Privacy Policy

When you create an account or workspace, we collect:

• Email address — for authentication and account communications
• Workspace configuration — workspace name, settings, and preferences

The core of the Service is memory storage. When your AI agents or integrations write memories to Neuroloom, we store:

• Memory content — the text you or your agents submit (decision records, code patterns, task context)
• Memory metadata — timestamps, tags, file path associations, and connections between related memories

What we do not store: Neuroloom does not receive or store your source code. When the CodeWeaver integration is used, parsing happens entirely on your machine. Only structural metadata — symbol names and file paths — is transmitted to our servers.

We log API requests for operational purposes:

• API key identifier (we store a SHA-256 hash — not the key itself)
• Request timestamps, endpoint paths, HTTP status codes, response times
• Request volume and usage patterns per workspace

These logs are used to operate the Service, diagnose errors, and enforce usage limits. Logs are retained for 90 days.

We use Sentry for error monitoring, in our API and background workers and in the dashboard in your browser. Sentry is always active because errors affect the reliability of a service you depend on. Apart from release-health session status (below), a report is sent only when an error occurs, and contains:

• The error — its type, message and stack trace. Error messages and our server log lines are free text, so they can occasionally include an identifier or a value from the request.
• For API errors — the request's method and route path (a template such as /api/v1/documents/upload/{token}, never the actual IDs or tokens), a few ordinary headers such as the user agent, the stack trace (our code, not variable values), recent server log lines, database statements (placeholders only, never values), Redis command names and outbound calls (method, host, path, status), and server details such as hostname and software versions.
• For dashboard errors — the page path (never a query string), your browser's user agent, locale and time zone, the app version when our build provides one, and a short trail of recent page navigations (as paths), network requests (method, status and path) and browser console messages.

API reports never include request bodies, query strings, cookies or IP headers. No user or workspace identifier is set on a report itself, but log lines in it can include IDs. Sentry sees our server's IP address, not yours.

No account or workspace identifier is attached to a dashboard report, though IDs can appear inside paths, such as /workspaces/<id>/… or /admin/users/<id>. Dashboard reports carry no cookies, clicks, typed input or page content, and we do not use Sentry's session replay or performance tracing in the dashboard. When our build provides a release version, the dashboard also sends Sentry session status (a session ID, timestamps and whether the session had an error) when a page loads or you move between pages. Sentry sees your browser's IP address for dashboard reports.

Neuroloom includes an optional, workspace-level quality evaluation flag (evaluation_consent). When enabled:

• Every retrieval event is logged: the query, which memories were shown, and subsequent tool actions within 15 minutes
• Logged events are periodically sent to language models hosted by SiliconFlow and DeepInfra for quality scoring — to calibrate our retrieval pipeline
• Scores are used to improve retrieval quality — not to train any model
• Both providers process data transiently (not stored to disk). DeepInfra is SOC 2 and ISO 27001 certified. SiliconFlow processes interaction data only as instructed and is under no obligation to store it

This flag is off by default. When the flag is off, only a simple retrieval counter is incremented — no content is sent to any third-party model. Error tracking remains active regardless of this setting.

The Neuroloom web dashboard keeps you signed in with browser storage, not cookies. Our sites use browser storage as follows:

• Dashboard, local storage — to keep you signed in (your sign-in refresh token and, if you use one, your API key) and to remember your selected workspace (strictly necessary)
• Dashboard, local and session storage — to preserve UI state, such as dismissed hints, and the page to return to after you sign in with an OAuth provider
• Website, local and session storage — the docs remember which code tab you picked and, if you press the D keyboard shortcut, your light or dark choice (nothing is sent anywhere)

We do not use third-party advertising cookies or cross-site tracking. Neither our website nor the dashboard sets analytics cookies. PostHog's browser code is set up to use neither cookies nor local storage, and Vercel Web Analytics identifies visitors by a hash of the request instead of a cookie. See §3.5 and §3.6 for what each tool receives.

• Railway — our hosting provider. Data resides on Railway-managed infrastructure in the United States.
• Vercel — delivers our website and the dashboard's web pages, so it sees the IP address and URL of each request to them. Your memories and account data are stored on Railway, not Vercel.

Memory content, submitted observations and search queries are processed by DeepInfra to generate embeddings (for your memories and your search queries), to re-rank search results, and, with its language models, to extract memories and classify relationships between them. DeepInfra processes data in memory only — not stored to disk, not used for model training. DeepInfra is SOC 2 and ISO 27001 certified.

For workspaces that have enabled the optional quality evaluation flag (§1.5), retrieval event data is periodically sent to SiliconFlow and DeepInfra for quality scoring using language models hosted on their infrastructure. Both providers process this data transiently — not stored to disk, not used for model training. DeepInfra is SOC 2 and ISO 27001 certified. SiliconFlow processes data as a neutral service provider and does not store interaction data beyond request fulfillment.

Sentry receives error reports from our API, background workers and the dashboard, as described in Section 1.4.

We use PostHog (United States) for product analytics, to understand how the Service is used. PostHog processes this data on our behalf. It receives events from three places:

• From our API (server side) — when you register or log in with your email and password: an event name (sign-up or login), the sign-in method ("email") and a random internal account identifier. Never your email address, password, name or memory content. They are sent from our servers, so PostHog sees our server's IP address, not yours.
• From the dashboard (in your browser) — a page view each time a page fully loads (not when you move around within the app) and a page-exit event when you leave it. The address is recorded as a path only, such as /memories, with no query string or fragment (campaign tags such as utm_source are recorded separately; see below). On some pages the path holds an internal record ID, such as a user ID on an admin page. A page exit adds the previous path, time on page and scroll depth.
• From the website (in your browser) — the same page views (full page loads only, not when you move between pages inside the site) and page exits, but the address keeps its query string and fragment (for example campaign UTM tags). The referring site is recorded as your browser supplies it. A website button click records the button's label and link. The newsletter form records whether it succeeded or failed, with a failure category (invalid email, server error, unexpected response or network error), never your email address.

Every browser event also includes the host, the referring site, and your browser, operating system, screen and window size, time zone and language, plus random identifiers that are new on every page load. Page views also include the page title. PostHog receives your IP address and may derive an approximate location from it.

PostHog's browser code does not send your account identifier, your email address or the content of the page, does not create a person profile, and is set up not to use cookies or local storage. Campaign tags found in a page address (such as utm_source) are recorded as separate fields. Advertising click IDs (such as gclid or fbclid) are masked, and we drop the search keyword that some search-engine referrers carry. We do not use session recording, heatmaps, or surveys.

We do not sell this data or use it for advertising. See §5 for retention and §7.2 for the legal basis.

Vercel Web Analytics (Vercel Inc., a US company) records page views on both our website and the dashboard, identifying visitors by a hash of the request rather than by a cookie. Records may include the page address, the referring site, your approximate location, and your browser, operating system and device type. In the dashboard the page address has no query string or fragment; on the website it includes the query string (Vercel filters some parameters).

We do not sell this data or use it for advertising. See §5 for retention and §7.2 for the legal basis.

We may disclose information if required by law, court order, or governmental authority.

If Neuroloom is acquired or merges with another company, your data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

• Access — View your data through the dashboard or API
• Deletion — Delete memories or workspaces via dashboard/API. Account closure: contact privacy@neuroloom.dev
• Export — Export your data via the API
• Correction — Update account info through the dashboard

Additional rights under GDPR:

• Right to object to processing based on legitimate interest
• Right to restrict processing in certain circumstances
• Right to data portability (structured, machine-readable format)
• Right to lodge a complaint with your data protection authority

Legal bases: Contract performance (providing the Service), legitimate interests (security, error monitoring, product and website analytics), consent (optional retrieval quality evaluation).

Data controller: Endless Galaxy Studios LLC, Delaware, USA.

• Right to know — Request disclosure of collected information
• Right to delete — Request deletion (subject to exceptions)
• Right to correct — Request correction of inaccurate information
• Right to opt out — We do not sell or share personal information for behavioral advertising

To exercise rights: contact privacy@neuroloom.dev. Response within 45 days.