Public product draft · 15 August 2026
Private by default.
Public only on purpose.
This page describes the engineering boundary, not a final legal notice. Neluora is in development and is not accepting public accounts.
Private Moment content
The implemented iPhone path encrypts private photo renditions, captions and selected metadata before upload. Neluora’s ordinary services do not receive the content keys. They do process ciphertext size and timing plus the opaque identity, device, audience, placement, quota and delivery state needed to authorize and operate sharing.
Account and profile data
Neluora needs an opaque account ID, independently identifiable devices, protected phone-verification binding and an owner-chosen Display name. The Display name is non-unique private presentation data. It is returned only in an authorized social context, is not searchable, and is never a login credential, public handle or phone-number substitute.
Connections and discovery
A discovered person, message request, Connection request, accepted Connection, Circle membership and block are separate states. Discovery alone grants no audience access. Neluora does not upload a readable address book. Production private phone discovery remains blocked until the reviewed oblivious protocol is implemented.
What Neluora does not build
- No advertising profile, fingerprinting or cross-app tracking.
- No feed ranking, dwell-time collection, engagement score or paid reach.
- No plaintext address-book upload or public Display-name directory.
- No server-side recognition, thumbnailing or analysis of private media.
Public Showcase is separate
Private Connections sharing never becomes public automatically. A future public export must show exactly what becomes visible, create a separate client-sanitized derivative and use isolated public storage and moderation. That runtime is not yet implemented or enabled.
Your controls and their limits
The product design includes audience review, Connection removal, block, device revoke, export and account deletion. Only the implemented controls are available in the current engineering build. Hosted deletion cannot recall content another person already decrypted or copied.
Waitlist
The optional waitlist is implemented as a separate double-opt-in service. It encrypts email addresses and delivery links, keeps only keyed lookup and action-token digests, records consent and privacy-notice versions, and is never joined to Neluora social activity. Delivery is transactionally queued and provider-idempotent; client-IP limits trust only configured proxy networks. It is not deployed: the isolated database, exact proxy inventory, email-provider secrets and final legal review must be provisioned before this form can accept real addresses.
Before external beta
The final notice must identify the controller, contact and DPO routes, lawful bases, processors, countries, retention, rights, supervisory authority and child-safety policy. Legal and privacy review remains mandatory.