Privacy policy

Nevo’s Brain is run by Gitroom LLC, the company behind Postiz (“we”, “us”). This policy covers the website at nevo.md and the MCP server at mcp.nevo.md (together, “the service”).

What we collect

When you visit nevo.md

The website is a static page. It sets no cookies and runs no analytics or advertising scripts; its fonts and videos are served from our own domain. If you pick an agent in “How it works”, your browser remembers that choice in its local storage, on your device only. We never receive it.

Like any web host, our hosting provider records standard request logs (IP address, browser, the page asked for, and the time) to run and protect the servers.

When your agent signs in to the MCP server

• Your email address, and when your account was created.
• A 6-digit sign-in code we email you. It works for 10 minutes.
• Your sign-in session: the IP address and browser it came from, and the access and refresh tokens your agent receives.
• The agent app you connected (for example Claude, ChatGPT or Cursor), as it registers itself: its name, ID and callback address.

When your agent uses the brain

Every call is logged with your account: which tool was used, the search text (up to its first 500 characters), which agent app sent it, and when. Your agent writes these searches, and they can describe your product or project. Don’t let it send passwords, keys or other people’s personal information.

We also use your IP address, in memory and for about a minute, to limit how many requests can be made.

How we use it

• To sign you in and answer your agent’s searches.
• To keep the service working for everyone: rate limits (60 calls a minute per person) and blocking accounts that abuse it.
• To improve the brain. Nevo reads what founders ask to learn which questions it answers poorly and what to add next.
• To send you Nevo’s newsletter (below).

If you are in the EU or UK, our legal bases are: providing the service you asked for (sign-in, answers), our legitimate interests (security, abuse prevention, improving the brain, and the newsletter, which you can stop at any time), and our legal obligations.

The newsletter

Signing in subscribes your email to Nevo’s newsletter, sent through beehiiv. The sign-in page says so before you sign in. Every issue has an unsubscribe link. Unsubscribing doesn’t affect your access to the brain, and signing in again never subscribes you again once you have left.

Who else handles it

We share data only with the providers that run the service for us, and only what each one needs:

Your agent app (Claude, ChatGPT, Cursor and others) sees your searches and the brain’s answers too. It is run by its own company, under its own privacy policy, not ours.

We don’t sell or rent personal information, and we don’t share it for advertising. We disclose it to others only if the law requires it, to protect the service or its users, or as part of a sale or merger of the business, in which case this policy keeps applying to it.

How long we keep it

• Sign-in codes: 10 minutes. Access tokens: one hour; refresh tokens until they expire or are revoked.
• Your account and its search log: until you ask us to delete them.
• The newsletter subscription: until you unsubscribe or ask us to delete it.
• Hosting request logs: for the short period our hosting provider keeps them.

Your rights

Wherever you live, you can ask us to show you what we hold about you, send you a copy, correct it, or delete it, and you can object to how we use it. Email [email protected] from the address you signed in with. We answer within 30 days. Deleting your account removes your email, your sessions, your search log and your newsletter subscription.

If you are in the EU or UK and think we have handled your data wrongly, you can complain to your local data protection authority. California residents: we don’t sell or share personal information as the CCPA defines it.

Where it is stored

Our providers store and process data in the United States and other countries, which may have different data protection laws from yours. For transfers out of the EU and UK we rely on the safeguards our providers offer, such as standard contractual clauses.

Security

Everything travels over HTTPS. There are no passwords to leak: you sign in with a one-time code, tokens are short lived and work only for this MCP server, and only Nevo can read the search logs. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Children

The service is for founders and is not meant for anyone under 16. If you think a child has signed up, email us and we will delete the account.

Changes

If we change this policy, we will update it here and change the date at the top. If a change affects how we use data we already have, we will email you before it takes effect.