This Privacy Policy explains what information Neutronics ("we," "us," "our") collects when you use BandForm, why we collect it, where it is stored, and what control you have over it.
We have tried to write this plainly. If anything is unclear, email info@neutronicsai.com.
1. The Short Version
- We collect your name, email, and password (stored as a cryptographic hash) so you can have an account.
- We store the EEG recordings you upload, and the labels and notes you attach to them.
- You must only upload de-identified data. Do not upload names, dates of birth, medical record numbers, or any other identifier of a person.
- We do not sell your data. We do not share it with advertisers. We do not use your recordings to train machine-learning models.
- You can export your data as CSV, and you can delete your account and its data at any time.
2. Information We Collect
2.1 Information you give us
- Account information. First name, last name, email address, and a password. Passwords are stored only as a salted cryptographic hash; we never store or have access to your plaintext password.
- Uploaded recordings. The EDF/EDF+ files you upload. These are binary signal files. They may contain metadata written by the recording equipment, including fields the EDF format reserves for patient and recording identification. You are responsible for ensuring these fields are de-identified before uploading.
- Content you create. Project names, participant labels, file group names, renamed files, reference notes, and any other text you enter.
- Derived data. Values computed from your recordings — power spectral density, band powers, extracted features, quality metrics — which we cache so the application does not have to recompute them.
2.2 Information collected automatically
- Session cookie. A single cookie that keeps you logged in. It is signed, HTTP-only, restricted to HTTPS, and set with SameSite=Lax. We do not use advertising or third-party tracking cookies.
- Technical logs. Standard server logs including IP address, request path, timestamp, and error information. These are used for security, rate limiting, and debugging.
- Rate-limiting counters. We count requests per account (and per IP address for sign-in and registration attempts, to prevent brute-force attacks) in a Redis store.
3. Why We Process It
| Purpose | Data used |
|---|---|
| Provide the service — store and analyze your recordings | Uploaded files, derived data, content you create |
| Authenticate you and keep you signed in | Email, password hash, session cookie |
| Protect the service from abuse and brute-force attacks | IP address, rate-limiting counters, logs |
| Diagnose errors and improve reliability | Technical logs |
| Contact you about your account or material changes to the service | Email address |
If you are in the European Economic Economic Area or the United Kingdom, our legal bases are: contract (to provide the service you signed up for), legitimate interests (security, abuse prevention, debugging), and consent where required.
4. Where Your Data Is Stored
BandForm is operated from the United States. If you access it from elsewhere, your data will be transferred to and processed in the United States.
We use the following service providers ("processors"):
| Provider | What they hold | Purpose |
|---|---|---|
| Railway | Application server; PostgreSQL database (accounts, project/participant/file metadata, cached analytics); Redis (rate limits) | Hosting and database |
| Cloudflare (R2) | The uploaded EDF binary files | Object storage |
These providers process data on our behalf, under their own terms. We do not grant them rights to use your data for their own purposes.
We do not use third-party analytics or advertising services in the BandForm application.
5. What We Do Not Do
- We do not sell, rent, or trade your personal information.
- We do not share your recordings with any third party except the infrastructure providers listed above.
- We do not use your uploaded recordings, or data derived from them, to train machine-learning or artificial-intelligence models.
- We do not read your recordings except where strictly necessary to operate or debug the service.
- We do not use advertising or cross-site tracking cookies.
6. Health Data and Special Categories
EEG recordings can constitute health data, and under the UK GDPR and EU GDPR, health data is a "special category" of personal data subject to heightened protection.
This is why we require that you upload only de-identified recordings. De-identified data that cannot reasonably be linked to an individual is not personal data, and this is the intended and required use of BandForm.
If you upload identifiable data, you do so in breach of our Terms of Service, and you — not us — are the controller responsible for that data. Please do not do this.
7. How Long We Keep It
- Account data: for as long as your account exists.
- Uploaded recordings and derived data: until you delete the file, delete your account, or we terminate the service.
- Technical logs: typically retained for a short operational period and then discarded or overwritten.
We may retain limited records where required to comply with legal obligations or resolve disputes.
8. Your Rights and Controls
Regardless of where you live, you can:
- Access and export your data. Feature values and analytics can be exported as CSV from within the application.
- Correct your account information from your settings.
- Delete individual recordings, projects, or participants at any time.
- Delete your account. From your account settings, you can delete your account. This removes your account record, your projects, participants, file groups, cached analytics, and the stored EDF binaries.
If you are in the EEA, UK, or a jurisdiction with comparable law, you additionally have rights to object to or restrict processing, to data portability, and to lodge a complaint with your supervisory authority.
To exercise any right, or if a deletion does not work as expected, email info@neutronicsai.com.
9. Security
We take reasonable measures to protect your data, including:
- All traffic served over HTTPS.
- Passwords stored only as salted cryptographic hashes.
- Per-account data isolation: every request for a project, participant, recording, or export is scoped to the authenticated account.
- Session cookies that are signed, HTTP-only, secure, and SameSite=Lax.
- Rate limiting on authentication, upload, and compute-intensive endpoints.
- Secrets and credentials held in environment variables, never in source code.
No system is perfectly secure. BandForm is early-stage software maintained by a small independent project, and you should not treat it as the only copy of any recording, nor upload data whose exposure would cause harm.
If you believe you have found a security vulnerability, please report it to info@neutronicsai.com rather than disclosing it publicly. We will respond as promptly as we can.
10. Children
BandForm is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect personal information from children. (This concerns the user of the service, not the subject of a de-identified recording.)
11. Changes to This Policy
We may update this policy. If we make material changes — particularly to what we collect or how we use it — we will take reasonable steps to notify you, such as by email or a notice in the application. The "Last updated" date above always reflects the current version.
12. Contact
Questions, requests, or concerns about privacy: info@neutronicsai.com
Neutronics
BandForm is for educational and research use only. It is not a medical device and is not for clinical or diagnostic purposes.