Privacy Policy

Effective September 14, 2026 · Applies to the hosted Neiliro service and this website

Neiliro is a household organizer built around a simple promise: your family's data belongs to your family. This policy describes what we actually collect, where it lives, and what you can do with it — in plain language, because a privacy policy you can't read isn't one.

Who we are

Neiliro is operated by Denis Burtsev. For anything in this policy: [email protected].

This policy covers the hosted service (your family's space at yourfamily.neiliro.com), the public demo, and this website. The self-hosted edition runs on your own server under your own control — nothing from it ever reaches us.

What we collect

• Creating a family: the family's name and the administrator's email address, which the form on this site hands to the hosted service; the service mails the invitation there and keeps the address as the founder's login. This website itself keeps a truncated, one-way digest of the IP address and the time of each attempt — to slow a scripted form down, identifying nobody. (The earlier waitlist held an email address and nothing else; those addresses are deleted 90 days after the waitlist closed on September 13, 2026.)
• Subscription: whether your family has a paid plan and until when, and the customer and subscription identifiers our payment provider, Paddle, assigns. Paddle sells the subscription as the merchant of record and holds the card; a card number never reaches us, only the fact that a payment happened, failed or was refunded.
• Account: your name, email address, and a one-way hash that lets us check your password — we never store the password itself, and your browser no longer sends it: it sends a key derived from the password, and that is what the hash is of. Your family's encryption key, stored only inside sealed envelopes that a member's password, the family's recovery code or another member's device can open, and we cannot. If you enable two-factor authentication, its secret. If you link Google sign-in, the permanent identifier Google gives us for your account. On the hosted service, the moment you accepted the Terms and this policy when the account was created — the documents are dated, so that timestamp says which version you agreed to.
• Sign-in housekeeping: whether your login address has been confirmed, and the one-time links we mail you — for confirming an address or resetting a password. Those are stored hashed, never in readable form, and expire (a week for a confirmation, an hour for a reset). We keep the fact that a password was reset and when, because "was my account recovered by someone else?" deserves an answer.
• Your family's content: the tasks, notes, calendar entries, financial records, uploaded files, and mail received at your family's address. This is your data, stored so the product can show it back to you — we do not read it, analyze it, or use it for anything else. Since September 10, 2026 the words in it are encrypted in your browser with a key we do not hold, so this is engineering as well as conduct; see Who can read your family's content for what that covers and what it does not.
• Health information, if you write it down: a profile can list a member's allergies. That is health data in the law's sense, and the only reason it is here is that a household needs it findable in a hurry. You choose whether to enter it; the field says what it is; it is encrypted with the family key like everything else, readable only inside your family, and deleted with the profile when the account is removed.
• Support messages: if you write to us through support.neiliro.com, the message, the address to reply to, and the family address you name — kept while we work on it and for a year afterwards, so "we discussed this before" has somewhere to look. The form also stores a shortened, one-way digest of your IP address, which exists to stop a public form being used to flood a mailbox and identifies nobody.
• Technical records: your active sessions with IP address and last-seen time (shown to you under Devices, so you can spot an unfamiliar login; a session idle for 30 days is dropped); a daily per-family activity count — how many requests, how many people signed in that day, and which sections were opened; never what was in them, and never who did what. There is no access log. The application log never includes the contents of requests; it does record a failed sign-in with the login address and the IP address it came from, which is how a password-guessing attempt gets noticed, and those lines are overwritten within weeks by ordinary log rotation.

Why we may process it

The law wants a reason named for every kind of processing. Ours are few:

• Providing the service you signed up for (the contract, art. 6(1)(b) GDPR): your account, your family's content, the letters that keep the account working, the plan and its state.
• Keeping the service safe and running (legitimate interest, art. 6(1)(f)): the IP digests behind public forms, the failed-sign-in lines in the log, the per-family activity counters, the encrypted backups.
• Your explicit consent (art. 9(2)(a)) for health information you choose to enter into a profile — given by entering it, withdrawn by deleting it.
• Our legal duties and promises (art. 6(1)(c)): the notice before this policy or the terms change, the letters the terms promise before data is removed, the consent timestamp that says which version of the documents you agreed to.

Google sign-in is your choice, made from settings, and rests on the contract like the rest of sign-in.

How long we keep it

• Your family's content and accounts: for as long as the family exists. After the free period or the subscription ends the hub is read-only for 60 days, with two letters before anything happens, then removed. Deleting the family, or removing one member, removes the data at once; encrypted backups expire within 14 days (two on the server, fourteen in object storage).
• Sessions: dropped after 30 days without use, or 90 days at most.
• Confirmation and reset links: a week and an hour, respectively, stored hashed.
• Support messages: a year after the message.
• Sign-up attempts on this website (IP digest, country, outcome): 90 days.
• Waitlist addresses: deleted 90 days after the waitlist closed.
• Application log lines: weeks, by rotation.
• Activity and demo counters: kept, because they contain nothing about a person.
• Letters in your family mailbox: as long as your family keeps them. Any adult can delete a letter, and the administrator can set an age (three months to two years) after which letters are removed on their own; by default nothing is removed.
• Your family's address after deletion: the subdomain is held for a year so that mail and bookmarks addressed to your family do not land with a stranger, then it may be given to someone else. The record that a family existed stays, with the billing identifiers accounting requires, and without the founder's e-mail.

What we deliberately don't do

• No analytics scripts, no trackers, no advertising — on this site or in the app. That's why there is no cookie banner: the only cookies are the ones that keep you signed in (and, on this site, the one that remembers your language). The single exception is the checkout page, which loads Paddle's own script to take the payment — that page says so.
• No email open or click tracking, and no newsletters or product mail you didn't ask for. Mail your family receives is not inspected beyond automated spam and size limits — and when you read it, remote images in it are never loaded, so a sender does not learn that you opened their letter.
• No selling or sharing of data with anyone, for any purpose. There is no version of Neiliro's business that involves your data being the product.

Who can read your family's content

Since September 10, 2026: not us. Everything your family writes — the text of notes, the names of events, tasks, accounts, categories and lists, the notes on transactions, the names and contents of files, the letters received at your family's address — is encrypted in your browser with a key that never reaches our servers. What we store is ciphertext and the key's sealed envelopes: one per member, opened by that member's password, and one opened by a recovery code the app shows your family exactly once. Invitations and re-admission links carry the key in the part of the address after the # sign, which browsers never send to any server. Neither we nor anyone who takes our disks or backups can open any of it. The design and the code are public — the decision record and the tracking issue.

What stays readable, and why. Dates, amounts, currencies, statuses and the links between records — that an event exists and when, that a payment was made and how much, which note a file belongs to — stay in the clear, because that is what lets the server add up a budget, repeat an event or send a reminder. Members' names and login addresses are readable, since they identify accounts, and so a birthday reminder carries a readable name. A file's size and type are readable; its name and its bytes are not. A letter keeps its arrival time, size and Message-ID readable, the last because threading needs it; the sender, subject, body and attachments are sealed. Wishlists are readable on purpose: they exist to be shown to people outside the family, and the wishlist page says so.

Four places where our server does see words. We would rather list them than leave you to find out:

• Mail arriving at your family's address reaches our server as plain text — that is how email works. The server seals it to your family's public key before writing anything; the plain text exists in the server's memory for milliseconds and is never stored or logged.
• A reply to such a letter is written in your browser but sent by our server, which therefore sees that text at the moment of sending. The stored copy is sealed like an incoming letter, and the reply box says so.
• Links that carry the key. A calendar subscription, a link to one event and a guest link to a shared list carry your family's key after the token, because a calendar app and a guest need words. When such a link is opened, our server uses the key to open those rows for that request only; it does not store the key and does not write it to a log. This also means the link is exactly as private as whoever holds it: hand your calendar subscription to Google Calendar and Google holds a key that opens your family's content, not just the feed. Any of these links can be revoked with one button in the app.
• Rows written before the key. Content created before your family's key existed stays stored as it was until a member runs "Encrypt what was written before the key" under Settings → Family key — once per member, because private rows are visible only to their owner. For those rows, "we do not read it" means what it always did: we don't.

What this does not protect against. The key is only as safe as the passwords and devices that hold it; a device without the key sees placeholders instead of words, which is the point. A password reset restores your account, not the key — a new password cannot open an envelope the old one sealed — so keep the recovery code, or ask another member for a re-admission link. No web application can protect you from an operator who serves a tampered copy of the app itself; what protects you there is that the code is open and the build can be checked against it. And we say "encrypted with a key we do not hold", never "zero knowledge": the shape of your data — how much, when, how often — is visible to us, and the words that are not are listed above.

Email the service sends you

Five kinds of letter, all from a no-reply address on our own mail domain, and nothing else — no newsletters, no product announcements, no "we miss you":

• the invitation to set up a newly created family, sent to the administrator's address once, when we create the family;
• a request to confirm the address an account signs in with, when the account is created;
• the link that resets a forgotten password, only when someone asks for it;
• a notice that this policy or the terms are about to change, sent to your family's administrator before the change takes effect, and only when something material changes;
• letters about your family's plan, to the administrator: a week and a day before the free period ends, when the hub becomes read-only, and a week before data is removed — each once. Receipts come from Paddle, not from us.

Every letter comes as plain text and, from September 2026, also as a laid-out version with the same words. Neither contains images, fonts, scripts or anything else that would make your mail program fetch something from a server when you open it — an open receipt by another name — and our mail provider is told not to rewrite links or add tracking pixels.

We ask you to confirm the address because it is the key to recovering an account: a typo at signup would otherwise hand a stranger a working way into your family. A reset link is only ever mailed to a confirmed address, is single-use, and does not switch off two-factor authentication. Because a reset request must not reveal whether an address has an account here, the page says the same thing either way.

Signing in with Google

Google sign-in is optional and stays off until you link it yourself from settings. When you use it we ask Google for the minimum — that the sign-in happened, and which address it belongs to — and keep only Google's identifier for your account. We get no access to your Gmail, Drive, contacts, or anything else in your Google account, and Google is told nothing about what is inside your family's hub. Google does, of course, see that you signed in to Neiliro; if you'd rather they didn't, use a password — that path is always available.

Where your data lives

Your family's hub runs in the European Union, on DigitalOcean servers in Amsterdam, Netherlands. Each family's data is a separate, isolated database. Backups are encrypted with a key that never touches the server; two days' worth stay on that server and fourteen days' worth in Cloudflare's object storage in the European Union, after which they expire. The words inside them are already ciphertext from your browser. The server disk itself is not encrypted today.

Two things are not in Amsterdam, and we would rather say so than let "in the EU" do more work than it should. This website, including the sign-up and support forms and their small database, runs on Cloudflare's network, which answers from wherever you are; what those forms hold is listed above, and Cloudflare handles it under its customer data processing agreement with the EU's standard contractual clauses. And the operator administers the service from Serbia, which is outside the EU and has no adequacy decision — over an encrypted connection to servers that stay in the EU; the key that opens backups is his alone, and your family's words inside them are ciphertext under a key he does not hold. This resolves when the operator relocates to the EU, and the policy will say so when it does.

We rely on four providers (our only subprocessors):

• DigitalOcean — servers (Amsterdam, EU)
• Cloudflare — DNS, this website, the sign-up and support forms and their database, and the encrypted backup archives (object storage, EU)
• Mailgun (EU region) — receiving and sending email for your family's address, plus the service letters above, processed and stored in the EU
• Paddle (Paddle.com Market Ltd, London) — payments: Paddle is the merchant of record for the subscription, so the card, the receipt and the tax are its business under its own privacy policy; we receive the fact and the identifiers named above

Your rights — built in, not on request

• Export: download your family's complete archive from settings, anytime, free, on any plan. It restores into a self-hosted Neiliro — leaving is always possible, by design.
• Deletion: deleting your family removes its database and files; backups expire within 14 days after that.
• Correction: everything is editable in the app.
• Your own copy: Settings → My data gives every member a readable file of everything their account can see, opened in the browser — the right to access and portability, exercised without asking anyone.
• Leaving: a member can delete their own account (Settings → My data), and the administrator can remove one (Settings → People). Everything only that person could see is deleted — private notes, personal calendars and accounts, the profile, sessions and key; what they added to shared spaces stays with the family without their name.
• For anything else GDPR grants you — restriction, objection, a question about this policy — write to [email protected]; we answer within a month. You can also complain to the data protection authority of the country you live in, without asking us first.

Children

Neiliro is made for households, and family spaces are created and managed by an adult administrator. A child has an account only when a parent or guardian creates it inside their own family; that is the consent the law asks for, and the parent can see, correct and remove the account at any time. A child then uses the hub like any member — signs in, gets a session, writes on the shared board — and nothing about them is collected beyond what that use requires. The service is not offered to children on their own, and we never knowingly create an account for a child outside a parent's family. The family mailbox is not shown to a child's account: bills, school letters and bookings are addressed to the household, and a child's account is a way to give them their tasks and the shared calendar, not the family's correspondence.

The public demo

The demo at demo.neiliro.com gives every visitor a throwaway sandbox that is deleted when you log out or after two hours of inactivity. We keep anonymous counters about demo visits (how many, which modules were opened, which site sent the visitor, whether on a phone or a desktop) — never who you are or what you typed.

If something goes wrong

If a breach affects your personal data, we will notify you and the relevant authority within 72 hours of discovering it, and tell you plainly what happened and what we're doing about it.

Changes

If this policy changes in any way that matters, we'll email your family's administrator at least 14 days before the change takes effect, and the hub shows the administrator a notice until they dismiss it. Cosmetic edits — typos, links, clearer wording of the same rule — get no notice. The current version always lives at this address; what changed and when is listed here, newest first.

• September 14, 2026 — the legal basis for each kind of processing and how long each is kept, said in their own sections; letters in the family mailbox: not shown to children's accounts, remote images never loaded, an age the administrator can set; the family's address held for a year after deletion; health information in profiles named for what it is; the two places outside Amsterdam (this website on Cloudflare's network, the operator's encrypted backup copy in Serbia); the failed-sign-in lines in the log; a member's own copy and a member's own removal as built-in rights; children's accounts described as they work. Clarifications and new rights, not a change of practice — no notice was sent.
• September 13, 2026 — creating a family from this website; the subscription, with Paddle as merchant of record; the fifth kind of letter (about your family's plan); the refund policy.
• September 10, 2026 — the encryption shipped: what is sealed with the family key, what stays readable, and the four places where words still pass through the server.
• September 9, 2026 — the consent recorded when an account is created, what the per-family activity count holds, the fourth kind of letter (this notice).
• September 5, 2026 — who can read your family's content today, said plainly; backups encrypted with a key that never touches the server.
• August 26, 2026 — account recovery: password reset by e-mail to a confirmed address, confirmation of the login address.
• August 24, 2026 — first published.