Privacy Policy

Overview

Nexion is a native macOS application that runs entirely on your computer. We are committed to protecting your privacy and being transparent about what data, if any, is collected.

Data That Stays on Your Device

The following data is stored locally on your Mac and is never transmitted to us or any third party:

• All application preferences and configuration (~/.nexion/)
• Terminal history and output
• Browsing history, bookmarks, and cached data
• File system contents and project data
• Git credentials and repository information
• Plugin data and userscripts
• Any code, files, or content you view or edit

AI Features and Third-Party Services

Nexion's AI-powered features (Explain Code, Diff Summary, Commit Messages, PR Descriptions, Terminal Analysis, Command Assistant, Page Summary) communicate with whichever AI provider you have configured: Anthropic (Claude), OpenAI, Codex / ChatGPT, Google Gemini, or GitHub Models. The provider is your choice, and Nexion ships with no provider configured by default.

• When you trigger an AI action, the relevant content (code, diffs, terminal output, page text) is sent directly from your Mac to the provider you selected, using either the API credential or OAuth session you configured
• Each provider's own privacy policy governs that communication: Anthropic, OpenAI, Google, GitHub, etc.
• Nexion does not proxy, inspect, store, or log the request or response beyond what your local session needs to display the answer
• API keys and OAuth tokens are stored on your Mac and are never transmitted to Nexion's servers: we do not operate an AI backend
• AI features are fully optional. If you do not configure a provider, the app never makes any AI request

AI Bots in the Terminal

AI coding agents (Claude Code, Codex CLI, Gemini CLI, Aider, GitHub Copilot) run directly in the terminal as independent processes. Nexion acts only as a host terminal: it does not intercept, modify, or log the communication between these tools and their respective services. Each tool's privacy policy applies independently.

What Agents Can Reach

An agent you launch inside Nexion is offered a set of tools for the workspace it is running in. It can open and read a browser pane, take a screenshot, draw on a canvas, add a note, drive the iOS Simulator and send you a notification. Everything it does happens on your Mac; none of it is reported to us.

What it deliberately cannot do matters more than the list above. There is no tool to type into a terminal, run a command, change a setting, load a plugin, or touch git or SSH. This is a boundary in the software, not a policy: a page that talks an agent into misbehaving still has no way to make Nexion execute anything.

Page content handed to an agent is wrapped and labelled as untrusted data, with the address it came from, precisely because a web page can try to address the agent reading it. That reduces the risk and does not abolish it, which is why the two capabilities that could do real harm, running JavaScript in a browser pane and reading or clearing browsing history, are switched off unless you turn them on in Settings → Privacy. While they are off, those tools are not offered to the agent at all.

The whole mechanism can be switched off in the same place. Doing so removes Nexion's entry from the agent configuration files it wrote, rather than merely refusing calls.

Web Browser

The built-in browser uses Apple's WebKit engine. Web pages you visit may collect data according to their own policies. Nexion's content blocker can be enabled to reduce tracking. Browser profiles use isolated cookie stores to keep sessions separate.

Plugins and Userscripts

Third-party plugins and userscripts run code that is not authored by us. While plugins run in isolated JavaScriptCore contexts with a permission system, and userscripts undergo basic security scanning, we cannot guarantee the behavior of third-party code. Review the source code of any plugin or userscript before installing it.

Email Addresses

Unlike everything else on this page, an email address identifies you. There are two reasons we might hold one, they are kept apart, and neither one implies the other.

Updates about Nexion. Giving us your address on a form only records that somebody asked. We then email that address a confirmation link, and you are on the list once you open it and not before, which is what stops anyone from signing up an address that is not theirs. We store the address, when it was asked for, when it was confirmed, and the IP address the request came from, which is the evidence that the consent existed. Every email we send carries a one-click unsubscribe link that needs no reply and no account. The legal basis is your consent (Art. 6(1)(a)), and you can withdraw it at any time.

A place in the iOS beta. If you ask for one, we record your address and the dates we approved and invited you, so we know who is waiting. To send the invitation, your address is passed to Apple: TestFlight invitations come from Apple, not from us, and this is a transfer to Apple Inc. in the United States, governed by Apple's privacy policy. There is no way to be in an Apple beta without it. Asking for a place does not subscribe you to anything: the updates list has its own checkbox, off by default, and its own confirmation.

We also keep a record of which campaign was sent to which address and whether it was delivered, so that a delivery problem can be diagnosed and so that an unsubscribe can be shown to have been honoured. We do not use tracking pixels, we do not record whether you opened an email or clicked a link in it, and we do not sell, rent or share addresses with anyone beyond what is described here. Write to [email protected] and we will delete everything we hold about your address.

Downloading Nexion

Downloads are served from storage.nexion.one, which sits behind Cloudflare. Each completed download of a release archive is recorded with the IP address it came from, the country Cloudflare derives from it, the browser's user-agent string, the file name, and the time.

This exists so we know how many people are running which build, which during a beta is how we judge whether a problem affects three people or three hundred. It is not linked to your email address, to a Nexion install, or to anything else on this page: no account is involved in a download and nothing is set on your device. Automatic updates are not counted here, because the check Nexion performs before updating is deliberately excluded from the log. The legal basis is our legitimate interest (Art. 6(1)(f)) in understanding the reach of a build we may need to withdraw.

Crash Reporting

Nexion includes an optional crash reporting subsystem powered by Sentry, hosted in the EU. Crash reports are sent only when the app crashes or throws a handled error, and only if you have left crash reporting enabled in Settings → Privacy. You can opt out at any time.

What we collect:

• The error type and a sanitized stack trace
• Nexion version and macOS version (Nexion is Apple Silicon only)
• An anonymous install identifier (a random UUID generated on first launch, not linked to your Apple ID, email, hardware serial, or any personal data)
• The feature area where the error occurred (e.g. ssh, editor, ai)

What we never collect:

• File paths, file names, or file contents
• SSH hostnames, usernames, ports, or keys
• Git repository URLs, branch names, commit messages, or diffs
• Terminal output, shell commands, or command history
• AI prompts, AI responses, or any API keys
• IP addresses (stripped at the edge)
• Browser URLs, bookmarks, or page content

Stack traces pass through a sanitization pipeline before leaving your Mac that strips home directory paths, SSH endpoints, common secret patterns, and URLs. Data is retained by Sentry for 90 days and then deleted. We can disable crash reporting remotely via a signed kill switch if a future build leaks data we did not anticipate, and the reporter self-disables after 7 days if the kill switch endpoint becomes unreachable (dead man's switch).

Usage Analytics

Nexion also includes optional product analytics powered by TelemetryDeck (TelemetryDeck GmbH, Augsburg, Germany), hosted in the EU (nom.telemetrydeck.com). Analytics help us understand which features are used and where the app is slow, so we can prioritize improvements. You can opt out at any time in Settings → Privacy.

What we collect:

• Coarse feature events (e.g. "a tab was opened", "an SSH connection was attempted", "a file was saved")
• Latency buckets, never raw timings (e.g. <500ms, 1-3s, 30s+)
• Error categories for failed operations (e.g. timeout, auth_failed): never the underlying message
• File extension categories (e.g. swift, markdown): never file names or paths
• The same anonymous install identifier used by crash reporting
• Nexion version and macOS version

What we never collect:

• File names, file paths, or file contents
• SSH hostnames, usernames, ports, or keys
• Git repository URLs, branch names, or commit messages
• Search queries or replace patterns
• AI prompts or responses
• Browser URLs, bookmarks, or page content
• Workspace names, tab titles, or bookmark names
• Keyboard shortcuts or menu commands
• IP addresses (TelemetryDeck does not log them server-side, and the anonymous install identifier is SHA-256 hashed on your Mac before any signal is sent, so the server never sees it in clear text either)
• Hardware fingerprints, MAC addresses, or Apple IDs

Every event is sampled deterministically per install so the same install does not repeatedly send the same event, and every value is either a bounded enum or a bucket, no free-text data ever leaves your Mac. Events are batched and flushed to the EU TelemetryDeck endpoint at most once every 30 seconds. Data is retained by TelemetryDeck for the minimum period supported by the plan and then deleted. Analytics can be disabled remotely via a signed kill switch, and the subsystem self-disables after 7 days if the kill switch endpoint becomes unreachable (dead man's switch). If we ever change analytics providers, a separate "provider gate" in the signed kill switch payload tells older app versions to stop sending events to the previous provider.

App Integrity & Update Checks

Nexion contacts our servers in two ways that are not part of crash reporting or analytics:

• Update check: at launch, every ~4 hours, and after wake-from-sleep, Nexion fetches our update manifest via Sparkle to learn whether a newer build is available. The request sends only the standard User-Agent string with your current Nexion version. No identifier, no usage data.
• Version support check: at launch and every ~2 hours, Nexion calls a small endpoint on our servers to verify the running build is still supported. We use this to point users running a build with a critical known issue at the fixed release. The request carries only the build number and marketing version (e.g. 4198 / 2026.8); no install identifier, no usage data. The response is an Ed25519-signed verdict that your local Nexion verifies against an embedded public key before trusting it.

Both checks transmit your IP address at the network layer (the standard cost of any HTTP request). We do not store it beyond the few seconds our rate limiter needs to enforce per-IP quotas. Both checks run regardless of your Privacy toggles: they are integrity functions rather than telemetry, and disabling them would prevent us from warning you about builds with critical known issues.

Your Rights (GDPR)

Where we hold your email address, the ordinary rights apply in the ordinary way, because there we can identify you. Write to [email protected] and we will tell you what we hold, correct it, or delete it. Unsubscribing needs none of that: the link in every email does it in one click.

Crash reporting and analytics work the other way around. They use an anonymous install identifier with no personal data attached, so we cannot link an event back to an individual, and that limits what we can honestly promise:

• Opt out at any time in Settings → Privacy. The toggles take effect immediately and any in-flight events are flushed before the subsystem shuts down.
• Right to access (Art. 15): since we cannot identify you, we cannot export "your" data on request. What we can do is describe exactly what categories of events any install may generate, which is the list above.
• Right to erasure (Art. 17): you can reset your anonymous install identifier by deleting ~/.nexion/observability.json and restarting the app. This creates a brand new identifier and orphans any prior events already stored at Sentry / TelemetryDeck (they will be deleted at the end of their retention window).
• Right to object (Art. 21): simply turn both Privacy toggles off. The app will never send anything again until you turn them back on.

Contact

For privacy-related questions, contact us at [email protected].