, so you can see what was removed. [To confirm: shorter retention for removed devices]
• Activation codes: deleted after 7 days. Rate-limit counters: about a day. Payment event records: 90 days.
• Billing records held by the payment provider follow their retention and applicable tax law. [To confirm: statutory retention period for our own invoices/records in Kosovo]
• Server logs: [To confirm: log retention at the hosting provider]. Logs never contain passwords or access tokens.

Deleting your account

You can delete your account at any time from Account → Delete account. This cancels any subscription immediately, deactivates your TVs (they continue as Noctune Free) and deletes your account, sessions and device records. Data on your TVs isn't affected; uninstall Noctune or use Remove playlist on the TV to delete it there.

Your rights

You can ask for access to, correction of, export of, or deletion of your personal data, and object to processing based on legitimate interest. Contact [To confirm: privacy email address]. You can also complain to the data protection authority. [To confirm: name of the competent supervisory authority]

Cookies

We only use cookies that are needed for the site to work: the sign-in session cookie (noctune.session_token) and related security cookies. They're not used for tracking, so no cookie banner is needed. [To confirm: confirm with counsel]

Children

Accounts are for adults who can enter into a subscription. [To confirm: minimum age]

Changes

We'll update the date above and tell account holders by email about significant changes.