Privacy Policy

This policy explains what Nexus keeps about you, why, who else handles it and what Nexus never keeps. Nexus is run from the Philippines by its owner, who decides how your personal information is used (its personal information controller under the Data Privacy Act of 2012) and is "we" and "us" here.

What we keep

• Your account. If you sign in with GitHub: your GitHub account's id, username, name, email address and profile picture. If you sign in with an email code: your email address. Each code is stored only as a hash, works once and expires after 10 minutes.
• Your Connections. Each server's address, the name and note you give it, the account it signed in as, and the tools and prompts it lists. Its credentials (OAuth tokens, API keys and headers) are encrypted with AES-256-GCM under a key of your own, which is itself encrypted with a master key kept apart from the database, so the database alone reveals nothing.
• Your Stars. Their names, descriptions and settings, and which tools and prompts are switched on. Star tokens are stored only as a hash. For a Star that clients sign in to, the apps you approved.
• Activity. For each tool call or prompt fetch through a Star: when it happened, the Star, the Connection, the tool or prompt's name, how it ended, how long it took and which client sent it (its token's or app's name). Each entry is kept for 30 days and then deleted.
• Payments. Your plan, each payment's period, amount, status and PayMongo reference, and when your Pro ends. Your card and e-wallet details go to PayMongo, never to us.
• Technical details. A session cookie that keeps you signed in, your browser's time zone so Activity shows your local time, and your IP address, which our rate limits and our hosting provider's logs see for a short time. Your choice of light or dark mode stays in your browser.

What we never keep

• The arguments and results of your tool calls, and the prompts your clients fetch. They pass through Nexus to the server and back, and are never stored or logged.
• The text servers send back when something fails.
• Passwords: Nexus has none.

We don't sell your information, show ads or use advertising or analytics trackers.

Why we use it

• To sign you in and run Nexus for you: connecting your servers, serving your Stars and showing your Activity.
• To take payments and keep track of your plan.
• To email you sign-in codes, and reminders before and after your Pro ends.
• To keep Nexus secure and within its limits, and to fix problems.
• To answer you when you write to us, and to keep the records the law requires.

We rely on our agreement with you (the Terms of Service), our legitimate interest in keeping Nexus safe and working, and our legal obligations.

Who else handles it

We share your information only with the services that run Nexus for us, and only what each needs:

• PayMongo processes payments, and receives what you enter on its checkout.
• GitHub signs you in when you choose GitHub.
• Our hosting provider runs Nexus's servers, database and backups. They may be outside the Philippines; we choose providers that protect data at least as well as the Data Privacy Act asks.
• Our email provider delivers sign-in codes and reminders.
• The MCP servers you connect receive your credentials and your clients' calls, because that is what you ask Nexus to do. Each follows its own service's privacy policy.

We disclose information to the authorities only when the law requires it.

How long we keep it

• Your account, Connections and Stars: until you delete them or your account.
• Activity: 30 days.
• Sign-in codes: until they're used or expire. Expired codes are removed daily.
• Payment records: as long as Philippine tax and accounting rules require, even after you delete your account.
• Backups: deleted data stays in the database's backups until they age out, after a limited time.

Deleting your account

Delete your account from Settings. It permanently removes your account and sign-in methods, your Stars, your Connections with their credentials and your encryption key, your tokens, the apps you approved and your activity, at once. Backups keep a copy until they age out, and payment records stay as long as the law requires.

Your rights

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to be informed, to access your information, to object to its processing, to have it corrected, to have it erased or blocked, to take it with you, and to be compensated for damages. You can see and change most of your information in Nexus itself. For anything else, email [email protected].

If you think we've mishandled your information, you can also complain to the National Privacy Commission.

Security

Credentials are encrypted under a key of your own, tokens and sign-in codes are kept only as hashes, and every connection to Nexus uses HTTPS. No system is perfectly secure: if a breach puts your information at risk, we'll tell you and the National Privacy Commission as the law requires.

Changes to this policy

The date at the top says when this policy last changed. Before a change that matters takes effect, we'll email you.

Contact

Questions or requests about your information? Email [email protected].