Nexus Protocol is built on a simple principle: your signal belongs to you. This document explains, in plain language, what data we collect, why we collect it, where it lives, and how you can take it back at any moment. No tracking pixels. No analytics. No selling. No sharing. Just what we need to make the app work, and nothing else.
Nexus Protocol is published by Nexus Protocol, operated from Barcelona, Spain. Throughout this document, "we", "us" and "our" refer to the publisher, and "you" refers to the person using the app.
When you create an account, we collect:
When you use the app, we store:
In-app purchases are processed entirely by Apple's App Store. We never receive, see, or store your credit card, billing address, or any payment information. We only receive a transaction receipt that tells us which tier you unlocked (Dossier, Full Access, Re-Evaluation Pass, etc.) so the app can grant you access.
Some preferences and a copy of your unlock state are stored locally on your iPhone using Apple's standard storage system (UserDefaults). This information stays on your device and is never transmitted anywhere unless explicitly listed elsewhere in this policy.
Your account and evaluation data are stored on Supabase, a cloud platform we use as our database and authentication provider. Supabase processes data on servers located in the European Union, in compliance with GDPR. You can read Supabase's own privacy policy at supabase.com/privacy.
We keep your account data and evaluations for as long as your account exists. When you delete your account, all associated data — answers, portraits, purchase records linked to your user ID — is permanently deleted from our database within 30 days. Backups containing the data are rotated out within 90 days. After that, no copy remains.
You have full rights over your data, in particular under GDPR:
To exercise any of these rights, contact us at the address below. We respond within 30 days.
Nexus Protocol is not intended for children under 16 years of age. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, please contact us and we will delete the account immediately.
All connections between the app and our servers use HTTPS / TLS encryption. Passwords are hashed with industry-standard algorithms and never stored or transmitted in plain text. Our database enforces row-level security, meaning each user can only access their own records. No system is perfectly secure, but we treat your data with the same care we expect for our own.
Our infrastructure is located in the European Union. If you access the app from outside the EU, your data may be transferred to and stored in the EU. We do not transfer personal data outside the EU to jurisdictions with weaker protections.
If we update this policy, we will post the new version here and update the "Last updated" date at the top. For material changes (for example, if we ever introduced any third-party processor), we will notify you in the app or by email before the changes take effect.
Data controller: Nexus Protocol
Location: Barcelona, Spain
Email: support@nexus-protocol.app
For any privacy question, request, or concern, write to the address above. We read every message.