Privacy
Privacy at NeyLivo
Not a legal document written to be unreadable. This is a list of every kind of data NeyLivo touches, why it exists, and who can reach it.
Last updated: August 12, 2026
The short version
- NeyLivo has no analytics, no crash reporting service and no advertising code. Nothing counts you.
- To register you need an email address and a password. Nothing else is required.
- Your messages and files are stored so the app can show them to you on any device. One-to-one direct messages can be end-to-end encrypted, and then the server holds ciphertext it cannot read.
- Attachments sent without attachment encryption are in public storage today and can be downloaded by anyone with the link. This is the project’s most serious open issue and it is listed as such.
- This website sets no cookies, loads no fonts or scripts from other servers, and does not measure your visit in any way.
Data, item by item
Scroll sideways on a phone.
| Data | Collected | Purpose | Retention | Who can access it |
|---|---|---|---|---|
| Email address | Yes | Registration, sign-in, password reset | Until you delete your account | You and the authentication service. Other users never see it. |
| Password | Yes, as a hash | Sign-in | Until changed or the account is deleted | Nobody. Stored as a bcrypt hash by Supabase Auth; NeyLivo writes no password storage of its own. |
| Username and display name | Yes | So people can find and recognise you | Until you delete your account | Anyone who can see you in a conversation or a server. |
| Profile details you add | Only what you enter | Your profile card: avatar, banner, colours, pronouns, about text, favourite games | Until you remove them or delete the account | Other users, according to the privacy settings you choose. |
| Messages | Yes | To deliver them and show your history on every device | Until deleted by you, or by a moderator in a server | You and the recipients. With end-to-end encryption on, one-to-one messages are ciphertext the server cannot read. Group chats and server channels are readable by the database operator. |
| Attachments and avatars | Yes | To deliver files you send | Until deleted | Currently: anyone with the link, without signing in — storage is public. With attachment encryption on, the file is encrypted before upload and useless without the key. |
| Calls | Metadata only | To place the call and show it in the conversation | The call record (who, when, how long) stays in the conversation; the media is not recorded | Participants. Media passes through the LiveKit server, which can decrypt it unless call encryption is on. |
| Contacts and friends | Yes | Friend list, blocking, who may call you | Until you remove them | You. Your friend list is not published to other users. |
| IP address | Not stored by NeyLivo | Unavoidable for any network connection | Whatever the infrastructure providers keep in their own logs | The services listed below, as part of serving the request. NeyLivo has no table of IP addresses. |
| Device information | Minimal | Trusted devices: a random identifier the app generates, a label you can set, and when it was last seen | Until you remove the device | You only. It is a random value and says nothing about your hardware. |
| Analytics | None | — | — | There is no analytics system in the app. Not a self-hosted one either. |
| Crash reports | Not sent anywhere | Diagnosing an error you hit | On your device only, until cleared | You. Errors are written to local storage, not uploaded. |
| Location | Never | — | — | The app does not ask for location and does not use it. |
| Cookies | None | The app keeps your session in local storage, not in cookies. This website sets no cookies at all. | — | — |
| Push notifications | Only if you allow them | Notifying you when the app is closed | Until you turn notifications off | The subscription is stored so the server can deliver a notification; the push service of your browser or phone delivers it. |
| Music listening | Yes, inside the app | Play counts and building your personal queue | Until the track or the account is removed | Total play counts are visible to everyone in the library; your personal listening history is yours and is not shown to others. |
Third parties
NeyLivo is not self-hosted. These services take part in making it work, and each of them at minimum sees the IP address of the device that connects to it.
| Service | What it does | When it is contacted |
|---|---|---|
| Supabase | Database, accounts, file storage, realtime connection | Constantly, while the app is open |
| LiveKit | Voice, video and screen sharing | During a call |
| jsDelivr (CDN) | Emoji images | Always, without any action from you — because the interface contains emoji. Bundling them locally is planned. |
| Tenor (Google) | GIF search | When you open the GIF panel |
| lrclib.net | Song lyrics | When lyrics are requested for a track |
| Audius, SoundCloud, YouTube | Playing music added by link | When such a track is added or played |
| Deezer, iTunes | Track metadata and cover art | When searching for a track |
| SteamGridDB | Game cover art | When game activity is displayed |
| OpenDota | Dota 2 statistics | Only if you request them in a profile |
| Hugging Face | Downloading a speech recognition model | Only when you press the button that needs it |
| GitHub | Checking for and downloading updates | On an update check |
| Render | The emergency chat | Only when the main backend has been unreachable for a while |
The app does not load fonts from a font CDN: they are bundled, specifically so that starting NeyLivo does not report your IP address to a third party before you have even signed in.
Plugins and your data
A plugin can only reach what its permissions allow, and you see that list before installing. But a plugin with the “send messages” permission really can send messages as you, and a plugin with network permission really can send data to the domains it declared. That is the point of the permission screen: an installed plugin acts with your hands.
Plugins cannot read your session, your password or your encryption keys — the browser does not give them access to any of those.
What you control
- Turn on end-to-end encryption for messages, attachments and calls
- Choose who may send you a friend request, who may write to you and who may call you
- Block a person, so nothing gets through in either direction
- Delete individual messages, or your entire account with its data, from inside the app
- Turn off notifications entirely, or per server and per channel
- Turn off screen capture protection, blurred messages, presence and activity status
This website
The site you are reading is static HTML on GitHub Pages. It sets no cookies, contains no analytics, embeds nothing from other servers, and loads no external fonts or scripts. GitHub, which serves the pages, sees the request itself — that is unavoidable for any hosted site.
Changes
When this page changes in a way that matters, the date at the top changes with it. The page is generated from the repository, so its history is public along with everything else.
For the technical detail behind these answers, see the security page.