Privacy Policy

Nexus is a read-it-later and knowledge intelligence application. This policy explains what data we collect, how we use it, and how we protect it.

What data we collect

• Google account information — email address, name, and profile picture, received via Google OAuth during sign-in.
• Saved articles and their content — URLs you save, along with extracted article text, metadata, and reading history.
• Gmail data — email content, subject lines, and sender information, accessed only with your explicit permission through Gmail OAuth scopes. Nexus requests the Gmail modify scope to enable newsletter management features.
• Calendar events — event titles and times, accessed only with your explicit permission through Calendar OAuth scopes.
• Chat conversations — messages exchanged with the AI assistant within Nexus.

How AI processes your data

Nexus uses AI to provide intelligent features including article triage, summarization, knowledge graph extraction, and conversational chat. Article content is sent to third-party AI providers (OpenAI and Anthropic) for processing.

• If you provide your own API keys (BYO keys), your keys are used for AI requests instead of platform keys.
• AI providers may temporarily process your content in accordance with their respective data usage policies. Nexus does not control how providers handle data beyond what their policies state.

API key security

If you choose to provide your own OpenAI or Anthropic API keys, they are encrypted at rest using AES-256-GCM encryption. Keys are only decrypted at the moment an API call is made and are never logged, displayed in full, or exposed through any interface.

Data storage and security

• All data is stored in PostgreSQL with encryption at rest.
• All network traffic is transmitted over HTTPS with TLS encryption.
• Database backups are encrypted and stored in Google Cloud Storage.
• Authentication uses secure, HTTP-only session cookies.

Data retention

• Articles and their metadata are retained for as long as your account exists.
• AI-generated data (summaries, tags, knowledge graph nodes) is retained alongside the articles they were derived from.
• When you delete an article, all derived data (summaries, knowledge graph entries, embeddings) is permanently removed.
• When you delete your account, all associated data is permanently removed.

Third-party services

• Google — OAuth authentication, Gmail access, Calendar access.
• OpenAI — AI processing (triage, summarization, knowledge graph, chat).
• Anthropic — AI processing (complex reasoning, chat).
• Sentry — error tracking and monitoring. No personally identifiable information is sent to Sentry.
• Google Cloud Platform — application hosting and infrastructure.

Browser extension permissions

The Nexus browser extension requests access to nexusprod.productslab.xyz to authenticate you and save articles you choose. The extension does not read or transmit page content unless you explicitly trigger a save. It stores only an authentication token in the browser's local storage.

Your rights

If you want to access, correct, or delete your data, email us at privacy@productslab.xyz. We respond within 30 days. You can also delete your account directly from the Settings page, which permanently removes all your data.

Contact

For privacy-related questions or data deletion requests, contact us at privacy@productslab.xyz.