Privacy Policy

What we collect

Account email address and password (hashed, via Supabase Auth). If you enable two-factor authentication, a TOTP secret. Billing details are handled directly by Stripe — norc never stores your card number.

Job and machine data you choose to sync: crontab entries, job names and schedules, machine names, and run status. This is the data you're already managing on your own systems — norc relays and stores it so you can view and edit it from web, desktop, and mobile.

If you use AI Studio, the prompts you write and, if you bring your own API key, that key (encrypted at rest with AES-GCM) to call your chosen AI provider on your behalf.

Standard operational logs (timestamps, IP address, error traces) for debugging and abuse prevention.

What we don't do

No ad tracking, no third-party analytics SDKs in the mobile or desktop apps, no selling or sharing your data with data brokers.

The marketing site (norc.app)

norc.app itself uses Vercel Web Analytics and Speed Insights — cookieless, aggregate measurement of page views and load performance. No cookies, no cross-site tracking, no individual profiles. This applies only to the marketing site, not the desktop, mobile, or vault apps.

Who else sees it

Supabase (database, auth, and relay infrastructure) and Stripe (billing) process data on our behalf under their own privacy and security terms. If you bring your own AI provider key, your prompts go to that provider (e.g. OpenAI, Anthropic) under their terms, not ours.

How long we keep it

Each category, for as long as your account is active, then deleted (including from backups) when you request account deletion:

• Auth record, password, and TOTP secret
• Synced job and machine data
• AI Studio prompt history and any BYOK key you stored with us

Two exceptions: billing records are retained by Stripe as required by law regardless of account deletion, and operational logs (timestamps, IP address, error traces) are kept only as long as needed for debugging and abuse prevention, deleted on a rolling basis independent of whether your account is still active. If you used a BYOK AI provider, that provider retains your prompts under its own terms — deleting your norc account does not delete anything already sent to them.

Your controls

Email hello@norc.app to export or delete your data, or to ask any question about this policy.