GitHub6 Open Neoma

Privacy

Nothing leaves unless you send it.

Neoma keeps your notes on your device and has nowhere to send them. This page lists every way it can touch the network, how to check that for yourself, and the full privacy policy.

What Neoma does not have

  • No account. No sign-up, no login, no email address.
  • No analytics. Not in the app, not on this website.
  • No telemetry. No crash reports or usage data, and nothing to turn off.
  • No remote AI. Your notes are never sent to a model.
  • No tracking pixels. Remote images are blocked until you allow them.
  • No hidden API calls. The app's security policy has no remote host to call.

When the network is used, and only then

Loading the web app
From this site, once; then offline
Remote images and video in notes
Blocked by default; your choice in Settings
Desktop updates
Only when you press Check for updates
Publishing
Writes files on your device; you upload them
Links you click
Open in your browser, like any link

If you enable remote content, the image or video host sees a normal request from your device, including your IP address. Those requests never pass through Neoma.

Verify it

Do not take our word for it.

The desktop app ships with the Content Security Policy on the right. A browser engine enforces it, and connect-src lists no remote host: the app cannot open a connection to send your notes anywhere.

  • Read the network audit: the method, the findings and the fixes.
  • Run it yourself: open the developer tools, watch the Network tab, use Neoma for an hour.
  • Read the source. Search for fetch(.
  • A CI check keeps this page identical to the policy the app ships.
Content-Security-Policy · shipped in the app
default-src 'self'
script-src 'self'
style-src 'self' 'unsafe-inline'
font-src 'self' data:
connect-src 'self' ipc: http://ipc.localhost tauri: asset: http://asset.localhost blob: data:
img-src 'self' asset: http://asset.localhost tauri: blob: data: https:
media-src 'self' asset: http://asset.localhost tauri: blob: data: https:
frame-src https://www.youtube-nocookie.com
object-src 'none'
base-uri 'self'
form-action 'none'
frame-ancestors 'none'

The policy

Privacy policy

Last updated: 29 September 2026

Neoma is built to keep your knowledge private by default. The short version: Neoma does not collect your notes or usage data. Notes stay on your device unless you export them. Remote content is blocked by default.

The application

Whether you use the web app, the desktop app (macOS, Windows, Linux) or the iOS app, Neoma runs entirely on your own device:

  • No account. There is no sign-up, no login, and no email is ever requested.
  • No telemetry. Neoma contains no analytics, tracking, crash reporting or usage collection. This is verified in our continuous-integration checks, which check normal use without off-origin requests. Enabling remote content is an explicit exception, described below.
  • No cloud. Your notes are stored locally. As plain Markdown files in a folder you choose, or in your browser's local storage. They are never uploaded to us or to anyone else.
  • Offline by design. The app boots and works with no network connection.
  • No automatic cloud sync in this release. Move notes between devices with exports. Any future online service would have its own terms and privacy information before you choose to use it.
  • Remote content is blocked by default. A remote image or video embed in a note tells whoever controls that address when you opened it. Neoma strips those sources before rendering, so no request is made. You can enable them in Settings. If enabled, the image host or video provider receives network information such as your IP address and may apply its own privacy policy. These requests do not go through Neoma servers.

Because your notes never leave your device, we have no access to them and could not read, share or sell them even if we wanted to.

Your data

Your notes, vaults and settings are yours. They live on your device (and, if you chose a local folder, as ordinary files you already control). On iPhone and iPad, vaults live in app storage: export a Markdown file or ZIP backup to access them in Files or another app. Browser vaults also require export. Desktop folder vaults can be managed using your normal file tools. Deleting the app or clearing browser data can remove app-managed vaults; keep backups outside Neoma.

This website

This marketing website (neomadev.app) is a set of static pages served by our hosting provider. We do not add analytics or tracking cookies to it. Our hosting provider may automatically record standard technical request logs (such as IP address and user-agent) for security and reliability, as described in their own privacy policy. Downloads of the desktop apps are served by GitHub from the project's Releases page and are subject to GitHub's privacy policy.

Third-party services

Neoma does not include advertising or analytics SDKs. External interactions include opening links and, only if you enable remote content, loading images or embedded YouTube videos from their providers. Fonts and application scripts are bundled locally.

Changes

If this policy changes, the "last updated" date above will change with it. The full history of this page is public in the open-source repository.

Contact

Email iwan.dominik@outlook.com with privacy questions, or raise an issue on the GitHub repository.

For the precise, verifiable version of these claims. What enforces them, what Neoma does not control, and how to check it yourself, see Confidentiality guarantees.