Skip to content

Privacy Policy

What personal data Neurolith collects, why and on what legal basis, who processes it, how long it is kept and the rights you have over it.

Last updated October 23, 2026 Download PDF

1Who We Are

1.1 This Privacy Policy explains how the founders who operate Neurolith (together, “Neurolith”, “we”, “us” or “our”) collect, use, share and protect personal data when you use the website at neurolith.app, the Neurolith Discord application, our emails and every related service (the “Service”).

1.2 For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the UK GDPR and similar laws, Neurolith is the controller of the personal data described in this Policy. You can contact us about any privacy matter at contact@neurolith.app. Information about the operator is set out in the Legal Notice (part of the Platform Disclosures).

1.3 This Policy applies to everyone who uses the Service, wherever they live. Section 11 and Section 12 contain additional information for residents of particular regions.

2Personal Data We Collect

2.1 Data you give us. We collect the personal data you provide directly:

  1. Account data: your email address, display name and profile picture, and, if you add them, a short bio and self-declared handles for X, Telegram or other platforms, and your dashboard layout preferences.
  2. Sign-in data from Google or Discord: if you sign in with or link Google, we receive your Google account’s email address, name and profile picture; if you sign in with or link Discord, we receive your Discord user ID, username and avatar. We do not receive your passwords.
  3. Analysis inputs: the contract addresses you analyse and, if you enter them, the amount you hold or invested and your entry market capitalisation.
  4. Tracked wallets: the public blockchain wallet addresses you add to My wallets, the names you give them and the platform you say they come from. We never ask for, and you must never give us, a private key or seed phrase.
  5. Waitlist data: your email address and, if you give it, your Discord username.
  6. Support requests: your name, email address, the topic and the content of messages you send us through the Contact page or by email.
  7. Referral payout data: if you request a referral payout, the blockchain network and wallet address you want it sent to.
  8. Payment data: when paid Plans are available, your billing details are collected directly by our payment processor. We receive your Plan, billing status, the amount, the date and transaction references, but never your full card number.

2.2 Data we collect automatically. When you use the Service we collect:

  1. Session and security data: the IP address and browser user agent used to sign in, session identifiers and timestamps, which keep you signed in and protect your Account.
  2. Usage data: the Calls you run and their results, the time of each, and your daily or monthly usage against your Plan’s limits.
  3. Account standing: your Plan, any roles or extra calls granted to you, when you accepted the Terms, and any suspension, ban or deletion, together with a record of administrative actions taken on your Account and by whom.
  4. Referral data: your referral code, the referral that brought you (if any), visits to your referral link counted with a salted one-way hash instead of the visitor’s identity, and the commissions, credits and payouts on your Account.
  5. Technical data: your IP address is processed briefly to enforce rate limits and prevent abuse, and error reports may include your browser type, the page concerned and a technical description of the error.
  6. Cookies and similar technologies: as described in the Cookie Policy.

2.3 Data from other sources. For wallets you track, we read public transaction data from blockchains and from blockchain data providers. When you use the Neurolith Discord application, we receive your Discord user ID and the commands you run, and we read and manage your roles in the Neurolith server.

2.4 We do not intentionally collect special categories of personal data (such as health, political opinions or biometric data), and you should not send them to us.

3How and Why We Use Personal Data

3.1 We use personal data only for the purposes below. For each, we state the legal basis we rely on under the GDPR:

  1. To provide the Service: creating and securing your Account, signing you in, running Calls, saving your history, tracking your wallets, applying your Plan’s limits, and managing your Discord roles. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
  2. To communicate with you: sending sign-in links, service and security messages, receipts and answers to your requests. Legal basis: performance of a contract, and our legitimate interest in operating the Service (Article 6(1)(f)).
  3. To process payments and run the referral program: billing, crediting referral commissions and sending payouts. Legal basis: performance of a contract, and compliance with legal obligations such as tax and accounting laws (Article 6(1)(c)).
  4. To keep the Service safe: preventing fraud, abuse, spam, attacks and breaches of our Terms, enforcing rate limits and recording administrative actions. Legal basis: our legitimate interests in protecting the Service, our users and ourselves.
  5. To improve the Service: diagnosing errors and measuring how well past Calls matched what happened next. This evaluation uses market data and the Calls themselves, not your identity. Legal basis: our legitimate interest in developing a reliable service.
  6. With your consent: setting the optional referral cookie and any other processing for which we ask your consent. You can withdraw consent at any time without affecting processing carried out before. Legal basis: consent (Article 6(1)(a)).
  7. To comply with the law and defend our rights: responding to lawful requests from authorities, keeping records required by law, and establishing, exercising or defending legal claims. Legal basis: legal obligation and legitimate interests.

3.2 Where we rely on legitimate interests, we have balanced those interests against your rights, and you may object as explained in Section 8.

3.3 Providing your email address is necessary to create an Account; without it we cannot provide the Service. Everything else you provide is optional.

4Automated Analysis

4.1 Calls are produced automatically from market and blockchain data about Crypto-assets. They are statements about assets, not decisions about you, and they do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. We do not use automated decision-making or profiling to make decisions about your Account, other than automated rate limiting and abuse prevention, which a person reviews on request.

5How We Share Personal Data

5.1 We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share personal data only as follows:

  1. Service providers (processors) that host, store, secure and deliver the Service on our behalf, under written terms that require them to protect it and to use it only on our instructions. They are Microsoft Azure (hosting, Belgium), Supabase (database, Germany), Upstash (short-lived caching), Cloudflare (network security), GitHub (deployments and backups), Brevo (email, France), Sentry (error monitoring, European Union) and, when paid Plans are available, Stripe (payments). A full list with each provider’s purpose and location is available on request at contact@neurolith.app.
  2. Platforms you choose to connect, such as Google and Discord, which receive information when you sign in with them or use the Discord application, under their own privacy policies.
  3. Data and AI providers, which receive the contract address and market data being analysed, and the public wallet addresses you track when we read their transactions. We do not send them your name, email address or other account details.
  4. Other users, only where you choose to share: a shared Call or profit-and-loss picture shows what you chose to share and your referral code, never your email address or a wallet address.
  5. Authorities and legal process, where required by law, court order or a binding request, or where necessary to protect the rights, property or safety of Neurolith, our users or others.
  6. A successor, if the Service or its assets are transferred to a company formed to operate it or in a merger, acquisition or sale, in which case this Policy will continue to apply to your data or you will be informed of any change.

6International Transfers

6.1 Our main database and hosting are located in the European Union. Some service providers, such as Discord, Google, Cloudflare and GitHub, are based in or process data in the United States or other countries outside the European Economic Area.

6.2 Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with additional safeguards where needed. You can ask us for more information about these safeguards at contact@neurolith.app.

7How Long We Keep Personal Data

7.1 We keep personal data only for as long as necessary for the purposes described in this Policy:

  1. Account, history, wallets and profile: while your Account exists. When you delete your Account, or we close it, it is closed immediately and kept for 60 days so that you can restore it by signing in again. After 60 days it is permanently erased, and your email address is removed from the records of past Calls and administrative actions.
  2. Sign-in sessions: up to 30 days after your last activity on that session.
  3. Rate-limit data: a few minutes to a day, in a short-lived cache.
  4. Waitlist entries: until you join the Service, ask us to remove you, or the waitlist closes.
  5. Support requests: up to 3 years after the request is closed, to handle follow-ups and legal claims.
  6. Payment, referral and payout records: as long as tax, accounting and anti-fraud laws require, generally up to 10 years.
  7. Database backups: up to 30 days, after which they are deleted on a rolling basis.
  8. Anonymous data: records of Calls and market outcomes that do not identify you may be kept indefinitely to improve the Service.

8Your Rights

8.1 Depending on where you live, you may have the right to:

  1. access the personal data we hold about you and receive a copy;
  2. rectify inaccurate or incomplete data;
  3. erase your data (you can also delete your Account yourself from your dashboard at any time);
  4. restrict our processing of your data in certain circumstances;
  5. receive your data in a portable format and have it transmitted to another controller;
  6. object at any time to processing based on our legitimate interests, and to any direct marketing;
  7. withdraw your consent at any time, without affecting earlier processing; and
  8. lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

8.2 To exercise a right, email contact@neurolith.app from the email address of your Account. We may need to verify your identity before acting on a request. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you. We do not charge for requests unless they are manifestly unfounded or excessive.

9Security

9.1 We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, row-level security on our database, single-use sign-in links that expire after 15 minutes instead of passwords, an authenticator app for administrative access, rate limits and monitoring. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet.

9.2 If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it where required, and we will inform you without undue delay where the breach is likely to result in a high risk.

10Children

10.1 The Service is intended only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at contact@neurolith.app and we will delete it.

11Additional Information for the European Union, EEA and United Kingdom

11.1 If you live in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR applies to our processing of your personal data, together with the national laws that supplement it. The rights in Section 8 are your rights under those laws.

11.2 You may lodge a complaint with the supervisory authority of the Member State where you live, work or where an alleged infringement took place, or, in the United Kingdom, with the Information Commissioner’s Office. We would appreciate the chance to address your concern first, so please contact us before you do.

12Additional Information for the United States

12.1 If you live in a U.S. state with a comprehensive consumer privacy law, such as California, Colorado, Connecticut, Virginia or Utah, you have the rights that law gives you, which may include the right to know what personal information we collect, use and disclose; to access and obtain a copy of it; to correct and delete it; to opt out of its sale, sharing for targeted advertising or use for profiling with significant effects; and not to be discriminated against for exercising these rights.

12.2 In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in Section 3, and disclosed them to the categories of recipients described in Section 5: identifiers (such as email address, user IDs and IP address); customer records (such as name and billing status); commercial information (such as Plans purchased); internet or other electronic network activity (such as usage data and session data); and inferences limited to your usage against Plan limits. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

12.3 We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. Because we do not sell or share personal information, we treat Global Privacy Control signals as a confirmation of that choice.

12.4 You may exercise your rights by emailing contact@neurolith.app. You may use an authorised agent, who must provide proof of your authorisation, and we may ask you to verify your identity directly. If we deny your request, you may appeal by replying to our decision; if we deny your appeal, you may contact your state’s Attorney General.

13Changes to This Policy

13.1 We may update this Privacy Policy from time to time. The effective date shows when it last changed. If we make a material change, we will tell you in advance by email, on the website or in our Discord server.

14Contact

14.1 For any question about this Policy or our handling of your personal data, or to exercise your rights, contact us at contact@neurolith.app.

Cookie Policy

15About This Policy

15.1 This Cookie Policy explains how Neurolith uses cookies and similar technologies on neurolith.app and its subdomains. It supplements the Privacy Policy.

15.2 A cookie is a small text file that a website stores in your browser. Local storage and session storage are similar technologies that keep information in your browser; session storage is cleared when you close the tab.

15.3 We do not use advertising cookies, and we do not use cookies to track you across other websites.

16Strictly Necessary Cookies

16.1 These cookies are needed for the Service to work and to keep it secure. Under the EU ePrivacy rules and equivalent laws they do not require your consent, and they cannot be switched off in the Service:

  1. better-auth.session_token: keeps you signed in. Set when you sign in; lasts up to 30 days.
  2. better-auth.session_data: a signed copy of your session that saves a database lookup on each page. Lasts 5 minutes.
  3. Other better-auth cookies: short-lived cookies that protect the sign-in flow with Google or Discord against forgery. Deleted when sign-in completes or within minutes.
  4. nl_consent: remembers your cookie choice so we do not ask again. Lasts 1 year.
  5. __cf_bm and similar cookies set by Cloudflare: our network provider uses them to tell people from automated abuse and to block attacks. Last up to 30 minutes.

17Optional Cookie

17.1 We set one optional cookie, and only if you select Accept all:

  1. nl_ref: when you open someone’s invitation or a shared link that carries their referral code, this cookie remembers the code so that the person who invited you is credited when you create an Account, under the Referral Program Terms (part of the Terms of Service). Lasts 30 days.

17.2 If you select Essential only, this cookie is not set, and any existing referral cookie is removed.

18Browser Storage

18.1 We store a few preferences in your browser’s local or session storage. They stay on your device and are not sent to us:

  1. your colour theme and the units you last chose;
  2. the Call you last opened, in that tab only, so that refreshing the page does not use another Call; and
  3. small technical markers, such as your scroll position and when your wallets were last refreshed.

19Analytics

19.1 We may measure visits and page performance with privacy-focused analytics that do not use cookies, do not identify you and do not follow you across other websites. We do not use Google Analytics or advertising pixels.

20Your Choices

20.1 On your first visit you choose Accept all or Essential only. You can change your choice at any time with Cookie settings at the bottom of every page.

20.2 You can also block or delete cookies in your browser’s settings. If you block strictly necessary cookies, you will not be able to sign in.

21Changes and Contact

21.1 We will update this Policy if we change the cookies we use; the effective date shows when it last changed. Questions can be sent to contact@neurolith.app.