Privacy Policy

Last updated: 2026-09-04.

The short version: your data is yours. We store it to run the service, we don't train models on it, we don't sell it, we don't run ads, and you can export it or delete your account at any time. The rest of this page is the detail behind that sentence — including the two places we send data outside our own infrastructure, and the one deletion we don't yet perform automatically.

What we collect

• Account — your name, email, and profile photo via WorkOS, our sign-in provider. We never see your password.
• Content you create — chat conversations, the memory captured from them, your vault notes, briefs, and profile snapshots.
• Connector data — what your connected tools return when a run reads them (see the per-connector list below).
• Credentials you hand us — connector OAuth tokens and, if you use the hosted runner, your Anthropic API key. Both are encrypted with Google Cloud KMS the moment they're received; plaintext is never stored, and our logging pipeline actively scrubs credential patterns.
• Billing — your Stripe customer id and subscription state. Card numbers never touch our systems (Stripe handles payment pages end to end).
• Operational data — request logs (secret-scrubbed) and usage counters used for quotas and reliability.
• Product analytics and session recordings — how you use the app, including recordings of your Nexus sessions in which page text is visible while form inputs are masked. See "Analytics and session replay" below.
• Feedback you send us — your report, a screenshot of the screen you were on (optional, and shown to you before sending), and diagnostic context. See "Product feedback you send us" below.

What each connector reads and writes

Nexus connects to your tools primarily to read them — that's how it builds your briefs, dashboard, and memory. It writes to a connected account only to carry out an action you have explicitly approved in the app; the automated agent can never send, share, or delete on its own initiative. Some providers only issue broad OAuth scopes that include write access; where that's the case, the write capability is constrained to approved actions, exactly as described here.

• Slack — your mentions and messages visible to you, via a user token acting as you.
• GitHub — your notifications: mentions, review requests, assignments.
• Asana — your tasks and their activity. Asana's OAuth grants a full user scope (the narrowest grant Asana offers today); we read your tasks and, with your approval, comment on or complete them.
• Linear — your assigned issues and their activity. Linear's grant includes write scopes, used solely to carry out actions you approve — creating or updating issues and comments.
• Google (Gmail, Calendar, Drive, Meet) — a single connector on Nexus's own OAuth client. Nexus requests read-write scopes because the connector is interactive by design: a read-only Gmail or Drive scope is classified just as sensitively by Google, so requesting read-only would gain no privacy while doing less. Write capability is bounded by the approval model above. Specifically:
  • Gmail — gmail.modify. Reads your mail so your briefs and open-loop detection can surface what needs a reply, and lets the agent prepare drafts you review in Gmail. Nexus never sends mail on its own initiative — sending a draft always requires your explicit approval, after which our server performs the send. Nexus does not delete your email.
  • Gmail settings — gmail.settings.basic. Lets Nexus carry out two mail-settings changes you approve: creating a filter (for example, newsletters skip your inbox and get a label) and turning your vacation auto-responder on or off. Both are proposals you approve first, and the auto-reply text is shown to you in full before it can be turned on. Nexus does not request the broader settings scope that would cover forwarding, send-as identities, or delegation — it cannot redirect your mail to anyone.
  • Calendar — calendar. Reads your events for your daily brief and scheduling context; any calendar change that would notify other people happens only through an action you approve.
  • Drive — drive. Reads your Drive files so relevant documents appear in your briefs and the agent can open a document you point it at, and lets the agent author documents in your own Drive when you ask. Nexus shares a file or changes its permissions only through an action you explicitly approve — the share request names the file and the recipient before you confirm it — and the agent can never share anything on its own.
  • Meet — meetings.space.created, meetings.space.readonly. Creates a Google Meet link when the agent sets up a meeting you approve, and reads the transcripts of meetings you attended so they can be summarized into your memory.

Connector content is fetched on demand for each run and clamped to your plan's lookback window (7 days on Free); we don't warehouse a copy of your Slack or your inbox. What persists is what your own runs write: briefs, memory entries, notes.

Google Workspace data — Limited Use

Nexus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, for data obtained through Google Workspace APIs (Gmail, Calendar, Drive, and Meet):

• We use it only to provide and improve the user-facing features that are prominent in Nexus — your briefs, dashboard, memory, and the actions you approve. We do not use it for any unrelated purpose.
• We do not sell it, and we do not transfer it for advertising, to data brokers, or to information resellers.
• We do not use it to develop, improve, or train generalized or non-personalized AI/ML models. Your Google Workspace data is never used for model training — not by Nexus, and not by Anthropic, whose models produce your Nexus outputs and do not train on the content of your requests (hosted runs use your own Anthropic API key).
• We do not allow humans to read it, unless: you gave affirmative consent for specific messages or files; it is necessary for security purposes (such as investigating abuse); it is required to comply with applicable law; or the data has been aggregated and anonymized for internal operations. This same restriction applies to any personnel of our subprocessors.

How we use your data

Solely to run the service: building your briefs and dashboard, capturing and indexing your memory, executing the actions you approve, enforcing quotas, and billing.

• We do not train AI/ML models on your data. Neither Nexus nor Anthropic (our inference provider) uses your content to train or improve generalized models. For Google Workspace data specifically, the Limited Use commitments in the section above apply.
• We do not sell your data or share it with advertisers. There are no ads.
• We disclose data only if legally required to.

How we protect your data

Nexus handles sensitive data — including Gmail, Calendar, Drive, and Meet content from Google, and equivalent data from other connectors — and protects it with layered technical controls:

• Encryption in transit. All traffic — between you and Nexus, and between Nexus and every provider's API — uses TLS (HTTPS). Connector data is never carried over an unencrypted channel.
• Encryption at rest. All stored data is encrypted at rest in Google Cloud (AES-256). Your connector OAuth tokens and any Anthropic API key you bring are additionally encrypted with Google Cloud KMS the moment we receive them; plaintext credentials are never written to disk.
• Centralized, least-exposure token custody. Refresh tokens for your Google and other accounts never leave our gateway. When a run needs to act, the gateway mints a short-lived (~1 hour) access token scoped to your space alone, and hands the code that runs your skills only that short-lived token — nothing more. The agent never holds a long-lived or send-capable credential.
• Tenant isolation. Your data lives under your own space, and every request is bound to that space on the server. One account can never read another's connector data, memory, or files.
• No writes without your approval. Reading is the default. Any outward-facing or irreversible action — sending an email, sharing a file, deleting — is blocked from the automated agent and can happen only through a proposal you explicitly approve in the app, which our server then executes. This is structural: the agent is not given a tool that sends or shares.
• Secret-scrubbed logging. Our logging pipeline actively redacts credential and token patterns before anything is written to logs.
• Least-privilege infrastructure. Service accounts hold only the permissions they need, and access to production systems is limited and audited.

Where it lives, and for how long

All data is stored in Google Cloud (US): Cloud Storage holds your markdown (memory, notes, briefs — the canonical copy), Firestore holds metadata and indexes, and a private vector index derived from your content powers recall. See Data handling for the byte-by-byte map.

Retention, plainly:

• Connector reads: not retained as such — read on demand, within your plan's lookback window.
• The memory your runs write (ledger entries, notes, briefs): kept while your account exists, because it is the product. Deleted notes sit in trash for 30 days, then are permanently removed.
• Export zips: self-delete after 7 days.
• Deleted accounts: purged from primary stores immediately (next section); backup snapshots age out within their retention window (≤14 days).

Your rights

• Export — always free, on every plan: a zip of your entire space, from Settings.
• Delete — deleting your account removes your tenant data from our systems: Cloud Storage objects (including version history and any export archives), Firestore documents, the vector index, your feedback reports and their screenshots, your KMS-encrypted credentials, and your WorkOS sign-in identity. Your stored connector tokens are deleted, so Nexus can no longer reach those accounts (to also revoke the grant at the provider, remove Nexus from that provider's connected-apps settings). Your Stripe subscriptions are canceled and the customer record deleted (we retain no payment data ourselves). Your PostHog analytics identities and session recordings are deleted too, and the associated events are queued for permanent erasure (PostHog processes those asynchronously, typically within days). Content you contributed to a team remains with the team.
• Correct — memory, notes, and profile snapshots are all editable in the app.

Analytics and session replay

We use PostHog (PostHog Cloud, hosted in the United States) to understand how the app is used and to diagnose problems. This is the one place your data leaves our Google Cloud environment for a purpose other than running the service, so it is worth stating precisely.

In the web app, in production, once you are signed in:

• Session replay is on. We record your Nexus sessions — the pages you visit, what you click, and how the interface responds — so we can see what actually happened when something goes wrong.
• Text you type into form fields is masked and never recorded.
• Text rendered on the page is not masked, and is recorded. This is the part to be clear about: because Nexus displays your content, a replay of your session can contain your briefs, notes, memory entries, and the subject lines and snippets shown on your dashboard. We accept this trade deliberately, because a replay with the content blanked out is usually useless for diagnosing a real problem — but you should know it is happening.
• Interactions and page views are captured automatically, along with your account id so we can tell one person's sessions apart from another's.

On the server, our memory service sends a small set of typed events — a memory was indexed, searched, expanded, reindexed, or a space was dropped. These carry counts and flags only (how many results, how long the query was, whether the search matched anything outside your recall window). They never carry your query text, your content, or your file names, and they are keyed to your space id. Unhandled server exceptions are also reported so we learn about breakage we would otherwise miss.

What is never sent to PostHog: your credentials, your connector OAuth tokens, your Anthropic API key, and the content Nexus reads from your connected tools.

If you would rather not be recorded, email support@davidchang.dev and we will exclude your account.

Product feedback you send us

When you report a bug or send feedback from inside the app, the report carries diagnostic context so we can act on it without a back-and-forth:

• A screenshot of the screen you were on, rendered from the page itself. You can turn this off before sending, and the dialog shows you what is attached. The screenshot will contain whatever your screen contained, which for Nexus usually means your own content.
• Technical context — the page you were on, the app build, your account and space ids, your browser and window size, your timezone, your last few skill runs and any error codes they produced, recent failed requests, and a link to the matching session replay.

Feedback reports and their screenshots are stored in our own Google Cloud environment, not with a third party, and are scrubbed for credential patterns before they are written. We use them only to fix what you reported.

Teams

Content in a team space is visible to every member of that space, with attribution. Admins control membership; removal takes effect immediately, but contributed content stays with the team.

Subprocessors

Changes and contact

Material changes are announced to active users by email. Privacy requests: support@davidchang.dev.