Privacy Policy

• Account data: email address, user identifiers, core authentication data, and account preferences.
• Sign-in with Google: if you choose to sign in with your Google account, we receive your email address, name, and profile photo through Google and Supabase. We do not receive your Google password or access your Gmail, Google Drive, or other Google services.
• User content: notes, snippets, text fragments, links, captured CSS selectors, settings, and other content the user chooses to save or sync.
• Usage data and statistics: number of text expansions, characters saved, links used, and other aggregated productivity metrics.
• Payment data: processed exclusively by Lemon Squeezy. NexoPad does not store full credit card numbers or full banking details.
• Support information: data that the user shares when contacting us for customer support.
• Technical information: browser type, extension version, error logs, and service operation data.
• Devices: a randomly created identifier for each browser and computer where you sign in, together with the browser and system name (for example, “Chrome · Windows”), to show them under My account › Devices and to apply the number of devices allowed by your plan.
• Windows app: what the app does on your PC and the data it sends are explained in section 23.

• Create an account or sign in.
• Save notes, snippets, links, or selectors inside the extension.
• Use the NexoPad app for Windows (see section 23).
• Add a template from the nexopad.app gallery with the “Add to NexoPad” button.
• Sync content across devices.
• Interact with our website or dashboard at dashboard.nexopad.app.
• Make a payment or subscribe to a plan.
• Contact us for support or inquiries.
• Generate technical logs required to operate the service.

• Colombia (Law 1581 of 2012): by registering or using NexoPad, you authorize the processing of your personal data for the purposes described in this policy.
• European Union / GDPR (Regulation (EU) 2016/679): processing may rely on contractual necessity, consent, legitimate interest, and legal obligation, depending on the situation.

• HTTPS/TLS encrypted communications in transit.
• Encryption at rest through infrastructure provided by AWS/Supabase.
• Row Level Security policies in the database.
• Authentication with JWT tokens and automatic refresh.
• Optional PIN lock to hide on-screen content in the browser extension.
• Signature verification for payment webhooks.

• Notify affected users by email within a reasonable period and, where applicable, within 72 hours after detecting the incident.
• Notify the Colombian Superintendence of Industry and Commerce and any other competent authority when legally required.
• Describe the nature of the incident, the categories of data affected, the measures adopted, and recommendations for users to protect their information.
• Document the incident internally, including its effects and the corrective actions implemented.

• Active account: while the user keeps an active account and uses the service.
• Inactive accounts: if an account is not used for more than 12 months, we may delete it along with all its content. We will notify you by email first, at least 30 days before deletion. To keep your account, just sign in.
• Account deletion: after an account deletion request, personal data and user content are removed within a maximum of 30 calendar days, unless a legal retention obligation applies.
• Trash: notes and links you move to the trash are automatically deleted from our servers 30 days later. In TEAMS plans, company notes deleted from the trash stay in the team trash for another 30 days, so the owner or an admin can recover them, and are then deleted.
• Audit logs (TEAMS) and support access logs: retained for 12 months from creation for security and traceability purposes, and then deleted automatically.
• Previous versions of notes (TEAMS): kept for 15 days so they can be restored, and then deleted automatically.
• Backups: backup copies that may contain user data are deleted within 90 days after account deletion.
• Billing data: retained for the period required under applicable tax law.

Colombia (Law 1581 of 2012)

• Know, update, and correct your personal data.
• Request proof of the authorization granted.
• Be informed about how your data is used.
• Request deletion of your data when appropriate.
• Revoke authorization when legally possible.
• File complaints with the Superintendence of Industry and Commerce (SIC).

European Union / EEA (GDPR)

• Access: obtain confirmation and a copy of your processed personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Restriction: restrict processing in certain circumstances.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, without affecting prior lawful processing.
• Complaint: file a complaint with the data protection authority in your country.

• Name and identification of the data subject.
• Email associated with the account, if applicable.
• A clear description of the request or complaint.
• Supporting documents, if any.

Users in Europe (GDPR)

• Access and portability: you may request an exportable copy of the data and notes we hold about you.
• Rectification: you may update or correct inaccurate data from your control panel.
• Erasure: you may request permanent deletion of your account, note vault, and associated data from our servers.
• Objection: you may object to the processing of your data for analytics or marketing purposes.

Users in California, U.S. (CCPA)

• Right to know and delete: you have the right to know what information we collect and to request its deletion.
• No sale of information: NexoPad does not sell, rent, or trade your personal data or note content to third parties.
• Non-discrimination: we will not deny service or change its quality because you exercise your privacy rights.

• The API key is stored only locally in the user's browser and is never transmitted to or stored on NexoPad's servers.
• When the user uses an AI feature, the selected content is sent directly from their browser to the chosen AI provider, using their own key, without passing through NexoPad's servers.
• NexoPad does not intercept, log, or store the content of these requests or the responses generated by the AI provider.

What it does on your PC

• Keyboard: it only remembers the last characters you type (60 at most) to recognize when you type a shortcut. Those characters exist only in your PC’s memory, are cleared when you switch windows, and are never saved to disk or sent to our servers or to third parties.
• Sensitive programs: in password managers, terminals (such as PowerShell or Command Prompt), remote desktop programs, Windows security windows, browsers (where the extension works), and any programs where you turn it off, the app keeps nothing you type and does not insert shortcuts. You can also pause it at any time.
• Clipboard: to insert a shortcut, it briefly places the text on the clipboard and pastes it; this step is kept out of the Windows clipboard history and is not synced to other devices. If a shortcut uses the clipboard variable, it reads the clipboard at that moment to complete the text, without saving or sending it.
• Screenshots: only when you use the screenshot tool. Images are saved on your PC, in the folder you choose (by default, Pictures\NexoPad), with a history and thumbnails in the app’s folder. They are never uploaded to our servers. You can delete them at any time or have them deleted automatically after 7 or 30 days. The “Copy text” feature uses the text recognition built into Windows, which works on your PC without sending the image. Scrolling screenshots take pictures of the area you choose while you scroll and join them on your PC; with "Auto scroll", the app moves the mouse wheel in that window. "Open an image" only reads the file you choose or the image you copied.
• Screen recording: only when you start it (with Alt+3 or the "Record" button), and a red frame marks the area while recording. The microphone is only used if you turn it on in the recording bar, and your PC's sound only if you enable that option; both start off and the app remembers your choice. Drawings you make while recording are part of the video. Videos are created and saved on your PC (temporary files in the app folder) and are never uploaded to our servers.
• Local copy of your data: to work quickly and also offline, it keeps on your PC a copy of your shortcuts, your basic account details (email, name, plan, and team), your usage counters, and the latest values you typed in shortcut forms. This copy is encrypted with Windows data protection, so it can only be read with your Windows user account on that PC. Your app preferences and this PC’s identifier are stored separately, unencrypted, because they don’t contain your texts. Your session is stored in Windows Credential Manager.
• Browser extension: to open the extension’s Notebook from the app, it checks the Chrome, Edge, and Firefox settings files on your PC to see whether the NexoPad extension is installed and enabled. It only looks for the extension: it does not read your history, passwords, or tabs, and it sends nothing.
• Open programs: the “Apps” section shows the programs you have open so you can choose where to turn NexoPad off. That list never leaves your PC.
• Start with Windows: the app only opens when your PC starts if you agree, and you can change this in Preferences.

What it sends to our servers

• Sign-in: your email and password, or Google sign-in, to connect to your account. With Google, your browser opens and the response returns to the app through a local address on your own PC.
• Your shortcuts: the app downloads your shortcuts and your team’s, and checks for changes from time to time.
• This PC in your account: a randomly generated identifier for this PC and the Windows version (for example, “Windows 11”), to show it under My account › Devices in the web dashboard, apply the number of PCs in your plan and let you disconnect it from there. The PC’s name is not sent.
• Usage statistics: how many times you use each shortcut and how many characters you insert, to show your time saved and to apply the monthly limit of the Free plan. The text you type and the names of the programs where you use your shortcuts are not sent.

How to delete the data on your PC

• Signing out deletes the saved session and the local copy of your shortcuts and account.
• You can delete screenshots from the app’s “Screenshots” section or from their folder.
• Uninstalling the app removes the data it keeps in its folder. Screenshots you saved in your pictures folder are kept, because they are your files. To also delete the session, sign out before uninstalling.