NeuroCognica

Privacy Policy

Version: 2.4 · Effective: 2026-08-16 Data controller: Michael Holt, trading as NeuroCognica

Read this first: two different things

NeuroCognica runs two things with genuinely different privacy properties, and blurring them would be dishonest in one direction or the other.

The desktop application is local-first and stays that way. The website is a website. When we say "nothing leaves your machine", that is a statement about ChronoSophia, and this document keeps the two apart so it cannot be read as covering both.

Part A — ChronoSophia, the desktop application

A1. What runs locally

Everything on the creative path:

No cloud API keys are required. No inference happens off your machine. We could not read your prompts if we wanted to, because they are never sent anywhere.

That includes the content-safety gate. It evaluates your request on your own hardware and records the decision to your own ledger. A refusal is not reported to us, and we cannot see that it happened.

A2. Telemetry — what is actually true today

The application has a telemetry framework with three consent levels, visible in Diagnostics ▸ System ▸ Telemetry & Privacy: Operational (marked required), Performance (off by default), and Content / training data (off by default).

The honest state of this feature: the collector is a local sink only. It writes JSONL to a file in your own application data directory. There is no upload endpoint, no network transport, and no code path that sends any of it to us. "Operational telemetry required" means a local log is written, not that anything is reported to anyone.

If that ever changes it will be disclosed in the release notes and require your consent before transmission — not enabled quietly in an update.

You can read your own telemetry log; its path is shown in Diagnostics ▸ System. You may delete it at any time.

A3. Network activity the application does make

Local-first does not mean airgapped, so here is every case:

• Dependency and model setup — downloads third-party tools and AI models from their own publishers, with your item-by-item consent, during setup.
• Update checks — if the in-app updater is used, it requests a feed file from the configured URL. Like any HTTP request, that reveals your IP address and the fact a check occurred to whoever hosts the feed. It carries no prompts, no renders, and no identity.

Neither path carries your creative work.

Part B — neurocognica.org, this website

B1. What the website collects today

Analytics is opt-in and off until you say yes. On your first visit you are asked once, in plain language, whether we may measure how the site is used. If you decline, nothing is recorded and you are not asked again — repeated asking is how consent stops being freely given.

If you accept, we record page views: the path, the referring site's hostname, and a hashed fingerprint of your browser. Your IP address and user-agent are stored as one-way hashes, never in the clear, and every event is deleted after 90 days. It is first-party only: no Google Analytics, no advertising networks, no cross-site tracking, and nothing sold or shared.

There is no analytics cookie. The measurement happens server-side and is gated on your recorded answer, so the only thing stored in your browser is the answer itself. The check is enforced on the server, not in the page — a client-side gate is a promise, this is an enforcement.

If you sign in with Google, we receive and store exactly four things:

We never receive your Google password. Google confirms who you are and returns those fields; nothing else is requested, because the permissions we ask for are limited to openid email profile.

A signed session cookie keeps you signed in for 7 days. Signing out clears it immediately, and the control is in the site header on every page.

Still true either way: no advertising, no third-party trackers, no external fonts or scripts.

The one unavoidable exception is the same for every website in existence: our host, Cloudflare, processes connection data — your IP address, the page requested, your browser's user-agent — in order to physically deliver the page and to block attacks. That is infrastructure, it is not analytics, and we do not receive a report of it.

B2. What we receive when you contact or buy

Only what you deliberately send:

• Purchase data — your email address and order details, handled by the payment platform. Where a platform acts as merchant of record it is the controller for payment data and holds your card details; we never see your card number. The platform in use is identified at checkout. If Stripe Managed Payments is used, Link is the merchant-of-record surface for the transaction and can send receipts, invoices, refund notices and transaction-support emails.
• Support correspondence — whatever you write to us, plus any logs or support bundle you choose to attach.

B3. Support bundles — read before sending

A support bundle may contain log files, configuration, version details, and file paths — which can include folder names and, depending on what you were doing, prompt text.

You choose whether to send one. Nothing is transmitted automatically. Review it first if it might contain something sensitive; we will work without one, it is just slower. Support material is used only to solve your problem, is never used for training, is not shared with third parties, and is deleted when the issue is closed or on your request.

Part C — Accounts, Mirrorborn and Chirox

Status: live. Sign-in, accounts and consent-gated analytics went live on 2026-08-04. The Mirrorborn assessment went live on 2026-08-06 and now stores what this section describes. Nothing here is a forecast any more; if it is written below, it is running.

Stripe checkout, purchase records and private ChronoSophia download links are connected. A paid webhook record issues the download link.

Cloud Chirox is experimental. It uses Google sign-in, stores text Dojo Record entries under your account, and sends the text/frame context you choose to submit to Google's Gemini API for guidance.

C1. What accounts collect

Identity from Google sign-in and consent records are live now and covered in Part B. Consent is stored as an append-only history — what you agreed to, which version you agreed to, and when you changed your mind — so a withdrawal is auditable rather than a silently flipped switch.

Analytics consent and research consent are separate permissions, and always will be. Agreeing to one never implies the other, and declining research costs you nothing: see what we ask, and why.

• Purchase records — Stripe checkout session IDs, payment intent IDs, customer IDs when Stripe provides them, checkout email, product, price, currency, payment status, refund status, and timestamps, so we can prove what was bought and support refunds.
• Download records — once private delivery is connected, the artifact, version, timestamp, and hashed IP address for abuse handling and support.

C2. Mirrorborn assessment data — the sensitive part

Mirrorborn is a reflection tool. Its whole purpose is that you write about yourself, so its data is more sensitive than anything else we hold, and it gets stated bluntly rather than buried:

• We store your written answers, the resulting five-station profile, and your history of past assessments — the history is the point of the product, because it is what lets you see change over time. Answers are saved as you write them, one at a time, so that leaving halfway never costs you the work.
• Answers are processed by Cloudflare Workers AI, running Meta's llama-3.1-8b-instruct, to tag them against a fixed taxonomy. Cloudflare is our processor for this and the request is served from their network. That is a real disclosure: unlike ChronoSophia, this processing happens off your machine.
• Legal basis: your consent. Not contract, not legitimate interest. You are asked before an assessment can start, the assessment cannot begin until you agree, and the agreement is recorded with a timestamp. You can withdraw it, and withdrawing means deletion.
• The model is not always able to interpret an answer. When that happens the answer is left out of the profile and the result says so, and a station with no evidence behind it is shown as empty. We would rather show you a partial picture than a confident invented one.
• Mirrorborn is not a clinical or diagnostic tool and its output is not medical or psychological advice. See MIRRORBORN_TERMS.md.
• You can export everything as JSON, delete a single assessment, delete all of them, or delete your account and everything attached to it — from your account page, without asking us. Account deletion cascades: consents, assessments, answers and profiles go with it, immediately and irreversibly.

C2b. Sentinel Online preparedness data

Sentinel Online is the website companion to EOAI-MGS. The installed Windows app is the offline emergency system; the website is for signed-in preparation and sync.

If you use the Sentinel checklist or household inventory, we store those rows in our Cloudflare-hosted database under your signed-in Google account. The page requires a separate Sentinel private-data acknowledgement before inventory can be added.

Sentinel inventory is for preparedness supplies only. The page and server reject obviously dangerous or over-specific entries, and you should not enter exact home addresses, weapons status, prescription details, identity numbers, or live rescue coordinates.

You can download your Sentinel checklist and inventory as a JSON sync file for the Windows app. You can also delete Sentinel web checklist, inventory and Sentinel private-data terms rows from the Sentinel page. Deletion returns a receipt ID and affected row counts. The receipt is minimal: it keeps proof that the action happened, but not the deleted preparedness contents. Public village-grid posts are separate public posts and have their own delete control.

Legal basis: your consent, given by accepting the Sentinel private-data warning and then entering the data.

C2c. Cloud Chirox and the Dojo Record

Chirox on the website is a cloud experiment, not the local-only desktop Chirox system. It is signed-in so the Dojo Record can belong to the same Google account each time you return.

• We store your text Dojo Record entries: daily check-ins, training notes, Mandarin notes, reading notes, review notes, timestamps, selected training target, and the Master exchange attached to the session.
• Camera frames are not saved as files in the Dojo Record. When you press a Chirox action that uses vision, the current frame may be sent to Gemini for that request and the stored record notes only that a frame was used.
• Master guidance is generated by Google Gemini from the text you submit, the selected target, the recent Dojo Record, the available library list, and any frame you explicitly send. That processing happens off your machine.
• Chirox is not medical advice, clinical advice, lineage authority, or a substitute for a qualified teacher. It is a practice mirror and record system.
• Deleting your account deletes the Cloud Chirox records attached to that account.

Legal basis: your consent, given by choosing to write a record entry or send text/frame context to Chirox.

C2d. The forum — the one public thing

Everything else described in this document is private to your account. The forum is not. It is the single place where what you write is shown to the public, and it deserves its own heading rather than a clause someone finds afterwards.

• A post publishes the words you wrote and the name on your Google account, to anyone on the internet, whether or not they are signed in or have an account at all. Your email address is never shown.
• Strict Shaolin Etiquette applies. Posts may appear immediately, but the forum is closely monitored by the operator. Harmful, abusive, degrading or disruptive speech can lead to deletion and an immediate ban from NeuroCognica services and products, including account-backed website features. This is stated on the forum page itself, above the box, not only here.
• You can delete your own posts at any time, and deleting your account deletes your posts along with everything else. That leaves visible gaps in conversations, which is the correct trade: an erasure that spared the public part would not be an erasure.
• Do not post personal information — your own or anyone else's. Once something is public, our deleting it does not un-read it.

Legal basis: your consent, given by choosing to post. Reading the forum requires no account and stores nothing about you beyond the ordinary hosting records in Part B.

C3. Analytics, when it exists

First-party only — no Google Analytics, no advertising networks, no cross-site tracking, and your data is never sold or shared with advertisers.

• Gated behind an explicit consent banner. Nothing fires before you opt in.
• IP addresses and user-agents stored hashed, never in the clear.
• Retained 90 days, then deleted automatically.

C4. Administrative access

For support and refunds, the operator can view an individual account's purchases, downloads and assessment status. That means a human at NeuroCognica can, in principle, read what you wrote in an assessment. Every administrative action is written to an append-only audit log. We would rather tell you this than have you assume otherwise.

Part D — Applies to everything

D1. Legal basis and retention

D2. Your rights

You may request access to, correction of, or deletion of the personal data we hold. You may object to processing, request portability, withdraw any consent you gave, and complain to your data protection authority (in the UK, the ICO).

Ask via SUPPORT.md and you will get a straight answer about exactly what exists.

If your purchase used Stripe Managed Payments, Stripe/Link also controls transaction records generated by that merchant-of-record flow. A deletion request for those Stripe-side records may need to be handled through Link or Stripe as well as through NeuroCognica.

D3. Children

Neither ChronoSophia nor Mirrorborn is directed at children under 16, and we do not knowingly collect their data.

D4. Changes

Material changes are published with a new version and effective date at the top. The copy shipped with your installed version records the terms in force for it. A change that starts new collection requires fresh consent; it does not take effect by publication alone.

D5. Contact

Privacy questions or requests: see SUPPORT.md.