Privacy Policy

Who we are

Neutrality is operated by Neutrality Corp ("we", "us"). We are the controller of the personal data described here.

For anything about this policy or your data, contact legal@neutrality.cc. You can also open a support ticket from your dashboard.

The short version

• We collect what we need to run your account, take payments, enforce licences and keep the service secure.
• We only accept crypto payments, so we never handle card details or billing addresses.
• The Neutrality client reads identifiers from your PC's hardware and Windows installation to tie your licence to one device. It does not upload your files, screenshots or browsing history.
• We don't run analytics, advertising or tracking scripts on the website, and we don't sell your data.
• The only cookies we set are ones the site needs to work. See the Cookie Policy.

What we collect

Your account

When you register and use the dashboard we store:

• your username and email address
• your password, stored only as an Argon2 hash and never in plain text
• two-factor details: your TOTP secret if you enable an authenticator app, and short-lived hashes of email codes
• your access request: the use case and organisation you give us, and the reviewer's decision and notes
• account state: registration date, subscription time remaining, invite codes you created or redeemed, and whether the account is banned or staff

The Neutrality client

When you sign in through the client, it reads identifiers built into your PC's hardware and Windows installation and sends them to us. We combine them into a device fingerprint. We also record the IP address and country you connect from, when you last used the client, and a trust score for the device. While a session runs, the client keeps checking in with us so we can confirm the session is genuine.

We use this to bind your licence to one machine, to detect account sharing, resold or stolen accounts and ban evasion, and to handle hardware ID reset requests.

We don't publish the exact list of identifiers, how they're combined or how much each one counts, because that would only help people get around licence enforcement. This doesn't limit your rights: you can ask for a copy of everything we hold about your device at any time (see Your rights).

Payments

We only accept cryptocurrency: Monero (XMR), Bitcoin (BTC) and Litecoin (LTC). We don't take card payments and we don't ask for a billing name or address.

For each payment we keep the amount, date, status and the payment's reference ID. Bitcoin and Litecoin transactions are recorded on public blockchains, which neither we nor anyone else can change or delete. Monero transactions are private by design.

Discord (optional)

If you link Discord, we store your Discord user ID, username and the OAuth tokens Discord issues. We use them to connect your Discord account to your Neutrality account and to add you to our community server. Discord asks you to approve the identify, email, guilds and guilds.join permissions. We don't store your Discord email address or your list of servers.

You can unlink Discord at any time from your dashboard, which deletes your Discord ID, username and tokens.

Support tickets and marketplace

We store the support tickets you open and the messages in them. Staff can add internal notes to a ticket, which you won't see. If you use the marketplace we store the plugins and profiles you create, the licences you buy or receive, and the profile copies you make.

Security logs

To protect the service we keep server logs and rate-limit counters. These can include your IP address, the endpoints you called and when you called them. Rate-limit counters expire automatically after a short window.

Why we use it (legal bases)

Automatic bans

The client's trust score and device checks can ban an account automatically, for example when they detect account sharing or ban evasion. Staff review every automatic ban afterwards, and a ban can also be lifted automatically if later checks clear it.

If you think a ban is wrong, email appeals@neutrality.cc from the address on your account. A staff member will review the decision and tell you the outcome.

Licence enforcement

A licence covers one person on one device. Here's how we protect that:

• Every change is recorded. When the identifiers we see from your device change, we log the change and weigh it. Small changes are expected and handled quietly. Bigger ones lock the licence until you sign in again or staff approve a hardware ID reset.
• No single check decides. We look at the device, the connection and the session together, so changing or hiding one value doesn't make a device look new. We add and change our checks over time without notice.
• Tampering counts against you. Spoofing, masking or randomising hardware identifiers, hiding the device behind a virtual machine, or modifying the client or its traffic lowers the device's trust score. So does signing in from a device that's already banned.
• Bans follow the abuse, not just the account. When we ban for sharing, reselling or ban evasion, we can extend the ban to every account linked to the same device, payment or Discord account.
• We keep the evidence. Records of a ban and what led to it are kept for 12 months, so a fresh account on the same machine doesn't start with a clean slate.

If you've changed hardware for a legitimate reason, open a support ticket and ask for a hardware ID reset before anything locks. If you think we got it wrong, appeal at appeals@neutrality.cc.

Who we share it with

We use these service providers to run Neutrality. They process data only on our instructions:

We only disclose data otherwise if the law requires it, or if we need to protect our rights or someone's safety. We don't sell personal data or share it for advertising.

International transfers

Some of these providers are based in, or store data in, the United States or other countries whose data protection laws may differ from yours. Where the law requires it, we rely on Standard Contractual Clauses or similar safeguards for these transfers.

How long we keep it

• Account data: while your account exists, then deleted within 30 days of you asking us to close it.
• Device identifiers and device history: while your account exists. If the account was banned, we keep the device fingerprint and ban records for 12 months after the ban to stop ban evasion.
• Trust score history: up to 12 months, and most entries much less.
• Payment records: as long as tax and accounting law requires, usually up to 10 years. They're kept even if you close your account.
• Support tickets: 2 years after the ticket is closed.
• Server logs: 30 days.
• Email and reset codes: until they're used or expire, usually within minutes.

Your rights

Depending on where you live, you can ask us to:

• give you a copy of your data (access and portability)
• correct data that's wrong
• delete your data
• restrict or object to how we use it, including uses based on legitimate interests
• withdraw consent, for example by unlinking Discord

To make a request, email legal@neutrality.cc from the address on your account, or open a support ticket. We reply within one month. If we're not able to deal with a request in full, for example because we have to keep payment records, we'll tell you why.

You can also complain to the data protection authority where you live.

Security

Passwords are hashed with Argon2. Sessions are signed tokens in an HTTP-only cookie. Codes and reset tokens are stored only as hashes, and the client talks to us over signed, encrypted channels. No system is perfectly secure, but if a breach affects your data we'll notify you and the relevant authority where the law requires it.

Age

You must be 18 or older to use Neutrality, and we don't knowingly collect data from anyone younger. If you believe someone under 18 has signed up, contact us and we'll delete the account.

Changes

If we change this policy we'll update the date at the top. If a change is significant, we'll also tell you by email or with a notice in the dashboard before it takes effect.