Privacy Policy

When you create an account or workspace, we collect:

• Email address — for authentication and account communications
• Workspace configuration — workspace name, settings, and preferences

The core of the Service is memory storage. When your AI agents or integrations write memories to Neuroloom, we store:

• Memory content — the text you or your agents submit (decision records, code patterns, task context)
• Memory metadata — timestamps, tags, file path associations, and connections between related memories

What we do not store: Neuroloom does not receive or store your source code. When the CodeWeaver integration is used, parsing happens entirely on your machine. Only structural metadata — symbol names and file paths — is transmitted to our servers.

We log API requests for operational purposes:

• API key identifier (we store a SHA-256 hash — not the key itself)
• Request timestamps, endpoint paths, HTTP status codes, response times
• Request volume and usage patterns per workspace

These logs are used to operate the Service, diagnose errors, and enforce usage limits. Logs are retained for 90 days.

We use Sentry for error monitoring. Sentry is always active because errors affect the reliability of a service you depend on. When an error occurs, Sentry captures:

• Stack traces
• Request context (endpoint, HTTP method, status code)
• Anonymized user/workspace identifiers for error grouping

Sentry does not capture memory content or your API payloads.

Neuroloom includes an optional, workspace-level analytics telemetry flag. When enabled, usage patterns are collected (memory write/read frequency, feature usage).

This flag is off by default. Error tracking remains active regardless of this setting.

The Neuroloom web dashboard uses:

• Session cookies — to maintain your authenticated session (strictly necessary)
• Local storage — to preserve workspace preferences and UI state

We do not use third-party advertising cookies or cross-site tracking. The marketing site uses PostHog for privacy-respecting analytics.

• Railway — our hosting provider. Data resides on Railway-managed infrastructure in the United States.

Memory content is processed by DeepInfra to power search and analysis features. DeepInfra processes data in memory only — not stored to disk, not used for model training. DeepInfra is SOC 2 and ISO 27001 certified.

Sentry receives anonymized error reports as described in Section 1.4.

We may disclose information if required by law, court order, or governmental authority.

If Neuroloom is acquired or merges with another company, your data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

• Access — View your data through the dashboard or API
• Deletion — Delete memories or workspaces via dashboard/API. Account closure: contact privacy@neuroloom.dev
• Export — Export your data via the API
• Correction — Update account info through the dashboard

Additional rights under GDPR:

• Right to object to processing based on legitimate interest
• Right to restrict processing in certain circumstances
• Right to data portability (structured, machine-readable format)
• Right to lodge a complaint with your data protection authority

Legal bases: Contract performance (providing the Service), legitimate interests (security, error monitoring), consent (optional analytics).

Data controller: Endless Galaxy Studios LLC, Delaware, USA.

• Right to know — Request disclosure of collected information
• Right to delete — Request deletion (subject to exceptions)
• Right to correct — Request correction of inaccurate information
• Right to opt out — We do not sell or share personal information for behavioral advertising

To exercise rights: contact privacy@neuroloom.dev. Response within 45 days.