Privacy Policy
Last updated: July 2026
What NexaOne is
NexaOne is an AI-powered personal, professional and business records organizer. Its core design principle: your data belongs to you and lives in your own Google Drive — not on our servers.
Data we store
We do not store your documents or records on NexaOne servers. When you add a record or upload a document, it is written directly to a folder named 'NexaOne' in your own Google Drive. Delete the app and your data remains yours, in your Drive.
Exactly what is stored, and where
To be precise, there are three separate buckets. (1) Your documents and files — these live ONLY in your own Google Drive and never leave it, except the file contents you choose to send for optional AI auto-naming. (2) Record metadata (titles, categories, dates) — sent to our AI provider (Groq) transiently, and only in the moment you ask the assistant a question, to generate an answer; your files are not included. (3) Your account details (name, email, account type, profession/business info you provide, plan and payment status, last-login time) — kept so we can operate the service. We do not run a traditional server database; there is no central store of your documents to breach.
Sub-processors
We rely on a small set of trusted providers to run the service: Google (sign-in and the Drive that stores your data), Groq (the AI that answers your questions), Vercel (website hosting), Razorpay (payment processing, if you subscribe), and Telegram (only if you choose to connect the optional bot). Each receives only the minimum data needed for its function, as described above.
Google account access
NexaOne uses Google Sign-In. We request access only to files and folders that NexaOne itself creates in your Drive (the drive.file scope). We cannot see, read, or modify any other file in your Google Drive. We receive your name, email address and profile photo to display inside the app.
Account & subscription details
To administer the service, NexaOne keeps your account details (name, email, account type, profession or business information you provide at signup, plan and payment status, and last-login time). Your documents and records are never part of this — they stay only in your own Drive.
Session data
A session cookie keeps you signed in. Access tokens for Google Drive are held in an encrypted session token in your browser and are never written to a database.
AI features
When you ask the NexaOne assistant a question, only metadata about your records (titles, categories, dates — not your document files) is sent to our AI provider, Groq, to generate an answer, and only when you actively ask. Your document files are sent to an AI service solely if you choose the optional bulk auto-naming feature, which reads a file to suggest its title and category. Ordinary uploads, downloads and Telegram file requests never send document contents to any AI.
Security
Connections are served over HTTPS with strict security headers, including a Content-Security-Policy and anti-clickjacking protection. Sensitive fields such as vault passwords are encrypted at rest with AES-256-GCM, and revealing one requires a fresh Google confirmation each time. Linked messaging accounts (for example Telegram) store your access token encrypted, never in plain text. Because your documents live only in your own Google Drive, there is no central store of your files for anyone to breach.
Analytics & tracking
We do not sell your data. We do not show ads. We may use privacy-respecting, aggregate analytics to understand overall usage (page views, not personal content).
Deleting your documents
Your documents and records live in your own Google Drive. To remove them, delete the 'NexaOne' folder from your Drive and revoke NexaOne's access at myaccount.google.com/permissions. Once revoked, the app can no longer read anything in your Drive.
Deleting your account data & retention
Separately from your documents, we keep basic account and operational details (name, email, account type, plan and payment status, last-login time) so we can run the service — stored in the operator's own Google Drive, not a NexaOne server. To have this account record removed, email jitu6583@gmail.com and we will delete it. Note: payment records may be retained where required by law or accounting, and anonymous, aggregate usage counts (with no personal content) may remain.
Sensitivity of metadata
Please be aware that record metadata itself — document titles, categories and dates — can be sensitive. This metadata is what is sent to the AI provider when you ask the assistant a question. If you prefer not to send any metadata to AI, you can turn off the AI assistant in Settings; the app will then answer using only a local keyword search.
Contact
Questions about this policy: jitu6583@gmail.com