Privacy Policy

Project Axis, based in the Netherlands, is the controller for the personal data processed in Nexus under the General Data Protection Regulation (GDPR, in Dutch: AVG).

For any question about privacy or to use your rights, email [email protected].

• Account data: email address, username, display name, password (stored only as a secure hash), date of birth, language and your account settings. If you add them: phone number, two-factor authentication and passkeys.
• Profile data you choose to add: avatar, banner, bio, pronouns, profile colours and linked accounts from other services.
• Content: messages, attachments and other files you upload, reactions, polls, forum posts, and the servers, channels, roles and emoji you create.
• Social data: friends, blocked users, server memberships and the direct and group conversations you take part in.
• Voice and video: audio, video and screen shares are sent in real time between participants with WebRTC. When a direct connection isn't possible, the stream is relayed through our TURN server. We do not record or store voice, video or screen shares.
• Technical and security data: IP address, browser and operating system, device type and approximate location (city and country, derived from your IP address) for each login session, plus security events such as failed logins and password changes.
• Payment data, if you buy something: the product, amount, date, invoice details and the status of your subscription. Your card or other payment details are processed by Stripe and not stored by us.
• Moderation data: reports you send or that are made about you, and actions taken by moderators or by us.
• Communication: emails you send us and our replies.

• To provide Nexus: creating your account, delivering your messages and calls, storing your files and showing your profile to others. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• To keep Nexus secure: detecting suspicious logins, preventing spam, phishing and abuse, enforcing our terms and handling reports. Legal basis: our legitimate interest in a safe service (Article 6(1)(f) GDPR).
• To fix errors and keep the service running: technical logs and error reports. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• To handle payments and keep financial records. Legal basis: contract (Article 6(1)(b) GDPR) and our legal obligation to keep accounting records (Article 6(1)(c) GDPR).
• To send service emails, such as email verification, password resets, security alerts and notices about your account. Legal basis: contract (Article 6(1)(b) GDPR).
• Optional features such as linking an account from another service. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by removing the link.

In your Privacy & Safety settings you can also choose whether information about how you use Nexus may be used to improve the service and to personalise suggestions. You can switch these options off at any time.

We don't sell your personal data and we don't use it for advertising.

Nexus uses only two cookies of its own, both strictly necessary:

• nexus_session: keeps you logged in. It is set when you log in and is valid for up to 30 days, or until you log out.
• NEXUS_LOCALE: remembers the language you picked. It is valid for one year.

The app also stores preferences on your device in your browser's local storage, such as layout and audio settings. This data stays on your device.

We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent. Cloudflare, which protects our website, may set a strictly necessary security cookie when it needs to check that a visitor is not an automated bot.

• Other users: what you post is visible to the people in the conversation, channel or server where you post it. Your profile is visible to people who share a server or conversation with you.
• Bots and applications: bots added to a server can read messages and member information in that server, within the permissions the server gives them. Applications you authorise with OAuth2 receive the data shown on the authorisation screen. These applications are run by their developers, not by us.
• Hosting: our servers are hosted in the European Union.
• Cloudflare: all traffic to Nexus passes through Cloudflare, which acts as a content delivery network and protects us against attacks. Cloudflare processes your IP address and request data for this purpose.
• Stripe: if you make a payment, Stripe processes your payment details. Stripe is responsible for its own processing of payment data under its own privacy policy.
• Email delivery: we use an email service to send account and security emails.
• GIF search: when you search for GIFs, your search term is sent from our server to the GIF provider (Giphy or Tenor). The GIFs you see are loaded from that provider's servers, which then receive your IP address.
• Watch Together: when you watch a YouTube video with others, the video is loaded from YouTube in its privacy-enhanced mode, and YouTube receives your IP address.
• Link previews: to show a preview of a link in a message, our server fetches the linked page. The website receives our server's address, not yours.
• Linked accounts: when you link an account from another service, we exchange data with that service to show the connection on your profile.
• Authorities: only when we are legally required to, for example by a court order.

We have agreements with our processors that require them to protect your data and use it only on our instructions.

Some of the services above, such as Cloudflare, Stripe and the GIF providers, are based in the United States or may process data there. We only allow such transfers when the recipient is certified under the EU-U.S. Data Privacy Framework or when Standard Contractual Clauses approved by the European Commission are in place.

• Account data: as long as your account exists.
• Account deletion: when you delete your account in settings, it is deactivated straight away and permanently deleted after 14 days. Logging in during those 14 days cancels the deletion. Servers you own must be transferred or deleted first.
• Messages: messages you sent in servers, direct messages and group conversations stay visible to the other participants after your account is deleted, but are no longer linked to your account. You can delete your messages yourself before you delete your account, or ask us to help.
• Content you delete yourself, such as a message or a file, is removed from Nexus straight away.
• Login sessions expire after 30 days or when you log out.
• Technical logs and error reports: 30 days.
• Data export packages: available for you to download while your account exists. Email us if you want an earlier package removed.
• Moderation records: as long as needed to enforce our terms, for example to prevent banned users from returning.
• Payment and invoice records: 7 years, as required by Dutch tax law.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• have your data deleted;
• restrict our processing of your data;
• receive your data in a machine-readable format (data portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting processing before the withdrawal.

You can do much of this yourself. Change your account and profile data in settings. Download a copy of your data under Settings, Privacy & Safety, "Request all of my data" (once every 30 days). Delete your account under Settings, My Account.

For anything else, email [email protected]. We reply within one month. We may ask you to confirm your identity first.

You also have the right to file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in the EU country where you live. We would appreciate the chance to answer your concerns first.

All connections to Nexus are encrypted with TLS. Passwords are stored only as secure hashes. You can protect your account with two-factor authentication and passkeys, and you can see and end your active sessions in settings. Access to personal data on our side is limited to people who need it to run Nexus.

If a data breach is likely to put your rights at risk, we will inform you and the Autoriteit Persoonsgegevens as required by law.

Nexus is not meant for children under 13, and we don't knowingly let them register. If we learn that a child under 13 has an account, we delete it. Parents or guardians who think their child under 13 has an account can contact us at [email protected].

Server owners can turn on AutoMod, which automatically checks messages against the rules they set, such as blocked words, spam and known phishing links, and can block a message or apply a timeout. We also check links against lists of known malicious websites. These checks don't lead to decisions with legal effects. You can contest a decision as described in our Terms of Service.

We update this policy when our processing changes. The date at the top shows when it was last changed. If a change is important, we will tell you by email or in the app before it takes effect.

Project Axis, the Netherlands. Email: [email protected].