Accounts, sessions, learning activity, and community features.
Product operation, progress tracking, safety, and support.
Privacy requests go to privacy@cogniflo.com.
This Privacy Policy explains what information Nuxflo collects, how that information is used, how account and session data is managed, how interaction and progress data may be stored, how user-submitted content may be handled, how cookies and session technologies are used, how admin-managed content is stored, and how you can contact us about privacy-related concerns.
When users create or sign in, we collect data such as username, email address, hashed password, account status, role, verification status, and linked identity information. OAuth access and refresh tokens remain encrypted in the authentication account store and are not copied into profile identity records.
Users may provide profile details such as display name, avatar reference, bio, timezone, and optional visibility preferences. This information personalises the experience and supports progress, streak, and activity features.
To keep users signed in securely, we store session-related data including opaque session identifiers, expiry and activity timestamps, revocation status, IP address, and user-agent details. Raw session tokens are never shown in session-management responses or privacy exports.
We store quiz attempts, answers, scores, progress counters, streaks, activity summaries, XP-like totals, achievement records, leaderboard entries, and session completion history. This data supports progress tracking, streaks, learning continuity, and other product features.
These scores and insights describe engagement and performance on Nuxflo tasks. They are not clinical, diagnostic, or psychometrically validated measures of intelligence, memory, attention, cognitive health, or mental health.
Interaction data may cover visits, timestamps, related content identifiers, and metadata for how users engage with first-class content such as quizzes, lessons, books, research, glossary entries, FAQs, release notes, blogs, and Word of the Day entries. Public statistics are aggregate-only and small cohorts are suppressed where an aggregate could identify a person. Analytics URLs retain pathnames and allowlisted campaign parameters, not arbitrary query strings or fragments.
When users interact with community features, we may store comments, votes, global messages, replies, and related content associations. This data powers those features and displays user-generated content within the platform.
Admin-managed content includes lessons, books, research entries, FAQs, glossary entries, release notes, Word of the Day, and sources. While this content is public, some associated metadata may be logged as part of publishing, syncing, and audit operations.
Voluntary one-time support uses the external Buy Me a Coffee hosted page. For a successful donation, Buy Me a Coffee sends Nuxflo a signed event. Nuxflo may publish a global thank-you using only the supporter display name supplied for public recognition, or an anonymous label; the supporter email, note, amount, and raw payment event are not published or retained by this integration. Paid Nuxflo plans use Razorpay recurring subscriptions linked to the subscribing account. Nuxflo stores the selected plan, provider subscription and payment identifiers, billing state, current period boundaries, cancellation state, and processing timestamps needed to grant access, reconcile charges, handle disputes, and meet accounting obligations. Razorpay collects payer contact and payment-instrument details under its own privacy terms; those details are not stored in the Nuxflo profile or subscription ledger.
We use collected information to create and manage accounts, authenticate securely, maintain sessions, display profiles, track progress, support comments, improve product quality, seed and sync content, troubleshoot bugs, and maintain administrative and security workflows. We operate the product — we do not treat this data as something to sell.
Nuxflo uses multiple internal systems. One system handles core accounts, sessions, quizzes, and the content registry. Another manages editorial and public content through PocketBase. Certain public records are linked to the core registry so we can track visits and engagement consistently.
We use secure, HTTP-only cookies and opaque session technologies to keep users signed in, identify valid sessions, and support logout and revocation. Session management uses a public session identifier while the secret token remains internal. Disabling essential cookies may prevent authenticated features from working.
Signed-in Free accounts may see Google AdSense ads on blog, research, and lesson pages. Google and its advertising partners may use cookies, local storage, device information, IP address, and ad interaction data to select, deliver, limit, and measure ads under Google's privacy terms and the consent choices offered where required. Signed-out visitors, active paid accounts, and administrators are not sent AdSense ad requests by these placements.
We take reasonable measures to protect account, session, activity, and content data. Measures include hashed password storage, encrypted OAuth tokens, email verification, recent-authentication checks for identity changes, server-side authorization, restricted admin credentials, managed uploads, and transactional audit and migration controls.
We retain account and canonical learning records while they are needed to operate the account. Raw analytics and content visits are retained for 90 days; security and audit history for 365 days; generated export files for no more than 24 hours; and deleted-account operational data for no more than 30 days unless limited aggregates must be retained by law.
We may disclose or process information when necessary to operate the platform, maintain security, investigate misuse, comply with legal obligations, or respond to lawful requests. We do not use this policy to claim we sell user personal data.
For viewers eligible to receive advertising, Google acts as an advertising provider and may receive the browser and interaction data needed to serve and measure an ad. Consent and privacy controls are presented according to the viewer's region and the advertising configuration.
The profile privacy screen provides a streamed downloadable JSON export and self-service account deletion. The export covers accounts, redacted identities and sessions, profiles, learning progress and answers, games, scores, visits, activity, achievements, votes, comments and messages, notifications, and analytics identifiers without password, bearer, OAuth, or session secrets. Some limited data may remain for security, compliance, or legally required aggregate reporting.
Comments, messages, or other user-generated content may be visible to others according to how the feature is designed. Avoid posting sensitive personal information in public areas.
Nuxflo is not intentionally designed to collect information from children in violation of applicable law. If you believe data was submitted improperly, contact us so it can be reviewed.
We may update this policy as the product evolves. Material updates will be reflected on this page with revised text and a new effective date when appropriate.
If you have questions or concerns about this policy or how we handle data, reach out at privacy@cogniflo.com.
