Privacy & Data

What we store. What we never do.

Nocturnal Post is engineered around a short data life. This page is the actual posture — the same rules run in the code you can read.

What Nocturnal Post stores

  • Message metadata — subject, sender, recipients, timestamps, folder.
  • A short body preview (first ~500 characters) to power classification and search.
  • Derived intelligence — categories, priorities, work items, briefing content.
  • Search vectors — numeric embeddings of previews, treated as sensitive data and purged with the same retention rules.

Everything above ages out on your retention schedule. Default maximum: 30 days. Hosted Free keeps a rolling 8 days.

What it never does

  • No tenant-wide mailbox crawling — access is per-user, per-folder, user-approved.
  • No full-mailbox ingestion by default — you select the folders.
  • No email bodies or tokens in logs.
  • No selling or sharing data — there is no data to sell.
  • No automatic external replies without review.

Technical posture

  • Per-tenant databases — your data lives in its own store, isolated from every other tenant.
  • Encrypted OAuth tokens — and one-click disconnect revokes them at Microsoft, not just locally.
  • Scheduled deletion — the Vault worker deletes expired messages, previews, and vectors every hour.
  • Export & delete — tenant admins can export all data as JSON or wipe it entirely.
  • Audit log — admin and security events are recorded.
  • Open source (AGPL-3.0) — every claim on this page is verifiable in the code.
For compliance teams

Nocturnal Post accesses mail through Microsoft Graph with delegated permissions granted by each individual user. Revoking access (via disconnect, password change, or Entra admin action) stops all processing immediately. Because retention is enforced in code and the maximum window is configurable, data-exposure windows are bounded and demonstrable — useful when the question "what email data does this system hold?" has a concrete answer: at most N days of metadata and previews, per user, in an isolated store, revocable now.

Questions about data handling? We answer them directly.

Ask us