Privacy policy

Deutsche Fassung

This policy describes which personal data NEXORA processes, as the software actually does it. Details that depend on this installation (the AI assistant or the mail server, for example) are read from its configuration. The German version is authoritative. It does not replace a legal review by the operator.

1. Controller

Raphael Krämer
Elly-Heuss-Knapp Weg 12 Gärtringen 71116 Deutschland
Email: raphael.kraemer15@gmail.com
Phone: 017670328053

2. In short

No advertising, no third-party tracking, no analytics cookies.
Exactly one cookie: the session cookie while you are signed in.
Fonts, images and scripts come from this server, not from other servers.
You can download your data and delete your account in the settings at any time.

3. Hosting

NEXORA runs on a server of this provider, who stores the data on our behalf: Prepaid Host Im Eichengrund 10 37170 Uslar

Uploaded files are kept on the same server.

4. Account and profile

For an account we store your email address, username, display name and a hash of your password (Argon2id; the password itself is never stored). Optionally, whatever you add to your profile: biography, location, links, skills, interests, experience, availability, profile and cover image. Your privacy settings decide what others see. If you use two-factor authentication, the secret of your authenticator app is stored encrypted and your recovery codes only as hashes.

The legal basis is Art. 6(1)(b) GDPR (the contract of use). The data is kept until you delete your account.

5. Cookie and browser storage

NEXORA sets a single cookie, nexora_session (with the __Host- prefix over HTTPS). It holds a random identifier of your sign-in, cannot be read by scripts, is sent only to this site and lasts 30 days or until you sign out. It is strictly necessary for signing in (section 25(2) no. 2 TDDDG), so no consent is needed.

For coding challenges your browser keeps code drafts in local storage. They leave your browser only when you submit a solution.

6. Sessions, security log and abuse protection

For every sign-in we store the browser name, IP address and times. You see these sessions in your settings and can end them there. An automatic cleanup job deletes expired and ended sessions, after 30 days at the latest.

A security log records sign-ins, failed sign-ins, changes of password, email address and two-factor authentication, and moderation actions, with the IP address. The address is removed after 30 days; the entry itself stays.

Against abuse we limit how often an IP address or email address can perform certain actions. Hashed values are kept in a cache for at most 24 hours for this. The legal basis for this section is Art. 6(1)(f) GDPR; our legitimate interest is the security of accounts and the platform.

7. Waitlist

Before the launch you can join the waitlist. We store your email address, optionally a desired username and your answer to “What do you want to build?”, plus the time and IP address of the signup and of the confirmation as proof of your consent (double opt-in). An entry counts only after you opened the link in the confirmation mail; unconfirmed entries are deleted after 48 hours. A confirmed username stays reserved for you until 30 days after the launch.

We write to you only about the waitlist and your invitation. Every such mail contains a link that removes you with one click; the entry is then deleted at once. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Confirmed entries are kept until you leave the waitlist or delete your account.

8. Email

NEXORA sends mail through the mail server 10.0.2.2 the operator set up. It sends only mail about your account (confirmation, password, security notices, address changes, deletion), about the waitlist and, only if you switch it on per kind under Settings, Notifications, notifications (at once or as a daily digest; never the text of messages). Every notification mail has a link that stops it with one click. There is no newsletter and there are no tracking pixels or tracked links.

9. Fonts

The fonts Archivo and JetBrains Mono are served from this server. Your browser does not contact any font service for them.

10. Statistics for developers

People who own a profile or project see how often it was viewed. A view counts once per visitor and day. Only a hash of your account id (or, when not signed in, your IP address) with a random daily value is stored, and that value is deleted after 2 days. After that nobody, not even the operator, can tell who viewed a profile. No cookie is set. Views are deleted after 90 days. Other numbers (new followers or likes, for example) are counted from existing records. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is telling developers how far their work reaches.

11. Content, messages and live features

Others see projects, posts, comments and public profiles as you set them. Direct messages, group conversations and their files are seen only by the conversation's current members, workspaces only by the team's members. For live updates your browser keeps a connection to the server; whether you are online is held in a cache only while connected, shown only to people you share a conversation with, and never if you switched off “Show activity”.

12. Uploaded files

Images are re-encoded on upload, which removes metadata such as camera details and GPS position. Other files are stored unchanged after their type was checked. Files are deleted with the content they belong to. The cleanup job deletes files no content points to after 24 hours.

13. AI assistant (NEXORA AI)

NEXORA AI is not set up on this installation. No data is sent to any AI provider.

14. Coding challenges

Submitted code is stored with its result and visible only to you. It runs on the operator's server in an isolated container without network access. Solved challenges and points appear on the leaderboard only if your profile is public and “Show activity” is on.

15. Recipients

Only the hosting provider (section 3) and, if you use the AI assistant and it is set up, Anthropic (section 13) receive data. We do not sell data or pass it on for advertising.

16. Your rights

You have the right to

access (Art. 15 GDPR) and data portability (Art. 20 GDPR): Settings, Account, “Download my data” gives you everything in one JSON file;
rectification (Art. 16 GDPR): you change your profile and email address yourself in the settings;
erasure (Art. 17 GDPR): Settings, Account, “Delete my account”, at once and completely, as described there;
restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR) to processing based on legitimate interests;
withdraw consent for the future (Art. 7(3) GDPR), for example with the unsubscribe link of the waitlist;
lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is: Supervisory Authority under Article 77 GDPR The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW) Address: Heilbronner Straße 35 70191 Stuttgart Germany Postal address: Postfach 10 29 32 70025 Stuttgart Germany Email: poststelle@lfdi.bwl.de Website: https://www.baden-wuerttemberg.datenschutz.de/

For anything you cannot do yourself in the settings, write to raphael.kraemer15@gmail.com.

17. Automated decisions

Reputation and achievements are computed by publicly described rules. There are no automated decisions with legal effect within the meaning of Art. 22 GDPR.