Privacy Policy

We handle information you provide or create in NexusDash, including:

• Account details such as your name, username, email address, profile image, authentication provider, and password hash when you use email-and-password authentication. We do not store your plain-text password.
• Workspace content such as projects, tasks, comments, meeting notes, roadmap items, invitations, notification preferences, and files or links you attach.
• Technical and security information such as session records, request IDs, timestamps, requested routes, and diagnostic information. Hosting and security providers may also process IP address and browser or device information when serving requests.
• Information from Google or GitHub when you choose social sign-in, such as your provider account identifier, name, email address, and profile image made available by that provider.

We use information to:

• create and secure accounts, sessions, and project access;
• provide project planning, collaboration, files, and notifications;
• deliver the Google Calendar features you explicitly connect;
• send service emails such as verification, recovery, invitations, and reminders;
• maintain reliability, prevent abuse, troubleshoot errors, and protect the service; and
• comply with legal obligations and enforce applicable agreements.

NexusDash does not sell personal information or use Google user data for advertising.

Google social sign-in and Google Calendar are separate, optional connections. Social sign-in uses basic identity information to create or access your NexusDash account. Connecting Calendar requests thehttps://www.googleapis.com/auth/calendar.eventsscope.

With Calendar connected, NexusDash reads event details needed to show your selected calendar in the workspace and, when you direct it to, creates, updates, or deletes calendar events. Event details can include titles, dates and times, descriptions, locations, status, and Google event links. NexusDash processes these event details on demand and does not create a separate permanent copy of your Google Calendar event list.

We store the selected calendar ID, granted scope, token metadata, and OAuth access and refresh tokens needed to maintain the connection. OAuth tokens are encrypted before they are stored in the database and are only decrypted by the server when it needs to call Google on your behalf.

Project content is shared with the people you invite according to their project role. Information is also processed by service providers that help operate NexusDash, including Vercel for application hosting, Supabase for managed database infrastructure, Cloudflare R2 for file storage, Resend for service email, and Google or GitHub for features you choose to connect. These providers process information under their own terms and privacy commitments.

We may disclose information when required by law, to protect users or the service, or as part of a business transfer. We do not allow service providers to use Google user data for advertising, data brokerage, or training general-purpose artificial intelligence models.

We retain account and workspace information while your account is active and as needed to provide the service. Security, audit, delivery, and backup records may remain for a limited period after they are no longer active where needed for reliability, fraud prevention, dispute resolution, or legal obligations.

Google OAuth credentials are retained while the Calendar connection is active. Removing NexusDash access in your Google Account stops future Google API access, but it does not automatically erase information already stored by NexusDash. To request deletion of your stored Google credentials, account, or other personal information, email the address in the Contact section. We will verify the request and delete or de-identify information unless retention is legally required.

We use administrative and technical safeguards designed to protect information, including access controls, tenant isolation, hashed passwords and session tokens, encrypted Google OAuth tokens, and HTTPS in hosted environments. No storage or transmission method can be guaranteed completely secure.

• You can update supported profile and Calendar settings in NexusDash.
• You can review or remove NexusDash's Google access at any time on your Google Account's connected-apps page. Removing access disables Calendar features until you authorize them again.
• You can ask to access, correct, export, or delete personal information by contacting us. Applicable law may provide additional rights.

Service providers may process information in countries other than your own. NexusDash is not directed to children under 13, and we do not knowingly collect their personal information.

We may update this policy when the service or legal requirements change. Material changes will be identified by a new effective date and, when appropriate, an additional in-product notice.

NexusDash is operated by Dorian Agaesse. For privacy questions or data requests, contact dorian.agaesse@gmail.com.