Privacy Policy
Last updated July 2026
Our approach
Noblot holds some of the most personal data you own — your clients, money, health, and journal. We treat privacy as a feature, not a checkbox. We do not sell your data or use your private content to train models.
What we store
Your account details, the records you create, and metadata needed to run the Service (e.g. counts used for your plan). Sensitive content is encrypted at rest.
Sensitivity tiers
Ordinary CRM data is encrypted against a database breach. Sensitive content — journal, health notes, finances, and relationship data — is protected more strongly, kept out of search and any cross-workspace view, and not part of ordinary staff or support access.
Intimate relationship content (Dynamics)
The optional Dynamics feature is encrypted per-relationship. Unlike the zero-knowledge journal, its keys are recoverable by the operator — a deliberate choice so accounts can be handled in a legal or safety matter. This is not zero-knowledge: staff could, in principle, decrypt this content. Every such access requires a stated legal basis and is written to an append-only audit log that you can see in Settings → Privacy. For nearly all users this log is empty.
Zero-knowledge lock
You can seal your journal with a passphrase. The key is derived on your device with Argon2id and never reaches our servers, so no one — including us — can read that content. Forgetting the passphrase means it cannot be recovered.
Your AI assistants
When you connect Claude or ChatGPT, they act only within the workspaces and scopes you grant on the consent screen. Personal and relationship workspaces are unchecked by default, and a passphrase-locked journal is never writable or readable by an AI.
Your rights (GDPR / DPDP)
You can export a machine-readable copy of your data at any time, and delete your account. Deletion crypto-shreds your encrypted content immediately (unreadable even in backups) and purges the remaining rows after a 30-day grace window.
Contact
Export and deletion are self-serve and need no request: both are in Settings → Danger zone inside your account. For anything else — including a request made without an account — reply to any email Noblot has sent you; replies reach us.