Privacy and security

What we store

• Your name, work email address, role and, if you add one, a profile picture.
• The guides, answers, questions, notes and screenshots your organisation writes.
• A security log of sign-ins and changes (who, what, when, IP address and browser), kept for 365 days.
• We never store your password itself, only a one-way hash. Two-step sign-in secrets are encrypted.

Where it is kept

• Data and files are hosted in Tokyo, Japan, with encryption in transit (HTTPS only) and at rest.
• Service providers: Vercel (hosting), Supabase (database), Cloudflare R2 (files), Resend (email), and Microsoft if your organisation signs in with Microsoft.

Who can see it

• Each client organisation has its own private space. People only see their own organisation’s content, plus anything published company-wide.
• Screenshots are private files served only to people allowed to read the article they belong to.
• Inside an organisation, owners decide who can read and who can edit.
• Reynald Arro (trading as 926 Systems) administrators can access data to provide support; every access is recorded in the security log.

How accounts are protected

• Two-step sign-in with an authenticator app, which administrators can require for privileged roles.
• Repeated failed sign-ins are blocked automatically. Removing someone or changing their role ends their sessions at once.
• Invites and password resets use single-use links that expire.

Your rights

• You can ask for a copy of the personal data held about you, or for it to be corrected or deleted.
• Organisations can export all of their content at any time, and have it permanently deleted when they leave.
• If a personal data breach affects you, you and your organisation will be told promptly, and regulators will be notified where the law requires.

Questions or requests

Contact privacy@noska.io.