Privacy Policy

1. Summary

NeatOS software runs on your computer. We do not sell personal data. The software has no account system and, in its current release, no analytics or telemetry. The public pages of the website need no account and use first-party, anonymous usage measurement only. A separate sign-in exists for invited NeatOS accounts; the section “Signing in to NeatOS” says exactly what it stores.

2. NeatOS software on your computer

The software does not collect, transmit or sell personal data. What stays on your device: your automations, their run history and output, local logs, and the audit log of the optional local API. You can delete all of this in the software's data settings, and uninstalling the software removes its data.

Secrets such as API keys are kept in Windows protected credential storage. They are not included in exports or logs, and the software offers a command that deletes them.

Network activity: the software makes outbound requests only when an automation you created sends one, and for a minimal connectivity check when you use the “internet available” trigger. Those requests go to the destinations you configured, not to us.

If a later version offers optional crash reporting, it will be off by default, and this policy will list exactly what it would send before the feature exists.

3. This website

Public pages need no account and no personal information. Feedback and report forms ask only for what the action needs; a one-way message needs no email address. Anonymous usage measurement is first-party, opaque and never used to identify you. The site uses no third-party analytics, fingerprinting or session replay. Errors show safe messages and request identifiers, never internal details.

4. Signing in to NeatOS

Some NeatOS workspaces need an account. Accounts are created by invitation from a NeatOS administrator. There is no public registration, and the public pages never ask you to sign in.

If you have an account, this is what sign-in stores and sets.

• Your account record: a username, a display name, an email address only if the invitation carried one, the roles and workspaces you were granted, your account status, and the times it was created, last signed in and last changed.
• Your passphrase is never stored. We store a salted one-way hash of it, which cannot be turned back into the passphrase.
• One cookie, named __Host-neatos_session. It keeps you signed in, is not readable by scripts on the page, is sent only over HTTPS, and is sent only for this site. Its value is a random token. It ends when you sign out, after 30 minutes without activity (15 minutes for privileged roles), or 8 hours after you signed in, whichever comes first. No other cookie is set by sign-in.
• For each session: a hash of that token, the times it was created, last seen and ended, and the strength of the sign-in. We do not store your IP address or your browser details on the session.
• A security log of sign-in events: sign-ins, sign-outs, refused attempts and account changes, each with the time, the outcome and a request identifier.
• To slow down password guessing we count failed attempts per account and per a pseudonymous key made from your network address with a secret. The count is temporary. Your address itself is not stored with it.

5. Your choices

You can use the public pages without giving us any personal information. For anything you sent through a feedback or report form, use the contact route below and tell us what you want removed.

6. Contact

For a privacy question, use: legal@neatos-systems.com.