Privacy Policy

1. Data Controller

Nexflow Tech is the data controller for personal information processed through Nexura.

• Product: Nexura
• Website: https://nexura.nexflowtech.in
• Support: support@nexflowtech.in
• Privacy inquiries: privacy@nexflowtech.in

2. Scope

This policy applies to the Nexura mobile apps (iOS and Android), web application, and related services. It does not cover third-party websites or services linked from Nexura, which have their own privacy policies.

3. Information We Collect

Account & profile information

• Email address, phone number, name, username, date of birth
• Profile photo, bio, work, education, status message
• Authentication identifiers (hashed password, Google/Apple subject IDs)
• Dating/Match preferences (gender, birth year, height, interests, visibility settings)
• Privacy settings (profile visibility, discover preferences)
• Preferred app language/locale

Messages & communications

• End-to-end encrypted message ciphertext, nonces, and sender public keys
• Message metadata: conversation IDs, sender/recipient IDs, timestamps, delivery/read status, message type
• Optional list previews and media references for encrypted messages
• Social posts, stories, reels, comments, and likes
• Friend requests, follows, blocks, and reports

Media & files

• Photos, videos, voice notes, and files you upload to chats, feed, or profile
• Media stored on our cloud storage (AWS S3 or equivalent)

Calls

• Call event timestamps and participant identifiers
• Encrypted call log payloads stored server-side (call details encrypted on device)

Translation data

• Text, images, or audio you submit for translation, OCR, or speech recognition
• Source/target languages and translation history (if you enable caching)

Device & usage information

• Device type, operating system, app version, language, timezone
• IP address, approximate location (city/country from IP or device)
• Push notification tokens (Expo/FCM)
• Session and authentication tokens
• In-app actions, feature usage, and crash/diagnostic logs
• Visitor/analytics identifiers, device fingerprint, UTM campaign parameters, referrer URLs

Payment information

• Subscription plan, billing country, transaction IDs, and payment status
• We do not store full credit card numbers — payments are processed by Apple, Google, Razorpay, Stripe, or RevenueCat

4. How We Collect Information

• Directly from you when you register, update your profile, send messages, or contact support
• Automatically when you use the app (logs, cookies, device data, analytics events)
• From third-party sign-in providers (Google, Apple) when you choose those login methods
• From payment processors regarding subscription status
• From other users when they interact with you (friend requests, reports, mentions)

5. How We Use Information

We use personal information to:

• Create and manage your account and authenticate you
• Provide messaging, calls, social feed, Match, and translation features
• Deliver push notifications you enable
• Process subscriptions and prevent fraud
• Show relevant Match suggestions and friend recommendations
• Moderate content, enforce Terms, investigate abuse, and comply with law
• Improve performance, fix bugs, and develop new features
• Measure marketing effectiveness and app usage (analytics)
• Communicate service updates, security alerts, and support responses

6. Legal Basis (EEA/UK Users)

Where GDPR applies, we process data based on: (a) performance of our contract with you; (b) your consent (e.g., optional marketing, translation of specific content, push notifications); (c) legitimate interests (security, analytics, product improvement) balanced against your rights; and (d) legal obligations.

7. End-to-End Encryption

One-to-one chat messages are encrypted on your device before being sent to our servers. We store encrypted ciphertext and cannot decrypt or read the plaintext content of those messages.

We may still access and process metadata (who communicated with whom, when, message type) and encrypted blobs for delivery. Limited authorized personnel may access user account data and message metadata for support, safety, and legal compliance. We do not sell message content because we cannot access encrypted plaintext.

8. Translation & Third-Party AI Processing

When you use translation features, the content you submit is sent to Google Cloud services (Translation API, Vision API, Speech-to-Text) to generate results. This processing is separate from end-to-end encryption and involves plaintext or extracted text. Google's processing is subject to Google Cloud's terms and privacy policies.

9. How We Share Information

We do not sell your personal information. We may share information with:

• Service providers: cloud hosting (AWS), database (MongoDB), cache (Redis), email (SMTP/Resend), push notifications (Firebase/Expo), analytics, payment processors (Apple, Google, Razorpay, Stripe, RevenueCat), advertising (Google AdMob), and translation (Google Cloud)
• Other users: according to your privacy settings and the features you use (profile, posts, messages to recipients)
• Law enforcement or regulators when required by valid legal process or to protect safety
• Business transfers in connection with merger, acquisition, or asset sale (with notice where required)

All service providers are bound by contractual obligations to protect data and use it only for the services they provide to us.

10. Advertising

Free plans may show ads through Google AdMob. Ad partners may collect advertising identifiers and usage data to serve and measure ads. You can limit ad tracking in your device settings (Limit Ad Tracking on iOS, Opt out of Ads Personalization on Android). Paid plans may disable in-app ads we control.

11. Data Retention

• Active account data is retained while your account exists.
• Encrypted messages remain on our servers until deleted by users or retention policies; recipients may retain copies on their devices.
• Deleted accounts are archived in a deactivated state; core profile data is removed from active use and your email/username may become available for re-registration.
• Logs and analytics may be retained for up to 24 months for security and product improvement.
• We may retain information longer when required by law or to resolve disputes.

12. Account Deletion & Your Rights

You can delete your account in the app under Settings → Delete account, or follow the steps at https://nexura.nexflowtech.in/delete-account. Deletion deactivates your profile, removes you from search and social graphs, ends subscription access, and revokes active sessions. End-to-end encrypted messages you sent may remain on other users' devices.

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing. Contact privacy@nexflowtech.in to exercise these rights. We will respond within applicable legal timeframes (e.g., 30 days under GDPR, 45 days under CCPA where applicable).

Indian users may exercise rights under the Digital Personal Data Protection Act (DPDP), including grievance redressal via privacy@nexflowtech.in.

13. Device Permissions

The app may request permissions to provide features:

• Camera — QR codes, profile photos, chat media, camera translation
• Microphone — voice messages, calls, voice translation
• Photo library — sharing and saving media, reels, posts
• Notifications — message alerts, calls, and activity updates
• Network — required for all online features

You can revoke permissions in your device settings; some features may not work without them.

14. Children's Privacy

Nexura is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact privacy@nexflowtech.in and we will delete it. Match features require users to be at least 18.

15. International Transfers

Your information may be processed in India and other countries where we or our service providers operate. We implement appropriate safeguards for cross-border transfers as required by applicable law (e.g., standard contractual clauses for EEA data).

16. Security

We use technical and organizational measures including encryption in transit (TLS), encryption at rest where applicable, access controls, and secure authentication. No method of transmission or storage is 100% secure; use a strong device passcode and keep your app updated.

17. Cookies & Similar Technologies

Our website and web app may use cookies, local storage, and similar technologies for authentication, preferences, and analytics. You can control cookies through your browser settings. The mobile app uses device storage and secure storage for tokens and preferences.

18. Changes to This Policy

We may update this Privacy Policy periodically. The "Last updated" date at the top reflects the latest version. Material changes will be communicated via the app, email, or website notice where required by law.

19. Contact Us

Privacy questions, data requests, or grievances:

• Email: privacy@nexflowtech.in
• Support: support@nexflowtech.in
• Website: https://nexura.nexflowtech.in/privacy
• Company: Nexflow Tech