Privacy Policy

1. Who we are

Neurix Reader ("the Service") is operated by Code Highland ("we", "us", "our"). We are the data controller for the personal information processed through the Service.

For any privacy question or to exercise your rights, contact us at [email protected].

2. What data we collect

• Account data: your email address and a securely hashed (bcrypt) password. Passwords are never stored in plain text. We also store your email-confirmation status and temporary email-confirmation and password-reset tokens.

• Uploaded documents: PDF files you upload are stored in per-user isolated storage on Google Cloud Storage so we can provide the reading and note-generation features. Your files are not accessible to other users and are deleted automatically when you upload a new document.

• Document content sent for AI processing: when you generate notes, the text (and, for scanned pages, the page images) of the page range you select is transmitted to third-party AI providers to produce the notes (see Section 5).

• Subscription & billing data: your plan/tier, subscription status, and identifiers provided by our payment provider, Lemon Squeezy. We do not receive or store your full card or bank details.

• Usage & security data: counts of notes generated, remaining free credits, rate-limit timestamps, and audit-log records (the action taken, the time, the document identifier, the page range, and which AI model was used). We use this to operate the Service, enforce plan limits, and prevent abuse.

• Analytics data (only with your consent): if you accept analytics cookies, Google Analytics 4 collects anonymised usage data such as pages viewed, session duration, and device/browser type, with an anonymised IP address.

• Data stored in your browser: your sign-in token, your personal section annotations, and your library/upload history are stored locally on your device, along with your cookie-consent choice. This data stays on your device.

• Server logs: standard HTTP request logs (anonymised IP, timestamp, endpoint) retained for a short period for security and debugging.

3. How we use your data

• To create and manage your account and authenticate you.

• To provide the reading and AI note-generation features on the documents you upload.

• To manage your subscription, enforce plan limits, and process billing through our payment provider.

• To send transactional emails (email confirmation, password reset, and account notices).

• To detect, prevent, and investigate fraud, abuse, and security issues.

• To understand aggregate usage and improve the product (analytics, only with consent).

We do not sell or rent your personal data, and we do not share it for third-party marketing.

4. Legal bases for processing (UK/EU GDPR)

• Performance of a contract: account data, document processing, and subscription management to deliver the Service you signed up for.

• Consent: analytics cookies and analytics data are processed only after you opt in; you can withdraw consent at any time.

• Legitimate interests: keeping the Service secure and preventing abuse.

• Legal obligation: retaining limited transaction records as required for tax and accounting (handled with our payment provider).

5. AI processing of your documents

To generate study notes, the content of the pages you select is transmitted to third-party AI providers, which process it and return the notes. Which provider is used depends on your plan, the language you choose, and whether the pages are text or scanned images. The providers we use are Anthropic, OpenAI, Google (Vertex AI), GitHub Models, and OpenRouter. Where a request is routed through OpenRouter, it is fulfilled by one of its upstream model providers.

We do not use your documents to train AI models, and each provider processes the content under its own API terms.

Generated notes are stored on our servers, associated with your account, so that reopening a section does not re-run the AI or use your daily allowance. They are deleted when the document they belong to is removed, and when you delete your account. See Section 9.

These AI providers may process data outside the UK and EU (including in the United States); see Section 8.

6. Payments

Payments and subscription billing are handled by Lemon Squeezy, which acts as the Merchant of Record for your purchase. Lemon Squeezy collects and processes your payment information under its own privacy policy and terms.

We receive only limited information from Lemon Squeezy, such as your email, subscription status, and customer/subscription identifiers. We never see your full card details.

7. Third-party processors

We share the minimum data necessary with the following categories of providers, each under appropriate data-protection terms:

• Google Cloud Platform — hosting, database (Firestore), and document storage.

• Anthropic, OpenAI, Google (Vertex AI), GitHub Models, and OpenRouter — AI processing of the document content you choose to summarise. OpenRouter forwards the request to one of its upstream model providers.

• Cloudflare — content delivery and protection for our website; it also tells us the country a request comes from, which we use only to display prices in your local currency.

• Lemon Squeezy — payment processing and subscription billing (Merchant of Record).

• Google Analytics — product analytics (only with your consent).

• Email delivery provider — sending transactional emails.

8. International transfers

Some of our providers (including US-based AI providers and our payment provider) may process your data outside the UK and EU. Where this happens, transfers are protected by appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

9. Data retention

• Account data: retained until you delete your account or request erasure.

• Uploaded PDFs: your plan sets how many documents your library keeps (one on the free plan, more on paid plans). When you go over that number, the least recently read document is removed automatically, together with its notes. You can also delete any document yourself at any time, which removes the PDF and its notes immediately.

• Generated notes: stored with the document they belong to, and deleted when that document is removed or when you delete your account.

• Usage & audit logs: retained for a limited period for security and support.

• Analytics data: governed by Google Analytics retention settings (default up to 14 months).

• Server logs: a short retention period (around 30 days).

10. Cookies & local storage

• Strictly necessary: a sign-in token is stored in your browser to keep you logged in. This is essential and does not require consent.

• Analytics (optional): Google Analytics 4 sets cookies (e.g. _ga, _ga_*) only after you accept analytics in the cookie banner. You can withdraw consent at any time from the privacy controls in the app.

11. Your rights

Under UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interests, and to withdraw consent for analytics.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

12. Supervisory authority

UK users may complain to the Information Commissioner’s Office (ICO) at ico.org.uk. EU users may contact the data protection authority in their country of residence.

13. Children

The Service is not directed at children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the app, and the "Last updated" date above reflects the latest revision.