Privacy Policy — NeuralRepo Addendum
Summary: you sign in with GitHub, Google, Apple or a link sent to your email. Your ideas are stored in your account and processed by AI models on Cloudflare's network for search, tagging and chat. If you add your own Anthropic, OpenAI or OpenRouter key, the features that use it send idea content to that provider. We don't store your searches, and we don't write your ideas to our logs. You can export everything, and you can delete your account yourself in Settings.
Contents
What NeuralRepo is
NeuralRepo is an idea manager. You capture ideas, then search, tag, link and track them on a kanban board or mind map. You can capture and read ideas through:
- the web app at neuralrepo.com, which can be installed on your device and can receive text you share to it from other apps
- the
nrepocommand-line tool - the REST API, with an API key
- the MCP server, which lets an AI assistant such as Claude read and write your ideas once you connect it
- email, by writing to
idea@neuralrepo.comfrom your account's address (Pro plan)
NeuralRepo runs on Cloudflare's network.
Data collected
1. Your account
You sign in with GitHub, Google or Apple, or with a one-time link sent to your email address.
- GitHub: we request the
read:useranduser:emailscopes and store your GitHub account identifier, your primary verified email address, your name (or username) and the address of your profile picture. - Google: we request the
openid,emailandprofilescopes and store your Google account identifier, email address, name and the address of your profile picture. - Apple: we store your Apple account identifier, your email address, which can be an Apple private-relay address, and your name if Apple provides it.
- Email link: we store your email address and a hashed copy of the link, which expires after 15 minutes.
We never receive your passwords, and we don't keep the access tokens GitHub or Google give us. If you sign in by a different method with the same email address, it is added to your existing account. Apple private-relay addresses are never matched this way.
We also store your plan and trial dates, your notification and search settings, and, if you subscribe, your Stripe customer and subscription identifiers.
Before you use NeuralRepo in a browser, and before a key is created for the command-line tool or an MCP connection, you must accept the Terms and this Privacy Policy. Each time you accept, we record the versions you accepted, the time, your IP address and your browser's user agent. When we update these documents, the web app asks you to accept them again.
2. Your ideas
- Each idea's title, body, status, number and how it was captured, and for some captures the address it came from
- The tags you create, the links you attach, the relations between ideas, including any note you write on one, and suggested duplicates
- A full-text search index of your titles and bodies
Your ideas are User Content under the Terms.
When you email idea@neuralrepo.com, we use the sender address to find your account. The subject becomes the idea's title and the text of the message becomes its body, with signatures and quoted replies removed. We don't keep the original message or its headers. We reply to confirm. If the address doesn't belong to a Pro account, nothing is saved and the reply says why.
3. Searches
What you search for is used to run the search and is not stored. A semantic search sends your search text to an AI model to find and rank results (see section 4). On the free plan we count your semantic searches each month; we keep the count, not the searches.
A search made through the REST API carries its search text in the request address, so it appears in our request logs (see section 7).
4. AI processing
NeuralRepo's built-in AI runs on Cloudflare Workers AI, using open-weight models hosted on Cloudflare's network.
- When you save or edit an idea, its title and body are turned into a search embedding. The embedding is stored in Cloudflare Vectorize with your account identifier and the idea's tags, status, source and creation time. The text itself is not stored there.
- Each tag also gets an embedding, made from its name and the titles of up to five of its ideas.
- A semantic search sends your search text, and the text of the ideas it is ranking, to a model.
- On the Pro plan, new ideas are tagged automatically: the title, body and your tag names are sent to a model.
- The AI chat (Pro plan) sends your conversation, your recent idea titles and tag list, and the ideas it looks up to answer you. Your chat history is stored in your account until you clear it or delete your account.
While an idea waits to be processed, its title and body pass through a Cloudflare queue.
All AI requests, including those made with your own key, pass through Cloudflare AI Gateway, which we use to route and monitor them. Its logs can include what a request contained and are kept under Cloudflare's own retention.
Your own AI provider keys (optional, Pro plan). You can add a key for Anthropic, OpenAI or OpenRouter. Features that use your key send content to that provider under your own account with them:
- Developing an idea into a spec: the idea's title, status, tags and body, the titles of related ideas, and its links. The spec that comes back is added to the idea's body.
- AI chat with a Claude model, through your Anthropic key: your conversation, your recent idea titles and tag list, and the ideas it looks up.
- The weekly digest summary: the titles of up to five new ideas and three stale ones, with counts.
- Checking your key, which sends a short test message, and listing the Anthropic models your key can use.
That provider's terms and privacy policy govern what it does with the content. Your keys are encrypted before they are stored, are never shown back to you, and are decrypted only to make a request.
For each AI request we keep a usage record: the feature, the model, token counts and estimated cost. It holds no content.
We do not use your ideas to train machine-learning models.
5. Emails we send
We send email through Resend, from noreply@neuralrepo.com:
- Sign-in links, when you ask for one
- A weekly digest on Sundays, for Pro accounts when there is something to report. It gives counts of new, duplicate and stale ideas. If you have added your own AI provider key, it instead carries a short summary your provider writes from the idea titles listed in section 4.
- A reminder about ideas you haven't touched for a while (30 days unless you change it), listing up to 10 of their titles, at most once every 25 days
You can turn off the digest and the reminders in Settings. Replies to ideas you capture by email are sent through Cloudflare.
6. The command-line tool
The nrepo tool saves your API key, your account identifier and the server address in ~/.config/neuralrepo/config.json on your computer. The file is not encrypted, so keep it private. Once a week the tool checks the npm registry for a newer version, sending nothing about you; set NREPO_NO_UPDATE_CHECK=1 to turn that off. If you use Claude Code, it installs a NeuralRepo skill file under ~/.claude/skills/. The tool sends no usage data.
7. Logs
Our server's logs record details of each request, such as the time, the address, the method and the result, along with messages about errors. We don't write your ideas, your email address or AI responses to them. Cloudflare keeps these logs for up to 7 days.
8. Cookies and browser storage
nrepo_sessionkeeps you signed in. It lasts 30 days and is renewed each time you use NeuralRepo.nrepo_legal_bindlasts up to 10 minutes. It ties a command-line sign-in to your browser while you accept the Terms.
The web app keeps display preferences, such as mind-map settings and panel sizes, in your browser's local storage, and holds text you share to it only until you save it. Its pages load fonts from Google Fonts and your profile picture from GitHub or Google, which exposes your IP address to them. There are no analytics or advertising scripts. The Cookies Policy has more.
How NeuralRepo uses this data
- To store, search and organize your ideas, and to run the AI features you use
- To sign you in, keep you signed in, and record your acceptance of the Terms and this Privacy Policy
- To send the emails described above
- To bill Pro subscriptions
- To apply plan limits and rate limits, which count requests and searches but don't record their content
- To keep track of what AI requests cost us to run
- To fix errors and prevent abuse
Our administrator view shows each account's email address, name, plan and counts of ideas, tags and relations. It does not show your ideas. We do not use your data for advertising or profiling, and we do not sell it.
Sharing
NeuralRepo has no feature for sharing ideas with other users or publishing them. Your data goes only to:
- Cloudflare: hosting, the database, the search index, AI models, queues, inbound email and logs
- GitHub, Google and Apple: sign-in
- Resend: email delivery. It receives your email address and the content of each email.
- Stripe: checkout and billing. We send Stripe your email address and your account identifier; Stripe collects your payment details, and we never see your card number.
- The AI providers you add keys for, as described in section 4
- The assistants and programs you connect: an AI assistant you connect over MCP, or a program using your API key, can read and change your ideas. The assistant's provider's terms govern what it does with them.
- Google Fonts, and GitHub or Google for your profile picture, as described in section 8
- Our support site: opening support from Settings sends your email address to
support.neuralrepo.comto sign you in there
Retention
| Data | Kept for |
|---|---|
| Ideas, tags, links and relations | Until you delete them or your account |
| Archived ideas | Until you permanently delete them or your account |
| AI chat history | Until you clear it or delete your account |
| An idea's search embedding | Until you archive or delete the idea |
| Searches | Not stored |
| Sign-in sessions | 30 days after you last use NeuralRepo, then deleted by a daily cleanup |
| Sign-in links | 15 minutes |
| MCP connections | Access tokens 30 days; refresh tokens 90 days, replaced each time the assistant renews its access |
| API keys for the command-line tool and those you create in Settings | Until you revoke them or delete your account; they don't expire |
| AI usage records | 90 days |
| Request logs | Up to 7 days |
| Billing event records (amounts and Stripe identifiers) | Kept as our financial record, including after you delete your account |
| Records of your acceptance of the Terms and Privacy Policy | Kept as our legal record, including after you delete your account |
Cloudflare's database recovery can restore earlier states of the database, including deleted data, for up to 30 days.
Security
- Sign-in sessions, API keys, MCP tokens and sign-in links are stored only as hashes. A new API key is shown to you once.
- Your AI provider keys are encrypted with AES-256-GCM, using a key held as a server secret.
- Every request is limited to your own account's data.
- Deleting your account, and permanently deleting ideas, can only be done while signed in on the web. An API key or MCP connection cannot do either.
Your rights
- Export: download all your ideas from Settings as JSON, CSV or a zip of Markdown files, on any plan.
- Delete ideas: deleting an idea archives it. It is hidden and removed from semantic search, but kept. To remove archived ideas for good, with their tags, links, relations and search data, use Permanently delete archived ideas in Settings.
- Delete your account: in Settings, type your account's email address to confirm. This immediately cancels any subscription and deletes your ideas, tags, links, relations, search data, AI chat history, API keys, MCP connections, saved AI provider keys and sessions. Your account record is cleared of your name, profile picture and billing identifiers, and your email address is replaced with a one-way hash. The record is kept only so your acceptance records still point at something. Those acceptance records, including the IP address and user agent recorded with each, are kept, as are our billing event records. AI usage records are separated from your account and deleted after 90 days. If you sign in again later, you get a new, empty account.
- What deleting your account cannot reach: Cloudflare's request logs and AI Gateway logs, which age out on their own; Resend's email delivery logs; Stripe's customer, invoice and payment records; what an AI provider received under your own key, which your agreement with that provider governs; and Cloudflare's database recovery, which keeps earlier states for up to 30 days.
- Revoke access: revoke API keys and disconnect MCP clients in Settings at any time.
- Remove your AI provider keys in Settings at any time.
- Turn off emails: the weekly digest and the reminders can be turned off in Settings.
- The rights in the Master Privacy Policy apply.
Contact
For NeuralRepo privacy questions and requests: support+neuralrepo@support.neuralconfig.com. For general privacy questions: privacy@neuralconfig.com.
← Back to the Master Privacy Policy