Privacy Policy
Last updated: October 4, 2026Operator and contact
This service is operated by Hava Durumu LLC, New Mexico, USA.
Support, privacy inquiries, and content reports: support@havadurumullc.com
This policy explains the data processed when using Notcuk, why it is used, and how to contact us about privacy.
Data collected and its purposes
When you create an account, we store your username, email address and a one-way hash of your password. Language preference, registration and last login times, email verification status and security records are processed to manage accounts, verify email, reset passwords and prevent abuse. Account passwords are not stored as plain text.
We store note titles, content, text or code format, sharing links, creation and expiry times, and any associated account. IP addresses may be processed when creating notes, registering and performing security checks. Contact form names, email addresses, subjects and messages are stored to handle requests and investigate abuse. Hosting infrastructure may keep access and error logs.
Note visibility and security
Anyone who knows the link to a note without password protection can read its content. A short link does not guarantee privacy. Note passwords restrict access; content is not end-to-end encrypted and is stored on the service’s server. Do not put sensitive personal information, account passwords or secret keys in notes.
Cloudflare Turnstile bot protection
Registration, guest note creation and contact forms use invisible Turnstile provided by Cloudflare, Inc. Verification may start in the background when a form page loads. Cloudflare may process IP addresses, browser User-Agent information, TLS fingerprints and site-related technical signals to detect bots and improve its service. Our server sends the verification token and IP address to Cloudflare; note content and account passwords are not included in the Turnstile verification request.
Cloudflare Turnstile Privacy Addendum · Cloudflare Privacy Policy
Hosting and email services
The website and database are hosted on Hostinger infrastructure. Registration, account activation, password reset, password change and inactivity notifications are sent through Brevo. Recipient addresses and email content are shared with Brevo to deliver these messages. Depending on provider infrastructure, data may be processed outside your country.
Cookies
A session identifier cookie manages login, language preference, form security and access to password-protected notes. Related session information is stored on the server. The application has no advertising or analytics cookies added. See Cloudflare documentation for its security service’s processing and cookies, and our Cookie Policy for our session cookie.
Retention and deletion
Guest notes become unavailable and are marked as deleted after 48 hours; this does not mean database records or backups are immediately physically erased. Notes placed in the trash by users are also marked as deleted in the application. Registration security logs are removed by the cleanup task after 90 days. Email verification links are valid for 24 hours and password reset links for 1 hours. Accounts without a login for one year receive an email warning. If there is no login within one month of the warning, the account and all its notes are permanently removed from the active application database. Guest notes are permanently removed from the active database by the next cleanup task once 30 days have passed since expiry.
Backup copies created for maintenance may exist. Daily automatic backups are not currently performed. This policy does not promise a fixed deletion period for existing maintenance backups or other contact and security records. To request deletion of an account or specific data, contact the address below; we will assess the scope of the request and any circumstances requiring retention.
Accounts inactive for one year receive an email warning. If you do not sign in within one month of the warning, your account and all its notes are permanently deleted.
Privacy requests
You can send requests for information, access, correction or deletion to support@havadurumullc.com. We may request information necessary to verify that the account belongs to you. Do not send your account password.
Policy changes
We update this policy when the service or data processing practices change. The current text and update date are published on this page.