Privacy policy

This policy covers the hosted Neo service at neoshield.dev. Neo is open source, and anyone can run their own copy; a self-hosted instance is operated by whoever runs it, not by us, and this policy does not apply to it.

• Your account. Your name, email address, and profile picture from Google when you sign in with Google, or just your email address when you sign in with an emailed link. A session cookie keeps you signed in.
• What you ask Neo to check. Links, pasted emails and text messages, screenshots, uploaded email files, and the messages you type in chat. If you set up email forwarding, the full original message you forward to your household address, including its headers and the names and types of any attachments.
• What Neo produces. Verdicts, the warning signs it found, the domains, addresses, and phone numbers it extracted, your conversation history, and counts of how many checks your household has used.
• Breach monitoring. Neo automatically monitors your verified sign-in email. Additional addresses require email confirmation. Address values are encrypted at rest in tenant-scoped storage; Neo keeps only selected breach names, dates and data types, never passwords or raw provider responses.
• Protected devices. When the household owner adds a browser or computer to protect a member, Neo keeps its name, kind, and platform, and the device checks in regularly with its app version and the time. An enrolled device also reports specific signals: the domain of a page that looked like a scam (never the full address, path, or page content) or a fake login page, the names of remote-access tools and flagged programs, a remote peer ID during a remote-access session, and screen-recording or accessibility permission grants. Signal records are kept for 30 days. When someone uses the browser extension's own link check (right-click a link, or paste one into the popup), Neo sends only that link, checks it the same way it checks a link you paste in chat, and does not save or alert on the result. The extension never sends browsing history, page content, form contents, or passwords. The Windows app checks programs and remote-access tools on the computer. It sends Neo only the name of a remote-access tool or flagged program when one appears, a remote peer ID during an incoming session, and the fingerprint (SHA-256) of an unsigned new program so it can be checked. It never sends your list of programs, files or browsing. On a Mac, with your permission (Full Disk Access), Neo also checks which apps were newly allowed to record your screen, control your Mac or read all your files. It sends only the app's name and which permission changed. The household owner can mark a tool as expected on a device, such as one they use to help another member, so their own sessions with it don't raise an alert.
• Technical records. Our hosting provider keeps standard request logs (IP address, browser, timestamps). Neo's own logs record hashed identifiers and outcome codes, never the content of what you submitted.

Only to do what you asked: analyze the thing you submitted, show you the result, keep your history so you can come back to it, email you the result of a forwarded message, and enforce the free usage limits. In a household, each member sees their own checks and the household owner sees everyone's. Chats are private to the person who had them. When a member's check comes back malicious or suspicious, a protected device reports a scam page, a remote-access tool, or a permission grant, or someone joins or leaves, the owner gets an alert on the dashboard and, depending on their settings, by email. Alerts contain Neo's one-line summary of the check, never the checked message itself, and the member can see the alerts about them. When a device is added to protect a member, the member gets an email saying so, and they can see and remove their devices in Settings → Household; removing one tells the owner.

Weekly digests. If enabled, your digest summarizes your own security checks from the past week. Owners also receive aggregate household alerts and member-device health, never member verdict details, member names or device names. Checked message bodies, checked URLs and free-form alert text are excluded; headlines have links, email addresses, phone-like digit runs and long alphanumeric tokens redacted; the email contains only those redacted headlines. Resend receives your address and the rendered digest to deliver it. For retries, Neo stores the exact request encrypted in the tenant-scoped delivery ledger; only the active sending run can read it. Inngest step state and digest fan-out events contain no address or rendered request. Terminal delivery clears the payload. The daily sweep clears non-sending payloads and sending payloads after they reach 24 hours old; under the daily schedule, encrypted request bytes may remain roughly 24–48 hours after creation. A deployed digest requires the operator's `NEO_MASTER_KEY`; local/mock mode uses a development-only key. We keep your membership preference and minimal delivery identifiers, period, status, timestamps and provider message ID in the database. Rotating `AUTH_SECRET` invalidates existing digest unsubscribe links; you can opt out in Settings or use a fresh link from a later digest.

Breach monitoring. Neo sends each verified address to Have I Been Pwned (HIBP) and the address is checked weekly against known breached-account records. HIBP receives the normalized email address for this lookup. Neo stores selected breach names, dates and data types, not passwords or the raw HIBP response. HIBP data is attributed under CC BY 4.0.

Account-hardening checklist. Your answers to the checklist in Settings → Hardening (for example, whether you use a password manager) are self-reported: Neo stores what you tell it and does not verify it with your providers. Answers are stored per household member, only you can see them, and they are deleted when you clear them, leave the household, or the owner removes you. A household owner sees only your percentage score, or “not enough answers”, never your individual answers.

Sign-in alerts. When you forward or paste a sign-in alert from Google, Microsoft, Apple, Facebook or Instagram, Amazon or PayPal, Neo stores the facts it reads from it: the provider, the kind of event, the device label, a coarse location, and the time. It does not store the alert's links, codes or your full address in that record, and a location worked out from an IP address is only a hint. Only you can see these records, and they are deleted when you leave the household or the owner removes you. A household owner sees only the resulting alert, never the list of your sign-in events. You can say “this was me” for a device so Neo stops asking about it.

Neo does not sell or rent your data, does not show ads, does not build advertising profiles, and does not use what you submit to train AI models.

Neo runs on a small number of service providers. Each one receives only what it needs:

• Anthropic (Claude models) receives the content being analyzed and your chat messages in order to produce the analysis. Anthropic does not use API data to train its models.
• Vercel AI Gateway routes each request to a model provider and brokers the inference. Every request requires zero data retention (the provider may not keep the prompt or the answer) and inference in the United States; a request that cannot meet both is refused rather than sent elsewhere.
• The model family each household member picks in Settings decides which model provider processes their chat messages: Anthropic by default, or OpenAI, Moonshot AI (Kimi) or xAI (Grok) when the operator has enabled them. Background work, such as analyzing forwarded email, always uses Anthropic.
• TypeSafe AI (Jev), only when enabled, receives a shortened, redacted excerpt of your chat message (links reduced to their domain, email addresses and phone numbers masked) to decide how large a model the question needs. It never receives attachments, analysis results, or the rest of the conversation.
• Google Safe Browsing and VirusTotal receive links (and, for attachments, a fingerprint hash of the file, never the file itself) to check against known-threat databases. The hosted service only looks links up; it does not submit new links for public scanning.
• Domain registries (RDAP) receive domain names to look up their age and registrar.
• Have I Been Pwned (HIBP) receives verified email addresses only when Neo checks them against its breached-account records. It does not receive passwords or message contents.
• Vercel hosts the app, keeps request logs, and stores uploaded and forwarded evidence. Neon stores the database. Resend receives forwarded email for your household address and sends sign-in links, result emails, weekly digests, and additional-address confirmation emails containing a single-use confirmation URL. Resend necessarily receives the destination address and that URL as part of delivery. Inngest runs background jobs. Weekly digest events and step state carry only identifiers/status; the temporary email request is stored encrypted in the tenant-scoped database ledger and is cleared on completion or by the daily sweep when it is non-sending or reaches 24 hours of age. Google handles Google sign-in.

• Raw evidence (uploaded files, screenshots, forwarded emails) is deleted automatically after 30 days.
• Verdicts and conversations are kept until you delete them, so your history stays useful.
• Removed devices are deleted 90 days after removal.
• Signal records a protected device reports are kept for 30 days.
• Your account is kept until you ask us to delete it.
• Weekly digest request payloads are encrypted in the delivery ledger while a send is pending, cleared when delivery becomes terminal. The daily sweep removes non-sending payloads and sending payloads at least 24 hours old; under the daily schedule, a pending payload may remain roughly 24–48 hours after creation.
• Breach-monitoring records are kept while an address is monitored. The encrypted address and breach observations are hard-deleted when an address is removed, when you leave the household, or when the owner removes you. Verification links expire after 24 hours; Neo stores only their hashes and clears expired hashes daily.
• Provider logs follow each provider's own retention, typically days to a few weeks. Encrypted copies in provider-managed backups may remain until those backups expire.

Everything travels over HTTPS. Uploaded and forwarded evidence is encrypted at rest with a key unique to your household. Each household's data is isolated in the database by row-level security. Content you submit is treated as untrusted by design, so a malicious email cannot instruct Neo to act on your behalf. The full source code is public at github.com/pkeenan87/neo-personal, and the threat model is described in its SECURITY file.

• Delete any verdict from its page; this also deletes the evidence attached to it.
• Delete any conversation from the chat sidebar.
• Control your own weekly digest in Settings → Digest or use its unsubscribe link. Owners default on and members default off; changing roles resets that default. Empty weeks are skipped. Digest preferences are separate from alert emails, and owners cannot change a member's preference.
• Manage additional addresses in Settings → Breaches. You can remove an additional address at any time; leaving or being removed from a household deletes its breach records.
• Rotate your household's forwarding address at any time from Settings; the old one stops working.
• Leave a household at any time from Settings → Household; your chats in it are deleted and the checks you ran stay with the household. Joining someone else's household deletes your own one-person household and everything in it, after you confirm.
• See and remove the devices that protect you from Settings → Household.
• As a household owner, mark a remote-access tool as expected on a device so your own sessions with it don't alert.
• Ask for a copy of your data or for your account and household to be deleted by emailing privacy@neoshield.dev. We answer within 30 days.

Neo is meant for adults and for families where an adult owns the household account. Do not create an account for a child under 13 (or the age of digital consent where you live).

When this policy changes, the date at the top changes with it and material changes are noted in the project changelog. Questions go to privacy@neoshield.dev or a public issue on GitHub.