Privacy Policy

Who is responsible

Neek is run from Germany, and its operator is the controller of your personal data under the General Data Protection Regulation (GDPR). Write to hello@neek.io with any question about your data or to use your rights.

Your account

To create and protect your account, Neek stores your email address, your handle and display name, a password hash when you use email and password sign-in, passkeys, two-factor authentication settings and recovery codes, your language and timezone, and the bio, links, avatar, and banner you add to your profile.

For security, Neek stores the IP address and browser of each active session, of devices you trusted for two-factor sign-in, and of every security event, such as a sign-in, a failed attempt, or a password change. It compares a new sign-in with your recent ones and mails you when it comes from a new device or network; that mail names the device and IP address. Your profile shows whether you are online.

What you publish

Neek stores what you publish: posts and articles, pictures, audio, video, polls, replies, quotes, reposts, and reactions, with their drafts and schedules. It also stores whom you follow, block, or mute, your bookmarks and poll votes, and the notifications you get. Neek removes location and camera data from the pictures you upload.

Each post is shown to the audience you choose: everyone, everyone without showing it in feeds and search (unlisted), or your followers. Your profile is public unless you turn it off in your settings. Whom you follow and who follows you is public too, and hidden with your profile. Bookmarks are private, and polls show only how many people voted for each answer.

When a status post contains a link, Neek fetches that page to show a preview and copies its picture. Videos from YouTube, Vimeo, or Twitch in a post load from that provider only after you click them.

Teams, project homepages, and newsletters

Teams store their members and roles, and invitations by email store the invited address until a week after the invitation expires. A team's project homepage lives at its own address on neek.io, such as mygame.neek.io, with its posts, its followers, and public feeds and a sitemap that search engines and feed readers can read.

Anyone can subscribe to a project's newsletter, with or without an account. For subscribers without an account, Neek stores the email address, language, and timezone, and sends a confirmation mail first; sign-ups that are not confirmed within 7 days are deleted. The people who manage a project can download its subscriber list, which shows subscribers without an account by email address and subscribers with an account by handle. Every newsletter has an unsubscribe link. If a mail bounces or is reported as spam, Neek stops sending mail to that address.

Neek also mails you a daily summary of replies, reactions, mentions, new followers, and reposts and quotes of your posts; you can choose what it contains or turn it off in your settings.

The fediverse

You can share your profile with the fediverse, the network of servers such as Mastodon. Sharing is off until you turn it on. While it is on, other servers can look up your profile and your public and unlisted posts, and can show them and keep copies under their own rules. Neek does not yet deliver posts to other servers or receive posts from them. For fediverse statistics, Neek publishes how many accounts it has, how many were active in the last month, and how many posts are shared, without names.

Linked integrations

Linked integrations are used for sign-in and, where enabled, to display or synchronize account details inside Neek. Each provider link can be removed from the linked accounts settings page.

The Steam friends list holds your friends' Steam IDs and since when you are friends.

When you turn on “Post my play sessions” for Steam (it is off by default), Neek asks Steam on a schedule which game your profile shows you playing and how your playtime grows. Each play session is kept as the game, when it started and ended, and how long it lasted, and every session of 10 minutes or more becomes a post on your profile and in your followers' home feeds, showing the game's cover art. You can hide a game from the public feeds: its play posts are then visible only to you. Game names, details, and art come from Neek's own catalog of the games its users played, which Neek fetches from the Steam store; the catalog holds no personal data.

Apps, MCP, and tokens

When you sign in to another app with your Neek account, that app receives your account ID, handle, display name, avatar, language, and time zone, and your email address only when it asks for permission to read it. Neek stores the apps you authorized and their tokens. Apps and MCP clients you connect, and personal access tokens you create, can read and write your posts within the permissions you grant.

Bots

A bot is an account that posts on its own and is marked as a bot. Neek stores who runs it, its instructions, the sources it reads, and a log of its runs. Bots that write with an AI model send their instructions and the new items from their sources to Anthropic, which writes the post; while it writes, it can read the bot's own posts on Neek and look up pages on the web.

Discord channels

A project's managers can connect a channel of their Discord server through the channel's webhook. Neek then sends that channel the project's new public posts: their title, the start of their text, their first picture, the project's name and picture, and a link to the post. Posts that aren't public are never sent. Discord receives them under its own privacy policy. Neek stores the webhook's address encrypted, and when and how its last delivery went.

Reports and moderation

When you report content, Neek stores your report with your account, or with the name and email address you give if you report without one. Reports about child safety can be anonymous. Neek keeps a record of its moderation decisions and the reasons it gave.

Who processes data for Neek

These services process personal data on Neek's behalf, each only for its part of running Neek.

• Hetzner Online GmbH runs Neek's server in Falkenstein, Germany, which holds its database and serves its pages, and keeps its encrypted backups in Hetzner Object Storage in Falkenstein.
• Bunny (BunnyWay d.o.o., Ljubljana, Slovenia) stores pictures, audio, and video in its storage region in Germany and delivers them through its content delivery network, which keeps temporary cached copies at edge locations that can be outside the EU. Your browser loads these files from Bunny, which sees your IP address; when you upload a video, your browser sends it to Bunny directly.
• Scaleway (Scaleway SAS, France) delivers Neek's mails and tells Neek when a mail bounces or is reported as spam.
• Anthropic in the United States writes the posts of bots that use an AI model. Data is transferred to the United States under the EU-U.S. Data Privacy Framework or standard contractual clauses.

Steam data is stored in Germany. Your Steam ID, the Steam profile data, the game and playtime data you choose to sync, and your play sessions are kept in Neek's database on that server at Hetzner Online GmbH in Falkenstein, Germany, and in its encrypted backups in Hetzner Object Storage in Falkenstein. When avatar sync is on, a copy of your Steam avatar is stored at Bunny (BunnyWay d.o.o., Ljubljana, Slovenia) in its storage region in Germany and delivered through Bunny's content delivery network, which keeps temporary cached copies at edge locations that can be outside the EU. Hetzner and Bunny process this data on Neek's behalf.

Steam, Discord, and Twitch are not Neek's processors: when you link them, Neek reads your data from them under their own privacy policies.

Cookies, browser storage, and logs

Neek sets only the cookies it needs to work: a session cookie when you sign in, which lasts until you close your browser or, if you ask Neek to remember you, at most 30 days and ends after 14 days without use; a cookie for 30 days when you trust a device for two-factor sign-in; and a language cookie for a year when you pick a language. Each project homepage has its own session cookie. To make the back button fast, your browser keeps copies of the pages you visited for as long as the tab is open. Neek uses no tracking or advertising cookies and no analytics.

The server logs each request with its address, result, and IP address, for security and to fix errors. Old entries are removed as the log fills up.

Legal bases

Neek processes your data to provide the service you signed up for (Art. 6(1)(b) GDPR): your account, what you publish, teams and projects, linked integrations, apps, and tokens. It keeps security logs, sends sign-in alerts, and handles reports and moderation based on its legitimate interest in a safe service (Art. 6(1)(f) GDPR) and its legal duties as a platform (Art. 6(1)(c) GDPR). Newsletters are sent with your consent (Art. 6(1)(a) GDPR), which you can withdraw with the unsubscribe link at any time. Optional synchronized data and fediverse sharing are processed only when you turn them on, and you can turn them off at any time.

Retention

Your account data and what you publish are kept while your account exists, until you delete them.

• Sessions end after at most 30 days, and trusted devices after 30 days.
• Security events, with their IP address and browser, are deleted after 90 days.
• Accounts whose email address is not confirmed within 14 days are deleted, with their sessions, tokens, and codes.
• Newsletter sign-ups that are not confirmed within 7 days are deleted, and a subscriber without an account is deleted once they have unsubscribed from every newsletter.
• Data exports are deleted after 7 days, and uploads never used in a post after a day.
• Access tokens expire after 15 minutes, refresh tokens after 30 days, and personal access tokens after a year, unless they are revoked first. Expired tokens are deleted 7 days after they expire, revoked ones within an hour, and authorization and device codes a day after they expire.
• Backups are kept for four weeks, so deleted data leaves them within four weeks.

Your data export

You can download a copy of your data from your account settings once a day. Neek mails you a link to a ZIP file that works for 7 days. It contains your account and profile, linked accounts and their synced data, sessions and security events, posts and drafts, reactions, bookmarks, poll votes, notifications, follows, blocks, mutes, teams, projects, newsletter subscriptions, apps and tokens, and your uploaded files. Passwords, keys, and token values are left out.

Deleting posts and your account

When you delete a post, its text and files are removed; an empty placeholder stays so that replies to it still make sense.

When you delete your account, you are signed out everywhere, your tokens are revoked, and the account is deleted after 14 days; signing in before then cancels the deletion. Then Neek deletes your posts and the replies to them, your files, reactions, follows, linked accounts, and newsletter subscriptions, and the projects of teams you own alone; a team you share passes to its next admin or member. Security events lose their IP address and browser and are deleted after 90 days. Moderation records keep the decision without your name, and reports you sent lose your name and email address. Copies that other fediverse servers made are not under Neek's control.

Unlinking integrations

Unlinking an integration removes that linked account record and deletes the cached linked avatar for that provider. Unlinking Twitch also deletes the channel's live state and stops Twitch's notifications about it. Provider-specific synced data that depends on the linked account, such as Steam profile, game, friend, badge, and achievement records, is removed with that linked account. Unlinking Steam, or turning “Post my play sessions” off, also deletes your play sessions and the list of games you hid; play posts already published stay, like any post, until you delete them or your account.

If your current Neek avatar uses the unlinked provider avatar, your account is switched back to your local avatar where available.

Your rights and controls

You may request access, correction, deletion, restriction, portability, or objection where these rights apply under the GDPR, and withdraw any consent you gave. You can also complain to a data protection supervisory authority, in particular the one where you live.

Most of this you can do yourself in your settings: change your profile, email, password, language, and timezone; turn your public profile, fediverse sharing, summary mails, and each integration's synced data on or off; manage sessions, passkeys, two-factor authentication, apps, and tokens; download your data; and delete your account.

Use of Neek is also governed by the Terms of Service.