Security & data handling
Last updated: July 2026
Our core principle
Your data lives in your own Google Drive — not on NexaOne servers. There is no central database of user documents to breach. This single design choice removes the most common and damaging class of security risk.
Google access (the drive.file scope)
NexaOne signs you in with Google and requests only the drive.file scope. In plain terms: we can see and manage only the files that NexaOne itself creates in your Drive (the 'NexaOne' folder). We cannot see, read, list, or modify any other file in your Google Drive. This is enforced by Google, not just by our code.
Where data lives
Your documents and records are written directly to a 'NexaOne' folder in your own Drive. Operational account details (name, email, plan, last login) are stored in the service operator's own Google Drive — again, not on a NexaOne server or database.
What is sent to AI, and when
When you ask the assistant a question, only record metadata (titles, categories, dates) is sent to our AI provider (Groq) to generate the answer, and only in that moment. Your document files are sent to an AI service solely if you choose the optional bulk auto-naming feature. Ordinary uploads, downloads and bot file requests never send document contents to any AI.
Encryption (at rest — not end-to-end)
Connections are served exclusively over HTTPS. Sensitive fields such as vault passwords are encrypted at rest with AES-256-GCM, and linked messaging tokens (e.g. Telegram) are stored encrypted, never in plain text. To be clear and honest: this is encryption at rest, NOT end-to-end encryption. The decryption key is held server-side, which means NexaOne's systems are technically able to decrypt these fields when you request them (for example, when you tap 'reveal' on a vault password). We do not claim that NexaOne can never decrypt your data.
Step-up confirmation
Revealing a stored vault password requires a fresh Google confirmation at that moment — a session cookie alone is not enough. This protects secrets even if a device is left unlocked.
Application hardening
The site sets strict security headers, including a Content-Security-Policy, anti-clickjacking (X-Frame-Options: DENY), MIME-sniffing protection, and HSTS. The admin console is restricted to the operator; payment confirmations are cryptographically signed; and inputs are validated server-side.
Sub-processors
We use: Google (sign-in and Drive storage), Groq (AI answers), Vercel (hosting), Razorpay (payments, if you subscribe), and Telegram (only if you connect the optional bot). Each receives only the minimum data needed for its function.
Export your data
There is nothing to export from us — your data is already in your Google Drive. Open the 'NexaOne' folder in Drive at any time to see, download, or copy everything, in standard file and JSON formats.
Delete your documents
Your documents live in your own Google Drive. To remove them, delete the 'NexaOne' folder from your Drive and revoke NexaOne's access at myaccount.google.com/permissions. After revoking, the app can no longer read anything in your Drive.
Delete your account data (and what we retain)
Separately, we keep basic account/operational details (name, email, plan, last login) to run the service — stored in the operator's own Google Drive, not a NexaOne server. Email jitu6583@gmail.com to have this account record deleted. Payment records may be retained where law/accounting requires, and anonymous aggregate usage counts (no personal content) may remain.
Responsible disclosure
Found a security issue? Please email jitu6583@gmail.com. We welcome good-faith reports and will work with you to resolve them. A machine-readable contact is published at /.well-known/security.txt.