Nookara is an account, storage, and messaging platform for the Scratch creative coding community, operated by Ikelene in Alberta, Canada. For privacy questions, contact [email protected].
We do not use tracking cookies, ad networks, or third-party analytics, and we never sell or rent your data.
When you sign into a Scratch or TurboWarp project through Nookara, that project must request specific permission scopes (e.g. "read storage," "view friends") and you approve or decline each one before signing in. A project can never access data outside the scopes you granted it, and - regardless of scope - it can only ever read or write your own account's data. It has no way to see or change another user's information, even if that user is also signed into the same project. This is enforced on our servers, not just trusted to the project's own code.
| Data | Retention |
|---|---|
| Account data | Until deletion, +30 days for recovery |
| Uploaded content | Deleted within 14 days of account deletion |
| API request logs | 30 days, then deleted automatically |
| IP hashes & security logs | Max 90 days, unless part of an active investigation |
| Credit & transaction history | Kept while the account exists, up to 5 years after deletion |
We never sell, rent, or share your data with third-party cloud, ad, or analytics providers. Your data is shared only when required by law (e.g. reporting CSAM), or as part of normal platform operation (your username, pfp, banner, bio, rank, and badges are visible to other users, same as any social platform).
We keep automated, encrypted backups of platform data for disaster recovery, retained for up to 14 days. These exist to recover from data loss on our end (hardware failure, corruption, etc.) - they're not a way to undo your own deletions, and we can't selectively restore one person's data from a backup without restoring everyone's data to that point in time.
No tracking cookies. Browser localStorage is used only to keep you signed in (your session token) and to remember recently-used accounts for quick sign-in on your own device. Nothing in localStorage is sent to third parties.
Nookara requires users to be 13 or older. We don't knowingly collect data from anyone under 13, and delete any such account immediately upon discovery. Report a suspected underage account to [email protected].
You can access and correct your data any time from your dashboard, and delete your account there too - this permanently removes your personal data. Email [email protected] for a data export or any other privacy request.
Passwords are bcrypt-hashed, session tokens are stored as SHA-256 hashes (never the raw token), and all connections are HTTPS-enforced. No system is perfectly secure - if a breach affects your data, we'll notify you by email as soon as reasonably possible.
We may update this policy from time to time; the version and effective date at the top will change accordingly, and we'll notify registered users by email for significant changes.