Privacy Policy

1. Who is responsible

The data controller for Noxyro is David García, operating Noxyro as a natural person (publicly davidgarciab). Contact: [email protected]. You can also reach the operator via GitHub at https://github.com/davidgarciab.

Noxyro has no user accounts, no customer database, and no video-upload backend. Most processing described below happens on your device or is limited to ordinary website delivery.

2. Scope

This policy covers the Noxyro website and in-browser app at https://noxyro.app, including English and Spanish pages. It does not cover independent websites you may open from Noxyro, such as Ko-fi or apps chosen by your device when you share a result.

3. What Noxyro does not collect

Noxyro does not upload, receive, or store your video, audio, frames, pose landmarks, or generated share files on a Noxyro server. Analysis, scoring (Aura XP), and share-asset generation run locally in your browser.

Noxyro does not collect names, email addresses, phone numbers, payment details, government IDs, precise location, or account credentials. Noxyro does not infer or score attractiveness, personality, gender, age, emotion, mental state, or identity. Camera and microphone access, when you grant it, is used only on your device.

4. Processing on your device

If you record or upload a clip, the file stays in browser memory as a local object URL. Noxyro may sample frames and run on-device computer vision (MediaPipe Pose Landmarker loaded from Noxyro’s static files) to produce an entertainment score. Audio may be captured for local preview and for a share video you choose to export; the Judge does not score sound.

This on-device processing is necessary to provide the service you request. Clips are discarded when you replace the video, start over, or leave the session. Noxyro does not keep your media after the browser session ends.

5. Storage on your device

Noxyro uses browser localStorage for functional preferences, not advertising. The language preference is stored under “noxyro_locale”. Optional result statistics (last score, personal best, scan count, and Judge version) are stored under “noxyro.result-stats.v1”. These values never leave your device through Noxyro.

This storage is strictly necessary or limited to the service’s basic function (remembering language and showing your own result stats). Noxyro does not set advertising cookies. You can clear this data with your browser’s site-data controls.

6. Website hosting (Cloudflare)

Noxyro is a static site hosted on Cloudflare Pages. When your browser requests pages, scripts, styles, or the pose model, Cloudflare may process technical data such as IP address, user-agent, referrer, requested URL, and approximate location derived from IP, in order to deliver the site, cache content, and protect against abuse. Noxyro does not operate an application server that logs clips or scores.

Cloudflare acts as a processor / service provider for website delivery. Cloudflare’s own notices apply to that infrastructure processing.

7. Optional product analytics

Some deployments may enable anonymous product analytics through PostHog (default ingest host https://eu.i.posthog.com). Analytics are off when no project key is configured. When enabled, Noxyro sends only named funnel events with allowlisted, bucketed properties (for example duration buckets, share format, or browser family). It does not send video, audio, frames, pose data, filenames, exact scores, challenge URL values, or identity.

PostHog is initialized without cookies or localStorage identifiers, without session recording, without autocapture, without pageviews, and with IP collection disabled. Events are for product funnel health, not profiling. If analytics are enabled on the copy you are using, PostHog is a processor of those limited event payloads.

8. Sharing and challenge links

If you share a result, your device’s share sheet or download tools send the file or text you chose to the destination you pick. Noxyro does not see which app you selected and does not upload the share file to Noxyro.

Challenge links contain only a bounded Aura XP value and Judge version. They are client-controlled prompts, not verified identity or proof of a score. Anyone who opens a challenge link can see those numbers in the URL.

9. Third parties you choose

Optional “Support Noxyro” links open Ko-fi (https://ko-fi.com/davidgarciab). Payments, supporter identity, and checkout data are processed by Ko-fi, not by Noxyro. Noxyro does not receive payment confirmation.

10. Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, Noxyro relies on: (a) performance of a contract or steps at your request (Art. 6(1)(b)) for on-device analysis and share-file generation you initiate; (b) legitimate interests (Art. 6(1)(f)) in delivering a static website, securing it, remembering language, and measuring anonymous product funnels when analytics are enabled; (c) consent (Art. 6(1)(a)) where a browser permission (camera or microphone) is required, which you can refuse or revoke in the browser.

Noxyro does not seek to process special-category data. Pose landmarks stay on your device and are used only to score the recorded moment as entertainment, not to identify you.

11. Retention

Media and analysis exist only in the current browser session unless you save or share them yourself. Language and result-stat keys remain in localStorage until you clear them. Cloudflare may retain security and delivery logs according to its own periods. Optional analytics events, if enabled, are retained by PostHog according to that project’s settings.

12. Recipients and international transfers

Website delivery may involve Cloudflare, which can process technical data outside your country, including the United States, with safeguards such as Standard Contractual Clauses where required. Optional PostHog ingest defaults to an EU host. Noxyro does not sell personal information and does not share it for cross-context behavioral advertising.

13. Your rights in the EEA, UK, and Switzerland

You may request access, rectification, erasure, restriction, objection, and portability of personal data we control, and you may withdraw consent for browser permissions at any time. Because Noxyro does not keep user accounts or media, we often cannot identify you from on-device clips. You can delete local data yourself via browser settings.

You also have the right to lodge a complaint with your supervisory authority (in Spain, the Agencia Española de Protección de Datos; in the UK, the ICO). Contact [email protected] to exercise rights. We may need enough information to locate any hosting logs that actually relate to you.

14. US state privacy notices (including California)

Noxyro is not in the business of selling or sharing personal information as those terms are used in the CCPA/CPRA and similar US state laws. We do not use or disclose sensitive personal information to infer characteristics about you.

Categories that may be processed in connection with visiting the site: identifiers and internet/network activity (such as IP address and user-agent via the CDN), and, if analytics are enabled, limited event data. Sources: your device and browser. Purposes: provide the site, security, and optional product metrics. Recipients: hosting (Cloudflare) and optional analytics (PostHog). Retention: as described above.

California residents may request to know, delete, or correct personal information we hold, and to opt out of sale/sharing (there is none to opt out of). We will not discriminate for exercising these rights. Submit requests to [email protected]. We do not currently process consumer requests through a recognized universal opt-out preference signal because we do not sell or share personal information for advertising. “Shine the Light” and similar disclosure laws: we do not disclose personal information to third parties for their direct marketing.

15. Children

Noxyro is not directed at children. Do not use it if you are under 13 (COPPA). If you are in the EEA or UK, you must meet the digital-consent age in your country (14 in Spain; 16 in some countries) or use Noxyro only with a parent or guardian. We do not knowingly collect personal information from children. If you believe a child provided data to us, contact [email protected] and we will delete anything we control.

16. Automated processing

Aura XP is an automated entertainment score produced on your device. It has no legal or similarly significant effect on you. It is not a biometric identification system, credit, employment, housing, or eligibility decision.

17. Changes

We may update this policy when the product or the law changes. The “last updated” date at the top will change. Continued use after an update means you have read the revised policy. Material changes will be reflected on this page.

18. Contact

Privacy questions and rights requests: [email protected]. Operator: David García. Website: https://noxyro.app.