Privacy Policy

1.1 Information you provide

• Google account information — When you sign in with Google, we receive your name, email address and profile picture via OAuth. We use this solely to identify your account within Nexoryx One.
• GA4 Property ID — You optionally provide a Google Analytics 4 Property ID to connect your analytics data. This is stored in your browser's localStorage and is never stored on our servers.

1.2 Information collected automatically

• Usage data — We may collect standard server logs including IP address, browser type, pages visited and timestamps. This data is used solely for security and performance monitoring.
• Cookies & session tokens — We use a session cookie (managed by NextAuth.js) to keep you signed in. No third-party advertising cookies are used.

1.3 Google Analytics data

When you connect a GA4 property, Nexoryx One reads analytics data from your property on your behalf using a Google service account that you explicitly grant Viewer access to. This data is fetched in real time, briefly cached in server memory (up to 5 minutes), and is never stored in a database or shared with any third party.

We use the information we collect to:

• Authenticate you and maintain your session
• Display your Google Analytics data in the Nexoryx One dashboard
• Send marketing report emails that you explicitly request
• Send scheduled report emails that you configure
• Improve the reliability and performance of the service
• Respond to your support requests

We do not use your data for advertising, sell it to third parties, or use it to train machine learning models.

Nexoryx One requests only the following OAuth scopes when you sign in with Google:

• openid — Verify your identity
• email — Your email address (for account identification and report delivery)
• profile — Your name and profile picture (displayed in the dashboard)

We do not request access to Google Analytics, Google Ads, Google Drive, Gmail or any other Google service through OAuth. GA4 data access is granted separately via a service account that you control and can revoke at any time from your GA4 Admin panel.

Nexoryx One's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell or rent your personal information. We may share data only in these limited circumstances:

• Service providers — We use Resend (email delivery) and Vercel (hosting). These providers process data only as directed by us and under appropriate data processing agreements.
• Legal requirements — We may disclose information if required by law, court order or governmental authority.
• Business transfer — If Nexoryx One is acquired or merged, your information may be transferred as part of that transaction. You will be notified by email.

• Session data — Your login session is kept for 30 days and then expires automatically.
• GA4 data cache — Analytics data is cached in server memory for up to 5 minutes only. It is never written to persistent storage.
• User settings — KPI goals, alert preferences and team members are stored in your browser's localStorage. Clearing your browser data removes them completely.
• Account deletion — To delete your account, email us at sub17h4@gmail.com. We will remove your email and any server-side records within 30 days.

We take reasonable technical and organisational measures to protect your information, including HTTPS encryption in transit, secure session tokens signed with a secret key, and no persistent storage of sensitive analytics data on our servers.

However, no internet transmission is 100% secure. We cannot guarantee absolute security and encourage you to use a strong password on your Google account and enable two-factor authentication.

Nexoryx One is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Withdraw consent at any time (by revoking GA4 service account access or deleting your account)

To exercise any of these rights, email sub17h4@gmail.com.

Nexoryx One is hosted on Vercel infrastructure which may process data in the United States and other countries. By using our service, you consent to this transfer. We ensure appropriate safeguards are in place in accordance with applicable data protection laws.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, by email. Your continued use of Nexoryx One after changes are posted constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us: