Privacy Policy

1. Commitment to Privacy and the LGPD

NeoLeaf values the privacy, sovereignty and security of the data of its users, researchers, academics and developers. This Privacy Policy explains clearly, transparently and accessibly how we handle data in accordance with the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) and other applicable international legislation.

Our architecture was designed under the principle of Privacy by Design and Data Minimization (Art. 6, III of the LGPD): we collect only what is strictly necessary to provide the editor experience and the synchronization with your GitHub or Codeberg.

2. Privacy-Oriented Architecture: 100% Compilation in the Browser

Unlike legacy cloud platforms, the NeoLeaf server does not process or inspect the academic or intellectual content of your texts to generate the PDF. Your data stays under your control and on your Git infrastructure.

3. Personal Data Processed and Purposes

The only data processed by NeoLeaf falls into the following categories:

• Authentication Data (GitHub or Codeberg OAuth): numeric ID on the chosen service, username (login), public display name, registered email and public profile picture (avatar).
  Purpose: Identify your session, show your participation in collaborative projects and check access permissions (Legal basis: Art. 7, V of the LGPD, performance of a contract).
• Access Tokens (GitHub or Codeberg): Tokens granted by you at sign-in to access repositories tagged [neoleaf]. On Codeberg, NeoLeaf also keeps the refresh token, used to keep the session alive.
  Purpose: Allow cloning, commit (Push/Pull) and synchronization operations with your repository on GitHub or Codeberg (Legal basis: Art. 7, V of the LGPD).
• Real-Time Collaboration: Cursor presence, text selection and simultaneous edits shared among authorized collaborators.
  Purpose: Real-time synchronization between you and the people you invited to your repository on GitHub or Codeberg. Signaling data is ephemeral and discarded after the WebSocket session ends.
• Technical Connection Logs: Source IP address, date/time of the request, accessed URL and the browser's User-Agent header.
  Purpose: Ensure operational security, mitigate denial-of-service (DDoS) attacks and meet the legal record-keeping obligations of the Marco Civil da Internet (Law No. 12.965/2014, Art. 15).

4. No Advertising Trackers

NeoLeaf does not sell, rent or share users' personal data with advertising partners or data brokers.

Our system does not include:

• No tracking pixel (such as Meta Pixel or TikTok Pixel);
• No third-party behavioral marketing tool or invasive analytics;
• No targeted advertising.

5. Use of Cookies and Local Storage

NeoLeaf uses only cookies and storage features that are strictly necessary for secure technical operation:

• latex_session: Cryptographic identifier of the active session, generated on the server with the HttpOnly, Secure and SameSite=Lax attributes (expires 30 days after sign-in).
• oauth_state: Temporary token protecting against cross-site request forgery (CSRF) attacks, valid for 10 minutes during sign-in.
• ld_lang / ld_theme (or LocalStorage): Records your visual preferences (light/dark theme) and selected language.
• IndexedDB (Browser): Local storage on your own computer for offline cache and fast access to the files of the projects you work on.

6. Strictly Necessary Sharing with Third Parties

To keep the service online with high availability and security, data travels exclusively through the following infrastructure partners:

• GitHub Inc.: For authentication via the OAuth protocol and operations on the Git repository of the user who signs in with GitHub.
• Codeberg e.V.: For authentication via the OAuth protocol and operations on the Git repository of the user who signs in with Codeberg.
• Cloudflare Inc.: Content delivery network (CDN), protection against DDoS attacks and encrypted SSL/TLS termination.
• Oracle Cloud Infrastructure: Application server where the NeoLeaf binary runs in a restricted and protected way.

7. Your Rights as a Data Subject (Art. 18 of the LGPD)

You have the full rights provided for by Article 18 of the LGPD, including:

• Confirmation and Access: Check which data we keep and access your projects at any time.
• Full Portability: Since your projects are ordinary Git repositories on GitHub or Codeberg, you can clone them, export them and use them in any other environment without any technological lock-in (*vendor lock-in*).
• Erasure and Revocation: When you click the Sign out (Logout) button, your session is immediately revoked on the server. You can revoke NeoLeaf's authorization at any time directly in your GitHub Application Settings or on Codeberg.
• Account deletion: You can delete your account at any time by clicking your name (profile) and "Delete my account". Deletion ends all your sessions, revokes NeoLeaf's authorization on your GitHub account (people who signed in with Codeberg remove the authorization in Codeberg's own application settings) and erases the information NeoLeaf keeps on the server (the session, with the GitHub or Codeberg access token), without changing any repository. Your project files are not on the server: they are in your browser's storage (which you can clear in its settings) and in your repository (GitHub or Codeberg). Only the technical connection records that the law requires us to keep remain (Marco Civil da Internet, Art. 15).

8. Data Protection Officer and Contact Channel

To exercise your rights as a data subject, request clarification about the processing of personal data or send any question about our privacy, contact our team directly: