Privacy Policy

1. Information We Collect

1.1 Licence Validation (All Products)

When you activate or validate your licence, the following is sent to our server (hosted on Cloudflare Workers):

• Your License Key (forwarded to Stripe for subscription validation)
• A hashed device identifier (used for device binding and enforcement)

We receive from Stripe:

• Membership ID (anonymous identifier)
• Licence validity status, plan name, and renewal dates
• Whether cancellation is pending

In connection with your purchase we also hold: your purchase email address and a mapping between that address and your licence, held on our infrastructure (Cloudflare) and processed by our email provider for licence delivery and service notices.

We receive and store the email address you use at purchase. It is provided to us through our email delivery provider, and is used to deliver your License Key, to send you service and licence notices (including any notice of changes to our terms or of discontinuation under our Terms of Service), and to help prevent fraud and abuse. We do NOT receive or store your payment card information or billing details; all payment processing is handled solely by Stripe.

1.2 Device Identification (NobleAIM)

To enforce the one-device limit, the Software generates a hardware identifier (HWID) derived from your Machine GUID, computer name, and CPU brand. This identifier is hashed using SHA-256 before transmission and is non-reversible. It is sent to our server during licence validation for device binding.

1.3 Application Telemetry (NobleAIM)

During licence validation, the Software also sends:

• Application version
• Session duration (time since last validation)

This data is used for analytics and service improvement.

1.4 Integrity Events (NobleAIM)

The Software includes a protection layer that detects tampering, debugging, reverse engineering, or unauthorised modification. As part of these checks, the Software may inspect the names and command-line parameters of other processes running on your device in order to detect debuggers, reverse-engineering tools, automated agents, and AI command-line tools (for example Claude Code or OpenAI Codex).

Where a process has already been positively identified as one of these prohibited AI command-line tools, the Software additionally reads the values of a small, fixed, name-based allowlist of that process’s non-secret environment variables (a limited set of model and endpoint settings) so that we can recognise which AI model or service the tool has been configured to use. This additional read is performed only against a process already identified as a prohibited tool, never as a general or background scan of other processes, and it reads from the running process’s memory, not from any file. Environment variables whose names denote secrets, such as API keys, authentication tokens, or passwords, are not on the allowlist and are never read, retained, or transmitted. From an endpoint setting the Software derives and keeps only a short provider label (for example a Kimi, GLM, DeepSeek, Qwen, OpenAI, Anthropic, Gemini, local, or custom-host label); the scheme, the path, and any credentials contained in the value are stripped and discarded before anything is recorded. From a model setting the Software keeps only the sanitised model name.

To identify which tool is running and to label the session in the integrity report, the Software may also read limited metadata that the AI tool records on your device in its own session-index or history files, namely the session name, recent session identifiers, and the working-directory path. It does not open or read your project files, your source code, or the contents of your conversations with the tool.

When such an event is detected, the Software sends an integrity report to our server (/api/tamper) containing:

• Your HWID (hashed)
• The type of integrity violation detected, and the name or identifier of the detected tool or process
• Where the detected tool is a prohibited AI command-line tool, the short provider label or sanitised model name derived from the environment settings described above
• Where the detected tool is a prohibited AI command-line tool, the session name, recent session identifiers, and working-directory path read from that tool’s session metadata, as described above
• Your IP address
• A timestamp

These checks inspect process names, command-line parameters, and the limited environment-variable allowlist and the session metadata described above; the environment data is read from a running process’s memory and not from any file, and these checks do not open or read the contents of your personal files, your documents, your source code, or your conversations with the tool. Integrity events are processed on the basis of our legitimate interests in protecting the Software from unauthorised modification, preventing fraud, and enforcing our licensing terms.

1.5 Marketplace Data (Noble Trainer)

• Display name (derived from your username at activation)
• Models and content you upload to the Marketplace (files and metadata)
• Interaction data such as download counts and likes

1.6 Data Stored Locally on Your Device (All Products)

The following data is stored locally and is NOT transmitted to our servers:

• (a) License File: Stores your License Key locally.
• (b) Log Files: Diagnostic logs that may contain file paths, hardware information (GPU name, driver version), window titles, process names, and error messages. File paths may include your Windows username.
• (c) Crash Logs: Written locally if the software crashes.
• (d) Configuration Files: Your settings, profiles, and preferences.
• (e) Captured Frames (Noble Remote): Frames captured from gameplay windows are written to local shared memory only. They are not sent to any server.

None of these local files are automatically uploaded to our servers. If you contact us for support and voluntarily share files, they may contain the information described above.

1.7 Update Checks (All Products)

Products periodically check for updates by requesting a version file from our servers. These requests contain standard HTTP headers (User-Agent, IP address) but no personal data beyond what is inherent in any HTTP request.

1.8 Server Logs

Server logs may temporarily contain request timestamps, request paths, response status codes, and error messages. We do NOT log authorisation headers or full request bodies. Cloudflare may independently log IP addresses per their own policies.

1.9 Third-Party Console Account Integrations (Noble Remote)

Noble Remote includes two optional capture modes that connect directly to a console platform. Neither mode is required to use Noble Remote, and neither sends any account material to Noble.

(a) Xbox Direct (Microsoft account)

If you select Xbox Direct, Noble Remote opens your default browser to Microsoft’s hosted login at login.live.com. You enter your Microsoft account credentials directly on Microsoft’s page; Noble never sees your username or password. Upon successful login, Microsoft returns OAuth material to a local-only listener within Noble Remote. From this, the Software retains:

• a long-lived refresh token, encrypted at rest using Windows DPAPI (per-user, per-machine, non-portable) in your profile under %APPDATA%\NobleRemote\;
• short-lived access tokens, XSTS user tokens, and an Xbox session token, held in process memory only and never written to disk;
• a locally generated device identifier (UUID) stored in your profile.

Streaming traffic and authentication flow directly between your PC and Microsoft’s public Xbox Live endpoints. Noble does not receive or proxy this traffic.

(b) PS5 Direct (PlayStation Remote Play)

PS5 Direct uses a two-step setup. You will be asked to sign in to your PlayStation Network account on Sony’s hosted login page at auth.api.sonyentertainmentnetwork.com. The page is rendered inside Microsoft Edge WebView2 (or your system browser as a fallback) and is sandboxed. Noble does not intercept, read, or have scripted access to the credentials you enter. Noble only observes the redirect URL Sony returns once authentication succeeds.

Following sign-in:

• The Software exchanges Sony’s redirect auth code for a short-lived OAuth access token using the public Remote Play client identifier (not a Noble secret). The token is used once to query Sony for your numeric account identifier and is then discarded; it is never written to disk.
• Only your numeric PSN account identifier (an 8-byte stable user ID) is retained, stored unencrypted in your profile INI under %APPDATA%\NobleRemote\.

Once your account identifier is known, you read an 8-digit pairing PIN off your console’s Settings screen and Noble Remote completes the LAN handshake with your PS5. The console returns per-device pairing keys (regist_key, morning_key) which are stored unencrypted in the same profile INI alongside the account identifier and console IP. These pairing materials function similarly to a Wi-Fi pre-shared key.

During streaming, communication is peer-to-peer between your PC and your PS5 over your local network using the public Remote Play protocol. The Software does not call any PlayStation Network cloud endpoints while a streaming session is active.

(c) No transmission to Noble

None of the credentials, tokens, account identifiers, or pairing material described above is transmitted to or stored on Noble servers.

(d) Removal

You can sign out of Xbox Direct or unpair from a PS5 at any time from within Noble Remote. Doing so deletes the corresponding stored material from your local profile.

2. How We Use Your Information

We use the information collected to:

• Validate your licence and enforce licensing terms (contract performance);
• Enforce device limits (contract performance);
• Detect tampering, debugging, or unauthorised modification of the Software (legitimate interest);
• Operate the Marketplace and provide the Service (contract performance);
• Provide update notifications (legitimate interest);
• Analyse application usage, version distribution, and session data to improve the Service (legitimate interest);
• Deliver your License Key and send service and licence notices to your purchase email address (contract performance, and our legitimate interest in communicating about the Service);
• Prevent fraud, abuse, and unauthorised access (legitimate interest);
• Comply with legal obligations (legal obligation).

2.1 Legal Basis for Processing (UK GDPR)

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service, including licence validation, session management, device activation, Marketplace operation, and update delivery.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for fraud prevention, abuse detection, service improvement, and security, and sending service and licence notices, including notices of changes or discontinuation, and using the purchase email address to help prevent fraud and abuse. We have assessed that these interests do not override your fundamental rights. You have the right to object to processing based on legitimate interests (see Section 7).
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable laws and regulations.

3. Third-Party Services

The Service relies on the following third-party providers:

3.1 Stripe (stripe.com)

• Purpose: License key validation and subscription management
• Data shared: Your License Key
• Data received: Membership ID, validity status, plan name, renewal dates
• Privacy policy: https://www.stripe.com/privacy

3.2 Cloudflare (cloudflare.com)

• Purpose: Hosts our APIs (Workers), databases (D1, KV), and file storage (R2)
• Data processed: License Key, HWID (hashed), integrity events, application version, session duration, standard HTTP metadata
• Privacy policy: https://www.cloudflare.com/privacypolicy/

3.3 Microsoft (microsoft.com), applies if you use Xbox Direct

• Purpose: Microsoft account authentication and Xbox Cloud Gaming streaming
• Data flow: credentials are entered directly on Microsoft’s hosted login pages and are never seen by Noble. OAuth tokens issued by Microsoft are stored locally on your device only (see Section 1.9). Streaming traffic flows directly between Microsoft’s edge servers and your PC.
• Microsoft privacy statement: https://privacy.microsoft.com/privacystatement

3.4 Sony Interactive Entertainment (playstation.com), applies if you use PS5 Direct

• Purpose: one-time PlayStation Network account authentication (to retrieve your numeric account identifier) and PS5 Remote Play console pairing
• Data flow: credentials are entered directly on Sony’s hosted login page and are never seen by Noble. A short-lived OAuth access token issued by Sony is used once and immediately discarded, never written to disk. Only the resulting numeric account identifier and per-device pairing keys are stored locally on your device (see Section 1.9). Pairing and streaming occur directly between Noble Remote and your PS5 over your local network.
• Sony privacy policy: https://www.playstation.com/legal/privacy-policy/

3.5 Resend (resend.com)

• Purpose: delivery of transactional email, including your License Key and service or licence notices
• Data shared: your purchase email address and the content of the message (for example your License Key or a notice)
• Privacy policy: https://resend.com/legal/privacy-policy

WE ARE NOT RESPONSIBLE OR LIABLE FOR THE PRIVACY PRACTICES, DATA HANDLING, SECURITY, OR POLICIES OF ANY THIRD-PARTY SERVICE PROVIDER.

4. International Data Transfers

The Service is hosted on Cloudflare’s global infrastructure. Your data may be processed and stored in any country where Cloudflare operates, which may include countries outside the United Kingdom or European Economic Area. Cloudflare maintains appropriate safeguards for international transfers as described in their privacy policy.

5. Data Security

We implement commercially reasonable technical and organisational measures to protect your information, including:

• License Keys are transmitted over HTTPS (TLS encryption in transit)
• Device identifiers are SHA-256 hashed before transmission (non-reversible)
• Sensitive credentials stored locally (such as the Xbox Direct OAuth refresh token in Noble Remote) are encrypted at rest using platform mechanisms such as Windows DPAPI. Other configuration data, profiles, and the PS5 pairing keys are stored in plaintext on your machine. These are device-pairing secrets equivalent to a Wi-Fi PSK, not user credentials.
• The Software uses certificate pinning to prevent man-in-the-middle attacks
• Session data expires automatically

However, no method of electronic storage or transmission is completely secure. We do not warrant or guarantee the absolute security of your data. You are solely responsible for maintaining the confidentiality of your License Key.

6. Data Retention

Server-Side:

• Device identifiers (HWID): Retained while you hold an active licence (a Subscription, a Fixed-Term Pass, or a Lifetime Licence) and for up to 12 months after your last successful licence validation, after which the identifier is deleted, EXCEPT that where an identifier is associated with a licence that has been revoked, or a device that has been banned, for breach, we retain it (in a minimised, ban-enforcement form) for as long as necessary to keep that revocation or ban effective. We delete a HWID earlier if you deactivate your device and hold no other active licence, unless it is retained under the ban-enforcement exception above or on another lawful ground.
• Purchase email address and email-to-licence mapping: Retained while you hold any active licence and for a reasonable period afterwards to handle refunds, service notices, and disputes, and, where an address is associated with fraud or abuse, for as long as necessary to prevent its recurrence; otherwise deleted or anonymised on a verified erasure request (Section 7).
• Integrity events: Retained for up to 30 days
• Subscription metadata from Stripe: Not stored, returned in real-time
• Server logs (Cloudflare): Retained per Cloudflare defaults (typically up to 72 hours for Workers logs, up to 30 days for other services)
• Marketplace data (Noble Trainer): Retained until you delete it or request deletion

Local (on your device):

• License file: Retained until you deactivate or delete it
• Log files: Overwritten on each application launch
• Crash logs, configuration files: Retained until you delete them manually
• Xbox Direct refresh token (DPAPI-encrypted, Noble Remote): Retained until you sign out from Noble Remote or revoke access via Microsoft’s account dashboard
• PS5 Direct pairing keys (Noble Remote): Retained until you unpair the console from within Noble Remote

We may retain certain data for longer periods where required by law, to resolve disputes, or to enforce our agreements.

7. Your Rights and Choices

You may:

• (a) Deactivate your device using the option within the software.
• (b) Delete local data (license files, logs, configuration) at any time.
• (c) Delete Marketplace content (Noble Trainer) through the software.
• (d) Contact us to request details of any data we hold, or to request deletion. On a verified erasure request we will delete the data we hold about you, except where we still need it to enforce licences, prevent fraud, keep a ban or revocation effective, comply with a legal obligation, or establish or defend a legal claim; where an exception applies we will tell you and will delete the data once it no longer does.

If you are located in the United Kingdom or European Economic Area, you have additional rights under UK GDPR, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests

To exercise these rights, contact us using the details in Section 10. We will respond within one month of receipt, as required by UK GDPR. We may verify your identity before processing any request. You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO): Website: https://ico.org.uk Telephone: 0303 123 1113

8. Children’s Data

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a person under 18, we will take reasonable steps to delete it.

9. Changes to This Policy

We may update this Policy by publishing a revised version on our website or within the Service. Material changes will be notified at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes your acceptance of the revised Policy.

10. Contact

For privacy concerns or data requests, contact:

Noble Software Limited (registered in England and Wales) Registered Address: 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom Website: nobleaim.co.uk Email: noblesupp@outlook.com