Privacy Policy

NoCringe helps adults generate dating reply suggestions from pasted text or screenshots. We process personal data to provide the service, authenticate accounts, enforce free usage limits, process subscriptions, keep the service secure, prevent abuse, and comply with the law.

Suggestions are generated by artificial intelligence. You are informed of this in the product. You remain responsible for reviewing any suggestion before sending it.

The data controller is:
Avayly B.V.
Legal form: besloten vennootschap (private limited company)
Registered address: Midaslaan 20, 5631 BE Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 90673891
Our VAT identification number (BTW-id) is shown on invoices issued through Stripe and is available on request at the contact email above.
Privacy / data protection contact: nocringe@avayly.com

We have not appointed a Data Protection Officer. For privacy questions or requests, use the contact email above. We will reassess whether a DPO is required as the product scales.

Depending on how you use NoCringe, we process the following categories of personal data:

• Account data: email address and user ID (UUID) created when you sign in with a magic link.
• Optional profile data you choose to save: writing style, gender, age range, dating goal, and free-text avoid / emphasize preferences.
• Usage data: the current day's generation count used to enforce the free daily limit.
• Subscription data needed to manage Pro plans: Stripe customer and subscription IDs, plan (weekly / monthly / annual), status, current period end, and cancellation flags. We do not store payment card numbers.
• Generation input for the duration of a request: conversation or message text you paste or that is extracted from a screenshot, plus any profile fields you include with that request.
• Technical and security data collected by our infrastructure providers, such as IP address, device or browser information, and operational logs.
• Cookie and local-storage preferences, including your cookie consent choices and PWA install-hint preferences.

Providing an email address is necessary to create an account. Optional profile fields are not required. Without submitting text for generation, we cannot provide reply suggestions.

Screenshots are processed locally in your browser with on-device OCR (Tesseract.js). The image itself is not uploaded to NoCringe servers. Only the extracted or pasted text (and optional profile fields) is sent to our backend and then to our AI provider to generate suggestions.

We do not store your conversation text, OCR text, or generated replies in our database after the request completes. Infrastructure providers may keep short-lived operational logs (for example IP addresses and error metadata). We configure OpenAI API requests with response storage disabled (`store: false`). OpenAI may still retain API inputs for a limited period for abuse monitoring under its then-current API terms unless a separate zero-retention arrangement applies.

Dating chats often contain intimate personal data, including data that may reveal sexual orientation, health, religion, or other special categories of data under GDPR Article 9, about you or about someone else. By submitting text for generation, you explicitly consent to that processing for the sole purpose of generating suggestions for you. You may withdraw this consent at any time by stopping use of generation features and contacting us; withdrawal does not affect processing already completed.

Please remove names, phone numbers, addresses, and other personal details of other people before generating replies whenever you can. Do not submit content involving minors, non-consensual intimate material, or information shared with you in confidence that you are not allowed to process.

If your pasted conversation or OCR text includes personal data about another person (for example a match), that data is processed only to provide the generation you requested. We do not use it to contact them, build profiles about them, or train AI models.

Providing individual privacy notices to those people is typically impossible or would require disproportionate effort because we do not store the chat content and usually cannot identify them. This public Privacy Policy is our notice for that processing. If you are a non-user and believe we hold your data, contact nocringe@avayly.com. Because chat content is not retained in our database, we will usually not be able to identify data about you.

We process personal data only for the purposes and on the legal bases below (GDPR Article 6, and Article 9 where special-category data is involved):

• Providing accounts and magic-link sign-in (email, user ID) — contract (Art. 6(1)(b)).
• Generating reply suggestions (submitted text and optional profile) — contract (Art. 6(1)(b)), and where special-category data is included or reasonably foreseeable, your explicit consent (Art. 9(2)(a)).
• Saving optional personalization profile — consent (Art. 6(1)(a)); you can clear or update it in the app.
• Enforcing free daily usage limits — contract / legitimate interests in fair use of the free tier (Art. 6(1)(b)/(f)).
• Managing Pro subscriptions via Stripe — contract (Art. 6(1)(b)); retaining invoice-related records where required — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, fraud prevention, and troubleshooting — legitimate interests (Art. 6(1)(f)).
• Responding to support and privacy requests — contract and/or legitimate interests (Art. 6(1)(b)/(f)).
• Complying with legal obligations and valid authority requests — legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, those interests are operating a secure, reliable service, preventing misuse of AI generation, and answering support requests. You may object as described in section 11. We do not use your chat content to train AI models.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you (GDPR Article 22). Usage counters and reply suggestions are assistive tools; you decide what to send.

We use carefully selected service providers that process personal data on our instructions or, where noted, as independent controllers for their own legal duties:

• Supabase — authentication (magic-link email OTP), database storage for profiles, usage counters, and subscription status. Email delivery for magic links is handled through Supabase Auth and any SMTP provider configured for that project.
• Vercel — hosting of the website and API routes.
• OpenAI — processing of submitted conversation or message text (and optional profile fields) to generate suggestions via the OpenAI API.
• Stripe — payment processing, invoices, receipts, payment methods, subscription changes, and customer portal. Stripe also processes certain data as an independent controller for fraud prevention, compliance, and its own legal obligations. See Stripe's privacy notice.

We do not currently use analytics or marketing pixels. If we introduce them later, they will load only after optional consent, and this Policy will be updated with provider names before that happens.

Our core application may run in the EU, but some providers (including OpenAI, Stripe, Supabase, and Vercel) are US companies or use infrastructure outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified organizations where applicable) and/or Standard Contractual Clauses with appropriate transfer assessments, as set out in our agreements with those providers.

You can request more information about transfer safeguards by emailing nocringe@avayly.com.

• Account data (email, user ID): kept while your account exists. We may delete or ask you to confirm inactive accounts after prolonged inactivity (for example 24 months without sign-in).
• Optional profile data: until you update or delete it, or until the account is deleted.
• Usage counters: current-day counters needed to enforce limits; deleted with the account.
• Subscription records: while needed to provide Pro access; minimal billing identifiers may be retained as required for tax and accounting (commonly up to 7 years under Dutch law) or left with Stripe as the system of record for invoices.
• Submitted chat text, OCR text, and generated replies: not stored in our database after the request. Providers may retain short operational or abuse-monitoring logs for limited periods under their terms.
• Operational logs (hosting/auth): typically a short period such as 7–30 days, subject to provider defaults.
• Cookie consent records stored in your browser: until you clear site data or update preferences.
• Support and privacy request correspondence: typically 1–3 years as evidence of how we handled the request.

Backups held by infrastructure providers may retain deleted data until those backups expire according to the provider's schedule.

We apply technical and organizational measures appropriate to the risk, including encrypted transport (HTTPS/TLS), access controls, Supabase row-level security on user tables, and least-privilege use of server credentials. No method of transmission or storage is completely secure. Avoid submitting unnecessary sensitive information.

Under the GDPR you have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to legal retention exceptions (for example tax records).
• Restrict processing in certain cases.
• Data portability for data you provided that we process by contract or consent.
• Object to processing based on legitimate interests; this objection is absolute for direct marketing.
• Withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
• Lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in your EU country of residence or work.

To exercise these rights, email nocringe@avayly.com from the address linked to your account, or while signed in. We will respond without undue delay and within one month (extendable by up to two further months for complex requests, with notice). We may need to verify your identity. Account deletion is currently handled by email request; we will cancel active Stripe subscriptions as part of deletion where applicable.

We use cookies, session storage, and local storage as follows.

Essential. Strictly necessary for authentication and session security (including Supabase auth tokens), remembering your cookie choices, enforcing free usage limits, PWA-related storage such as the install hint preference, and core app features. These do not require optional consent.

Optional analytics and marketing. We do not currently load analytics or marketing cookies or pixels. The preference controls in Cookie settings are reserved for future optional tools. Until a provider is enabled and named in this Policy, turning those categories on does not load any extra tracking.

You can change optional choices anytime using Cookie settings in the footer, or clear site data for NoCringe in your browser.

NoCringe is only for users who are at least 18 years old. We do not knowingly collect personal data from minors. If we learn that an account belongs to a minor, we will delete it and related personal data. Age is based on self-declaration at present.

We may update this Privacy Policy when our practices, providers, or the law change. We will update the “Last updated” date above. For material changes, we will provide additional notice (for example by email or an in-app notice) where appropriate. If a change requires new consent, we will ask for that consent before relying on it.

Privacy questions and requests: nocringe@avayly.com
Postal: Avayly B.V., Midaslaan 20, 5631 BE Eindhoven, the Netherlands

Related documents: Terms of Service.