This policy describes how Nocturnal handles personal information. It is written to match the product as it ships today — the Mac app, the IDE dashboard window, the hosted site at nocturnal.sh, and the Cloud Functions behind them.
The shorter product list — what we store, what we do not, and the Settings switches — is What syncs to your account.
Last updated: 13 September 2026.
Questions and requests: support@nocturnal.sh.
A connected workspace
Nocturnal uses Firebase to save account settings, device workspace state, and cloud chats so you can continue across devices and recover saved workspace information after a reinstall. Your repository files stay on the computer running the project. Agents run there. Process logs, the full JSONL transcript, attachments, and .nocturnal/ files are on that disk. Bring-your-own tokens (GitHub, Anthropic, and optional OpenAI / Gemini / Groq keys for voice input) stay in ~/.nocturnal/secrets.json (mode 0600) on that device. Voice recordings are sent to the vendor you picked and are not stored in Firebase. The engine binds 127.0.0.1 only.
We do not store a copy of your source tree. We do not upload tokens, attachments, or process/script logs. A cloud chat can still contain snippets the agent printed — treat it like email.
Who this applies to
It covers anyone who:
- visits nocturnal.sh
- creates a Nocturnal account
- signs in on the app, the IDE window, localhost, or the hosted dashboard
- links a device or is invited to someone else’s project
- starts a Paystack subscription or clicks Buy Me a Coffee
- sends in-app feedback
Marketing pages are public. The product — app, IDE window, and hosted dashboard — requires a signed-in account.
What we collect
Account
Firebase Authentication holds your sign-in. Google sign-in gives us the email, display name, and photo Google already has. Email sign-in stores the email you typed. We assign a user id.
New accounts get an access grant during alpha (users/{uid}/access). An operator can later revoke access, require a paid plan, or block app versions older than a floor. Those rules live in Firestore config/policy.
Device and status
After you sign in on a computer, that device is linked. We store a device name, platform, last-seen time, engine version, and pending remote commands so your phone can drive the same machine.
We save your account settings and each computer’s project list, opened folders, layout, and device settings. A machine identifier helps reconnect a recognized computer to its saved workspace after a reinstall. A status mirror (project names, ports, processes, git/CI summaries) supports the hosted dashboard. This saves workspace information; it does not back up your repository files or replace Git and file backups.
One exception is worth naming: each project’s favicon is copied into your account so the phone app and the hosted dashboard can show it when they cannot reach the Mac. It is the only file content we copy out of a repository, it is limited to the usual icon filenames (favicon.svg, favicon.ico, apple-touch-icon.png and the like) under 24 KB, and it is deleted when the project or the icon goes away. An icon larger than that is left on the Mac, and the project shows a plain folder mark instead.
Cloud chats
New chats go to Firestore by default (mirrorAgents on) so you can continue from your phone or invite someone to that computer. We store the session name, status, and the chat text the dashboard already shows, under sessions/{id}/events.
Turn a session to Keep on this Mac, or turn off “New chats go to the cloud” in Settings, and that chat text is not uploaded. You cannot continue that chat from your phone or share it.
Sharing a project
An email invite lets another signed-in account remote-control your computer for that project — your Claude login, your ports, your agents — while the machine is on. They do not receive the files, beyond the cached project icons described above. They can read the same status mirror and send the same commands. Revoke the invite to cut them off.
Feedback and the public site
In-app Feedback writes what you typed, plus the screen you were on, OS, viewport, timezone, language, app version, and IP address, to a private roadmap collection with your user id and email. Operators can read submissions. There is no public ideas list. The public release feed (releases/latest) has version numbers and download URLs, not account data.
Payments
The public offer is one month free without a credit card, then $5 USD per user per month. If you start a subscription, Paystack processes the card. We store a customer code, subscription status, and the email Paystack already has. We do not store card numbers. Buy Me a Coffee is a separate one-off link; that site has its own policy.
What stays on the machine
The git repo, .env files, tokens in ~/.nocturnal/secrets.json, composer attachments, and process/script log files. The local JSONL transcript is the full record. Nothing in Firebase replaces those files.
Why we use it
| Purpose | What we use |
|---|---|
| Sign you in and keep the session | Auth email / Google profile, refresh token |
| Decide whether the app may run | Access grant, config/policy, app/engine version |
| Let a phone or collaborator drive a linked Mac | Device heartbeats, commands, status mirror, cloud chats |
| Charge a subscription if you start one | Paystack customer and subscription records |
| Improve the product from what you send | Feedback text, screen, OS, IP, and account |
| Publish installers | Public release metadata |
We do not sell personal information. The public website (nocturnal.sh) uses the Google tag for Google Analytics and Google Ads conversion measurement, described below. The desktop app, the local dashboard, and the phone apps do not load it.
Anonymous usage analytics
We record anonymous, aggregate product events — page views, download clicks, active-install pings, agent starts and completions, feature usage — to understand how the product is used and where people get stuck. Events are stored as daily totals in Firestore, not linked to user accounts, and are visible only to operators.
Google Analytics and Google Ads
nocturnal.sh loads the Google tag to measure site traffic (pages, referrers, approximate location, device type) and to tell Google Ads when someone who arrived from an ad signs up, downloads the app, joins the mailing list, or starts a trial. Google sets cookies for this and processes the data under Google's privacy policy. We do not send your name, email address, or account id to Google. In the EEA, the UK, and Switzerland the tag runs in consent mode with storage denied, so no Google cookies are set there. You can opt out anywhere with Google's browser add-on or ad settings.
Cookies and local storage
Firebase Auth keeps you signed in (browser storage / cookies it manages). The dashboard uses browser storage for session and interface state, including cached preferences and dismissed notices. Account settings and saved device workspace state also sync through Firebase. Outside the EEA, the UK, and Switzerland, the public website also sets Google Analytics and Google Ads cookies (see above).
Who else sees it
Google Firebase — Authentication, Firestore, Hosting, Cloud Functions, and Cloud Storage. Product data sits in project nocturnal-sh, Firestore region europe-west1. Installers live in public Storage under releases/. Google’s terms apply to that infrastructure.
Paystack — only if you open checkout.
Buy Me a Coffee — only if you follow that link.
A person you invite — status and commands for the shared project on your machine, plus cloud chat text for that project.
Operators — accounts with an Auth admin claim can list users, read access and billing status, grant or revoke access, and read in-app feedback (including IP and the screen you sent it from). They cannot read ~/.nocturnal/secrets.json or your repo. Company social credentials and the marketing agent API key are operator-only and are not your customer data.
GitHub and Anthropic are called from your machine with your tokens. Those tokens are not uploaded to Nocturnal.
How long we keep it
Account, device, access, billing, and cloud-chat records last until you ask us to delete them or we close the account. Link codes are short-lived Cloud Functions documents. A revoked share invite is deleted. Local files last until you delete them on that computer.
Your choices
- Keep a chat on the Mac: Settings → Cloud, or right-click a session → Keep on this Mac. The same choices are listed on What syncs to your account.
- Stop a collaborator: revoke the project invite.
- Sign out: Account on nocturnal.sh, or the admin bar if you are an operator.
- Delete your account: open Settings → Cloud → Delete account on any device (the Mac app, Electron, the web dashboard, or the mobile app). This permanently removes your Auth user, all Firestore documents under your uid — settings, device links, cloud chats, session events, access grants, push tokens, and machine mappings — and signs you out. Feedback submissions you sent are kept as anonymized product insight (the text stays, your uid, email, and IP are stripped). Invites you sent are deleted. Local files on your disk are yours to remove. You can also email support@nocturnal.sh and we will do it for you.
If you are in South Africa, you can also ask for access, correction, or deletion under POPIA. If you are in the UK or EEA, the same requests cover the personal data we hold. We will say if we need more to find your account.
Children
Nocturnal is a developer tool. It is not directed at children under 16. If we learn an account belongs to a child, we will delete it.
Changes
If the product starts collecting something this page does not describe — analytics, a new processor, a paid lock that changes storage — this page will change on the same day, with a new date at the top. The public URL stays https://nocturnal.sh/privacy.
Email updates
If you opt in through the website, we store your email address, signup time, and the consent wording so we can send Nocturnal product updates and launch news. This is separate from creating an account. We keep the signup while you remain subscribed. Email support@nocturnal.sh to unsubscribe or request deletion; marketing messages will also include an opt-out method. We do not automatically subscribe app users. The signup endpoint uses a hashed network identifier for abuse prevention.