Privacy

This page is a translation. The Spanish version is the official one: if they differ in any way, the Spanish version prevails. Read it in Spanish

Last updated: October 19, 2026.

At neografo we process the data we need to run the community and keep it safe, and nothing more. We don't sell data, there is no advertising and we don't use third-party trackers. Here we explain, with no fine print, what we store, why, for how long and what you can do about it.

Who is responsible

neografo.com. For anything about your data, write to info@neografo.com.

What data we process and why

Your account

• What you give us when you sign up: email, display name, username and password (stored encrypted: no one can read it, not even the team).
• What you add if you want: profile photo, bio, signature, favorite styles and two-factor authentication.
• Your preferences: light or dark theme, site language, languages of the topics you want to see, time zone, which notifications you get by email and who sees your stuff.
• Your activity in the community: ink, level, badges, streak, who you follow, your friends, your saved items and collections, and the last time you were online.

Why: to give you an account and make the community work. Legal basis: the terms of use, which you accept when you create your account (Art. 6(1)(b) GDPR).

What you post

Your pieces, questions, tutorials, resources, comments, public collections and your profile (name, @username, photo, bio, level and badges) are seen by the community. Also, right now anyone can see them without an account, and search engines can show them. In Settings → “Who sees your stuff” you can keep your profile and your posts for people with an account only (your comments on other people's posts will be shown without your name) and choose whether you appear in “Who's online?”.

Photos you upload are re-encoded when we save them: all their metadata is lost, including GPS location and camera model. If the watermark is turned on, photos of pieces show your @username. Resource PDFs are stored as they are: check their properties before uploading them.

Your email is always private. It doesn't appear on your profile or anywhere on the site, the community and moderators don't see it, and we don't give it to anyone. We only use it to write to you, and only the admins see it, to manage your account. That's also why you can't use an email as your display name. Legal basis: the terms of use (Art. 6(1)(b) GDPR).

Private messages

If private messages are turned on, we store your conversations so that you and the other person can read them. No one on the team can open them. Only if someone reports a message, moderators see that message and the five before it in the conversation, to understand the context. Email notifications don't include the text, only who wrote to you. Deleting a conversation removes it from your inbox; the other person keeps their copy. In Settings → “Who sees your stuff” you choose whether you receive them from the whole community, only from your friends, or from no one. Legal basis: the terms of use (Art. 6(1)(b) GDPR).

Emails

We email you about what your account needs (confirming your email, changing your password, security alerts, moderation decisions about your posts) and, if you have it turned on, about activity (comments, replies, mentions…), at most 10 per hour. Every notification email has a one-click unsubscribe link, and in Settings → “Email notifications” you choose which ones you get. No newsletters, no advertising.

Moderation

If you report something, we store the report and the reason; we never tell anyone who reported them. If the team removes something of yours, we store the decision and the reason, explain it to you, and you can appeal. Legal basis: the terms of use and our legitimate interest in keeping the community safe and in line with its rules (Art. 6(1)(b) and 6(1)(f) GDPR).

If you send a suggestion to the team, we store what you write, what it is about, the page you sent it from, its status and the team's reply. Only the admin team can see it (with your name, never your email). You can see yours in “My suggestions”; they are included in your data file and deleted with your account. Legal basis: the terms of use (Art. 6(1)(b) GDPR).

Security and abuse prevention

To protect accounts and detect abuse we keep an activity log: logins (including failed ones), changes to your account, posts, reports and moderation decisions, with the date, IP address and browser. We also use that log to look for possible cheating with ink (for example, accounts that share a device and give each other ink): the system only flags cases, and a person on the team always decides. Only the admin team can see it. Legal basis: legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

To stop robots we use our own check, which runs in your browser: it doesn't connect to any third-party service.

YouTube videos

Some stories and tutorials include a YouTube video. When you open those pages, your browser downloads the video's preview image from i.ytimg.com, YouTube's (Google's) image server, which therefore receives your IP address and browser data, but not the page you are viewing. Legal basis: our legitimate interest in showing which video it is before you decide to watch it (art. 6.1.f GDPR).

The video itself doesn't load until you click it. Then your browser loads it from youtube-nocookie.com, and YouTube processes that same technical data and what you watch, under its own privacy policy. We don't send it anything else about you. Legal basis: your consent, which you give by clicking the video (art. 6.1.a GDPR).

Vimeo videos

Some stories and tutorials include a Vimeo video. When the text is saved, our server asks Vimeo once for the video's preview image and title, without anyone's data. When you open the page, your browser downloads that image from i.vimeocdn.com, Vimeo's image server, which therefore receives your IP address and browser data, but not the page you are viewing. Legal basis: our legitimate interest in showing which video it is before you decide to watch it (art. 6.1.f GDPR).

The video itself doesn't load until you click it. Then your browser loads it from player.vimeo.com, with Vimeo's option that avoids tracking cookies and visit statistics, and Vimeo processes the technical data needed to play it, under its own privacy policy. Legal basis: your consent, which you give by clicking the video (art. 6.1.a GDPR).

Google Maps

Some stories and tutorials include a Google Maps map or indoor tour. When you open the page, nothing is loaded from Google: you only see our own card. The map loads when you click it, from google.com, and Google then processes your IP address, browser data and what you look at on the map, under its own privacy policy. We don't send it anything else about you. Legal basis: your consent, which you give by clicking the map (art. 6.1.a GDPR).

Google Drive documents

Some stories and tutorials include a document (a PDF, for example) stored on Google Drive. It works like the maps: when you open the page, you only see our own card, with an image of the first page that our server requested from Google when it was published and that we serve ourselves (your browser does not contact Google to show it). The Drive viewer loads when you click it, from drive.google.com. Google then processes your IP address, browser data and, if you are signed in to Google, your account, under its own privacy policy. We don't send it anything else about you. Legal basis: your consent, which you give by clicking the card (art. 6.1.a GDPR).

Waitlist and invitations

If you leave us your email so we can tell you when sign-up opens, we store the email, the language and the dates you left it and confirmed it, and we use it only for that notice. Legal basis: your consent, which you confirm with the link in the email and can withdraw at any time with the unsubscribe link (Art. 6(1)(a) GDPR). If someone on the team invites you, we store your email to send you the invitation.

Usage statistics

We count visits with our own system and without cookies. We don't store your IP or anything that identifies you: everything is added up per page and per day. What we count:

• how many times each page is viewed, and which one is viewed first in the day;
• how people arrive: directly, from a search engine, a social network or another site (only the domain), or from one of our emails (only the type of email, never who received it); and, if the link carries one, the campaign (utm_source, utm_medium, utm_campaign);
• the type of device (phone, tablet or computer), the family of operating system and browser (for example, “Android” and “Chrome”, without versions) and the browser's main language;
• how long the page is in view and, in stories and tutorials, how far it is read (in 25% steps);
• what is searched for in the site's search box, without who searched. In the panel we only see searches made several times.

To count different people in a day, and to know whether someone viewed a single page, we use a code that changes every day and is deleted the next day, so we can't know who you are or follow you from one day to the next. If your browser sends “Do Not Track” (DNT) or “Global Privacy Control”, we don't count you. The totals are kept for 25 months. Our emails carry no tracking pixels: we don't know whether you open them. Legal basis: legitimate interest in knowing how the site is used so we can improve it (Art. 6(1)(f) GDPR).

How long we keep it

• Your account and what you post: as long as you have the account. When you delete it, it's deleted (see below).
• Activity log: 365 days.
• Site notifications (the bell): read ones, 3 months; the rest, at most 1 year.
• “Download my data” file: 7 days after it's ready.
• Waitlist: until you unsubscribe or, at most, 90 days after we tell you sign-up is open. If you don't confirm your email, we delete it after 30 days.
• Sign-up attempts with an email provider we don't accept: we only keep the domain (the part after the @), never the email, and how many times it was tried, to decide whether to accept it. We delete it 365 days after the last attempt.
• Unconfirmed sign-ups: what you type when signing up is kept until you confirm your email; if you don't confirm it within 24 hours, we delete it.
• Invitations not accepted: they expire after 14 days and we delete them 30 days later.

Who we share it with

With no one, for their own purposes: we don't sell or hand over data.

When something visible without an account is posted, we tell search engines its address (IndexNow) so they find it sooner; we only send them the page address, nothing about you.

We will only give data to an authority if a law requires us to.

If you delete your account

You can delete your account whenever you want from Settings → “Delete my account”. When you do, we delete your profile, your pieces, questions, tutorials and resources (with their images and files), your comments, the ink and “helpful” votes you gave, your reports, your suggestions, your sessions and your data file if you had requested one. There are two exceptions, so we don't break other people's conversations:

• A comment of yours that has replies from other people stays empty and without your name.
• Your private messages stay in the other person's conversation, without your name (“Deleted account”).

Activity log entries are deleted when their period ends (365 days).

Your rights

At any time you can ask us to access your data, correct it, delete it, restrict its use, object to it or take it to another service (portability), and withdraw any consent you gave us, without affecting what was done before. You can do many of these things yourself:

• Settings: change your data, your preferences and who sees your stuff.
• Settings → “Your data”: download a copy of everything in one file (access and portability).
• Settings → “Delete my account”: delete it with everything that's yours.
• Any of our emails: unsubscribe with its link.

For anything else, write to info@neografo.com; we'll reply within one month. If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD).

Minors

You must be at least 14 years old to create an account, the age from which Spanish law allows you to give consent yourself. If we learn that an account belongs to someone younger, we will delete it.

Cookies

We only use strictly necessary technical cookies (the session, form protection and, if you choose them, “Remember me”, theme and language), and there is no advertising or third-party tracking, so we don't ask for your permission with a banner. Which ones, what for and for how long, in the cookie policy.

Changes to this policy

If we change something important (what data we process, why or who with), we'll let you know by email before it applies. You'll always see the date of the last update at the top.

← Back