Privacy policy

This policy explains what personal data Nexus Tweaks ("we") processes through this website and Nexus Tweaks ("the app"). The short version: the app sends no telemetry and only checks your account when it starts, the website uses cookieless analytics, your account holds just what's needed to sign you in, and payments are handled by Stripe.

Who is responsible

Nexus Tweaks. Contact: our Discord server.

The app

Nexus Tweaks has no telemetry and no update checks. Settings, change history, benchmarks and logs are stored only on your PC, in %LOCALAPPDATA%\NexusOptimizer. The app uses the network only for:

• the account check. When you sign in, and each time the app starts, it sends us your sign-in token (or, when you sign in, your email and password), a device ID, your PC's name and the app version, and we record the IP address the request comes from. The device ID is a one-way hash of Windows' machine ID, so it can't be turned back into that ID. We use this to confirm your plan, count your PCs against it and show them on your account page. IP addresses are used only to spot abuse, such as one account being shared widely, never to decide whether you can sign in. Your sign-in token is stored on your PC, encrypted with Windows' data protection for your Windows user;
• live latency probes to a host you can change or turn off;
• network tests you start (pings, connection tests, DNS lookups, download and bufferbloat tests);
• app installs you start, which download through winget from the publisher;
• links you click.

Apart from the account check, none of these send information about you to us. If you send us a log file with a support request, we use it only to answer that request.

This website

Your account. When you create an account we store your email address and a scrypt hash of your password (never the password itself), when you confirmed your email, and your sign-in sessions (with the IP address and browser name they started from, so we can protect your account). We also store the PCs signed in to the app, as described above, and your purchases. We use this to sign you in on the website and in the app, deliver what you bought, and provide support. Account emails (confirming your address, resetting your password, purchase confirmations) are sent through Resend.

Analytics. We use cookieless analytics ([Plausible or Umami]) to count page views and simple events, such as a checkout being opened. They don't use cookies, don't collect personal data and don't track you across sites. Data is aggregated.

Hosting. Our host ([Vercel / Cloudflare]) processes technical data such as IP addresses to deliver the site and protect it from abuse. It is kept only as long as needed for that.

Support form. When you contact us, we process your name, email address, order number (optional), message and any file you attach, to answer you. The message is delivered to us by email through Resend. Spam protection is provided by Cloudflare Turnstile, which processes technical data from your browser to tell people from bots.

Purchases. Checkout runs on Stripe's own payment page. Stripe collects your payment and billing details under its own privacy policy and, through Stripe Managed Payments, acts as the merchant of record for the sale. We receive your order ID, email address, plan and amount, and attach the purchase to your account so the app can sign in with it. We also store Stripe's customer ID for your account, so later purchases use the same customer. We never receive your card details.

Legal bases (GDPR)

• Performing a contract with you: your account, purchases, the app's account check and PC limit, support for buyers.
• Legitimate interests: answering enquiries, keeping the site and accounts secure (including recording IP addresses to spot abuse), aggregated cookieless analytics.
• Legal obligations: keeping transaction records where the law requires it.

How long we keep data

• Support messages: [RETENTION_PERIOD e.g. 24 months after the conversation ends].
• Your account and the PCs on it: until you ask us to delete your account. Removing a PC deletes its record. Expired website sessions and used email links are deleted regularly.
• Order records: as long as your account exists and as required by tax law.
• Analytics: aggregated, without personal data.

Your rights

You can see your account, PCs and purchases on your account page, and ask us for access to, correction or deletion of your personal data (including deleting your account), restriction of or objection to processing, and data portability. Contact us on our Discord server. You can also complain to your data protection authority.

Changes

We'll update this page when practices change. The date at the top shows the last change.