Privacy policy
Last updated 3 September 2026. Published by NeuraCrypt, for the Signal Studio application and the eeg.studio website.
This is written by the people who built the software, not by a lawyer
It describes accurately what the system does. It has not been reviewed by counsel, and it is not a substitute for your own institution's assessment. If your legal or data protection office needs something in a particular form, ask and we will provide what we can.
The short version
The website only holds what you deliberately put there: your account, what you publish, what you post, and what you install while signed in.
The desktop application
What never leaves your machine
- Your recordings, in any format.
- Your pipeline files and their parameters.
- Results, figures and exports.
- File paths, patient identifiers, channel labels, anything in a header.
- Which cards you use and how often.
This is not a promise about intent; it is a statement about what the
software does. The only network code is in the Python scripts that ship with
it, and you can read them in Resources/scripts/ inside the
installation.
The two requests it makes
| When | To | Carrying |
|---|---|---|
| Once a day at most, to check for updates | eeg.studio | Your version number and platform. No identifier, no account. |
| When you search or install from the marketplace | eeg.studio | Your search terms and the entry you chose. |
Both go through our own domain on Cloudflare. Cloudflare sees the IP address making the request, as any host would; we do not store it against your account.
An extension you install may make its own requests. That is the point of extensions, and it is why each one states which services it contacts on its marketplace page. We review that claim before approving; we cannot guarantee it forever.
The website
| What | Why | How long |
|---|---|---|
| Account identifier, name, email | To sign you in and attribute what you publish | Until you delete the account |
| What you publish | To show it in the marketplace | Until you delete it |
| Forum posts and replies | To hold a conversation | Kept, detached from you on deletion |
| Votes, reviews, installs | Ranking, and the "installed it" marker on reviews | Until you delete the account |
| Notification preferences | To send only what you asked for | Until you change or delete them |
| API tokens | Publishing from a script. Only a SHA-256 is stored, never the token | Until revoked |
Analytics
There are none. No Google Analytics, no advertising pixels, no session recording, no cookies for tracking. The only cookies are the ones that keep you signed in.
If that ever changes, this page changes first, and a banner will ask before anything is set.
Who else touches it
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosting, database (D1), file storage (R2) | See data location |
| Clerk | Sign-in and session management | United States |
| GitHub | Hosting the installers you download | United States |
Nobody else. No data broker, no advertising network, no analytics vendor.
Your rights
Under the GDPR and comparable laws you can see what we hold, correct it, take it with you, and have it deleted. Rather than making you write to us, both are buttons in your account: export everything as JSON, or delete the account.
More detail on the legal basis for each item, and on transfers outside the EU, is on the GDPR page.
Children
The site is not intended for anyone under 16 and we do not knowingly hold an account for one.
Changes
Material changes are announced on the forum before they take effect. The date at the top of this page is the last change of any kind.
Contact
Through the forum, or
privacy@eeg.studio. For security issues use the
disclosure process instead.