Privacy Policy

1. Who We Are and Scope

Neuralist is a productivity application that helps you turn ideas into action. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data across our marketing website at neuralist.io and within the Neuralist application (collectively, the "Services").

The data controller is Kiwi Oak LLC, which operates Neuralist. You can contact us using the information in the Contact section below.

2. Information We Collect

We collect different information depending on how you interact with the Services and which features you choose to use.

Website

• Email address if you join our mailing list or contact us
• Cookie preferences and consent status
• Analytics data such as page views, traffic sources, device information, browser information, and site interaction data when optional analytics cookies are enabled
• Marketing attribution data when optional marketing cookies are enabled
• Advertising and conversion event data, such as when a visitor signs up for an account, when optional marketing cookies are enabled
• Technical information such as browser, device, network, and approximate location information derived from technical data

Account and Application Data

• Account information from our authentication provider, such as your email address and basic profile data
• Subscription, billing, payment, and invoice status from our payment processor
• User-generated content such as tasks, plans, notes, conversations, board content, and related metadata
• Settings and feature data such as preferences, notification settings, onboarding state, feature participation, achievements, and usage information
• Security and authentication data such as IP addresses, login activity, session and authentication information, browser or user-agent information, request identifiers, and account-risk or abuse-prevention information
• Operational information such as application logs, errors, diagnostics, performance information, and service activity

Shared Boards and Organizations

If you use collaboration features, we may collect and process information about organizations, shared boards, invitations, memberships, roles, and member administration. This may include names and email addresses used to invite or identify members, as well as records of membership, access, and administrative activity.

Content you create or add on a shared board, including tasks, plans, notes, conversations, and related activity, may be visible to other members who have access to that board. Organization administrators may also be able to manage members, roles, and access and view administrative or audit information associated with the organization.

AI and Nova

When you use Nova or other AI features, Neuralist processes information needed to understand and respond to your request. Depending on the feature and request, this may include your message, relevant recent conversation history or summaries, tasks, plans, boards, calendar information, dashboard context, timezone, request metadata, and other information retrieved by Neuralist that is relevant to the request.

AI processing may also include tool requests and results used by Nova to search your information, answer questions, or prepare and perform actions you request.

We may store AI interaction and execution data, including messages, conversation context and summaries, AI outputs, tool calls and results, pending actions, usage information, provider responses, errors, and related diagnostic information. This information is used to provide AI features, maintain conversation continuity, operate requested actions, enforce usage limits, troubleshoot problems, and improve the reliability and safety of the Services.

Calendar Data

• Calendar integration data if you choose to connect a Google account for Google Calendar functionality
• Calendar feed data if you choose to enable an ICS feed that can be subscribed to or imported into calendar applications

Notifications and Devices

If you enable push notifications, we may collect and store information needed to register your device and deliver notifications. This may include a device identifier, browser and platform information, locale, timezone, application installation status, push subscription information, notification delivery status, and related diagnostic information.

Notifications may contain information related to the feature that generated them, such as reminder or account information. Push notifications are delivered using the push service associated with your browser, device, or operating system.

Imports

If you import information from another service, such as by uploading a Todoist backup, we process the uploaded data to perform the import. Imported data may include tasks, dates, notes or comments, project structure, and other information contained in the import, including author information when you choose to import it. Information successfully imported becomes user-generated content in Neuralist.

Referrals and Rewards

If you participate in a Neuralist referral or reward program, we may process information about referral relationships, referred accounts, qualification status, subscriptions or invoices relevant to a reward, reward amounts and history, refunds or disputes, and information used to detect fraud or abuse.

Referral features may display limited information about a referred account, such as the referred user's email address and whether the referral has qualified for a reward, to the user who made the referral.

3. How We Use Information

Website Uses

• Send updates to subscribers who opt in
• Respond to messages and support requests
• Measure and improve site content, usability, and performance
• Understand how visitors interact with the website, including through analytics and site interaction tools when optional analytics cookies are enabled
• Measure campaign performance, attribution, and conversions when optional marketing cookies are enabled
• Support advertising and remarketing activities when optional marketing cookies are enabled

Application Uses

• Provide, operate, sync, and improve Neuralist and its features
• Store and organize tasks, plans, conversations, boards, settings, and other user content
• Provide shared boards, organizations, invitations, and collaboration features
• Authenticate users, maintain sessions, secure accounts, and prevent fraud and abuse
• Process payments, manage subscriptions, and administer referral or reward programs
• Deliver AI features and perform AI-assisted actions you request
• Provide calendar integrations you enable, including Google Calendar integration and ICS calendar feeds
• Register devices and deliver notifications and reminders you enable
• Send transactional emails such as account, security, invitation, reminder, summary, and referral messages
• Process data that you choose to import into Neuralist
• Enforce feature and usage limits
• Monitor, troubleshoot, secure, and improve the reliability and performance of the Services
• Comply with legal obligations and enforce our agreements

4. Legal Bases for Processing

Where required, we rely on one or more legal bases for processing personal data, including performance of a contract, our legitimate interests in operating, securing, preventing abuse of, and improving the Services, your consent where applicable, and compliance with legal obligations.

5. How We Share Information and Third-Party Services

We disclose information to service providers where needed to operate the Services. Our providers include:

• Authentication: Clerk
• Payments and billing: Stripe
• Email delivery: Resend
• Marketing email: MailerLite
• AI features: OpenAI API
• Calendar integration: Google APIs for Google Calendar functionality you enable
• Hosting and infrastructure: Fly.io for the app and Cloudflare Pages for the marketing site
• Analytics and site interaction measurement: Google Analytics, Microsoft Clarity, and Audacy Creator Lab
• Advertising measurement and marketing attribution: Google advertising services, Meta Pixel, Pinterest Tag, and Reddit Pixel
• Security and abuse prevention: Cloudflare Turnstile on protected forms
• Browser, device, and operating-system push services when you enable push notifications

These providers receive information as necessary to perform services for us and process that information subject to their applicable terms, privacy commitments, and legal obligations.

Analytics and Advertising Providers

Analytics, advertising measurement, and marketing attribution providers may receive information such as pages visited, referring pages, campaign identifiers, browser and device information, approximate location derived from technical data, cookie or similar identifiers, and conversion events. For example, we may send sign-up related conversion events to Google, Meta, and Reddit when optional marketing cookies are enabled.

Microsoft Clarity may help us understand how visitors interact with the website through information such as clicks, scrolling, page navigation, and similar site interaction data when optional analytics cookies are enabled.

AI Providers

When you use AI features, Neuralist sends information needed to process your request to our AI provider, OpenAI. This may include your message and relevant context Neuralist automatically assembles for the request, such as conversation history or summaries, tasks, plans, boards, calendar information, tool inputs and results, and related request context.

Neuralist receives AI-generated outputs from OpenAI and may store information about the interaction and its execution as described in this policy. According to OpenAI's documentation, data submitted through its API is not used to train or improve OpenAI's models.

Google Calendar

When you connect a Google account for Google Calendar integration, Neuralist uses that connection only to provide the calendar functionality you enable. We do not use your Google account integration for unrelated purposes.

ICS Calendar Feeds

If you enable an ICS calendar feed, Neuralist creates a feed URL that can be subscribed to or imported into calendar applications. The feed URL acts as a secret link: anyone or any service with access to it may be able to retrieve the calendar data included in the feed until you revoke it. Calendar applications using the feed may periodically request updated data from Neuralist.

Push Notifications

When you enable push notifications, notification delivery uses the push infrastructure associated with your browser, device, or operating system. Information necessary to route and deliver a notification is therefore transmitted through the applicable push service. The information visible in a notification may also be visible through your device or operating system according to your notification settings.

Shared Boards and Organizations

When you participate in a shared board or organization, information and content you make available there is disclosed to other members according to their access. Organization administrators may receive or access membership, role, access, and administrative information as needed to manage the organization.

Transactional Email

We use email providers to deliver transactional messages such as invitations, reminders, summaries, security and account notices, and referral communications. Depending on the message, these emails may contain account information or information related to your Neuralist content.

URL Information

Neuralist may retrieve information about a URL you add to content, such as a page title, to provide related application features. When Neuralist retrieves information from an external URL, the operator of that website may receive technical information associated with the request from Neuralist's infrastructure.

Legal and Safety Disclosures

We may disclose information when reasonably necessary to comply with applicable law, legal process, or lawful government requests; protect the rights, safety, and security of Neuralist, our users, or others; investigate fraud or abuse; or enforce our agreements.

Business Transfers

If Neuralist or Kiwi Oak LLC is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law.

6. Cookies and Tracking

We use necessary cookies and similar technologies to run the site and app. We also use non-necessary cookies and similar technologies for optional analytics, site interaction measurement, advertising measurement, marketing attribution, conversion tracking, and remarketing. You can change your choices at any time through the Cookie settings link. Your choice will be honored on future visits from the same browser.

Categories:

• Strictly necessary: required for security and core functions
• Analytics: helps us improve content, usability, and performance, optional and opt out available
• Marketing and advertising: helps measure campaign performance, attribution, conversions, and support remarketing, optional and opt out available

Optional analytics and marketing technologies are used only after consent. These may include Google Analytics, Google advertising and conversion tracking technologies, Microsoft Clarity, Audacy Creator Lab, Meta Pixel, Pinterest Tag, and Reddit Pixel.

Google, Meta, Reddit, and similar advertising providers may receive conversion events, including account sign-up related events, only when optional marketing cookies are enabled. These events help us measure whether our advertising is effective and may help support advertising or remarketing features.

If optional cookies are not accepted, Neuralist does not intentionally load these optional analytics or marketing tracking technologies.

7. Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this policy, including providing the Services, maintaining security, resolving disputes, preventing fraud and abuse, complying with legal obligations, and maintaining appropriate business records. Retention periods vary depending on the type of information and why it is processed.

Mailing list information is retained until you unsubscribe or it is otherwise no longer needed. Account, subscription, billing, referral, and transaction records may be retained for a reasonable period after an account is closed where needed for accounting, fraud prevention, dispute resolution, auditing, or legal compliance.

User-generated content associated only with your personal account is generally retained while your account is active and until you delete the content or request deletion of your account, subject to reasonable retention for security, backups, dispute resolution, and legal compliance.

Content you contribute to a shared board or organization may remain associated with that shared board or organization after you leave it or delete your account when the content is also part of other members' shared workspace, records, or conversation history. Where appropriate, identifying account information may be removed or disassociated from retained shared content.

AI interaction and execution records, operational logs, security records, notification delivery records, organization audit information, referral records, and similar diagnostic or administrative information may be retained for periods appropriate to their operational, security, fraud prevention, auditing, dispute resolution, and legal purposes.

Calendar integration records and ICS feed settings are retained while enabled or as needed to provide the integration, unless you disconnect, revoke, delete, or request deletion of the related data, subject to reasonable retention for security, dispute resolution, and legal compliance.

Files provided for an import may be processed temporarily to complete the import. Information successfully imported into Neuralist is then retained as the corresponding user-generated content.

8. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal data, including encryption in transit, access controls, authentication and security measures, and monitoring of our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International Data Transfers

We operate in the United States and may process or transfer data through service providers located in the United States or other countries. Where required by applicable law, we use appropriate safeguards for international transfers of personal data.

10. Your Rights

Depending on where you live, you may have rights regarding your personal data, including rights to access, correct, delete, or receive a copy of certain information, and to object to or restrict certain processing or withdraw consent where processing is based on consent. EU and UK users may have rights under applicable data protection laws, including the GDPR. California residents may have rights under the CCPA and CPRA. We will respond to applicable requests in accordance with applicable law.

11. Children's Privacy

Neuralist is not intended for children under 13. A higher minimum age may apply in some jurisdictions. We do not knowingly collect personal data from children in violation of applicable law.

12. Your Choices

• Unsubscribe from marketing emails using the unsubscribe link in any marketing email
• Manage cookie preferences using the Cookie settings link
• Manage available account, email, and notification preferences within Neuralist
• Disable push notifications through your browser or device settings
• Disconnect Google Calendar integration if you no longer want Neuralist connected to your Google account
• Revoke an ICS feed if you no longer want its feed URL to provide calendar data
• Leave shared boards or organizations where the applicable controls are available
• Request deletion of your account and associated personal data, subject to the exceptions described in this policy and applicable law

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, or applicable requirements. We will post the updated policy on this page and update the effective date above.

14. Contact

If you have questions about this Privacy Policy or want to make a privacy request, contact us at:

Email: contact@neuralist.io

For requests involving your account or personal data, please include the email address associated with your Neuralist account so we can verify the request as appropriate.