Privacy Policy

We collect the minimum needed to run Neuricon: your account details, your public posts and profile, and basic usage data. We never sell your data. Your email is never shown publicly. You can delete your account and data at any time.

• Account data: email address, sign-in provider (Google, GitHub, or email), and whatever profile info you add (username, display name, bio, avatar). Passwords are hashed by our auth provider and never stored in readable form.
• Public content: community posts, comments, likes, your public profile, XP, and level. This is visible to everyone by design.
• Usage data: pages visited and time spent, used to award XP and improve the site. Stored as aggregate XP events, not detailed browsing logs.
• Technical data: IP addresses are stored only as SHA256 hashes for rate limiting and spam prevention — the raw IP is never kept.

Our news wire is built by automated ingestion: we fetch public RSS feeds, model registries (like Hugging Face), and GitHub trending data once a day, then summarize items for the wire. Our catalog researchers verify tool and model details against official documentation and independent sources. None of this touches your personal data — ingestion only reads public third-party sources.

• Run your account: sign-in, password reset, profile display
• Operate the community: show your posts, award XP, compute levels
• Keep the site safe: rate limiting, spam and abuse detection
• Improve Neuricon: aggregate, anonymized usage statistics

We do not use your data for advertising profiles and we do not sell it. Ever.

• Public: username, display name, avatar, bio, level, XP, badges, posts, comments, likes.
• Private: email address (visible only to you and our systems), password hash (visible to nobody), IP hashes (used only for rate limiting).
• Service providers: Supabase (database and authentication) and Vercel (hosting) process data on our behalf under their data-processing terms. OAuth providers (Google, GitHub) receive only what their sign-in flow requires.

We use httpOnly, Secure, SameSite cookies for authentication sessions — these are essential and can't be disabled without breaking sign-in. We use localStorage only for non-sensitive preferences (theme) and your anonymous guest ID for likes. No third-party tracking cookies.

Account data is kept while your account exists. Public posts and comments may remain visible after account deletion (attributed to a removed user) unless you ask us to remove them too — contact us and we'll honor it. Backups rotate out within 30 days.

Depending on where you live (GDPR, CCPA, and similar laws), you may have the right to access, correct, export, or delete your personal data. To exercise these rights, use the contact page or email contact@neuricon.dev — we respond within 30 days. Deleting your account deletes your profile, XP history, and private data; public posts are handled per section 7.

Neuricon is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.

Sessions live in httpOnly cookies (never localStorage). Passwords are hashed with bcrypt via Supabase Auth. Database access is gated by Row Level Security. Admin endpoints require a secret key. That said, no system is perfectly secure — use a unique password and enable your provider's 2FA where available.

We'll update this policy as Neuricon grows and announce material changes on the site. Continued use after changes means you accept them.

Privacy questions or data requests? Reach us through the contact page or email contact@neuricon.dev.