Privacy policy

• Account: your email address and name, held with our sign-in provider, plus the username you claim.
• Connected sources: public data from the accounts you connect (for example your GitHub profile and public repositories, Dribbble shots, Instagram posts, or an RSS feed you provide). We read it so we can build and update your site.
• Text you give us: anything you paste (such as LinkedIn text or a bio), and updates you email to your Neverstale address.
• Your site content: the text, images and links on your portfolio, and its version history.
• Billing: handled by Stripe. We store your plan and Stripe customer and subscription identifiers, never your card number.
• Product emails: we record that a digest was sent and which actions you took from it.
• Your timezone: your browser tells us your timezone (for example Pacific/Auckland) so the weekly digest arrives in your morning. We use it to pick a likely billing currency too. We do not store your location.

We ask for read-only access and only the scopes we need. Access tokens are encrypted at rest, are never returned to your browser and are never written to logs. Only public source data is published by default. You can disconnect a source at any time, which stops further fetching; content already on your site stays until you remove it. Images from sources whose links expire, such as Instagram photos and video posters, are copied into our file storage so your site keeps working, and are deleted with your account.

We send content from your connected sources and anything you paste to an AI provider (OpenAI) to classify changes and draft the text for your site. That content is treated as untrusted input, and drafts must be grounded in your source data. We do not use your content to train our own models, and we use the provider’s API under terms that do not permit them to train on API data by default.

Published portfolios set no cookies and need no consent banner. Their built-in analytics is cookieless and stores aggregates only: daily counts of visitors, views, referrers, countries and which outbound links were clicked. A visitor’s country is worked out from their request at our network edge and only the two-letter country code is kept. IP addresses are not stored. Unique visitors are counted with a hash that rotates daily, so a person cannot be followed from one day to the next. Raw events are deleted within 24 hours; only the daily totals remain.

Anyone can paste a website address into our free Staleness Checker at /staleness, without an account. When you do, our servers fetch that public page, look for signs of when it was last updated, and may look at the public GitHub activity of an account linked on it. Only the numbers from the result are sent to our AI provider to write a short summary, never the page’s own text.

• Reports: the address you checked and the report are stored for 30 days so the result can be shared by link and repeated checks cost nothing. Anyone with a report’s link can view it, but reports are not listed or indexed by search engines.
• Rate limiting: to prevent abuse we keep a salted one-way hash of your IP address, never the address itself, for up to 2 days. It is used only to count how many checks come from one place.
• No cookies and no account are needed, and we do not build a profile of people who use the tool.

We use these providers to run Neverstale. Each only receives what it needs for its job:

• Clerk: sign-in and account identity.
• Microsoft Azure: hosting, database, file storage and background processing.
• Stripe: payments and subscriptions.
• Postmark: sending and receiving email.
• OpenAI: drafting site text, as described above.
• The sources you connect (GitHub, Dribbble, Instagram and others): we fetch your data from them.

We do not sell your personal information.

You can delete your account from Settings. This removes your site, sources, snapshots, drafts and history, cancels any subscription and signs you out. Copies in infrastructure backups age out on the backup schedule. Billing records we are legally required to keep may be retained by Stripe.

If you downgrade, your content is never deleted. A custom domain is unbound after a 14-day grace period.

Under the New Zealand Privacy Act 2020, and the GDPR where it applies to you, you can ask to see the personal information we hold about you, correct it, or have it deleted. Most of this you can do yourself in the dashboard. For anything else, or a complaint, email support@neverstale.page.

Data is encrypted in transit. Credentials for connected sources are encrypted at rest. Email action links are signed and expire within 14 days. No system is perfectly secure, and if a breach affects you we will tell you as the law requires.

We will update this page when our practices change and revise the date above. Questions: support@neverstale.page.