Accounts, sessions, learning activity, and community features.
Product operation, progress tracking, safety, and support.
Privacy requests go to privacy@nuxflo.com.
This Privacy Policy explains what information Nuxflo collects, how that information is used, how account and session data is managed, how interaction and progress data may be stored, how user-submitted content may be handled, how cookies and session technologies are used, how admin-managed content is stored, and how you can contact us about privacy-related concerns.
When users create or sign in, we collect data such as username, email address, hashed password, account status, role, verification status, and linked identity information. OAuth access and refresh tokens remain encrypted in the authentication account store and are not copied into profile identity records.
Users may provide profile details such as display name, avatar reference, bio, timezone, and optional visibility preferences. This information personalises the experience and supports progress, streak, and activity features.
To keep users signed in securely, we store session-related data including opaque session identifiers, expiry and activity timestamps, revocation status, IP address, and user-agent details. Raw session tokens are never shown in session-management responses or privacy exports.
We store quiz attempts, answers, scores, progress counters, streaks, activity summaries, XP-like totals, achievement records, leaderboard entries, and session completion history. This data supports progress tracking, streaks, learning continuity, and other product features.
These scores and insights describe engagement and performance on Nuxflo tasks. They are not clinical, diagnostic, or psychometrically validated measures of intelligence, memory, attention, cognitive health, or mental health.
Interaction data may cover visits, timestamps, related content identifiers, and metadata for how users engage with first-class content such as quizzes, lessons, books, research, glossary entries, FAQs, release notes, blogs, and Word of the Day entries. Public statistics are aggregate-only and small cohorts are suppressed where an aggregate could identify a person. Analytics URLs retain pathnames and allowlisted campaign parameters, not arbitrary query strings or fragments.
If a visitor allows analytics cookies, Nuxflo also sends limited website-use events to Google Analytics. These events may include the page pathname and title, referring site origin, content type, device category, language, campaign source, and product action. Nuxflo does not send Google Analytics an account ID, internal anonymous ID, internal session ID, email address, full referring URL, or arbitrary URL query string.
When users interact with community features, we may store comments, votes, global messages, replies, reports, and related content associations. A report includes the selected reason and any optional details the reporting user provides. This data powers community features and helps us review reported content.
Admin-managed content includes lessons, books, research entries, FAQs, glossary entries, release notes, Word of the Day, and sources. While this content is public, some associated metadata may be logged as part of publishing, syncing, and audit operations.
Voluntary one-time support uses the external Buy Me a Coffee hosted page. For a successful donation, Buy Me a Coffee sends Nuxflo a signed event. Nuxflo may publish a global thank-you using only the supporter display name supplied for public recognition, or an anonymous label; the supporter email, note, amount, and raw payment event are not published or retained by this integration. Paid Nuxflo plans use Razorpay recurring subscriptions linked to the subscribing account. Nuxflo stores the selected plan, provider subscription and payment identifiers, billing state, current period boundaries, cancellation state, and processing timestamps needed to grant access, reconcile charges, handle disputes, and meet accounting obligations. Razorpay collects payer contact and payment-instrument details under its own privacy terms; those details are not stored in the Nuxflo profile or subscription ledger.
We use collected information to create and manage accounts, authenticate securely, maintain sessions, display profiles, track progress, support comments, improve product quality, seed and sync content, troubleshoot bugs, and maintain administrative and security workflows. We operate the product — we do not treat this data as something to sell.
Nuxflo uses multiple internal systems. One system handles core accounts, sessions, quizzes, and the content registry. Another manages editorial and public content through PocketBase. Certain public records are linked to the core registry so we can track visits and engagement consistently.
We use secure, HTTP-only cookies and opaque session technologies to keep users signed in, identify valid sessions, and support logout and revocation. Session management uses a public session identifier while the secret token remains internal. Disabling essential cookies may prevent authenticated features from working.
Google Analytics is optional. Its script does not load until a visitor selects “Allow analytics.” Selecting “No thanks” keeps it disabled. The choice is stored in this browser and can be reset by clearing Nuxflo site data. Advertising personalization and Google Signals are disabled in the Nuxflo Analytics configuration.
Google AdSense serving is currently paused. Nuxflo does not load Google's advertising script or send ad-serving requests from blog, research-note, or lesson pages. If advertising is enabled after provider approval, this policy and the applicable consent experience will be reviewed before launch.
We take reasonable measures to protect account, session, activity, and content data. Measures include hashed password storage, encrypted OAuth tokens, email verification, recent-authentication checks for identity changes, server-side authorization, restricted admin credentials, managed uploads, and transactional audit and migration controls.
We retain account and canonical learning records while they are needed to operate the account. Raw analytics and content visits are retained for 90 days; security and audit history for 365 days; exports are generated on request and are not stored as download files on our servers. Deleting an account removes or anonymizes its identifying details. Anonymized activity records and erasure records may remain to keep shared records consistent and prevent deleted identities from being restored. They do not have a fixed deletion period. Encrypted backups expire under our separate backup schedule. Google Analytics data follows the separate retention setting in the Nuxflo Google Analytics property.
We may disclose or process information when necessary to operate the platform, maintain security, investigate misuse, comply with legal obligations, or respond to lawful requests. We do not use this policy to claim we sell user personal data.
When analytics is allowed, Google processes limited website-use and technical request data as Nuxflo's analytics provider. Google Analytics does not receive the Nuxflo account, internal anonymous, or internal session identifiers used by our own systems.
Ad serving is paused, so Google does not currently receive browser or interaction data from Nuxflo ad placements. Any future advertising launch will require updated disclosures and the consent and privacy controls applicable to the viewer's region.
The profile privacy screen provides a streamed downloadable JSON export and self-service account deletion. The export covers accounts, redacted identities and sessions, profiles, learning progress and answers, games, scores, visits, activity, achievements, votes, comments and messages, notifications, and analytics identifiers without password, bearer, OAuth, or session secrets. Some limited data may remain for security, compliance, or legally required aggregate reporting.
Comments, messages, or other user-generated content may be visible to others according to how the feature is designed. Avoid posting sensitive personal information in public areas.
Nuxflo is not intentionally designed to collect information from children in violation of applicable law. If you believe data was submitted improperly, contact us so it can be reviewed.
We may update this policy as the product evolves. Material updates will be reflected on this page with revised text and a new effective date when appropriate.
If you have questions or concerns about this policy or how we handle data, reach out at privacy@nuxflo.com.
