This policy explains what data Neat handles and why. The short version: when you self-host, we receive nothing; when you use hosted Neat, we hold only what is needed to run your graph, and we do not sell your data, use it for advertising, share it to build a profile of you, or use it to train models.
Who we are
neat.is and hosted Neat are operated by legal entity name, registered address ("Neat", "we", "us"). For any privacy question, contact us at contact email.
When you self-host
The Neat software is open source and runs on your own machines. When you self-host, your code, the graph Neat builds, and the telemetry you feed it stay on your infrastructure. We do not receive them, and we cannot see them.
When you use hosted Neat
To run the managed service we hold the following:
- Account: your email address, handled through our authentication provider, Supabase Auth.
- Billing: handled by Stripe. We never see or store your full card number — Stripe processes payments and returns only what we need to manage your subscription (such as its status).
- Project metadata: the names and configuration of the projects you create, stored in our control plane.
- Your graph: the daemon we run for you builds a graph from (a) your source code, read through the Neat GitHub App with contents:read permission, only on the repositories you grant, and (b) the telemetry from the providers you connect. The graph lives in your tenant.
- Provider connections: when you connect a provider, its OAuth refresh tokens are sealed with Google Cloud KMS and are never exposed to your browser.
Google user data
If you connect Google Cloud to hosted Neat, then with your explicit consent we request two read-only Google OAuth scopes: logging.read, to read your Cloud Logging entries, and cloudplatformprojects.readonly, to list your Google Cloud projects.
We use this data for one purpose only: to build your own dependency and observability graph inside your Neat tenant. We do not sell it, do not use it for advertising, do not share it with third parties, and do not use it to train models or any other AI or machine-learning system.
This data is stored in Google Cloud, region europe-west2, encrypted at rest confirm region if any tenant runs elsewhere.
You stay in control: disconnect Google at any time from the Neat console, and revoke Neat’s access at any time at accounts.google.com under your third-party access settings. Deleting the project deletes the graph built from that data.
Neat’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and analytics
This website (neat.is) uses PostHog for product analytics. PostHog sets cookies and records how the site is used — for example, which buttons and commands you click — so we can understand what’s working. By default this runs on PostHog’s US cloud confirm PostHog region: default is us.i.posthog.com.
If you submit an email address through a form on this site (for example, an enterprise enquiry), that email may be associated with your analytics profile so we can follow up. Confirm whether the hosted app and console (app.neat.is) also use analytics, and add it here if so.
Who we share data with
We do not sell your data. We rely on a small set of providers to run the service, each handling only what its job needs: Supabase (authentication), Stripe (billing), Google Cloud (hosting, key management, and the logging data you connect), and PostHog (website analytics). Confirm this is the complete list of subprocessors before publishing.
Retention and your rights
We keep hosted data while your account and projects are active. Deleting a project deletes its graph. State the retention period for account closure and any backups.
You can ask us to access, correct, export, or delete the personal data we hold about you — email contact email and we’ll act on it. Confirm the rights framework that applies (e.g. UK GDPR) and any specifics counsel wants stated.
Changes and contact
If we change this policy we’ll update the effective date above, and note material changes. Questions or requests: contact email.