Privacy Policy

The website and Nocturne Messenger are run by Nocturne Eternal, which is responsible for your data under this policy.

Nocturne Eternal is an independent community for the alternative music scene, run by one person, not a company with a data team. Questions, requests, or complaints about your data go to nocturne.3ternal@gmail.com.

Your account. Your email address and password. Sign-in is handled by Supabase Auth; your password is stored hashed and we never see it.

Your profile. Whatever you choose to add: display name, username, photos, pronouns, age, gender and who you're looking for, city, bio, bands, instruments, genres, best gig, profile links, layout and theme choices, jukebox playlist, and so on.

Age verification. You have to be 18+, and we check with Stripe Identity: a photo of your ID plus a matching selfie, taken and processed by Stripe, not us. Your ID images never touch our servers. Once Stripe verifies you, we fetch just your date of birth from Stripe to work out whether you're 18+, and then we keep only the result (verified or not, and when). We don't store your name, date of birth, or anything from the document.

Payments. Membership is paid through Stripe Checkout. Stripe handles your card details; we never see them. We keep a record of the purchase (Stripe's session and payment IDs, amount, currency) so we know your membership is active.

Location (optional). If you tap "use my location" on your profile, we save your coordinates rounded to about 100 meters. Only you can read them. Other members only ever see a distance ("12 mi away"), calculated on our server, never your coordinates. You can clear it anytime. Your city is a separate field you type yourself.

Music connections (optional).

• ✦Spotify: if you connect it, we store the access tokens Spotify gives us (server-side only, never shown to anyone) and use them to read your top artists, recently played and currently playing tracks. We save your top artists and genres to your profile. You choose who sees your listening, and disconnecting deletes the tokens.
• ✦Last.fm: just your Last.fm username, used to look up your public recent scrobbles.
• ✦Discogs: we don't connect to your Discogs account. Vinyl Shelf records are ones you pick from Discogs' public catalog, and we save the title, artist, year and cover image.

Stuff you post and send. Messages, message requests and reactions, Backstage posts, replies and images, Stories (and who viewed them), Ledger entries, profile updates, likes, passes and matches, follows, Signal Boosts, shows you're going to, Band / Circuit / Collective listings, saved searches, and Epitaphs words.

Safety and feedback. Reports you file (who, why, and any details you add), people you block, bug reports (with the page you were on and your browser's user agent), and suggestions.

Browser storage. We keep your login session in your browser's local storage so you stay signed in, plus a few small flags like "dismissed this banner." No advertising or tracking cookies, and no third-party analytics.

The Messenger uses your regular Nocturne account: same email, same password, same data. On top of what's above, it handles:

• ✦Buddy lists and buddy requests.
• ✦1:1 messages and chat-room messages.
• ✦Photos and videos you send in chats. Stored privately. Only the people in that conversation, or the members of that room, can view them.
• ✦Online status and "last seen." Visible to other members unless you turn on Invisible, which hides both.
• ✦Chat rooms you're in. Other members of a room can see that you've joined it and whether you're in it right now (the room's "here" list). Room owners and our admins can remove messages and people from a room.
• ✦Typing indicators. Sent live and never stored.
• ✦Push notifications (Android). We store your device's push token so Google Firebase Cloud Messaging can deliver notifications. Notifications show only who it's from, never what the message says. Sign out or uninstall and the token stops working.

• ✦Members: your profile, posts, Stories (for 24 hours), Ledger, Vinyl Shelf and music taste are visible to other signed-in members, subject to your own privacy settings (like who sees your Spotify listening).
• ✦Anyone with your profile link: once you're verified, someone who isn't signed in sees a short teaser: your photo, display name, username, city, genres, and the first 200 characters of your bio. Nothing else.
• ✦Private stuff: messages are only visible to you and the person you're talking to (or the room). Your email, exact location, Spotify tokens, reports and blocks are never shown to other members.
• ✦Blocking cuts contact both ways. Banned members are hidden from everyone.
• ✦Us: the admin can see reports, bug reports and suggestions in order to act on them, and can access the database to keep things running and deal with abuse.

We don't sell your data. We don't run ads, and there are no ad or tracking SDKs in the site or the app. We only pass data to the services that actually run Nocturne:

• ✦Supabase: database, sign-in and file storage.
• ✦Vercel: hosts the website.
• ✦Stripe: payments and age verification.
• ✦Resend: sends our emails (sign-in links, match notifications, announcements).
• ✦Google Firebase Cloud Messaging: delivers Messenger push notifications.
• ✦Spotify, Last.fm, Discogs: only if you use those features, and only to look up the music data described above.
• ✦Ticketmaster and SeatGeek: we send them the city or keyword you search for shows. Nothing about you.

We'd also hand over data if the law genuinely required it, or to protect someone from real harm.

We email you for account stuff (confirming your address, password resets, email changes). We also send match notifications, which you can turn off in Account settings, and the occasional announcement, which has an unsubscribe link.

We keep your data while your account exists. Stories disappear from view after 24 hours. Disconnecting Spotify deletes its tokens straight away. When you delete your account, your data goes with it (see below).

Do it yourself, any time: sign in, go to your Account page, tap Delete my account at the bottom, and type DELETE to confirm. It happens right away, cancels any active membership, and signs you out. It can't be undone.

Can't sign in, or rather we handle it? Ask us instead:

1. 1Email nocturne.3ternal@gmail.com from the email address on your Nocturne account, with the subject "Delete my account." (Can't use that address anymore? Email anyway and tell us your username; we'll work out how to confirm it's you.)
2. 2We confirm it's really you, so nobody can delete your account for you.
3. 3We delete your account and reply once it's done, within 30 days (normally a lot sooner).

What gets deleted: your login, profile and photos, location, music connections, messages and Messenger chats and media, posts, replies, Stories, Ledger entries, likes, matches, follows, listings, buddy list, and push tokens. This covers both Nocturne Eternal and Nocturne Messenger, since it's one account.

What we may keep: Stripe keeps its own records of payments and identity checks under its own policies, which we can't delete for you. If an account was banned for breaking the rules or failing age verification, we may keep a minimal record so the same person can't just sign up again. Words you added to a shared Epitaphs verse stay in the verse, without your name.

Just want something smaller removed, like a post, your location, or Spotify? You can do most of that yourself, or email us and we'll help.

Nocturne is for adults. Everyone has to pass age verification before they can use the community features, and anyone who comes back under 18 is permanently banned. We don't knowingly collect anything from children. If you think a minor got in, report them or email nocturne.3ternal@gmail.com.

You can ask to see a copy of your data, get something corrected, or have it deleted. Email nocturne.3ternal@gmail.com and we'll sort it out. Depending on where you live (for example the EU, UK or California), the law may give you extra rights; we'll honor them.

Everything travels over HTTPS. Database access is locked down per member with row-level security, so members can only read what they're allowed to. Private files are stored privately, secrets like Spotify tokens are only ever touched by our server, and payments and ID checks go through Stripe instead of us. Nothing online is 100% secure, but we treat this as a real job, not an afterthought.

If we change how we handle your data, we'll update this page and the date at the top. If it's a big change, we'll tell you in the app or by email before it takes effect.