Privacy Policy

Effective date: May 30, 2026 · Last updated: July 3, 2026

NEX (“NEX,” “we,” “us,” or “our”) operates nexrbx.com, the NEX desktop application for Windows and Linux, and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information, and how you can exercise your privacy rights.

We designed this notice for users worldwide, including under the EU/EEA and UK General Data Protection Regulation (“GDPR”), the Australian Privacy Act 1988 and Australian Privacy Principles (“APPs”), and United States state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”).

1. Who we are

For purposes of applicable privacy law, NEX is the data controller (GDPR) and APP entity (Australia) responsible for personal information processed through the Service. NEX is based in the United States.

Privacy contact: [email protected]
For privacy-related requests, please email from your registered account email when possible so we can verify your identity. A physical mailing address for privacy correspondence is available upon request by emailing the address above.

We have not appointed a separate Data Protection Officer. Privacy inquiries may be sent to [email protected].

2. Information we collect

Depending on how you use the Service, we may collect the categories of information below.

We do not intentionally collect sensitive categories of personal information (such as government ID numbers, precise geolocation, racial or ethnic origin, health data, or biometric templates) unless you voluntarily provide such information in free-form content. Please do not include sensitive information in public profile fields, uploads, or support messages unless necessary.

3. How we collect information

• Directly from you when you register, sign in, update settings, upload content, contact us, or make privacy choices.
• Automatically when you visit or use the Service, including through cookies, server logs, security tooling, and consent management systems.
• From third parties such as Discord or Google when you use OAuth sign-in, Cloudflare when traffic is proxied, email delivery providers, analytics or advertising partners where enabled, and infrastructure providers that host or store data.

4. How we use information & legal bases

We use personal information for the purposes below.

Where we rely on legitimate interests, we balance those interests against your rights. You may object to certain processing as described in Section 12.

5. Cookies & similar technologies

We use cookies, local storage, session storage, and similar technologies to operate the Service, remember preferences, protect accounts, and—where permitted—measure usage or show ads.

Examples of technologies we use

• Essential cookies / storage: authentication session cookies, CSRF protection tokens, visitor identifiers used for consent management, and settings needed to operate the site securely.
• Preference storage: analytics consent choice, ad opt-out preference, dismissed announcement banner IDs, and similar local settings.
• Analytics technologies: first-party analytics session identifiers and event data when you consent; third-party tags from Google Analytics / Google Tag Manager on many pages.
• Advertising technologies: third-party ad scripts on public listing pages when ads are enabled and not opted out.

You can control some technologies through your browser settings (block or delete cookies), through our analytics consent banner, and through Dashboard → Settings for site promotions/ads. Blocking essential cookies may prevent parts of the Service from working.

6. Analytics & advertising

First-party analytics

Our own analytics tooling records events such as page views, searches, and interactions only if you have consented through our analytics consent banner. Consent is stored per account where signed in, and via consent records linked to a visitor identifier or hashed IP for anonymous visitors.

Third-party analytics

We use Google Analytics (measurement ID G-8SWZ4MS20S) and Google Tag Manager (GTM-PDVWR3RM) on many pages. Google may collect information such as device identifiers, IP address, browser data, and usage events according to Google’s policies. You can learn more at Google’s Privacy Policy and opt out via Google Analytics Opt-out Browser Add-on.

Advertising

We may display third-party ads on public listing pages unless you disable “Site promotions” in Dashboard → Settings, or you have an active Nex+ membership (ad-free). Ad partners may use cookies or similar technologies to deliver and measure ads.

We do not sell your personal information for money. Under some U.S. state laws, certain ad and analytics disclosures may be considered “sharing” for cross-context behavioral advertising. See Section 13 for opt-out options.

7. Desktop application

In addition to the website, we offer the NEX desktop application for Windows and Linux. When you install and run the app, we process the following in addition to the information described elsewhere in this notice:

• Install identifier: the first time the app runs, it generates a random identifier that is stored locally on your device and sent with usage signals so we can count distinct installations. It is not derived from your hardware and you can reset it from within the app.
• Usage & version telemetry: each time the app launches it sends a “heartbeat” containing the install identifier, your operating system platform, and the app version. From this we derive the number of launches and the first-seen and last-opened timestamps for each installation. When you are signed in, this activity is linked to your account so we can measure active users and support your account.
• Download logging: when an installer is downloaded, we log the file name, platform, version, size, a hashed IP address, and user-agent to understand download volume and detect abuse.
• Automatic updates: the app periodically checks our servers for new versions and can download and install updates so you stay on a supported release.
• In-app notifications: the app periodically checks our servers for informational and promotional messages (for example, new script uploads, product news, and updates) and may display them as desktop notifications. See Marketing communications for how to turn these off.

We use desktop information to provide and secure the app, measure adoption and active usage, understand which versions are in use, deliver updates and notifications, and improve the product. Our legal bases are performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interests in operating, securing, and improving the app (Art. 6(1)(f)), and, for promotional notifications, your consent or opt-out where required.

Your controls. You can disable usage telemetry, turn off notifications, and reset your install identifier from the app’s settings. Disabling telemetry stops future heartbeats; existing records are retained and deleted per Section 10. Turning off notifications stops the app from displaying them.

8. How we share information

We share personal information only as described below.

• Service providers / subprocessors that help us operate the Service, such as hosting, CDN, email delivery, analytics, advertising, storage, and security providers.
• Identity providers (Discord, Google) when you choose OAuth sign-in.
• Other users and the public when you publish profile information, scripts, comments, or other public content.
• Moderation & safety where necessary to enforce policies, protect users, or respond to abuse reports.
• Law enforcement when we identify or reasonably suspect child sexual abuse material (CSAM) or other serious unlawful activity, as described in Section 16. We may disclose account and technical records we hold about the relevant user to appropriate authorities.
• Legal & business transfers if required by law, court order, or governmental request, or in connection with a merger, acquisition, financing, or sale of assets with appropriate safeguards.

Subprocessors & key third parties

Our current subprocessors and integrations may include:

• Cloudflare — content delivery, security, and DDoS protection
• Resend — transactional and marketing email delivery
• Amazon Web Services (AWS) — storage and infrastructure where enabled
• Google — Analytics, Tag Manager, and OAuth
• Discord — OAuth and bot/integration services where used

This list may change as our infrastructure evolves. We require service providers to handle personal information consistent with this policy and applicable law.

9. International transfers

NEX is located in the United States. If you access the Service from outside the U.S., your information may be processed in the U.S. and other countries where we or our providers operate.

Where required by GDPR or UK GDPR, we rely on appropriate safeguards for transfers outside the EEA/UK, such as Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms offered by our providers.

Under APP 8, we take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the APPs, including contractual protections where appropriate. By using the Service, you acknowledge that cross-border processing may occur.

10. Data retention

We retain personal information only as long as reasonably necessary for the purposes described above.

• Account data: retained while your account is active and as needed thereafter for legal, security, or backup purposes.
• Deleted accounts: when you delete your account, we deactivate it, anonymize core identifiers (such as email and username), end active sessions, and process deletion requests. Some residual records may remain in backups or logs for a limited period.
• Security & auth logs: generally retained up to 12 months, with IP addresses and user-agent strings in security/auth logs removed after approximately 90 days.
• Analytics consent records: retained while relevant to demonstrate consent; stale anonymous consent records may be deleted after approximately 30 days.
• Marketing records: retained while you remain subscribed and for a reasonable period afterward to honor opt-outs and legal obligations.
• Desktop app records: installation and usage records (install identifier, platform, version, launch counts, and last-opened timestamps) are retained while relevant to measure active usage; download logs follow the security/auth log periods above, with hashed IP addresses removed after approximately 90 days.
• Public content: may remain visible if mirrored, cached, or copied by third parties outside our control even after deletion from our systems.

11. Security

We use administrative, technical, and organizational measures designed to protect personal information, including password hashing, access controls, rate limiting, CSRF protections, transport encryption (HTTPS), and security monitoring. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of a data breach likely to cause serious harm under Australian law, we will assess notification obligations and notify affected individuals and regulators where required.

12. Your privacy rights

Depending on where you live, you may have some or all of the rights below. We will not discriminate against you for exercising privacy rights permitted by law.

Rights available to many users

• Access — request confirmation of whether we process your information and obtain a copy.
• Correction / rectification — request correction of inaccurate information. You can update much of your profile in Dashboard → Settings.
• Deletion / erasure — request deletion of personal information, subject to legal exceptions.
• Portability — receive certain information in a structured, commonly used, machine-readable format where applicable.
• Restriction — request that we limit processing in certain circumstances.
• Objection — object to processing based on legitimate interests, including profiling tied to those interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Marketing opt-out — unsubscribe from promotional email via message links or Dashboard → Settings → Marketing emails.
• Analytics opt-out — decline analytics in our consent banner; change consent later by clearing site data or contacting us.
• Ad opt-out — disable “Site promotions” in Dashboard → Settings and use partner opt-out tools linked above.

How to exercise your rights

Email [email protected] with your request. Include enough information for us to verify your identity. Signed-in users may also use authenticated account tools where available:

• Data export: request a copy via email, or use our authenticated export endpoint at /api/settings/export when signed in.
• Account deletion: email us, or submit an authenticated deletion request to /api/settings/delete-account with confirmation as required by the API.

We aim to respond within 30 days, or the timeframe required by applicable law (for example, 45 days under CCPA/CPRA where extensions apply). We may request additional verification for sensitive requests.

EEA, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority. A list of EU authorities is available from the European Data Protection Board. UK complaints may be submitted to the Information Commissioner’s Office (ICO).

Authorized agents

Where permitted by law (including California), you may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and direct verification from you.

13. California notice (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy.

Categories collected in the preceding 12 months

Sale or share of personal information

We do not sell personal information for monetary consideration. We may allow certain analytics and advertising partners to collect information through cookies or similar technologies on our site, which may constitute “sharing” for cross-context behavioral advertising under California law.

Your opt-out choices:

• Disable “Site promotions” in Dashboard → Settings.
• Use Google ad personalization controls at adssettings.google.com.
• Submit a “Do Not Sell or Share My Personal Information” request to [email protected].
• Honor Global Privacy Control (GPC) signals where we detect them and where legally required.

Sensitive personal information

We do not use or disclose sensitive personal information for purposes requiring a “Limit the Use of My Sensitive Personal Information” right under CPRA. If that changes, we will update this policy and provide a limit mechanism.

Shine the Light

California Civil Code § 1798.83 permits California users to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their independent direct marketing purposes in exchange for compensation. Requests may be sent to [email protected].

Other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, and other states with comprehensive privacy laws may have similar rights to access, delete, correct, opt out of targeted advertising, and appeal denied requests. Contact [email protected] to exercise those rights.

14. Australia notice (Privacy Act & APPs)

We manage personal information in an open and transparent way consistent with APP 1. This policy describes the kinds of personal information we collect, how we collect and hold it, the purposes of collection, how to access and correct it, and how to make a complaint.

• Collection: we collect information that is reasonably necessary for our functions and activities, including operating accounts, securing the platform, and communicating with you.
• Direct marketing: we send promotional email only in accordance with your choices and applicable law. You may opt out at any time.
• Overseas disclosure (APP 8): we use providers that may process data outside Australia, including in the United States. We take reasonable steps to ensure overseas handling complies with the APPs.
• Access and correction (APP 12 & 13): you may request access to or correction of personal information by contacting [email protected].
• Complaints: if you believe we have mishandled personal information, contact us first. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

15. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact [email protected] and we will take appropriate steps to delete it.

Where GDPR applies, we do not knowingly rely on consent from children under the age required by local law (typically 16, or 13 where permitted) for information society services without appropriate parental authority.

16. Thumbnails & prohibited imagery

When you upload scripts or other content to the Service, you may provide preview images (“thumbnails”). Thumbnails are subject to the rules below. We review thumbnails and related uploads as part of moderation and safety operations described elsewhere in this policy.

Thumbnail rules

Thumbnails must not contain:

• Images of people (including photographs, realistic depictions, or other identifiable human likenesses); or
• Images of children (minors), in any form.

These restrictions apply regardless of whether a person or child is named, whether the image is cropped or low resolution, and whether the thumbnail is marked public or private within the Service.

Enforcement

If we determine that a thumbnail or related upload violates this section, we will delete the offending content and ban the responsible account, typically without prior notice. Bans may be permanent. We may retain records needed for security, legal compliance, and abuse prevention as described in Section 10.

Child sexual abuse material (CSAM)

If we identify or reasonably suspect CSAM—including in thumbnails, uploads, profiles, or other user content—we will report it to appropriate law enforcement authorities (such as the National Center for Missing & Exploited Children in the United States, or equivalent agencies in other jurisdictions).

In connection with such reports, we will preserve and disclose to law enforcement all personal information and technical records we have gathered about the user or account involved, to the extent permitted or required by law. This may include, without limitation:

• Account identifiers, username, email address, and registration details;
• IP addresses, device and network signals, session data, and security or authentication logs;
• Upload metadata, file hashes, timestamps, and moderation history;
• Communications with us related to the account or reported content; and
• Any other information we process about that user as described in Section 2.

By using the Service, you acknowledge that we may take these steps without separate notice to you where the law or an ongoing investigation requires it. If you encounter content you believe may be CSAM, contact [email protected] immediately and do not redistribute the material.

17. Automated processing

We use automated systems for security and integrity, including hashed device fingerprinting and network signals to detect banned users, suspicious login activity, and abuse. These processes support moderation and account protection; they do not produce legal or similarly significant effects solely by automated means without human review where required by law.

18. Marketing communications

Promotional email practices are described in our Promotional Policy. Transactional and security email may still be sent even if you opt out of marketing. You can manage marketing preferences in Dashboard → Settings → Marketing emails or through unsubscribe links in messages.

Desktop notifications. The NEX desktop application may display informational and promotional notifications (for example, new script uploads, product news, and update announcements). You can turn off notifications in the application’s settings.

19. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be posted on this page and, where appropriate, notified through the Service or by email. Continued use after the effective date constitutes acceptance of the updated policy, to the extent permitted by law.

20. Contact us

Questions or privacy requests: [email protected]

Terms of Service · Promotional Policy · Home