Privacy Policy

You can browse the whole catalogue without an account. The items below are stored only once you sign in or contribute something — except the server logs, which exist for every visit.

• From Google sign-in: your email address, display name and the URL of your Google profile picture. We never receive your Google password.
• From email sign-up: your email address and a password. The password is stored only as a bcrypt hash and is never stored in plain text.
• Your username, which you choose and can change in Settings.
• What you save: the packs on your shelves, and whether each shelf is public.
• Your reviews: the star rating, the title and body text, and the language the review was written in.
• Taste answers: your Taste Battle comparisons and the optional taste sliders on a review. These are stored against your account, and are only ever displayed as part of an aggregate figure — nobody sees how you answered a particular comparison.
• Basic account activity: when you registered and a count of your visits.
• Server logs: like any website, our servers record your IP address, browser user-agent and the time of each request. We use these to keep the site running and to investigate abuse or faults.

We do not ask for your address, phone number or any payment details, because the site sells nothing.

Photos are not uploaded. The review form has an "Add photos" control, but in this beta the images stay in your browser as a preview and are never sent to us or stored. If that changes we will update this page first, and we will strip location metadata from any image we do accept.

Some of what you contribute is public by design. Please assume anything in this list is visible to anyone on the internet.

• Your reviews, with your display name and profile picture, on the pack's page and on the Reviews page.
• Your public profile at /u/your-username, which lists your review count, average rating and public shelves.
• A shelf, only if you mark it public. Shelves are private until you do.

Your email address is never shown to other members.

• Sign-in cookie. Set when you sign in so you stay signed in, and it expires after about 30 days. Removing it signs you out.
• Local storage. Keeps your language choice and the packs held in the side panel, so they survive a refresh. This never leaves your browser.
• Session storage. Holds your scroll position, a cached page of search results, and — on our pre-release test site only — a flag noting you entered the access password. It is cleared when you close the tab.

We have installed a Google Tag Manager container on the site. As of the date at the top of this page it contains no active tags, so no analytics or advertising code is running and no measurement data is being collected through it.

Before we enable any tag, we will name it on this page and update the date. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If that ever changes, we will say so here and provide the opt-out the law requires.

The services below process data on our behalf or are contacted directly by your browser. Each can see your IP address and basic request details.

• Vercel — hosts and serves the site, and keeps the server logs described above.
• Neon — hosts our database, where your account and contributions are stored.
• Amazon Web Services — stores the product images the site displays.
• Google — sign-in, and Google Fonts, which your browser loads directly from Google. Google Tag Manager is installed but currently loads nothing, as described above.
• Retailers we link to — we send them nothing about you, but they will see you as a visitor once you follow one of our links to their listing.

We do not sell your data and we do not share it with advertisers.

• Account data — for as long as your account exists. When you ask us to close it, we act within 45 days.
• Server logs — kept short-term for security and fault investigation, and not used to build a profile of you.
• Backups — our database backups rotate, and a deleted record can persist in them for up to 90 days before it ages out. We do not restore deleted data from a backup except to recover from a failure.

You can ask us to:

• tell you what we hold about you, and give you a copy of it
• correct anything that is wrong
• delete your account and the data tied to it
• stop processing your data

Email mk@noodleindex.com from the address on your account — that is how we confirm the request is yours. We will not treat you differently for exercising any of these rights.

There is no self-service delete button yet, so email is the only route today.

When we close your account we:

• delete your account record, including your email address, name and profile picture
• delete your shelves, your saved packs and your Taste Battle answers
• keep your reviews but remove you from them. The review text and rating stay on the pack's page, with the author shown as "Former member". Deleting reviews outright would remove catalogue content other readers rely on, so we anonymise instead.

Two exceptions apply to everything above: data already written to a backup ages out on the schedule described earlier, and we keep anything we are legally required to keep for as long as that obligation lasts.

If you want your reviews removed rather than anonymised, say so in your email and we will remove them.

Traffic to the site is encrypted in transit. Passwords are stored as bcrypt hashes, never in plain text. Access to the database is limited to the people who operate the service.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

The site does not set a minimum age for creating an account, and we do not ask your age.

We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it. We do not sell the personal information of anyone under 16 and we do not use it for targeted advertising. If you believe a child's information is here, email us and we will remove it.

When we change this policy we update the date at the top of the page. If a change materially affects what we collect, who can see it, or what we do with it — enabling a measurement tag, for example — we will email account holders and ask you to accept the change rather than treating your continued use as agreement.

NoodleIndex is operated by Myko Soft Inc. For anything in this policy — a copy of your data, a correction, a deletion, or a question — write to mk@noodleindex.com.

Myko Soft Inc is based in Rancho Palos Verdes, California. The law governing this policy will be named here once the company's registration is complete — we would rather leave that gap visible than print something that turns out to be wrong.