Privacy notice
What we process, why, and your choices.
Effective 23 September 2026.
This notice explains which personal data NeuroFly processes when you visit neurofly.app, write to us, or use the NeuroFly software, why, and what you can do about it. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
NeuroFly, Zurich, Switzerland, contact@neurofly.app. See the imprint.
2. What we process, and why
When you open a page
- Data
- IP address, time, requested page, and the browser and network details that every web request carries.
- Purpose and basis
- Delivering the site and protecting it against abuse; legitimate interest (GDPR Art. 6(1)(f)).
- Recipient
- Our host, GitHub (GitHub Pages). GitHub logs and stores visitors’ IP addresses for security. We do not receive these logs.
When you accept statistics
- Data
- Page address including its parameters, referring page, browser, operating system, device type, screen size, language, approximate location derived from the IP address, clicks on links to other sites, and a random visitor ID stored in your browser.
- Purpose and basis
- Understanding which pages are read, to improve them. Only with your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time under .
- Recipient
- Rybbit (rybbit.com), which stores statistics on servers in the EU (Hetzner, Germany and Finland). See section 3.
When you use the contact or suggestion form
- Data
- What you enter: name, email address, organisation, role, topic and message, or your suggestion and reference.
- Purpose and basis
- Answering you and reviewing suggestions and scientific corrections: our legitimate interest in replying and in correcting and improving the project, or steps you ask for before an agreement (GDPR Art. 6(1)(f), 6(1)(b)).
- Recipients
- Airform (airform.io), which forwards the form to our mailbox, and Apple (iCloud Mail), which hosts the mailbox. See section 4.
When you email us
- Data
- Your email address, the message and anything you attach.
- Purpose and basis
- Answering you, as for the forms.
- Recipient
- Apple (iCloud Mail).
When you use NeuroFly on your computer
- Data
- Your settings, simulation runs, recordings and exports.
- Purpose
- Running the software on your device.
- Recipient
- No one. The software sends nothing to us or to anyone else (section 5).
Fields marked as required on the forms are needed to process your request; without a return address we cannot reply.
3. Page statistics
Statistics are optional. Nothing is measured unless you choose Accept all in the cookie banner or switch on statistics in the privacy settings; until then no statistics script is loaded.
If you accept, the Rybbit script loads from app.rybbit.io and records the data listed above. Rybbit states that it uses
the IP address only briefly to derive an approximate location and does not store it. The script keeps a random visitor ID in
your browser’s local storage (rybbit-visitor-id) so that a repeat visit is counted as one visitor. Session
recording, error reporting and tracking of clicks, copying and form input are switched off for this site.
Rybbit keeps the statistics for the retention period of our plan, three years on the Standard plan, and then deletes them. Rybbit uses further service providers, among them Cloudflare (USA) for its network; the current list is published at rybbit.com/subprocessors. You can withdraw your consent at any time under ; the visitor ID is then removed from your browser. Withdrawal does not affect statistics recorded before it.
4. Contact form, suggestions and email
The forms on the contact page are transmitted through Airform (airform.io), a form service that forwards submissions to our mailbox by email. Airform runs on the infrastructure of Heroku (Salesforce, USA) and Cloudflare (USA). Its own terms apply to its processing. Instead of using a form you can write to us directly at contact@neurofly.app.
Our mailbox is hosted by Apple (iCloud Mail); for people in the EEA, the UK and Switzerland, Apple Distribution International Ltd., Ireland, is responsible. Apple may store data in the USA and other countries and protects such transfers with the European Commission’s standard contractual clauses.
We keep messages and submissions for as long as they are needed for the purposes described here, including the documentation and further development of the project, and beyond that where statutory retention duties or our legitimate interests, in particular the establishment, exercise or defence of legal claims, require it. Suggestions and corrections may be used and published under the terms of use; we may name their authors when crediting a contribution. If you do not want to be named, please say so in your message.
5. The NeuroFly software
NeuroFly for Windows runs on your computer. The current version (2.1) contains no telemetry, crash reporting, update check, advertising or account, and sends no data to us. Links to scientific publications in the application open in your web browser, and only when you click them.
The application keeps your interface settings (for example language and panel choices) in its own local storage on your device. Recordings and exports are written only where you save them. Deleting those files, or uninstalling the application and its data folder, removes them. Do not place other people’s personal or confidential data in experiment notes unless you are entitled to.
6. Our profiles on social networks
NeuroFly has profiles on Instagram, TikTok and X. This website only links to them; it embeds no content, buttons or plugins from these platforms, so viewing our pages sends no data to them. When you open or interact with one of our profiles, the platform processes your data under its own responsibility and privacy policy (Instagram, TikTok, X); we have no influence on that processing.
The platforms may give us aggregated statistics about the use of our profiles, such as reach and interactions. Where the law makes us jointly responsible with a platform for such processing, the platform’s arrangements for joint responsibility apply, and requests concerning your rights are best addressed to the platform, which alone has access to the data. If you send us a message or comment through a platform, we process it to answer you and to interact with our audience, based on our legitimate interest (GDPR Art. 6(1)(f)).
7. Service providers abroad
Some of the providers named above process data outside Switzerland and the EU, mainly in the USA:
- GitHub (hosting): certified under the EU–U.S. and the Swiss–U.S. Data Privacy Framework; GitHub also uses the European Commission’s standard contractual clauses.
- Apple (mailbox): standard contractual clauses.
- Rybbit (statistics, only with consent): stores statistics in the EU; for providers outside the EEA, Rybbit states that it uses standard contractual clauses or other recognised mechanisms.
- Airform (forms): runs on infrastructure in the USA. Your message passes through it only if you use a form; you can email us directly instead.
8. Security
We take technical and organisational measures that we consider appropriate to protect personal data; the website is served over encrypted connections (HTTPS). No transmission over the internet and no storage system is completely secure, and we cannot guarantee the security of data you send to us; you do so at your own risk. Please report a suspected security problem to contact@neurofly.app.
9. Your rights
Within the limits of the applicable law you can ask what data we hold about you, have it corrected or deleted, object to its processing or ask us to restrict it, and, where the GDPR applies, receive it in a portable format and withdraw consent with effect for the future. Write to contact@neurofly.app; we may ask for information needed to confirm that a request comes from you, and we may restrict, defer or refuse a request to the extent the law permits. You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.
10. Children
This website and the software are made for researchers, educators, students and interested adults. They are not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has sent us personal data, please tell us.
11. Changes
We may amend this privacy notice at any time without prior notice. The version published on this page applies.