Who is responsible for your data
Neuro Gardens (“we”, “us”) is the controller of personal data processed through the Neuro Gardens app on iOS, Android and the web, and through this website. You can reach us about anything in this policy at support@neurogardens.com.
What we process, why, and for how long
We process personal data only where the law gives us a basis to. For each purpose:
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Showing you this website and keeping it secure | IP address, browser and device type, pages requested | Legitimate interests (Art. 6(1)(f)): running a secure, working site | Not stored by us. Our host, Cloudflare, keeps short-lived request logs for security. |
| Understanding how the website is used (Google Analytics), when analytics cookies are on (in the EU, EEA, UK, Switzerland and other places that require it, only if you accept them) | Pages viewed, clicks on buttons and links, approximate location (country/city), device and browser type, a random visitor ID stored in a cookie | Your consent (Art. 6(1)(a)) | Cookies expire after up to 2 years; Google keeps the reports for up to 14 months |
| Understanding how the app is used (anonymous product metrics) | Event names and coarse properties (for example outcome id, music genre, that the Plus sheet opened), app platform and version — not your name, account, email or a lasting device id | Legitimate interests (Art. 6(1)(f)): improving the product | Up to 24 months; a one-way hash of your IP for rate limiting is kept up to 24 hours |
| Telling you when the app launches (email list) | Email address, which form you used, sign-up time, and where you came from (the name of the site that linked you here and any campaign tags in the link, never the full address) | Your consent (Art. 6(1)(a)) | Until you unsubscribe or withdraw consent |
| Stopping spam sign-ups | IP address of the sign-up request | Legitimate interests (Art. 6(1)(f)): protecting the list from abuse | Erased automatically after 5 minutes |
| Answering support requests | Name, email address, your message, and from the app recent logs plus device details (app version, platform, and what was playing) | Legitimate interests (Art. 6(1)(f)), or performing our contract with you (Art. 6(1)(b)) | Up to 24 months after the conversation ends |
| Streaming music in the app (Neuro Gardens Plus) | IP address and the files requested | Performing our contract with you (Art. 6(1)(b)) | Not stored by us beyond Cloudflare’s short-lived request logs |
| Suggesting a sound in the Sound Guide (Plus), answering repeat questions, and improving the guide (including training our own models) | The text you type and the guide's replies, not linked to your name, account, device or IP address | Your consent (Art. 6(1)(a)), and your explicit consent (Art. 9(2)(a)) for any health details you choose to share, given in the app before your first message | Up to 3 years |
| Unlocking purchases and Neuro Gardens Plus | Confirmation from Apple or Google of what you bought and when it expires | Performing our contract with you (Art. 6(1)(b)) | Kept on your device while your purchase is active |
Information that stays on your device
Your audio settings, chosen outcomes, mixes, volume levels, liked songs and playback history are stored locally on your device, and songs you download for offline listening are saved to the app’s storage. We never receive this information.
Cookies, analytics and local storage
Analytics cookies. How we ask depends on where you are, which we work out from your connection’s country (we do not store it):
- In the EU, EEA, UK or Switzerland, and in other places whose law requires consent first (Brazil, China, Quebec, South Korea, Thailand, Turkey, Vietnam, Gibraltar and the Channel Islands, and the Isle of Man), or if we can’t tell where you are, we ask first. Until you click Accept, Google Analytics is not loaded and nothing is sent to Google. We ask again after 12 months; if you click Reject, we remember that and don’t ask again.
- Everywhere else, including the United States, Google Analytics is on by default and you can turn it off at any time. If your browser sends a Global Privacy Control signal, we treat it as a request to turn analytics off and don’t load Google Analytics.
When Google Analytics is on, it sets these cookies:
| Cookie | Purpose | Expires |
|---|---|---|
_ga | Distinguishes visitors with a random ID | 2 years |
_ga_20KESCW7G3 | Keeps track of your visit (session) | 2 years |
We use Google Analytics only to measure how the site is used. Advertising features, Google signals and ad personalization are not enabled. You can change your mind at any time with the Cookie settings link at the bottom of every page (on the app tour, on its last step); choosing Reject or Turn off analytics removes these cookies.
Local storage (no consent needed). The site saves a few small values in your browser to remember choices you made: your cookie choice and when you made it, light or dark mode, whether you closed the email sign-up box, and whether you already signed up. For the current browser tab only, it also remembers which consent rules apply where you are, so we don’t have to ask our server on every page. These values contain no personal data and are never sent to us. Clear your browser’s site data to remove them.
Where you came from. If you join the email list, we receive with your email address the name of the site that linked you here (never its full address) and any campaign tags in the link (such as utm_source), so we can see which links bring people who sign up. Only when analytics is on does the site remember this in your browser, for the current tab, so it still counts if you sign up on another page; it disappears when you close the tab.
Fonts and all other files are served from our own domain. Links to outside sites, such as PubMed studies, only contact those sites if you click them.
In-app product metrics (not advertising). The Neuro Gardens apps may send anonymous event names and coarse properties (for example that a song was liked, or which outcome played) to our servers so we can see what is used. Events can queue on the device while offline and flush when connectivity returns. They are not tied to your name, account or a lasting advertising identifier, and we do not use them for ads.
Sound Guide
The Sound Guide is part of Neuro Gardens Plus. It suggests an outcome based on what you type. When you use it, new messages are sent to Anthropic, PBC, which runs the AI model that writes the reply, as our processor. We save the text of each Sound Guide conversation and the reply so the same question can be answered again without calling the AI, and so we can improve the guide, including by training our own models. We don't save your name, account, device or IP address with the conversation, so we can't link it to you. To prevent abuse we keep a one-way hash of your IP address, separately, for up to 24 hours. Please don't enter health details you'd rather not share; the guide offers general wellness suggestions, not medical advice.
Purchases
Purchases are made through Apple (App Store) or Google (Google Play), which act as independent controllers under their own privacy policies. We never see your payment card details.
Who receives your data
We do not sell, rent or trade your personal information. We share it only with:
- Cloudflare, Inc., which hosts this website, our music library and our databases as our processor under a data processing agreement
- Google (Google Ireland Limited and Google LLC), which provides Google Analytics as our processor, when analytics cookies are on (in the EU, EEA, UK, Switzerland and other places that require it, only if you accept them)
- Anthropic, PBC, which runs the AI model behind the in-app Sound Guide, as our processor, only for messages you send to the guide
- Apple and Google, for purchases you make through their stores
- Authorities, where we are legally required to
International transfers
Cloudflare, Apple and Google are based in the United States, so your data may be processed outside the EU and UK. These companies participate in the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and transfers are also covered by the European Commission’s Standard Contractual Clauses.
Your rights
If you are in the EU, EEA or UK (and, as a matter of policy, wherever you are), you have the right to:
- Access the personal data we hold about you and get a copy of it
- Correct data that is inaccurate
- Erase your data
- Restrict how we use it
- Port it: receive it in a machine-readable format
- Object at any time to processing based on our legitimate interests
- Withdraw consent at any time, for example by unsubscribing from the email list. This does not affect processing that happened before you withdrew.
- Complain to your local data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch); in the EU, see the list at edpb.europa.eu.
To use any of these rights, email support@neurogardens.com. We respond within one month and may ask you to confirm you own the email address in question.
Do you have to give us your data?
No. Signing up for emails and contacting support are optional, and you can use the website without giving us any personal data. We do not make decisions about you by automated means or profile you.
Security
All data is sent over HTTPS and stored with encryption at rest. Access is limited to the people who need it to run Neuro Gardens.
Children
Neuro Gardens is not directed to children under 16, and our email list is only for people 16 or older. If you believe a child has given us personal data, contact support@neurogardens.com and we will delete it.
Changes to this policy
If we make significant changes we will update this page and the date below, and tell you in the app or by email where appropriate.
Last updated: October 18, 2026