Nocta

Privacy Policy

Last updated October 25, 2026

What Nocta is

Nocta is a companion app for people on CPAP therapy. It reads the data your CPAP machine writes to its SD card and explains each night in plain language. Nocta is a wellness tool, not a medical device. See our Terms of Service.

In this policy, "Nocta", "we" and "us" mean the people who make Nocta. "You" means you.

What Nocta keeps about you

Nocta keeps what it needs to explain your nights:

• Your CPAP data. The nights read from your SD card: usage hours, AHI and other event counts, leak, pressure and the machine's settings.
• Your morning check-ins and the answers you give during setup.
• Your equipment log, like when you last replaced your mask or filter.
• A profile photo, if you add one.
• Nights from a connected wearable, once they've synced (see below).

Your SD card is read in your browser; the card's files themselves are never sent anywhere. What Nocta reads from them is kept in your browser on the device you're using, and:

• With an account, a copy is also saved to your account, so the same nights, check-ins and settings are there on every device you sign in on. Other people using Nocta can't see it. Unless you turn it off, the people who make Nocta can also see it, to improve Nocta (see "Sharing your data with us to improve Nocta" below).
• Without an account ("Look around without an account"), everything stays in that browser and nothing is sent to our servers.

Nox, Nocta's coach, answers from replies written ahead of time, in your browser. Your data is not sent to an AI service. If that ever changes, we'll update this policy before it does.

What our servers keep

Your account. When you create an account, we keep:

• Your email address.
• Your password, if you sign up with email. It's stored in a scrambled (hashed) form we can't read.
• If you sign in with Google: your name, email address and profile picture link from your Google account.
• Whether you've finished setting up the app.
• The saved copy of your data described above: your CPAP nights, check-ins, setup answers and photo, equipment log, and wearable nights and workouts.

If you choose "Look around without an account", nothing about you is sent to our servers.

Connected wearables. If you connect Oura, Fitbit or Whoop, that company gives Nocta an access key so Nocta can read your sleep and workout data. Our server keeps:

• The access key and the key used to renew it.
• Which company it's for, when you connected, and when Nocta last synced.

The access key never reaches your browser. When Nocta syncs, our server uses the key to ask the company for your recent nights and days and passes them to your browser. They are then saved with the rest of your data, in your browser and to your account.

What Nocta reads from wearables

Nocta only asks for read access, to sleep data and to your workouts and steps. It never writes to your wearable account.

• Oura: sleep stages, heart rate during sleep, heart-rate variability, breathing rate and nightly blood oxygen; your workouts (type, start and end time, intensity) and daily steps.
• Fitbit (through your Google account): sleep stages, heart rate, resting heart rate, heart-rate variability, breathing rate and nightly blood oxygen; your workouts (type, start and end time, length, active zone minutes) and daily steps.
• Whoop: sleep stages, resting heart rate, heart-rate variability, breathing rate and blood oxygen; your workouts (type, start and end time, strain).

Nocta doesn't show your workouts or steps as such. It uses them only to help explain your nights: for example, a hard workout the evening before a night when your heart-rate variability dropped, or whether your AHI tends to differ on days you worked out. You can turn off Workouts and Steps for each wearable on its page in Nocta.

Wearable data is shown next to your CPAP nights, and it can shape the morning's suggestion: for example, how long you slept compared with how long the mask was on, or an oxygen reading that has been low for several nights. Nocta treats a wearable's numbers as estimates. It never uses them to diagnose anything; at most, they point you to your doctor.

Nocta's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Nocta uses your Google data to show it to you in Nocta and, only if you turn on "Let Nocta's makers see my Fitbit data", lets the people who make Nocta see it to improve Nocta's insights. Never for ads, and we never sell it or pass it on.

Sharing your data with us to improve Nocta

With an account, the people who make Nocta can see your data, to understand how Nocta's insights fit real nights and make them better. This is on unless you turn it off. It covers:

• Everything your CPAP card recorded, night by night: when you used it, every breathing event (each apnea and hypopnea, with its time and length), leak, pressure, breathing rate, blood oxygen if recorded, minute-by-minute readings, the short breathing and pressure recordings around each event, and your machine's settings.
• Your wearable's nights and days from Oura or Whoop: sleep stages, heart rate, heart-rate variability, breathing rate and blood oxygen, and the day's workouts and steps. Data from Fitbit (through Google) is shared only if you choose to: Nocta asks you right after you connect a Fitbit, and you can also turn on "Let Nocta's makers see my Fitbit data" on the Fitbit page in Nocta. It's off until you say yes, and turning it off deletes what was shared.
• Your morning check-ins, the insight Nocta showed you each night, and whether you said it was helpful.
• What you told Nocta during setup (like your age, sex, height and weight, sleep conditions, mask and insurer) and your equipment log.
• Who you are: it's linked to your account, including your name and email address.

It's stored on Supabase's servers in the United States. Only the people who make Nocta can see it, and we use it only to improve Nocta. We never sell it or share it with insurers, employers, advertisers or data brokers.

To stop, turn off Settings › Share my data to improve Nocta. We stop looking at your data, and the nightly copies made for this are deleted. (Your account still keeps its own saved copy, so it's there on your devices, until you delete your account.) If you use Nocta without an account, none of your data is shared.

How you use Nocta (usage analytics)

To learn which parts of Nocta help and which confuse, Nocta records how you use the app and sends it to PostHog, our analytics provider:

• What you do, like opening a tab, importing an SD card, opening a night or asking Nox a question.
• Where you tap and scroll, including which buttons you press (but not what they say).
• Recordings of your visits, with the content hidden. They show the layout of each screen and where you tap, scroll and pause. Every word and number is blanked out, anything you type is hidden, and charts, graphs and photos are replaced with empty boxes. So a recording shows how you moved through Nocta, not your nights, your check-ins or what you asked Nox.
• About your device: phone-sized or desktop-sized screen, your browser, and the app version.
• Your IP address, which PostHog uses to estimate roughly where you are (country and city), so we can see where Nocta is used.
• Who: with an account, a random ID for your account (not your name or email). Without one, a random ID for that browser.

None of this includes your CPAP data, your check-in answers, anything you type, or anything about your health. Nocta doesn't use cookies for this.

If part of Nocta breaks, a crash report goes with them: what went wrong and where in Nocta's code, so we can fix it. It doesn't include what was on your screen.

All of this is on unless you turn it off: Settings › Share usage data. Once off, that browser sends nothing more, recordings included.

Feedback you send

If you use Settings › Send feedback, or answer when Nocta asks how it's going, we keep your rating, what you wrote, where you sent it from and the app version. With an account, it's linked to your account so we can understand it in context. If you delete your account, the feedback stays but is no longer linked to you. Please don't include health details you'd rather keep private.

Who else handles your data

Nocta uses a few service providers to run. Each only gets what it needs:

• Supabase stores your account, the saved copy of your data, the data you share with us (unless you turn sharing off), and wearable access keys, on servers in the United States.
• PostHog receives the usage analytics and screen recordings described above (with your health data hidden), and your IP address, on servers in the United States, unless you turn them off.
• Vercel hosts the website. Like most web hosts, it records basic request details such as your IP address.
• Google Fonts supplies Nocta's typefaces. Your browser downloads them from Google, which sees your IP address.
• Google, if you sign in with Google or connect a Fitbit.
• Oura and Whoop, only if you connect one of them.

We don't sell your data. We don't use advertising, and the usage analytics above never include your health data. We don't share your data with insurers, employers or data brokers. We would only disclose it if the law required us to.

Your choices

• Stop sharing your data with us: Settings › Share my data to improve Nocta.
• Turn off usage analytics: Settings › Share usage data.
• Export your data: Settings › Export everything (JSON) downloads everything Nocta has about you as a file, and Export nights (CSV) gives your nights as a spreadsheet.
• Disconnect a wearable: You › Wearables › the device › Disconnect. This deletes the access key from our server. You can also remove Nocta from that company's app or website.
• Delete your account: Settings › Delete account. This deletes your account, the saved copy of your data and any wearable access keys from our servers, and erases Nocta's data from the device you're using. Other devices you've signed in on keep their own copy until you sign out or clear them there.
• Erase this device's data (using Nocta without an account): Settings › Erase this device's data removes everything Nocta keeps in this browser.

Our service providers may keep backups for a short time after you delete something. Backups are not used for anything except recovering from failures.

Keeping it safe

All connections to Nocta use HTTPS. Your saved data is locked to your account: the database only lets you read or change your own. Wearable access keys are stored where only our server can read them, and they're never sent to your browser. No system is perfectly secure, but we only keep what Nocta needs to work.

Children

Nocta is for adults. It isn't meant for anyone under 18, and we don't knowingly collect data from children.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects what we keep or who sees it, we'll tell you in the app before it takes effect.

Contact

Questions, or a request about your data? Email jonathanchiang7@gmail.com.