Privacy
What we collect, who else sees it, and what you can do about it.
Last updated 9 September 2026
- No analytics, no trackers, no advertising. The app contains no analytics script, no tag manager, no advertising pixel and no third-party cookie. Nothing follows you between sites, because there is nothing to follow you with.
- Only strictly necessary cookies. One session cookie, set when you sign in, so the app knows it is still you. It is not used for anything else and there is nothing to consent to — which is why you have not been shown a banner.
- Your writing is yours. We do not read it, sell it, or use it to train anything. Export any page or an entire branch to Markdown, HTML or PDF at any time, on any plan, free — the conversion happens in your browser.
- Deletion means deletion. Deleting your account removes your pages and their contents, the workspaces you own, your comments, your notifications, invitations you created and your sign-in identity.
Who is responsible
TODO: registered legal name is the data controller for the information described here. You can reach us at TODO: contact@yourdomain.
What we collect
Your account. When you sign in with Google we receive your name, email address and profile picture. We do not receive your Google password and cannot act on your Google account.
What you write. Pages, comments, page properties, whiteboards and any files you upload. This is stored so the app can show it back to you and to the people you share a workspace with.
How you have it set up. Your workspaces, who is in them, your starred pages, and preferences like reading width and interface scale.
Payment records. If you subscribe, we store which plan a workspace is on and an identifier for the subscription. Card details are handled by Dodo Payments and never reach our servers.
Names on a published page. If you restrict a published page to specific email addresses, those addresses are stored on the page so we can check them against whoever tries to read it.
Why we are allowed to
For everything needed to run the service — your account, your writing, your workspaces — the legal basis is performance of a contract: it is the thing you asked us to do. For payment records it is a legal obligation as well, since invoices have to be kept. We do not rely on legitimate interests for tracking, because there is no tracking.
Cookies
One, and it is the session cookie set when you sign in. It exists so that the next page you open knows it is still you. There is no analytics cookie, no advertising cookie and no cookie set by anybody else, which is why this site does not ask you to accept any — under the ePrivacy rules a strictly necessary cookie needs no consent.
Who else sees it
Only the services below, each for the single purpose named. None of them is an advertising network, and we do not sell or share personal data for advertising in any sense.
| Service | What for | What they receive |
|---|---|---|
| Convex | Database, file storage and server functions | Everything you write: pages, comments, uploads, workspace and account records. |
| Cloudflare | Hosting and content delivery | Requests to the site, including IP address and browser headers, as part of serving pages. |
| Sign-in | Your name, email address and profile picture, received when you choose to sign in with Google. | |
| Dodo Payments | Payments, as merchant of record | Your name and email address, and the size of your workspace. Card details go to them directly and never reach us. |
| Unsplash | Cover image search | The search term you type. Requests are made by our server, so your IP address is not sent. |
| Klipy | GIF search | The search term you type. Requests are made by our server, so your IP address is not sent. |
The other people in your workspace see what you write in it — that is the point of a shared workspace. A page you publish is readable by whoever you chose: anyone with the link, only named addresses, or only people at a domain.
Where it is stored
Our database and file storage are operated by Convex, and the site is served through Cloudflare's network, so data may be processed outside the European Economic Area. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses in our agreements with those providers.
How long we keep it
Your writing is kept until you delete it. Deleting a page moves it to the trash, where it stays until you empty the trash — at which point it is removed. Page history is kept for the last fifty versions of a page. Your account and everything attached to it is kept until you delete the account. Payment records are kept as long as tax law requires, which is usually several years.
Your rights
If you are in the UK or the EEA you have the rights below. Three of them do not need us at all:
- Access and portability. Export any page, or a whole branch of pages, to Markdown, HTML or PDF from the page menu. It is free on every plan and the file is produced in your browser.
- Erasure. Settings → Your account → Delete account. This removes your pages and their contents, the workspaces you own, your comments, your notifications, invitations you created and your sign-in identity.
- Rectification. Your name and picture come from your Google account; changing them there changes them here.
- Objection, restriction and complaint. Write to us at TODO: contact@yourdomain. You also have the right to complain to your local data protection authority.
Children
Nex is not intended for children under 16, and we do not knowingly collect their information.
Changes
If this policy changes in a way that affects you, we will say so before it takes effect rather than quietly restamping the date.