The essentials
- We collect the minimum needed to run Noroît.
- No advertising, no audience measurement tools, no tracking cookies.
- Your data is never sold, rented or shared for commercial purposes.
- It is hosted in France, and you can delete your account yourself, at any time.
Data controller
INFODUX LLC, 8 The Green, Suite A, Dover, DE 19901, USA — publisher of Noroît. For any question about your data: contact@noroit.org.
INFODUX LLC is established in the United States. The General Data Protection Regulation (GDPR) applies to the data of people who use Noroît from the European Union, and we apply it to all our users.
Data processed
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account: email, name, encrypted password (never stored in plain text), language | Identify you and write to you about the Service | Contract | Until the account is deleted |
| Application data: boats, polars, start and finish points, alerts, settings | Make them available on all your devices | Contract | Until the account is deleted |
| Sign-in sessions: IP address, browser, dates | Keep you signed in, secure the account | Legitimate interest (security) | Erased when the session expires (after 7 days without use) |
| Account usage counters: weather requests and routings per day | Apply the limits of your plan | Contract | 13 months |
| Visitors without an account: IP address and daily counters | Limit free use and prevent abuse | Legitimate interest | IP address erased within 3 days; only anonymous totals remain |
| Subscription: plan, status, dates, Stripe customer ID | Manage the subscription and billing | Contract; accounting and tax obligations | Duration of the subscription; invoices kept as long as the law requires (up to 10 years) |
| Correspondence with us (emails) | Answer your requests | Legitimate interest | 3 years after the last exchange |
| Administration log: actions taken on an account (plan change, block) | Traceability and abuse prevention | Legitimate interest | 3 years |
Card numbers are entered directly with Stripe: we never have access to them. The areas you look at and the routes you compute are only used to answer you; we do not keep a history of your positions.
Recipients and service providers
Only authorized INFODUX LLC staff can access your data, along with our service providers, each for its own part:
- Hostinger International Ltd (Cyprus): hosting of the website and database, on a server located in France.
- Stripe: payment and billing. Stripe also acts as a data controller for its own obligations (fraud prevention, financial regulations).
- Brevo (Sendinblue SAS, France): sending of sign-in, password reset and subscription emails.
Weather forecasts are requested by our server, without passing your IP address or identity on to the data providers.
Services contacted by your browser
To display some layers, your browser contacts third-party services directly, which then receive your IP address and the area displayed, as with any website:
- base maps: Esri (ArcGIS Online, USA), OpenStreetMap and OpenSeaMap;
- precision computations: EMODnet (bathymetry, European Union) and OpenStreetMap Overpass servers (charted hazards);
- secure payment form: Stripe (stripe.com), loaded when you subscribe or save a card;
- “Navionics” view: Garmin’s official module, loaded only when you open that view and subject to Garmin’s privacy policy.
Transfers outside the European Union
Our database is hosted in France. Some providers (Stripe, Esri) may process data in the United States; these transfers are covered by the EU–U.S. Data Privacy Framework or by the European Commission’s standard contractual clauses.
Cookies and local storage
Noroît only uses what is strictly necessary for it to work, which does not require consent:
- a session cookie (
better-auth.session_token), set when you sign in and removed when you sign out; -
the browser’s local storage (
noroit-v1), which keeps your settings and your last computation on your device, even without an account; - your language choice (
noroit.lang), kept in the browser’s local storage when you choose French or English.
No advertising or audience measurement cookie is used.
Security
Communications are encrypted (HTTPS), passwords are stored as hashes and access to the server is restricted. Repeated sign-in attempts are limited. If a data breach posing a risk to you occurred, we would inform you.
Your rights
You have the right to access, rectify, erase, restrict, object to the processing of and port your data. In practice:
- delete your account: “My account” > “My data” in the application. Erasure is immediate;
- get a copy of your data (JSON format) or exercise another right: email contact@noroit.org from your account’s address.
We reply within one month. If you believe your rights are not being respected, you may contact the data protection authority of your country (in France, the CNIL).
Minors
Noroît is intended for adults. A minor may only create an account with the consent of their legal guardian.
Changes
We may update this policy, in particular when the Service changes. Any significant change is announced to you by email or in the application before it applies. The version date appears at the top of the page.