The rule is short. What enters Neuraphic stays in Neuraphic. Nothing is sold, and no other company learns anything about a person because they visited us.
That is easy to write and easy to write falsely, so it is worth stating the version that can be checked: open any page, open the network panel, and count the hosts that are not ours. The number should be zero.
It was not zero
Until recently every page on this site fetched its typeface from a content delivery network. That is an ordinary thing to do; it is how most of the web loads fonts, and it is one line of markup.
It also meant that every visit to every page sent the visitor’s address, their browser, and the page they were reading to a third party, before a word had been rendered. No analytics, no advertising, no tracking pixel. A font.
The fonts are now served from this site. The list is empty.
Why the boundary is drawn at where data goes
A privacy commitment usually gets written as a promise about collection: we collect only what we need. That is a fine sentence and almost impossible to audit from outside.
The more useful boundary is about destination. Personalising something with what we already hold is one kind of act. Another company coming to know something about a person is a different kind, and only the second one is irreversible.
If advertising ever exists here it will follow the same line: recommendations drawn from what is already ours, and nothing that teaches an outside party who someone is.
What this does not fix
Declared boundaries and measured ones are different things. Every entry on the sub-processors page is a place data legitimately goes, and that list is a statement rather than a measurement.
The measurement above covers what a browser does on this site. It says nothing about what happens after someone signs in, which is a larger surface and deserves its own accounting.