Privacy Policy
At Neurako, we view privacy not merely as a regulatory requirement, but as a fundamental cornerstone of human intellectual freedom. This policy explains how we handle your data.
01. Introduction
Timothy Holbrook, operating under the brand Neurako (“we”, “our”, or “us”) operates the Neurako mobile applications (iOS and Android) and the web application at app.neurako.com. This Privacy Policy describes how we collect, use, and protect information about you when you use our services.
We treat your data with the same care you give to your own intellectual work — with respect, discretion, and purpose. We collect only what we need, retain it only as long as necessary, and never sell it to third parties.
For GDPR purposes, we act as the controller for the personal data described in this policy. Depending on the context, we process personal data to perform our contract with you, comply with legal obligations, pursue legitimate interests in operating, securing, and improving the service, and where required obtain your consent for optional processing such as consent-based product analytics in the web and mobile apps, consent-based marketing analytics on our public marketing site, consent-based product analytics on tools.neurako.com, and — when you opt in on tools.neurako.com and continue into the app — measurement of that tools-to-app handoff.
Last updated: September 2026. If we make material changes, we will notify you via email or in-app notification at least 30 days before the changes take effect.
02. Information We Collect
We collect two categories of information to provide and improve our services:
Account Identity
- Email address
- Display name
- Profile avatar (optional)
- Authentication tokens
- OAuth provider identifiers (Apple / Google, where used)
- Device push notification tokens
Cognitive Artifacts
- Flashcard decks and cards you create
- Study session logs and review history
- Audio recordings (deleted after 30 days)
- Images (retained until card is deleted)
- Subscription and purchase metadata
- Feedback submissions and support requests
Website & Security Data
- IP address and approximate network location derived from it
- Browser type, operating system, and user-agent string
- Request metadata such as URL path, referrer, and timestamps
- Security and abuse-prevention signals, including rate-limit and bot events
- Consent records and related audit metadata
Optional Product Analytics
- Screen names / routes and onboarding, study, paywall, and feature-usage events
- Broad app and device metadata such as app version, OS version, locale, and device model
- Consent version plus prompted / accepted / revoked timestamps for auditability
- Only collected after you explicitly opt in inside the web or mobile app, or — for the tools-to-app handoff — after you opt in on tools.neurako.com
- When you are signed in to the web or mobile app and have opted in, analytics events are associated with your account (not just an anonymous browser ID) so we can understand your journey through the product
- If you use a free tool at tools.neurako.com and click “Open in Neurako” having consented to analytics there, that consent choice carries into the app so we can measure how well that specific handoff works
- If you opt in to analytics on tools.neurako.com, we also load PostHog on that site (the same project as the marketing site and app) to understand which tools people use and which ones lead to signups
- We do not send flashcard content, deck names, typed answers, photos, audio recordings, or other study content to PostHog
Biometrics (optional app lock)
You may optionally enable Face ID, Touch ID, or Android BiometricPrompt as a local app lock on your device. Neurako never receives, stores, or processes your biometric templates. Those stay in the operating system secure enclave or trusted execution environment. A device passcode fallback is always available. Apple’s and Google’s privacy policies apply to the biometric subsystem.
Photos and faces
Photos you capture or upload for flashcard generation may contain faces. We do not run facial recognition, face matching, or unique identification of people. Images are sent to AI providers only to build the flashcards you requested.
Age data
If we collect age or age-attestation data for youth-protection or account eligibility, we do not use that data for advertising or other commercial profiling (TDDDG § 20).
Consent audit records
When you set cookie preferences on our public sites, we store an audit record in cookie_consents, including your consent choices, version, timestamp, IP address, and user-agent. We retain this metadata to demonstrate consent and to investigate abuse, for as long as needed for that purpose.
03. AI Processing & Governance
Neurako uses AI to transform your captures into flashcards. We take a privacy-first approach to every AI operation.
Cloud AI for audio, images, text, and tutoring
When you use AI features, the content needed for that request may be sent to Google Gemini directly or routed through OpenRouter to supported model providers.
Consent-based access
AI features are optional. You can withdraw AI consent in your account settings and continue using manual card creation.
Tutor memory profiles
If you enable tutor memory, we store compact extracted learning facts such as goals, pacing preferences, and recent session summaries to personalize future tutor sessions.
Scoped retention
Audio uploads are deleted from our storage within 30 days. Images remain available until the related card or your account is deleted.
AI Disclosure: Your audio, images, text prompts, tutor text, and generated study content may be processed by Google Gemini directly or by OpenRouter as an AI routing provider. Providers and models may change based on availability, reliability, capability, and configuration. We send this content only to provide the AI feature you requested and do not sell your study content.
04. Your Sovereign Rights
You retain full ownership of your intellectual work. We recognise the following rights:
Right of Portability
Export all your flashcard decks and study history at any time in JSON format from your account settings.
Right to Erasure
Delete your account and all associated data permanently from your account settings. Deletion is irreversible and takes effect within 30 days.
GDPR Rights
If you are in the European Economic Area, you have the right to access, rectify, restrict, object to processing, and withdraw consent for consent-based processing of your personal data.
CCPA Rights
California residents have the right to know what personal information is collected, to request deletion, and to opt out of any sale (we do not sell your data).
05. Security Standards
We rely on infrastructure and security providers including Supabase infrastructure and Cloudflare, with the following protections:
- Encryption at rest managed by Supabase infrastructure (SOC 2 Type II certified)
- Edge delivery and abuse protection through Cloudflare
- TLS in transit for all API communications
- Row Level Security on all database tables
- Responsible disclosure: [email protected]
07. Processors
We use the following processors and service providers to operate Neurako. Each processes personal data only as needed for the stated purpose. You can request an Art. 28 data processing agreement (AVV/DPA) for B2B use by emailing [email protected].
Stripe
Web payments and billing for subscriptions and token packs.
RevenueCat
Mobile and web entitlement tracking for App Store, Google Play, and related purchases.
Resend
Transactional and (where consented) lifecycle email delivery.
Railway
Hosting of the Neurako API.
Cloudflare Turnstile
Bot protection and security on authentication and similar forms.
Apple and Google IAP & OAuth
In-app purchases (merchant of record on those stores) and Sign in with Apple / Google authentication.
Expo / EAS
Building, signing, and delivering the Neurako mobile apps.
LangCraft
Optional pronunciation assessment when you enable that feature.
Google Gemini
AI processing of text, images, audio, and tutor conversations you request.
OpenRouter
Optional routing of AI requests to supported model providers.
PostHog EU
Consent-based product and marketing analytics (EU-hosted project).
Vercel
Hosting of the marketing site, web app, and related front ends; optional analytics after consent.
Supabase
Database, authentication, and private file storage.
08. International Transfers
Some processors are established in the European Union or in a country covered by an adequacy decision of the European Commission. Others (including providers in the United States) may process data outside the EEA. Where no adequacy decision applies, we rely on the Commission’s Standard Contractual Clauses (SCCs) and supplementary measures required by the provider’s data processing terms. PostHog analytics for Neurako are configured on PostHog’s EU cloud.
You can obtain more detail about a specific transfer tool by contacting us at [email protected]. We do not sell your personal data.
09. Contact & Support
If you have questions about this policy or want to exercise your rights, please reach out:
Neurako Privacy Team
We respond to all privacy enquiries within 72 hours.
Timothy Holbrook, operating under the brand Neurako
Baumannstraße 4
04229 Leipzig
Germany
See also: Terms of Service and Impressum