Privacy Policy — Noox
Last updated: 2026-09-26
This Privacy Policy explains how Noox ("the Application") processes — or, in most cases, does not process — personal data. The controller of the personal data described here is David do Rosário Taveira ("we", "the Author"), reachable at info@nooxspace.com.
This English text is a translation of the Portuguese original, provided so that you can read this Policy in a language you understand. The Portuguese version is the original wording; this does not affect any mandatory rights you have, nor your right to rely on the language version in which this Policy was presented to you.
In short (the 10-second version)
- Noox is a 100% local application. Your files, the way you organise them and your usage data never leave your computer.
- The Application requires no account and no login. Your files and the way you organise them are not synchronised with any server.
- The only thing the Application sends on its own initiative is the check of your licence key against the Author's licence server, on activation, at every start-up and then every seven days while the Application is open — see section 4.
- The Application checks for updates every three hours and downloads them in the background, but installs nothing unless you say so — see the "Technical exception" in section 1.
- We do not collect, do not sell and do not share your personal data.
- The only personal data that may exist are: (a) the purchase data, processed by Paddle (not by us); (b) your licence key and this device's activation identifier, used only to validate the licence; (c) your email, only if you voluntarily sign up for the waiting list or the newsletter; and (d) the text (and, optionally, system info) you send, only if you use the "Feedback" button.
1. Data the Application does NOT collect
Noox was designed on the principle of data minimisation. Specifically, the Application does not send to us or to third parties:
- your files or their content;
- the way you organise your files (positions, notes, drawings, cards, virtual spaces, layouts);
- your habits or usage statistics;
- identifiers of your device for tracking, advertising or profiling purposes;
- the name of your computer, your username or hardware identifiers.
All of this remains exclusively on your computer, under your control.
Necessary exception: licence validation sends your licence key and the activation identifier of this device to the Author's licence server — this is what makes the licence work, and it is described in detail in section 4.
Technical exception: the Application downloads two files hosted on GitHub:
- at start-up, a small configuration file, used to remotely disable features should a problem be found (for example, an incompatibility with a Windows version). If the request fails, the Application still works with the last known configuration;
- every three hours while the Application is open, a small file stating the latest version. If a new version exists, the installer is downloaded in the background — but nothing is installed without an action by you: the update is only applied when you ask for it to be applied.
These requests are automatic and do not depend on any action by you. They send no data about you — they are downloads, not uploads — but, as with any request made over the Internet, GitHub's server sees your IP address.
Apart from these two exceptions, nothing leaves the Application without an action by you.
Voluntary exception: if you use the application's "Feedback" button, the data you write (and, only if you authorise it, diagnostic information about your system) is sent by your explicit decision — see section 6.
2. Data stored locally on your device
In order to work, Noox stores data locally, on your own disk. This data is not transmitted to us:
- Noox organisation data — the positions, notes, drawings, cards and spaces you create, stored in files next to your folders or in the application's area.
- Embedded browser data (WebView2) — when you open websites inside Noox, the Microsoft Edge WebView2 component may store cookies, sessions and browsing data locally, just like a normal browser. This data stays on your computer and can be managed or deleted by you.
- NooxRec recordings — the screen videos you choose to record are stored locally, at your command. We have no access to them.
- Local log files — the Application may generate diagnostic files on your computer to help identify errors. They are not sent automatically to us. If, in order to solve a problem, you decide to share them with us, you will do so voluntarily and explicitly.
3. Purchase data (processed by Paddle)
Noox is sold through Paddle, acting as Merchant of Record. When you buy the Application:
- it is Paddle — not the Author — that collects and processes the data required for the transaction (for example, name, billing address, email and payment data);
- the Author has no access to your payment data (card number, etc.);
- the processing of that data is governed by Paddle's Privacy Policy, available at https://www.paddle.com/legal/privacy.
The Author may receive limited data from Paddle relating to the sale (for example, purchase confirmation and associated email) for the purposes of licence management and support, processed only for that purpose and for as long as necessary.
The Author's own order record. Outside Paddle, the Author keeps a simple record of orders — email, licence key and date — in order to reissue your key if you lose it and to support you without depending on the store continuing to exist. That is the basis for this processing: the Author's legitimate interest (Article 6(1)(f) GDPR) in being able to honour the licence you purchased. This record is not a tax document and is therefore deleted at your request. ⚠️ If you request erasure, the Author will no longer be able to link you to your licence: save your key before doing so.
4. Licence validation
This is the only communication made on the Application's own initiative in which it sends data about you — the requests to GitHub described in the "Technical exception" of section 1 only download files and send no data about you. That is why it is described here in detail, and section 2.3 of the Terms refers to this section.
When it happens:
- on activation, at first start-up on each device;
- at every start-up of the Application, and thereafter in a periodic check every seven days while the Application stays open — always in the background;
- on deactivation, if you choose to release this device's seat.
What data is sent (to the Author's licence server, at `licenses.nooxspace.com`, and only to it):
- your licence key;
- the activation identifier of this device, returned by the server on activation;
- on first activation, a device label whose only purpose is to let you tell your two seats apart if you need support. That label is made up of the operating system (for example, "Windows") and the activation date — it does not include the name of your computer, your username, the equipment's serial number or any hardware identifier.
- a random verification code, generated on your own device and replaced at every validation. Its only purpose is to detect that the same licence is being used on two computers at the same time. ⚠️ It says nothing about your equipment: it is a random value, it is not derived from your hardware and it is not a device identifier.
What data is NOT sent: none of your files, nothing about how you organise them, no usage statistics, no address you have visited inside the Application. Validation carries nothing about what you do in Noox — only whether the key is still valid.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) — it is the mechanism that makes it possible to sell the licence on the terms of section 2 of the Terms.
Who processes the data: the Author is the data controller. The licence server runs on Cloudflare infrastructure (Workers, Durable Objects and KV), which acts as a processor and is where the key and the activation identifier are stored. ⚠️ Paddle takes no part in this validation and has no access to this data — its role ends with the purchase (section 3). At purchase, the email carrying the key is delivered by ZeptoMail (Zoho).
If there is no internet connection, nothing is sent and nothing happens: the Application keeps working and tries again later. We neither store nor transmit any record of failed attempts.
5. Waiting list and newsletter (optional)
If — and only if — you voluntarily sign up, on the website or when purchasing:
- Data collected: your email address and the choices you ticked.
- Opening notice (waiting list): an email each time the beta opens to the list, with the time of that opening and, where there is one, the access code.
- Newsletter: news and new features, issues identified and fixed, and Noox offers and promotions.
- You can choose both or just one of them, and you can unsubscribe from each one separately.
- Email confirmation: your sign-up only becomes active after you click the confirmation link we send you. We keep the date and time of the sign-up and of the confirmation, and the text you accepted, as proof of your consent. If you do not confirm, we send you nothing else.
- Legal basis: your consent (Article 6(1)(a) GDPR), given separately for each choice.
- Unsubscribing: you may unsubscribe at any time through the unsubscribe link included in every message, or by contacting us.
- Processor: delivery may be operated by an email service provider (Zoho Campaigns, da Zoho Corporation B.V.), which processes your email solely for this purpose and on our behalf.
We do not use this email for any other purpose and we do not sell or share it for third-party marketing purposes.
6. Feedback and problem reports (optional)
If — and only if — you voluntarily use the application's "Feedback" button:
- Data collected: the text you write, the application version and — only if you tick the consent checkbox on that panel — diagnostic information about your operating system (name, version and Windows build number).
- Purpose: diagnosing and fixing reported technical problems.
- Legal basis: your consent (Article 6(1)(a) GDPR) — the checkbox is unticked by default and you can send the text without ticking it.
- Retention: for as long as necessary to investigate and resolve the reported problem.
- How it is delivered: the message is sent to the Author's server (Cloudflare) and from there turned into an email to the contact mailbox, delivered by ZeptoMail (Zoho) — the same processors already used for the licence and for the key email. No additional provider is involved.
- It is anonymous. The message carries neither your licence key, nor your email, nor any identifier of your device. If you write your contact details inside the text, that is because you chose to — and it is the only way we can reply to you.
If you don't use this button, none of this data is sent.
7. Third-party services
Noox integrates or relies on third-party components, each with its own policies:
- Paddle (purchase processing) — https://www.paddle.com/legal/privacy
- Cloudflare (licence-server infrastructure — Workers, Durable Objects and KV; where the key and the activation identifier are stored) — https://www.cloudflare.com/privacypolicy/
- Microsoft Edge WebView2 (embedded browser) — when you open sites, Microsoft's policies and those of the sites you visit apply.
- ZeptoMail (Zoho) (email delivery: licence key and feedback messages) — https://www.zoho.com/privacy.html
- GitHub (hosting of the configuration file downloaded at start-up and of the Application updates — see the "Technical exception" in section 1) — https://docs.github.com/site-policy
- Zoho Campaigns, da Zoho Corporation B.V. (waiting list and newsletter, where applicable).
The websites you open inside Noox belong to third parties and are governed by their own privacy policies — we have no control over them.
8. Data retention
- Local data remains on your computer for as long as you keep it; you control it and may delete it at any time.
- Purchase data is retained by Paddle under its own policy and legal obligations (for example, invoicing).
- The Author's own order record (section 3) is retained for as long as the licence exists, for support and key reissue, and is deleted at your request.
- Licence activation data (key, activations and their labels) is retained on the Author's licence server (Cloudflare) for as long as the licence exists. You may deactivate a device at any time in the Application, which removes its activation.
- The waiting list and newsletter email is retained until you unsubscribe, together with the proof of consent (date, time and accepted text).
- Feedback data is retained as described in section 6.
9. Your rights (GDPR)
As a data subject, and to the extent that personal data is processed by us, you have the rights of:
- access to your data;
- rectification of incorrect data;
- erasure ("right to be forgotten");
- restriction of and objection to processing;
- portability of the data;
- withdrawal of consent at any time (without affecting prior processing).
To exercise these rights, contact us at info@nooxspace.com. You also have the right to lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) — https://www.cnpd.pt —, or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place (Article 77 GDPR).
Limits to erasure. The right to erasure is not absolute. Where a legal retention obligation exists, the data it covers cannot be erased — this is the case for invoicing records, under Article 17(3)(b) GDPR. Note that the invoice for your purchase is issued and kept by Paddle, not by the Author: it is Paddle that is subject to that tax obligation, and it is Paddle you should contact about those documents (see section 3).
In practice, with the Author: if you request erasure of your data, everything is deleted — the newsletter email, any feedback you sent, contact details and the order record described in section 3. Nothing remains on the Author's side under a tax obligation, because the Author is not the one who invoices you.
10. Children
Noox is not specifically directed at minors and does not knowingly collect personal data from children.
11. International transfers
As the Application is local, we do not transfer your usage data outside your computer. The only processing with a possible international dimension is that operated by Paddle, Cloudflare (licence server) and the email provider (sections 4 and 6), subject to the safeguards laid down in their respective policies and in the GDPR.
12. Changes to this Policy
We may update this Privacy Policy. The version in force will be the one published at https://nooxspace.com, with its date. Material changes will be notified to you in a reasonable manner.
13. Contact
- Data controller: David do Rosário Taveira
- Email: info@nooxspace.com
- Address: Vila Nova de Gaia, Portugal
- Site: https://nooxspace.com