Privacy Policy

Last updated: October 20, 2026

1. Operator and contact information

NexaTools (nexatools.in) is an independently operated web utility platform. Most tools do not require registration, though certain features request an email address or a Google account authorization. For privacy requests, data-access or deletion inquiries, or grievances, email support@nexatools.in.

2. Browser-local processing and client-side encryption

Many formatters, calculators, image/audio/video converters, and PDF utilities run directly in your browser using JavaScript, WebAssembly, HTML5 Canvas, or the Web Crypto API. When you use those local tools, your file contents are processed in device memory rather than uploaded to a NexaTools server. However, loading any webpage still involves standard HTTP requests to our hosting CDN, font providers, and optional analytics or advertising scripts.

• NexaShare: Files are encrypted in the browser using AES-GCM prior to upload. Our server and storage provider receive the encrypted ciphertext, filename, file size, and the email address/verification token used to authorize the upload. The decryption key is placed in the URL fragment (after #key=), which browsers do not normally include in HTTP requests. Anyone with the complete URL can decrypt the file, and NexaTools cannot recover lost decryption keys.
• NexaVault: Files are encrypted and decrypted locally in the browser with AES-GCM and uploaded directly to the Google Drive account you authorize via Google's drive.file OAuth scope. Your OAuth access token is held in browser memory for the active session, and your encryption key is not transmitted to NexaTools. Google receives file metadata and ciphertext under Google's own privacy policy and terms.
• Peer-to-peer file transfer: File and chat payloads are sent over a WebRTC data channel between connected browsers. NexaTools runs a signaling service to coordinate room codes and WebRTC session descriptions (offer/answer/ICE candidates), and browsers query Google's public STUN servers to establish connectivity. Chat messages are stored locally in your browser's localStorage. Because network topology varies, this tool should not be treated as a certified security product.
• NexaBatch: File transformations run locally in your browser. If you use the optional AI workflow planner, your prompt along with each selected file's name, MIME type, and approximate size (in KB)—not the file contents—is sent from your browser to the AI provider endpoint you configure (such as Google Gemini or an OpenAI-compatible API). Any API key you enter is saved in your browser's localStorage.
• WebADB: Android Debug Bridge key pairs generated in the browser are stored locally in your browser's IndexedDB database (WebADB) and are never transmitted to NexaTools.

3. Features that transmit data over the network

When you use features that depend on server state or external data sources, the following information leaves your browser:

• URL Shortener: The destination URL, optional custom alias, expiration or click-limit rules, safety-warning flag, and optional password (which is hashed server-side before storage) are sent to the NexaTools API and stored in our database or key-value store. Destination hostnames may also be checked against DNS blocklists.
• Disposable Email: Generated mailbox addresses, credentials, and message fetches are proxied through our API to Mail.tm. Mailbox credentials are saved in your browser's localStorage under nexatools_temp_mail so you can access your inbox during your session. Message retention is governed by Mail.tm.
• External Lookup & Utility APIs: Queries entered into IP lookup, DNS/DMARC analysis, site-status check, currency conversion, Microsoft Store package lookup, or Steam Workshop lookup tools are transmitted to the corresponding upstream services (including Cloudflare/Google/Quad9 DNS, GeoJS, RDAP, crt.sh, Frankfurter, Microsoft, or Steam APIs). Those services process the request and network metadata under their own policies.
• Online Code Compilers: Source code and standard input submitted to the compiler tools are sent to Compiler Explorer (Godbolt) for remote compilation and execution. Do not submit proprietary code, credentials, or personal data to remote compilers.
• Bug Reports: Submitting the bug-report form sends your description, category, current page URL, browser user-agent string, timestamp, optional email address, and Cloudflare Turnstile verification token to our API, which creates an issue in our GitHub repository. Do not include passwords, keys, or private data in bug reports.
• Commercial Development Inquiries: If you submit an inquiry to hire us for custom web or software development, we collect your name, email address, optional phone/WhatsApp number, project category, budget range, timeline, and project brief. We use Resend to send verification codes and confirmation emails. If we proceed with a paid engagement, invoicing and payments are processed by third-party payment processors (such as Dodo Payments or Plisio for cryptocurrency); NexaTools does not collect or store raw payment card numbers, CVVs, or bank credentials.
• Hosting, Security, Advertising, and Analytics: Our site and APIs run on Cloudflare, which processes IP addresses and HTTP request headers for routing, DDoS mitigation, and security. Some pages include Cloudflare Web Analytics or contextual ad slots served by Sponsoric (sponsoric.com). We also use Google Analytics 4 with Consent Mode v2: analytics storage and ad-related consent signals default to denied unless you explicitly accept cookies via our consent banner or Cookie Policy controls. In denied mode, Google may still receive basic cookieless pings.

4. How we use and share information

We process data solely to operate the tools you request, maintain infrastructure security, prevent abuse, respond to support or project inquiries, and measure aggregate site performance. We do not sell personal data to data brokers. Data is shared only with the infrastructure, payment, email, or API providers necessary to fulfill the specific feature you choose to use.

5. Data retention and deletion

• Verification codes and upload sessions: Email verification codes expire after 10 minutes and upload session tokens expire after 15 minutes. Daily per-email upload counters reset on a 24-hour cycle.
• NexaShare files: Shared files are intended for short-term transfer (typically up to 7 days), after which automated cleanup routines remove expired files where supported. Because cleanup schedules and storage backends can vary across environments, do not rely on NexaShare for permanent archival storage, and delete or avoid uploading sensitive files you do not want retained in encrypted form.
• Shortened URLs: Short links with a specified expiration (up to 1 year) or maximum click limit are disabled or removed once the limit is reached. Links created without an expiration date remain stored until removed by administrative cleanup or an abuse/deletion request.
• Browser storage: Data saved in localStorage or IndexedDB remains on your device until you clear it using the tool's reset controls or your browser settings. sessionStorage entries are cleared when you close the browser tab. See the Cookie Policy for a full table of storage keys.

6. Your privacy rights

Depending on where you live, you may have statutory rights regarding your personal data:

• India (DPDP Act, 2023): You may request access to a summary of personal data processed by us, correction or erasure of your personal data, grievance redressal, and the right to nominate an individual in accordance with the Digital Personal Data Protection Act, 2023.
• EEA, UK, and Switzerland (GDPR / UK GDPR): You may request access, rectification, erasure, restriction, or portability of your personal data, object to processing, withdraw consent at any time (for example, via our Cookie Policy controls), or lodge a complaint with your local data protection authority.
• California and US State Privacy Laws (CCPA/CPRA): You may request disclosure or deletion of personal information collected about you and correction of inaccurate information. We do not sell personal information for monetary consideration.

To exercise any of these rights for server-held records (such as a shortened URL, project inquiry, or bug report), email support@nexatools.in with the relevant details so we can locate the record and verify your request. Note that we cannot delete data held independently by third-party services (such as Google Drive, Mail.tm, or Compiler Explorer) on your behalf.

7. Security and user precautions

We use HTTPS encryption and standard access controls, but no internet transmission or browser environment is immune to risk. Malicious browser extensions, compromised devices, or leaked share links can expose data even when a tool runs client-side. Always keep backups of your original files and store encryption keys securely.

8. Policy updates and grievance contact

We update this Privacy Policy when our tools, third-party integrations, or legal obligations change, and we post the revision date at the top of this page. For any privacy questions or grievances, contact support@nexatools.in.