In short. NeuroPress is a blogging platform. We collect what we need to run your account and your blog, and nothing more. We never sell personal information and we do not use it for advertising. Data from a Google AdSense or Ad Manager account you connect is read only to show you your own earnings, is stored encrypted, and is deleted when you disconnect. On blogs hosted here, the blog’s owner decides what is collected from readers, and we process it on their behalf.
1. Who we are and what this covers
NeuroPress (“NeuroPress”, “we”, “us”) provides a hosted blogging platform. This policy explains how we handle personal information on:
- the public website at neuropress.io;
- the NeuroPress app at app.neuropress.io, which includes the dashboard, the API and the connectors for AI tools;
- blogs hosted on NeuroPress, whether on a NeuroPress address or on the owner’s own domain. For those blogs we act on behalf of the blog owner; see section 6.
If you have a question about anything here, write to [email protected].
2. Information you give us
- Account details. Your name, email address and password when you create an account, and the name of your blog. Your password is never stored in readable form; we keep only a one-way hash of it.
- Your content. Posts, pages, images and other media you upload, categories, menus, theme choices, custom domain and the other settings of your blog. Anything you publish is public by design.
- Your team. The email addresses and roles of people you invite to work on your blog.
- Add-on settings. Details you enter to switch on optional features, for example an ad code, a Google Analytics ID, or the server, username and password of an email account you want your blog to send from. Passwords and similar secrets are encrypted before they are stored (see section 10).
- Messages. Anything you send us by email or through the dashboard.
3. Information collected automatically
When you use the website or the app, our servers receive some information on their own:
- Sign-in session. When you sign in we set a cookie that keeps you signed in. It is required for the app to work and contains no tracking.
- Server logs. The address of the device you connect from (IP address), the browser you use, the pages you request and when. We use these to keep the service running, to investigate problems and to protect against abuse. They are kept for a short period and then discarded.
- Sign-up protection. We count sign-ups per IP address for one hour to slow down automated account creation. The count lives in memory and is not written to our database.
- Preferences. Choices such as light or dark mode are saved in your own browser only.
We do not run analytics trackers or advertising cookies on neuropress.io or in the NeuroPress dashboard.
4. Google account data
The optional Ad Revenue add-on lets you connect a Google AdSense or Google Ad Manager account so that your dashboard shows what your blog earns. You connect it through Google’s own sign-in screen, where Google shows you exactly what we are asking for and you decide whether to allow it. This section explains what that access is used for.
What we ask Google for
| Permission | Why we need it |
|---|---|
adsense.readonly | Read-only access to your AdSense reports, so we can fetch daily earnings, impressions, clicks and page views for the sites and ad units you choose. We cannot change anything in your AdSense account with it. |
admanager | Access to your Ad Manager network, to run the same earnings reports. Google does not offer a read-only permission for Ad Manager, so the consent screen shows broader access than we use. The only change we ever make in your network is to create a custom targeting key, and only if you switch on per-page reporting, so earnings can be broken down by article. |
userinfo.email | The email address of the Google account you connected, so the dashboard can show which account is linked. |
What we store
- The email address of the connected Google account, and the AdSense account or Ad Manager network you selected.
- The reports we fetch: earnings, impressions, clicks, page views and ad requests per day, per ad unit and, when you turn it on, per page address. They are stored so your dashboard opens quickly and so the optional Revenue Routing add-on can weight your own links by what each one earns.
- The access and refresh tokens Google issues when you connect. They are encrypted at rest with AES-256-GCM and are used only to fetch reports: automatically a few times a day, and when you open the Ad Revenue page.
How we use it, and how we do not
- We use Google account data only to provide the Ad Revenue and Revenue Routing features to you.
- We do not sell it, we do not use it for advertising, and we do not share it with anyone other than the service providers that host our servers (section 8).
- No person at NeuroPress looks at it, except with your permission to resolve a support request, for security purposes such as investigating abuse, or where the law requires it.
- We do not use Google account data to develop, improve or train generalised artificial intelligence or machine-learning models.
NeuroPress’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting
Open the Ad Revenue page of your blog and press Disconnect. We ask Google to revoke the grant, delete the tokens and the connection, and delete every earnings figure we fetched through it, including any per-page breakdown. You can also withdraw NeuroPress’s access at any time from your Google account permissions; the connection then stops working and you can remove it from the dashboard.
5. AI features and connectors
- AI add-ons. The AI writer, SEO optimiser, assistant and fact checker are optional. When you use one, the text it needs to do its job (a draft, a title, the claims in a post you asked us to check) is sent to OpenAI to produce a result. We send only what the feature needs. Your password, your Google account data and your readers’ data are never included.
- Connectors for ChatGPT, Claude and similar tools. You can create a connector that lets an AI tool read and write your blog with the permissions you choose. The secret key is shown to you once; we store only a one-way hash of it. We keep a log of each call the tool makes (which action, when, and whether it succeeded) for 30 days so you can review what it did. Delete the connector at any time to revoke access.
- Stock photo search. When you search for a photo inside the editor, your search words are sent to Pexels.
6. Readers of blogs hosted on NeuroPress
Every blog on NeuroPress belongs to its owner. The owner decides what the blog contains, which features are on and which third-party services are added, and is responsible for telling readers about their own practices. NeuroPress processes reader information on the owner’s behalf, as follows.
- Page statistics. For each page view we record the page, the referring site, the browser and device type, and the country, which we work out from the IP address on our own server. The IP address itself is not stored. To count unique visitors we keep a one-way hash of the IP address, browser and the current date; it changes every day, so it cannot follow a reader over time.
- Visitor Insights. If the owner turns this on, the blog records how pages are used: mouse movement, scrolling, clicks and the structure of the page, so the owner can find things that are confusing or broken. Anything typed into a form is always masked, and the owner can choose to mask all text on the page. Recordings are kept for 30 days unless the owner sets a shorter period, and never longer than 90 days.
- Ad Shield. To protect the owner’s advertising account from fraudulent traffic, we check every visit before an ad is shown, using the IP address, its country and network, the browser identification, the referring site and the rate of requests. When a visit is blocked we keep the IP address, the reason, the page and the time for 30 days so the owner can review it. Daily totals, without any addresses, are kept for a year.
- Comments. If the owner allows comments, we store the name, the optional email address and website, the IP address and the text of each comment until the owner removes it.
- Services the owner adds. An owner may add Google Analytics, Google AdSense or Ad Manager ads, embedded videos from YouTube or Vimeo, fonts from Google Fonts, or their own scripts. Those services receive your visit directly and may set their own cookies under their own policies, for example how Google uses information from sites that use its services.
If you want to see, correct or delete information a blog holds about you, contact that blog’s owner. We help owners carry out such requests, and you can also write to us at [email protected] if you cannot reach them.
7. Cookies and browser storage
- neuropress.io sets no cookies.
- The NeuroPress app sets a sign-in cookie when you sign in, and uses your browser’s local storage for preferences such as light or dark mode and unsaved drafts. Nothing in it is used for tracking.
- Hosted blogs receive no cookies from NeuroPress itself. A blog uses local storage for the reader’s light or dark choice and, when Visitor Insights is on, a session identifier that is discarded when the tab closes. Cookies may be set by services the owner has added (see section 6).
8. Who we share information with
We never sell personal information. We share it only with the service providers below, who process it on our instructions to run NeuroPress, and in the limited legal situations listed after the table.
| Provider | What for | Where |
|---|---|---|
| Contabo GmbH | The servers and database on which NeuroPress and every hosted blog run. | Germany |
| Cloudflare, Inc. | Domain name service and the network layer in front of our servers, including protection from attacks. Cloudflare sees the traffic to our addresses. | Global network, United States |
| Google LLC | Sign-in with Google and the AdSense and Ad Manager reporting services, only when you connect an account (section 4). Some blog themes load fonts from Google Fonts. | United States |
| OpenAI | The optional AI writing, SEO, assistant and fact-checking features, only when you use them (section 5). | United States |
| Pexels | Stock photo search inside the editor, only when you search. | United States |
Working out a visitor’s country from an IP address happens on our own server with a local copy of a geolocation database; no address is sent anywhere for that purpose.
We may also disclose information when the law requires it, to protect the rights, safety or property of NeuroPress, our users or others, or to a successor if NeuroPress is ever sold or merged, in which case this policy continues to apply.
9. How long we keep information
| Information | Kept for |
|---|---|
| Account details and your content | As long as your account exists. Deleted within 30 days of a deletion request; copies in backups are overwritten in the normal backup cycle. |
| Google tokens and fetched earnings reports | Until you disconnect the Google account, remove the add-on, or delete the blog. |
| AI connector call log | 30 days. |
| Visitor Insights recordings | 30 days by default; the owner can choose between 1 and 90 days. |
| Ad Shield blocked-visit records | 30 days for individual records; daily totals without addresses for one year. |
| Page statistics | As long as the blog exists, as statistics without IP addresses. |
| Comments | Until the blog owner deletes them or the blog. |
| Server logs | A short period for security and troubleshooting. |
Deleting a blog deletes everything stored for it, including its statistics, recordings, comments and connections. Deleting an account deletes the blogs it owns, unless they have been handed to another member first.
10. Security
- All connections to neuropress.io, the app and hosted blogs are encrypted with TLS.
- Passwords are stored only as one-way hashes. Secrets such as Google tokens and email passwords are encrypted at rest with AES-256-GCM.
- Every record in our database is tied to a blog and protected by row-level access rules, so one blog can never read another blog’s data.
- Access to production systems is limited to the people who operate the service.
No system is perfectly secure. If you believe you have found a security problem, please tell us at [email protected].
11. Your rights and choices
Depending on where you live, you may have the right to:
- see the personal information we hold about you and receive a copy of it;
- correct it when it is wrong;
- have it deleted;
- object to or restrict how we use it;
- withdraw a permission you gave us, such as the Google connection;
- complain to the data protection authority where you live.
You can change your account details, your blog’s settings and every connection yourself in the dashboard. For anything else, including deleting your account or receiving an export of your data, write to [email protected] from the email address on your account. We answer within 30 days. Readers of a hosted blog should contact that blog’s owner first (section 6).
12. Where information is stored
NeuroPress runs on servers in Germany. Some of the providers in section 8 are based in the United States, and your information reaches them only in the situations described there. Where the law requires a safeguard for such transfers, we rely on the provider’s participation in a recognised framework or on standard contractual clauses.
13. Children
NeuroPress is not directed at children under 16 and we do not knowingly collect personal information from them. If you believe a child has given us personal information, write to us and we will delete it.
14. Changes to this policy
We may update this policy as NeuroPress changes. The date at the top shows when it was last revised. If a change materially affects how we use your information, we will tell you in the dashboard or by email before it takes effect.
15. Contact
NeuroPress
[email protected]