Privacy

Who runs this

NexoNet is one rented server, run by one person for a handful of friends and family. There is no company here, nothing is charged, and there is nothing to sell.

Because access is by invitation, whoever invited you knows you are here. They can see that your account exists and which apps you were given. They cannot see what is inside them.

What is stored

Account

Your name, your email address, your passkeys or password hash, the apps you have access to, and when you last signed in.

App content

Whatever you put in an app: what you have watched, the notes you write, the routes you save, what you record about your health.

Sign-in records

Every sign-in, with a time and the address it came from, so an unexpected one can be spotted. Kept 365 days.

Request logs

The time, the network address, the page asked for and the browser used, for every request to every app. Kept 15 days.

DNS lookups

If you enrolled a device on the private resolver, the addresses it looks up are logged, which is a record of the sites it visits. Kept 24 hours.

Email

Account notices and invitations. NexoNet can send mail and cannot receive it, so there is no mailbox here holding your replies.

What is not done

No advertising, no ad identifiers, no third-party analytics, no session recording, no fingerprinting, and no cookies beyond the one that keeps you signed in.

Your content is never sold, never rented, never handed to anyone for marketing, and never used to train a model.

Being exact about one word: there is no tracking of you as a person, but there is logging. Every request is written down, as described above. That is how an attack gets spotted and blocked, and it is not optional.

Outside providers

Some things need outside services to work. They receive only what the job needs, never your account details and never anything you keep here.

Hetzner

Rents the machine and runs the building it sits in, in Germany, inside the EU. A processor under GDPR, given no access to what is stored.

Cloudflare

Answers DNS for the domain, so it sees which names are looked up. No traffic passes through it: it is deliberately configured not to proxy.

Resend

Delivers outbound email. It sees the address a message goes to and its subject.

Tailscale

Runs the private network. It sees device names and connection times, never the traffic itself.

Media sources

Watch passes a search term or an item id out to fetch a stream. It does not send your name or your email.

Public and private networks

Every app you use answers on the public internet and is gated by who you are, so it works from anywhere. The private network is for the tools that maintain the server, not for the things you came for.

Inside the private network, traffic between a device and the server is not visible to an internet provider.

Who can see your content

Other members cannot see your content unless you share it with them inside an app. Each account only sees its own files, its own history and its own notes.

The person who runs the server has the technical ability to read anything on it, in the same way anyone holding the key to a filing cabinet does. That is true of any server. It is used to fix things, not to browse.

So treat NexoNet as private rather than secret. Do not store what you would not want one trusted person to be able to see.

Backups and retention

Being straight with you about this one, because it is the place NexoNet falls short of what you would get from a company.

Nightly backups

Databases and configuration are copied every night and the last 14 days are kept.

Where they sit

On the same server, and not encrypted. They protect against a mistake or a bad upgrade. They would not survive the machine itself being lost.

Is that being fixed

It is on the list. Until this page says otherwise, it has not been done.

Deleted content

Gone from the app immediately, and out of the backups within 14 days.

Closed accounts

The account record and its content are deleted within seven days of you asking.

Security

Passkeys are preferred over passwords, and a passkey replaces a username and password rather than being bolted onto one. Passwords, where they are used, are stored hashed.

Sign-in records are currently held for 365 days, which is longer than they are useful for. If that bothers you, say so: it is a setting, not a principle.

If anything is ever exposed or lost in a way that affects you, you get told directly, as soon as it is understood: what happened, what was involved, and what to do. No quiet fixes.

What you can ask for

You can ask for a copy of everything held about you, ask for something to be corrected, ask for an app to be emptied, or ask for the whole account to be deleted. No form, no waiting period, and no reason needed.

You can also just stop using it. Nothing is charged, nothing renews, and nothing is sent to you but notices about your own account.

Children

An account for a child is set up by the adult who invited them, and that adult can ask for the account and everything in it to be removed at any time.

What each app holds

Every app keeps its own data, in its own place. The colour marks the app throughout NexoNet, the same one you see on your apps page and on the status page.

Changes

If this policy changes in a way that matters, the change is posted on the status page. Small corrections are made quietly and the date at the top moves.

10 September 2026 · v1.1

Rebuilt on the Prism privacy artboard: a contents rail, twelve sections and the row tables. Three subjects the old page never covered are now answered: which outside services see what, which apps answer only on the private network, and accounts for children.

27 August 2026 · v1.0

First published. Written against the running estate rather than a template: backups are named as local and unencrypted, sign-in records as kept for a year, and request logging is described rather than denied.