GitHub6 Open Neoma

Confidentiality guarantees

Last updated: 22 August 2026

This page exists for the people who have to justify their tools to someone else: a research office, an ethics committee, a firm's IT policy, a supervisor asking where interview transcripts are stored.

Every claim below is stated precisely and can be checked. Where a claim is enforced by something stronger than our good intentions, that is said. Where it is not, that is said too.

The guarantee

Neoma makes no network requests of its own. There is no account system, no sync server, no telemetry, no analytics and no crash reporting. The application never contacts us, because there is nothing to contact.

There will never be a Neoma server that holds your notes. Sync, if it is ever built, will be strictly peer-to-peer. Device to device, with no intermediary holding your content. This is a commitment about the architecture, not a description of a current limitation.

What enforces it

Two independent layers, because a promise about behaviour is weaker than a constraint on capability.

1. Content Security Policy

The desktop application runs under a Content Security Policy whose connect-src directive permits no remote origin at all. The application cannot upload a note. Not by fetch, not by XMLHttpRequest, not by WebSocket, not by sendBeacon. This is enforced by the platform, not by our code, and it would hold even if our code were compromised.

script-src 'self' means no remote script can execute. form-action 'none' means nothing in a note can submit anywhere. object-src 'none' blocks plugin content entirely.

2. A test that fails the build

e2e/network.spec.ts records every request the application makes while loading, creating a vault, and editing, and fails if any leaves the origin. It runs in continuous integration on every change.

What Neoma does not control

Remote content in your notes. Markdown permits images and video embeds that point at other people's servers. A remote image is a beacon: whoever controls that address learns when the note was opened and from which IP. If a note was written by somebody else, that is a disclosure.

Neoma therefore blocks remote content by default. Remote image sources are stripped before the note is rendered, so no request is made, not merely hidden after the fact. You see a marker showing what was blocked and the address it pointed at, as text rather than a link.

You can turn this on in Settings if you need it. It is off until you do.

Update checks (desktop only). The desktop application checks a public URL for a new version. This sends no information about you or your notes. It is a request for a file, the same as visiting a web page. It can be disabled, and it does not exist in the web or App Store builds.

How to verify this yourself

Do not take our word for it. The method is short:

  1. Install Neoma.
  2. Run a packet capture Wireshark, or nettop -p Neoma on macOS.
  3. Use it: create a vault, write notes, link them, render them, search.
  4. Observe that nothing leaves the machine.

Then repeat with a note containing ![](https://example.com/x.png) and confirm no request is made until you enable remote content in Settings.

The open-source edition's source is available under AGPL-3.0, so the rendering and storage paths can be read directly rather than inferred.

What we would have to tell you

If Neoma ever began transmitting anything, this page and the privacy policy would have to change, and the network test would have to be deleted or weakened in a public commit. There is no version of that which happens quietly.

Questions from a compliance reviewer

Where is data stored? In a folder you choose on your own device, as plain .md files, or in your browser's local storage for the web app. Neoma has no storage of its own.

What is the data retention period? Not applicable. We hold no data.

Who are the sub-processors? None. There is no processing to sub-contract.

What happens on a breach of your systems? Your notes are not on our systems, so a breach of ours does not expose them.

Can it run air-gapped? Yes. The application works with no network connection, and the desktop build has no functionality that requires one.

What is the export path? Your notes are already plain Markdown in a normal folder. There is nothing to export from.