Privacy policy

Last updated: 3 September 2026.

This page describes how the hosted NeuronPool coordinator handles data. It is a product statement that matches the code in this repository, not a substitute for counsel-reviewed contracts. The operator is Danny Mota. The live hosted origin is https://neuronpool.damnknee.workers.dev (and https://api.neuronpool.dev when that hostname resolves). Self-hosted operators run their own coordinator and are not covered by this notice unless they publish their own.

Related: Terms, Data retention.

Prompts and completions

Buyer prompts and model completions are sealed between the coordinator and the serving host (X25519 ECDH → HKDF-SHA256 → XChaCha20-Poly1305, a fresh ephemeral key per job). D1 and the Durable Object job hub store ciphertext only. Usage token counts stay plaintext so we can meter.

We do not log prompt or response bodies. Audit events strip those fields. API keys and host tokens are stored as hashes, not as secrets in logs.

Prompts and responses are not used for training. We do not train on prompts, completions, or host outputs. There is no training pipeline. Hosts infer locally; they do not ship prompt bodies back to NeuronPool for model training.

Where plaintext still exists

Sealing is not operator-blind inference.

• Buyer edge. The waiting Worker isolate decrypts sealed chunks just before writing SSE or JSON to the buyer, then drops the per-job ephemeral key. A compromised coordinator process can see that plaintext. Persisted coordinator storage cannot.
• The serving host. After the agent opens the sealed lease, the prompt is plaintext in that process. Anyone with a root or admin shell on the machine can read it.

What hosts can see, by trust tier

This table matches the implemented trust contract. It is not marketing.

Tier	What a buyer can rely on	Can the host operator read the prompt?
none	Heartbeat liveness. Pool and self only; not public.	Yes. No binary-integrity or confidentiality claim.
software	The agent binary matches a publicly verifiable blessed hash, as of the last challenge. Default public floor.	Yes. Sealing stops at the agent process. True on Linux and Windows today. Also true on macOS: the PT_DENY_ATTACH shim blocks debugger attach when the signed launcher armed it; it is not a TEE. Root can still read memory.
edr	Same as software, plus an org-controlled EDR sensor agrees the device is in the fleet.	Yes. EDR is not a TEE. Root can still read memory.
hardware	Nothing today. X-NeuronPool-Min-Trust: hardware returns 503.	Not granted. Reserved for a future TPM / confidential-compute path.

Treat software as “blessed agent, hostile operator.” If you need operator-blind inference, wait for hardware or send the job to machines you already trust (self or a tenant pool) and accept that the hosted Worker edge still decrypts.

Public-marketplace hosts are independent third parties, not NeuronPool subprocessors of the prompt. Tenant-pool hosts are processors of the customer who enrolled them. Social / friends-pool members should assume the serving friend can read the job.

What the coordinator stores

When you create an account or call the API we keep:

• Account email, password hash, session cookie, API key ids and hashes, host public keys, org membership, pool membership.
• Job metadata: job id, model, token counts, timestamps, status, host pseudonym, trust tier, pool id, billable flag. Not prompt bodies.
• Ledger rows, invoices, Stripe customer / Connect ids, USDC deposit references when you use those rails.
• Hash-chained audit_log of security-relevant mutations (no prompt fields).
• Optional EDR device ids and sealed vendor credentials for orgs that enable that feature.
• Host telemetry (opt-in, default off). If a host runs neuronpool telemetry on, the agent may POST crash reports and anonymous runner stats (OS, runner, model family, ttft/tps) to POST /v1/telemetry. Prompts, emails, hostnames, and host tokens are never included. See docs/provider/telemetry.md.

Job metadata is kept 30 days. See Data retention for the rest of the schedule.

Subprocessors (hosted coordinator)

Vendor	Purpose	Prompt bodies?
Cloudflare, Inc.	Workers, D1, KV, Durable Objects, DNS, TLS, observability	No. Ciphertext in transit and at rest; metadata and logs as below.
Stripe, Inc.	Checkout, Connect payouts, invoicing	No.
Resend, Inc.	Transactional email when RESEND_API_KEY is set	No. Account email and notification copy only.
GitHub, Inc.	Source, CI, release assets	No customer prompts.

Self-hosted / air-gapped coordinators do not send data to Stripe, Resend, or GitHub as part of serving jobs. Cloudflare may still apply if the operator deploys there.

Cookies and accounts

The dashboard uses a session cookie after sign-in. Public pages (/privacy, /terms, /retention, /status, /benchmarks, /) do not require an account and do not set a session.

Payments

Card checkout and host cash-out go through Stripe. USDC deposits, when configured, go through the hosted onramp. Those vendors see billing identifiers, not prompts.

Requests

Signed-in accounts can self-serve:

• Export. GET /v1/account/export (session cookie) downloads a JSON copy of your profile, API-key ids, host-token ids, host metadata, pool memberships, usage, and ledger rows. It never includes another tenant's data, prompt or response bodies, or secret hashes.
• Delete. POST /v1/account/delete (session cookie, CSRF-protected via Origin / Sec-Fetch-Site) revokes sessions, API keys, and host tokens immediately, anonymises the account email, and after a 7-day grace removes hosts and pool memberships. Ledger rows are kept 7 years for tax and accounting with amounts unchanged; they are no longer tied to your email.

The dashboard Export data and Delete account buttons call those endpoints. You can also email security@neuronpool.dev (or use GitHub private vulnerability reporting for security issues) for access, correction, or deletion help, subject to the ledger retention in Data retention.

Changes

Material changes to this notice will be posted on this page with a new “Last updated” date.