One policy across Nexosa.

The short version

• The website has no account, advertising or tracking, and sets no cookies of its own. It counts visits only if you accept that in its cookie banner, and it keeps your answer in your browser so it does not ask again.
• The publisher controls the project reference service, but does not receive account or library data from independently operated servers.
• The operator of the server you use controls its accounts and viewing data. Their identity must be shown before sign-up.
• Local media stays on your device. It is read only after you enable the feature and grant the device permission.
• You can export your server data, clear viewing history, sign out, and delete your account inside the apps.
• Every processing rests on one stated legal basis, chosen before it began; section 3 names it for each purpose, and where it is a legitimate interest, the interest and the weighing behind it.

1. Scope and responsibility

"Nexosa" in this policy means the website, desktop app, Android app and server software together. The website and software publisher is Victor Guminski. The publisher also operates the HTTPS reference service selected by a fresh Android install and is the controller for accounts created on that service. The publisher's address and electronic contact are on About this site.

Every other Nexosa server is operated independently. The person or organization running that server is the controller for accounts, access lists, viewing data and server logs connected with that server. Their name, postal address and electronic contact must appear in the privacy notice shown by the app before account creation. Do not create an account if those details are missing.

A server used only for a purely personal or household activity may fall outside GDPR under Article 2(2)(c). An operator serving anyone beyond that setting must meet the controller duties described here and any other duties that apply to their operation.

2. What is processed

Nexosa has no advertising identifiers, telemetry, automatic crash reporting, profiling or automated decisions with legal or similarly significant effects. The only thing an app ever sends the publisher is a problem report you wrote and pressed Send on.

3. Purposes and legal bases

Under GDPR Article 6(1), each purpose personal data is processed for has to rest on one legal basis, decided before the processing starts. The list below names that basis for every purpose described in section 2. Where the basis is a legitimate interest, the interest itself and the weighing against your rights are stated here rather than left for later, and you may object to that processing under section 7. Consent is never bundled into the terms of service: agreeing to the terms is agreeing to the terms and nothing else, and wherever consent is the basis it is a separate act of yours that you can take back.

• Delivering the website, the downloads and the relay, Article 6(1)(f): the connection data any web request carries, the address, the time, the page or file asked for and the browser, at the website host, the download host and the Nexosa relay, together with the security events they record. The interest is answering the request you made and keeping those three machines up and free of abuse. It is necessary because a request cannot be answered without knowing where to send the answer, and abuse cannot be stopped without seeing where it comes from. Weighed against your rights: the data is what every website sees, no identifier is added, no profile is built, it is used for nothing else, and it is kept only as ordinary connection logs. The publisher has judged that interest to outweigh the intrusion, and you can object.
• Accounts, profiles and the functions you turn on, Article 6(1)(b): creating and signing in to an account on a server, password recovery, playback positions and watched marks, favorites, playlists, the play log, the profile shown to the other accounts on the same server and the friendships between them, the data export, updates, the phone telling your own server what it plays so a PC of yours can show it on Discord, and every other function you switch on inside an app. Each is necessary to provide the part of the service you asked for, as the terms describe it, and each can be switched off, cleared or deleted inside the app.
• Nexosa Premium, Article 6(1)(b): the membership agreement: reading your Discord user id and roles once you have authorised it on Discord's own page, issuing the entitlement, renewing it while the membership lasts from your apps and your household's server, and the relay learning the household's chosen name and the Discord user id in the entitlement the server presents. None of it is possible without those, and none of it happens unless you turn Premium on.
• Local media on your device, no controller: the media index is read by the app on your own device, after a permission you grant to the operating system and can revoke there at any time, and nothing from it is ever sent to the publisher or to a server. Nobody but your own device processes it, so no controller needs a basis for it; the switch in the app and the permission in the system are what keep it yours.
• Problem reports, Article 6(1)(a): a report from the About section of an app is your consent: you write it, you decide whether a way to reach you goes with it, the switch beside it decides whether the last part of the log goes, and nothing leaves the device until you press Send. You can withdraw it by asking the publisher, through the contact on About this site, to delete the report, and it is deleted; it is kept only as long as it takes to look into the problem in any case. Separately, the website's counting of reports per address, by a hashed form of the address kept for an hour, rests on the security interest below.
• Visitor statistics on the website, Article 6(1)(a): the website counts a visit only after you press Accept in its cookie banner, which then loads Cloudflare Web Analytics: the page, the site that linked to it, browser and operating system family, the country the connection comes from and how quickly the page loaded, with no cookie set and no attempt to recognise you again, shown to the publisher as totals. The same consent is what section 3-15 of the Electronic Communications Act requires before anything is loaded onto your device for that purpose. You withdraw it under "Withdraw cookie consent" at the bottom of every page, or change it under "Cookie settings" beside it; a withdrawal on a page that has already been counted reloads that page so nothing further is counted. Remembering your answer, yes or no, is the one thing the website stores itself, and it is strictly necessary to honour that answer.
• Security and abuse prevention, Article 6(1)(f): validated access tokens, short-lived stream tickets, the invite-only email allow list on a server that has one, the limit on how many reports one address can send, and the records needed to notice and investigate an incident. The interest is protecting accounts, libraries and the services themselves from misuse. Weighed against your rights: each measure uses the least data that serves it, none of it reaches beyond the service it protects, and none of it is used to profile you. For the publisher's own services the publisher has done that weighing; the operator of an independently run server is the controller for its allow list and its incident records and must do the same for them.
• Legal duties, Article 6(1)(c): answering data protection requests within the time the law sets, assessing and notifying a personal data breach, handling a notice under Article 16 of the Digital Services Act and recording the decision on it under Article 17, and complying with a valid order from an authority.
• Connections your device makes to other services, no basis needed of the publisher: Radio Browser and the broadcasters, the Internet Archive, Openverse, ccMixter, Audius, LRCLIB, MusicBrainz, Wikidata, Wikipedia, the Cover Art Archive, CritiqueBrainz, ListenBrainz, Last.fm, Discogs, and the Discord app on the same PC. Each of those connections is made by your own device when you press something, the way a browser opens a page you asked for, carrying what section 2 says it carries and nothing about you beyond that. Nothing passes through the publisher or a Nexosa server, and the publisher never receives any of it, so the publisher is not the controller for it and does not process it. Each service is its own controller for what it receives, under the policy section 2 links.
• Special categories of personal data, Article 9: Nexosa asks for none, needs none, and the publisher processes none. A play or watch history kept on a server is ordinary account data under the second point above, but what a person listens to or watches can reveal something the law protects specially, a podcast about a health condition or religious music, say. That is why the history never leaves the server you chose, can be switched off per device, cleared and deleted by you, and is never part of a profile. A server operator serving anyone beyond their own household must keep that in mind, and a request form under section 7 must not be used to send sensitive information the request does not need.

A name and email are required only when you choose to create a server account. Local media can be used without giving the Nexosa project an account.

4. Recipients and external connections

• Cloudflare: hosts the static website and may process ordinary connection and security data for the website controller. After you accept it in the cookie banner, Cloudflare also receives the visit counts described in section 3, as a processor for the publisher, and may process them in the United States under its transfer terms.
• Public download host: receives ordinary connection data when you choose a website download, when a Nexosa server checks for updates on its own behalf or on behalf of the apps that use it, and when an app with no server connected reads the public release feed itself. No account or profile data goes with any of those requests, and private project repository addresses and credentials are not sent to the app. The Google Play build does not perform self-updates.
• Google Play: provides the Android store package, updates, integrity and related store services under your Google account. Nexosa does not receive your Google account details from Play.
• Buy Me a Coffee: takes Nexosa Premium payments under its own terms and privacy policy, and tells Discord to grant or remove the membership role.
• Discord: receives your sign-in when you turn Premium on and answers, to the Nexosa website, with your user id and your roles in the Nexosa server; later renewals, from your apps and from your household's server, ask the same question through the project's bot. If you send a problem report from an app, Discord also hosts the private channel the publisher receives it in, under Discord's own terms.
• The Nexosa relay: a machine run by the publisher that carries connections between the apps and a Nexosa Premium household's own server when they are away from home. It sees the household's chosen name, the Discord user id in the entitlement the server presents, and the addresses connections come from; the content of every connection is encrypted end to end with a key only the household's server holds.
• Radio Browser and radio broadcasters: receive a request directly from your device when you use the radio part of either app, and only then. The directory is not run by the publisher, and a broadcaster is not run by anybody connected with Nexosa.
• The Internet Archive: receives a request directly from your device when you use the open music part of either app, and only then. The Archive is not run by the publisher, and the licence on each release is the word of whoever uploaded it.
• Openverse: receives a request directly from your device when you search in either app, and only then. Openverse, run by the WordPress Foundation, is an index rather than a host: it says where an openly licensed recording lives and under what licence, and the recording itself then comes from whoever holds it, which is named on every result. Neither is run by the publisher.
• ccMixter: receives a request directly from your device when you search in either app or play a track it holds, and only then. ccMixter is not run by the publisher. Every upload on it carries the Creative Commons licence its maker chose, and the apps show only those licences anybody may play under.
• Audius: receives a request directly from your device when you search in either app or play a track it holds, and only then. Audius is a network rather than one server, so the app first asks audius.co which servers are answering and then asks one of those; each request carries a name saying it is Nexosa asking, which Audius asks for, and nothing about you. Audius is not run by the publisher. The music on it is put there by the artists themselves, and what may be played is what Audius says may be played. What the app holds from Audius lasts one session and no longer, which is what its API terms allow: the track details for five minutes, the artwork in the device's memory only and never written to the picture cache on the disk, and everything dropped when the app has been away for five minutes or is closed. Nothing from Audius is downloaded, and no play of it is recorded in your history.
• The server host: carries server traffic when the operator uses a cloud host. A server running only on a home machine has no cloud server host.

Nexosa does not sell personal data and does not share it for advertising. External providers may process data outside the EEA. The responsible controller must use an EEA region where available and put an Article 28 processing agreement and a valid Chapter V transfer mechanism in place where required.

5. Retention

• Website and download connection records follow the security and retention settings of the relevant host.
• Device settings remain until you change them or remove the app data.
• Device sessions remain until sign-out, profile removal, account deletion or token expiry.
• A Nexosa Premium link code lives for ten minutes at most. The entitlement stays on the device, and on a server it was handed to, until you forget it in the app, remove the app data, or it lapses and is not renewed; a server also lets it go the moment the website says the membership behind it has ended.
• A problem report is kept by the publisher only as long as it takes to look into it. The hashed address the website counts reports against is gone within an hour.
• The relay keeps a household's name and the Discord user id that brought it while the server is connected and for one week after, in memory only, and nothing about the connections it carried beyond ordinary connection logs.
• Playback progress, favorites and playlists remain until you clear or delete them or delete the account.
• Account name and email remain until account deletion, subject to any legal retention duty.
• After account deletion, a random account identifier with no name or email may remain for up to seven days to reject old tokens, then it is removed.
• The Android data-export file in the Nexosa cache is removed after the save or share sheet closes. A copy you save is under your control.
• Requests and reports are kept only as long as needed to answer, document and defend the decision, then deleted or anonymized.

6. Cookies and device storage

The website sets no cookies. It stores one thing in your browser, and only after you have answered its cookie banner: the answer itself, yes or no, in local storage under the name nexosa-consent, so the question is not put again on every page; that is strictly necessary to honour your answer. It counts for a year, and is removed on your first visit after that, or sooner when you change it. Visitor statistics load only after a yes, set no cookie and store nothing; they are described in section 3, and the banner is described point by point on thecookies and storage page. Its host, Cloudflare, can set security cookies of its own, depending on the publisher's Cloudflare settings; those are strictly necessary, exempt from consent under the same section 3-15, and declared with their lifetimes on the same page. The apps use no cookies. App files are limited to storage that is necessary for a feature you explicitly request, such as staying signed in, remembering settings, keeping the radio stations you chose to keep or, outside the Google Play build, installing an update you requested. This reflects the strictly necessary exception in section 3-15 of the Norwegian Electronic Communications Act. Nothing an app stores is read by the publisher, and none of it is used to recognise a device anywhere else. The apps frame nobody's page and load no player of anybody else's, so no third party sets anything on your device through them. Earlier versions of the desktop and phone apps did play three services in their own embedded players, and those players set cookies and storage inside their frames; they are gone, and the desktop app keeps a row under Tasks, settings that clears anything they left behind. On a phone, clearing the app's storage in the system settings does the same.

7. Your rights

Where GDPR applies, you may request access, correction, deletion, restriction, portability and, where relevant, object to processing or withdraw consent. You also have the right to complain to a supervisory authority.

• Access and portability: use "export my data" in the desktop tasks screen or Android Profile tab to receive the server data as JSON.
• Correction: change your display name in either app; ask the server operator to correct your email address, which is a row on that server.
• Erasure: clear watch history, remove favorites, delete playlists or delete the account inside either app. Public instructions and an outside-the-app request path are on the account deletion page. Ask the operator to remove your email from an invite-only allow list.
• Restriction, Article 18: "remember where I got to", in each app's settings and on by default, is what sends a playback position and a watched mark to your server so a film can be resumed on another screen. Switch it off and that device stops sending either from its next report onwards, including mid-playback; nothing already stored is touched, and the entries above clear or export it. It is per device, because it is the device that reports. Beyond that, contact the controller identified for the server or processing concerned.
• Objection, Article 21: to any processing that rests on a legitimate interest in section 3, contact the controller identified for the server or processing concerned; the publisher, for the website, the downloads, the relay and the report limit. Separately distributed builds provide a version-check switch. The Google Play build does not perform the external version check.
• Withdraw consent: visitor statistics on the website are withdrawn under "Withdraw cookie consent" at the bottom of every page, in one press, and changed under "Cookie settings" beside it. A problem report is deleted when you ask the publisher to delete it. Local media is switched off in the app, and the operating-system permission revoked, at any time.
• Report something in a library (Digital Services Act, Article 16): both apps carry a notice form on a server item, and one on the Android Profile tab and the desktop tasks screen for a concern about a server rather than one of its files. It asks what the item is, why you believe it is unlawful, and for your confirmation that what you have said is accurate, and will not send without all three; your account already identifies you to that server. An item notice is stored by that server for its operator. A concern about the server itself, where there is no item to point at, is handed to your device's own mail program addressed to the contact the server publishes. Nothing about either reaches the Nexosa project.
• Find out what was decided, and disagree with it (Articles 17 and 20): the decision on a notice appears in the app you reported from, under "what you reported", written out as what was done, on what ground, the operator's reason, whether anything was automated, and what you can do next. Nothing is automated: a Nexosa server has no automated detection, so a person reads every report. You can say the decision is wrong, once, free, for six months from it, and it goes back to the same operator to look at again. Article 19 exempts a qualifying micro or small online platform from most of Section 3. The location of a server in a home does not decide whether the operator is an enterprise or whether the service is an online platform, so each operator must assess the service it actually provides. Going to a court where you live is unaffected either way.

The controller normally answers a verified request within one month. In Norway you may complain to Datatilsynet, P.O. Box 458 Sentrum, NO-0105 Oslo.

8. Children

Nexosa is not directed to children under 13 and is not enrolled in Google Play's Designed for Families program. In Norway, a child aged 13 or older may give their own consent where an information-society service relies on consent. A parent or guardian must approve and supervise any use by a younger child on a private household server. Operators must not expose children to unlawful or age-inappropriate media.

9. Security and incidents

Nexosa uses authenticated profiles, validated access tokens, per-profile authorization, short-lived single-item stream tickets, secure mobile token storage and data minimization. The Google Play build accepts only HTTPS server addresses and disables cleartext traffic. Separately distributed builds can use plain HTTP on a trusted home network, but that traffic is not encrypted between the device and server.

No system is completely secure. Where GDPR applies, the responsible controller must assess a personal-data breach, notify the supervisory authority within 72 hours when required by Article 33, and inform affected people when Article 34 requires it.

10. Changes and contact

Material changes receive a new effective date and should be presented before they take effect for an account. The version shown by an independently operated server may add its controller details, providers, retention periods and local choices. It may not remove rights given by mandatory law.

Contact the server operator for account, library and server requests. Contact the Nexosa project maintainer for the website or published app itself. Include enough information to identify the relevant server or request, but never send your password or access token.