NOODLES PRIVACY POLICY Noodles for iPhone and iPad Effective date: 10 October 2026 Last updated: 10 October 2026 Noodles is a cybersecurity assessment, evidence collection, and compliance tracking app developed by Rocheston. This Privacy Policy explains how Noodles handles information. In this policy, "Rocheston," "we," "us," and "our" refer to Rocheston, and "you" refers to anyone who uses Noodles. The short version is simple. Everything you do in Noodles stays on your device. Rocheston does not collect, receive, sell, rent, share, or upload any of it. PRIVACY AT A GLANCE • Rocheston collects no data through Noodles. Not your personal information, not your assessment content, not your usage. • Your assessments, findings, evidence, and reports are stored only on your iPhone or iPad. • No account. No sign-in. No Rocheston servers. No cloud sync. • No advertising, no analytics, no tracking, and no data brokers. • Your content is never sent to OpenAI or any other AI provider, and it is never used to train AI models. • Noodles works fully offline. • A copy of your work leaves your device only if you choose to export or share it, or if your own Apple backup settings include it. 1. SCOPE OF THIS POLICY This policy applies to the Noodles app for iPhone and iPad. It does not cover Rocheston websites, support channels, or other Rocheston products, which have their own privacy notices. It also does not cover Apple, the App Store, or any third-party app or service you choose to use alongside Noodles. Those are governed by their own policies. 2. OUR PRIVACY DESIGN: LOCAL BY DEFAULT, LOCAL BY DESIGN Noodles was built for work that is often confidential: customer names, internal control weaknesses, audit evidence, and security gaps. That kind of information should not sit on someone else's server, so Noodles does not use one. Rocheston does not operate any server, database, or cloud service for Noodles. We do not receive, view, store, analyze, or have access to anything you create in the app. We cannot see your customers, your control responses, your findings, your evidence, or your reports. If anyone, including a government authority, asked Rocheston to produce your Noodles content, we would have nothing to provide, because we never have it. 3. INFORMATION ROCHESTON COLLECTS: NONE Through Noodles, Rocheston does not collect: • Your name, email address, phone number, or any account or login details. • Device identifiers, advertising identifiers, or IP addresses. • Your precise or approximate location. • Your contacts, photo library, or files. Items you choose to import stay on your device. • Usage analytics, behavioral data, feature-usage statistics, or app-integrated crash reports. • Any assessment content, including customer details, control responses, notes, findings, evidence, photos, audio, video, documents, or reports. This is why the Noodles App Store privacy label states "Data Not Collected." 4. INFORMATION NOODLES STORES ON YOUR DEVICE So that you can perform, save, and resume your assessments, Noodles stores the information you choose to enter, capture, or import. It stays in the app's private storage on your device and may include: • Organization and customer details, such as names, logos, contact names, roles, email addresses, and telephone numbers. • Assessment setup, including the selected framework (such as NIST SP 800-53 or the Rocheston Cybersecurity Framework), scope, and assessment details. • Requirement records, including status (compliant, partially compliant, gap identified, or out of scope), responsibility, assessor rationale, implementation notes, owners, review dates, and drafts. • Findings, risks, actions, auditor requests, guided interview notes, and deadlines. • Evidence, including photos, video, audio recordings, scanned documents, and imported files, together with their titles, captions, tags, review decisions, timestamps, and file-integrity information. • Text extracted from supported evidence files. • Dashboard data, assessment history, review calendar entries, saved reports, report snapshots, and app preferences. Entering someone's contact details does not send them a message, create an account for them, or share their details with Rocheston. Assessment history exists for your own recordkeeping. It is not usage tracking and is never sent to us. Imported files can carry their own embedded information, such as an author's name, document revision details, or a photo's capture date, device model, or location. Noodles preserves original evidence files as imported and does not strip this metadata. Review files before you import or share them. 5. ON-DEVICE PROCESSING AND OFFLINE USE Every part of the Noodles workflow runs on your device: assessment calculations, compliance coverage, dashboards and charts, evidence handling, supported text extraction, and report generation in PDF, CSV, HTML, and ZIP formats. Noodles does not send your notes, documents, photos, recordings, or reports to OpenAI or any other external AI provider. Your content is never used to train any AI model. Noodles does not need an internet connection to perform assessments. There is no Rocheston account, no automatic cloud synchronization, and no remote copy of your notebook. 6. NO ADVERTISING, ANALYTICS, OR TRACKING Noodles contains: • No advertising or ad networks. • No third-party analytics or crash-reporting SDKs. • No tracking cookies, tracking pixels, or device fingerprinting. • No data-broker integrations. Noodles does not track you across other companies' apps or websites, does not build a profile of you, and does not monitor your activity outside the app. Because it does not track you, Noodles never asks for tracking permission under Apple's App Tracking Transparency framework. 7. PERMISSIONS YOU CONTROL Noodles asks for access only when you use a feature that needs it, and only for that feature. • Camera: to take evidence photos, scan documents, or record video. • Microphone: to record audio evidence, interviews, or the sound in a video. • Photos: Noodles uses Apple's photo picker, so it receives only the photos and videos you select. It does not need full access to your photo library. • Files: Apple's document picker gives Noodles only the files you choose to import. • Notifications: optional review reminders are scheduled locally on your device. Depending on your notification-preview settings, a reminder may show an assessment name on your lock screen. • Face ID, Touch ID, or device passcode: used only if you turn on App Lock. Noodles does not request access to your contacts or your location. You can decline any permission, or change it at any time in your device's Settings. If you do, the related capture, reminder, or App Lock feature may not be available, but the rest of Noodles continues to work. 8. HOW YOUR WORK IS PROTECTED Noodles stores your work inside its private app container, which iOS isolates from other apps, and uses Apple's Data Protection file-protection features. Optional App Lock uses Apple's device authentication: Face ID, Touch ID, or your device passcode, where supported. Noodles receives only a success or failure result. It never receives or stores your biometric data or your passcode. Portable backups created in Noodles can be protected with a password. Rocheston never receives your backup password and cannot recover it. If you lose it, the encrypted backup cannot be opened. If you turn encryption off, anyone who obtains the backup file can read it. Please keep in mind: • App Lock controls access to the app. It does not protect copies you have already exported. • Your device's own security matters. Use a strong device passcode, keep iOS up to date, and avoid using Noodles on a jailbroken device. • No security measure is perfect. Because your data lives on your device, protecting that device is the most important step you can take. 9. EXPORTS AND SHARING: ONLY WHEN YOU DECIDE Noodles can create PDF reports, CSV data exports, HTML dashboard reports, ZIP packages containing reports and supporting evidence, and portable backups. All of these are created locally on your device. Nothing is ever sent automatically to an auditor, customer, colleague, cloud service, or Rocheston. You decide whether to share or save an export, and where, using Apple's share sheet or file controls. When you send an export by email, messaging, AirDrop, a cloud drive, or any other service, that copy is handled by that service under its own privacy practices, and by whoever receives it. Exports can contain any assessment information and evidence included in your selection, including confidential customer details and file metadata. Unless an export option states that it is encrypted, treat exported files as readable by anyone who obtains a copy. Review the contents and the recipient before you share. 10. APPLE BACKUPS AND SYSTEM SERVICES Noodles never sends your data anywhere. A few iOS features, which you control, can copy it outside the app: • Device backups. Depending on your settings, iOS may include Noodles data in an iCloud Backup or in a backup to your computer. These are Apple operating-system backups, not uploads to Rocheston, and we cannot access them. Manage them through Apple's backup settings. For stronger protection, consider encrypted computer backups or Apple's Advanced Data Protection for iCloud. • Cloud files. If you import a file stored with a cloud provider, the system picker may download it to your device. If you save an export to a cloud provider, that provider receives the copy. • Keyboards and dictation. Text you type or dictate is handled by the keyboard or dictation service you use. Third-party keyboards granted "Full Access" may be able to transmit what you type, so consider using the standard Apple keyboard when entering sensitive information. • Apple services. Apple may process App Store, purchase, and device information under its own policies. If you choose to share analytics with app developers in your iOS settings, Apple may make crash reports or aggregate app information available to Rocheston. That information comes from Apple, not from Noodles, is controlled by your iOS settings, and never includes your assessment content. Apple's backup information: https://support.apple.com/en-us/108770 Apple's privacy policy: https://www.apple.com/legal/privacy/ 11. DATA RETENTION AND DELETION Your work stays on your device until you delete it. Rocheston does not keep any server copy. To delete information in Noodles: • Use "Clear assessment and start new" in Settings to remove the current assessment from the active notebook and begin again. • Delete saved reports from the Reports screens. • Deleted evidence first moves to Recently Deleted, where it remains stored on your device so it can be recovered. Moving evidence there is not permanent erasure. • When you create a portable backup, the option to include recently deleted evidence is turned on by default. Turn it off if you do not want those items included. Noodles also keeps local recovery information, including a previous notebook save. Audit history and saved report snapshots can retain earlier content, and older assessments preserved during an app update may remain as local backup files. Clearing the active assessment is therefore not a secure erase of every historical copy. To remove all Noodles data from your device, use the iOS "Delete App" option. Do not use "Offload App," which removes the app but keeps its documents and data. Deleting Noodles does not delete copies stored in device backups, Files, Photos, other apps, or with people you shared them with. Those must be managed separately. Because Rocheston never has your data, we cannot access, recover, or remotely delete it for you. Export anything you want to keep before you clear an assessment or delete the app. 12. DEMONSTRATION DATA Noodles includes a fictional Acme Corporation assessment so you can explore the app. It is stored locally on your device. You can delete or restore it in Settings, and doing so does not register you with any server or send any information to Rocheston. 13. YOUR RESPONSIBILITIES WHEN ASSESSING OTHERS Noodles is often used to assess real organizations. When you record information about customers, employees, or other people, you decide what to collect and keep, and you are responsible for handling it in line with your contracts, confidentiality obligations, and applicable law. Rocheston does not receive this information and has no role in how you use it. 14. CHILDREN Noodles is designed for cybersecurity learners, IT professionals, consultants, and compliance teams. It is not directed to children. Because Noodles collects no information from anyone, it does not knowingly collect information from children. 15. YOUR PRIVACY RIGHTS Privacy laws around the world, including the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act, other US state privacy laws, and India's Digital Personal Data Protection Act, give people rights over personal data that companies hold about them. Through Noodles, Rocheston holds no personal data about you. There is nothing for us to access, correct, delete, export, or restrict, and there is no sale or sharing of personal information to opt out of. Rocheston does not use Noodles data for targeted advertising, profiling, or automated decision-making, and does not transfer it across borders. You exercise full control directly in the app. You can view, edit, export, and delete everything you have created at any time. 16. CONTACTING ROCHESTON FOR SUPPORT If you contact Rocheston for support, we receive only what you choose to send us, such as your name, email address, and message. That communication is handled under the privacy notice of the channel you use and is not connected to your Noodles data. Contacting us never gives Rocheston access to your device or your notebook. Please do not include confidential customer information, evidence files, or backup passwords in a support request unless there is a specific reason to share them. 17. LINKS TO OTHER WEBSITES If you open a link from Noodles to an external website, such as Apple's support pages or Rocheston's website, you leave the app. Those websites are governed by their own privacy policies. 18. CHANGES TO THIS POLICY We may update this policy as Noodles evolves. The updated version will show a new "Last updated" date. Rocheston will never quietly begin collecting data. If a future version of Noodles introduces any online feature or data collection, we will describe it clearly in the app and in this policy, update the App Store privacy details, and explain any choices available to you before the feature is used. 19. CONTACT US For questions about Noodles or this policy, contact Rocheston at: https://www.rocheston.com/contactus/index.php Please identify the product as "Noodles for iPhone/iPad" so your inquiry reaches the right team. Noodles. Put cybersecurity knowledge into practice. Developed by Rocheston.