Short version: Noctet collects no data. Everything you enter stays on your device. No server, no account, no analytics, no advertising.
1. What is Noctet
Noctet is a free, local-only toolbox for network and security engineers: subnet calculation, IPv6 tooling, certificate and key inspection, JWT and SAML decoding, TLS and HTTP header analysis, packet and capture triage, configuration diffing, IOC handling, CVSS scoring, hashes, regex testing, timestamps, encoders and decoders, MAC vendor lookup and offline reference tables. It runs as a Progressive Web App (PWA) in the browser and as an Android app distributed through Google Play; both run the same code from the same build. It is developed and maintained independently by Feym Luna.
2. Data collection
Noctet collects no personal data of any kind. Specifically:
- No name, email address, or account is required or collected.
- What you paste or type (addresses, tokens, logs, configuration excerpts, files) is processed in the browser. The app's own code contains no request that sends it anywhere: no fetch, no XMLHttpRequest, no sendBeacon, no WebSocket.
- No usage analytics, crash reports, or telemetry are collected.
- No cookies are used.
- No advertising networks, advertising identifiers, or third-party SDKs are embedded.
- No device identifiers, contacts, location data, or files other than the ones you explicitly open are read.
3. Local storage
Tool inputs and app settings (such as the theme) are written to your browser's local storage, a standard browser feature that keeps data on the device, so your work survives a page reload. The app has no code that reads this storage in order to send it anywhere. What does leave the device is what you send yourself: text you copy to the clipboard, a file you export, and whatever your own device or browser backup includes.
Secrets and cryptographic keys pasted into the JWT tool are deliberately excluded from storage: they exist in memory only and are gone when the page closes. A token pasted into the JWT tool is held in session storage, which the browser clears when the session ends; it is not written to durable local storage. Files selected in the hash tool are read in memory and are not written to storage at all.
You can delete all stored data at any time from within the app (System → Delete all local data) or by clearing your browser data through your device settings. Deletion is immediate and irreversible.
4. External connections
The app loads its own static code from its hosting domain and caches it for offline use. Everything it needs is part of that download: the monospace typeface, the vendor (OUI) database and every reference table. No external font, CDN or lookup request is made. The app ships a Content-Security-Policy of default-src 'self' with connect-src 'self', which your browser enforces: a script on the page can only open connections to the app's own host. That covers fetch, XMLHttpRequest, WebSocket and sendBeacon. It does not cover a link you tap yourself, which is an ordinary navigation and stays visible to you. There is one such link in the app:
- Buy Me a Coffee (buymeacoffee.com/feymluna). This page opens only when you explicitly tap the support link at the foot of System. It is entirely voluntary and governed by Buy Me a Coffee's own privacy policy.
5. The Android app
The Android app is this web app packaged whole: every file it needs ships inside the app, and updates arrive as app updates through Google Play. It embeds no advertising, analytics or Google Play Services libraries, and it declares no permissions at all, not even internet access. The only network activity it can cause is opening an external link, and that happens in your own browser, outside the app.
Google Play itself records installs, updates and, where your device is configured to send them, crash reports. That collection is Google's, follows Google's privacy policy and is outside the developer's control. What reaches the developer is the aggregate statistics the Play Console shows: install and uninstall counts, device and country breakdowns, and crash traces that carry no personal identifiers. The Data Safety declaration in the Play listing states that this app collects no data and shares no data.
6. Third-party components
Noctet uses no third-party services. It does bundle third-party software as static files: the React user-interface library (MIT license), the Capacitor bridge that packages the Android app (MIT license), the JetBrains Mono typeface (SIL Open Font License 1.1) and a snapshot of the IEEE MA-L vendor registry. None of them contacts its origin or its author at any point. The complete license texts ship with the app and are readable under System, Licenses.
7. Disclaimer
Noctet is provided for informational purposes only, without warranty of any kind. Calculations and reference data are implemented with care, but network planning decisions remain your responsibility: verify results before applying them to production environments.
8. Changes to this policy
If this privacy policy changes, the updated version will be published in the app and at noctet.feymluna.com/privacy with a revised "Last updated" date. Since no data is collected, changes are unlikely to affect users materially.
9. Contact
For questions about this privacy policy, reach out by email:
The developer goes by Feym Luna and responds in English and German.