Privacy Policy
In short: your messages, photos, videos, voice messages, files, locations, safety alerts, profile and group details are end-to-end encrypted. Only you and the people you talk to can read them. Not us, and not our servers. We don't show ads, we don't sell your data, and we don't use advertising or tracking tools.
1. Who we are
Nexsaya is provided by Nihar Kalyanam, United States ("we", "us"). We are responsible for the information described in this policy. You can reach us at support@nexsaya.com.
2. What is end-to-end encrypted
These are locked on your phone before they are sent, and can only be unlocked on the phones of the people you send them to:
- Messages in one-to-one chats and groups, including replies, reactions, edits, forwarded and scheduled messages
- Photos, videos, voice messages and files
- Locations you share, live locations, Walk me home and Safe arrival updates, and SOS alerts
- Your profile name, about text and profile photo, which are readable only by people you chat with
- Group names, descriptions and photos, which are readable only by group members
- Moves in games you play with friends
Our servers store these only in locked form, so they can be delivered and kept as your chat history. We cannot unlock them.
3. Information we store
To run the service, our servers keep some information that is not end-to-end encrypted:
| Information | Why we need it |
|---|---|
| Phone number, and email address if you add one or sign in with email, Apple or Google | To create your account, sign you in and let you recover it. Other people see your number only if your privacy settings allow it. |
| Username, if you choose one | So people can find you without your phone number. Usernames are public. |
| Your public encryption key | So others can send you encrypted messages. Your private key never leaves your phone unencrypted. |
| Your chat backup, if you turn it on | An encrypted copy of your keys, locked on your phone with a password only you know, so a new phone can read your chat history. We can't open it or reset the password. Turning backup off deletes it. |
| Who you message, when, and delivery and read times | To deliver messages and show ticks. Read receipts and last seen follow your privacy settings. |
| Group membership and admin roles | To deliver group messages and apply group permissions. |
| Chat settings such as muted, pinned, archived and disappearing-message timers | So your settings work across sessions. |
| Which messages you starred, not their content | To show your starred list. |
| Ideas board posts, votes and comments | The Ideas board is public to everyone using the app and is not end-to-end encrypted. If you post anonymously, other users don't see your name, but our team can, to keep the board safe. |
| Basic technical logs such as error reports and IP addresses | To keep the service running and protect it from abuse. Kept for a short time. |
4. Information that stays on your phone
- Your private encryption key and your profile and group keys (only an encrypted copy leaves your phone, if you turn on chat backup)
- Your locked-chats PIN. We never receive it, so we cannot recover a forgotten PIN.
- Emergency contacts and medical information you enter, safety settings and PINs, and saved places such as Home
- Game scores and statistics
- Photos, videos, voice messages and files you receive (downloaded automatically, as set in Storage settings). You can clear them there.
5. Contacts
If you allow it, the app checks which of your contacts use Nexsaya. Your phone turns each number into a scrambled code (a SHA-256 hash) and sends only those codes. Names and the rest of your address book are never uploaded, and the codes are not kept after the check. You can turn off "Find me by my number" so others can't find you this way.
6. Location and safety features
We use your location only when you choose to: when you share a location, start live location, send an SOS alert, or use Walk me home or Safe arrival. It is sent end-to-end encrypted to the people you chose. Turning a location into a street address is done by your phone's own maps service.
Safety features help you reach people you trust. They depend on your phone, its battery, its connection and its settings, and they don't replace emergency services.
7. Service providers
We use a small number of providers to run Nexsaya. They may process limited information for us and only under our instructions:
- Hosting: a cloud provider runs our servers and stores the information described in section 3.
- Text messages: an SMS provider (such as Twilio) receives your phone number to deliver your sign-in code.
- Email: an email provider receives your email address to deliver sign-in codes.
- Sign in with Apple or Google: if you use them, Apple or Google confirm your identity to us under their own privacy policies.
- App stores and notifications: Apple and Google deliver the app and, once notifications are on, a wake-up signal that contains no message content.
We don't sell or rent your information, and we don't share it with advertisers or data brokers.
8. Keeping and deleting data
- Encrypted photos, videos, voice messages and files are deleted from our servers 90 days after they are sent. Phones that downloaded them keep their copy.
- With disappearing messages on, messages and their files are deleted from our servers after the time you choose.
- "Delete for everyone" removes the encrypted message from our servers.
- You can delete your account at any time in the app under You, then Delete my account. This removes your profile, your one-to-one chats and their files, your group memberships and your Ideas votes. Messages you sent in groups stay with the other members, as in other messengers.
- We may keep limited records for longer when the law requires it or to deal with abuse.
9. Legal requests
We respond to valid legal requests as the law requires and review each one carefully. Because of end-to-end encryption, we have no message, media, location or profile content to provide. We can only provide the limited information described in section 3.
10. Security
We use end-to-end encryption (X25519 key exchange with XSalsa20-Poly1305), encrypted connections (HTTPS), and your phone's secure storage for keys. No system is perfectly secure, so please keep your phone, its passcode and your PINs safe.
11. Children
Nexsaya is not for children under 18, or the minimum age required in your country if that is higher. If you believe a child has created an account, contact us and we will delete it.
12. Your rights
You can see and change your profile and privacy settings in the app, and delete your account at any time. Depending on where you live, you may also have the right to ask what information we hold about you, to correct or delete it, to object to or limit how we use it, and to complain to your local data protection authority. Email support@nexsaya.com and we will reply within the time the law requires.
13. This website
This website uses no cookies, no analytics and no tracking tools, and loads nothing from other companies. Our web host may keep standard server logs, such as IP addresses, for a short time to keep the site secure.
14. Changes
If we change this policy, we will update the date at the top. If a change is important, we will tell you in the app before it takes effect.
15. Contact
Questions about privacy? Email support@nexsaya.com.