Last updated 11 November 2026
- Nexur is a free, non-commercial service run by a private individual in Italy, on a server in Italy.
- We keep what's needed to run the chat and keep it safe. No ads, no trackers.
- Calls and screen shares are end-to-end encrypted and never recorded.
- Nobody browses your private messages or files: admins only see what someone reports, and every look is logged.
- You can download all your data or delete your account at any time in Settings.
1. Who is responsible
Nexur at nexur.app is run by a private individual, Filippo Pietro Neri, based in Italy, who is the data controller for the personal data described here (GDPR art. 4(7)). It is a non-commercial project: there are no ads, no paid plans and no selling of data.
Contact for anything about your data or this policy: [email protected]. There is no data protection officer; one isn't required for a service of this size (GDPR art. 37).
The service runs on a server physically located in Italy and operated by the controller. Your data is stored there and is not sent to a hosting company.
2. What we collect
Information you give us
- Account: email address, username, password (stored only as a salted Argon2 hash, never in readable form), and, if you add them, display name, avatar, banner, bio, pronouns, profile colours and links to other accounts.
- What you post: messages, edits, reactions, files and images, custom status, server names and icons, emojis, and personal notes.
- Your settings: appearance, notification and privacy choices, favourite emojis and GIFs, trusted sites.
- Linked accounts (only if you connect them in Settings → Connections): for Spotify, GitHub or Roblox, your account id and name on that service, its public details (for example your number of public GitHub repositories), and whether to show them. For Spotify we also keep an access token, encrypted, so we can see what you're playing; GitHub and Roblox tokens are used once and thrown away.
- Sign-in security: whether you turned on two-factor authentication, the name you gave each passkey, and backup-code status (the secrets themselves are stored protected and are never shown back).
- Reports and appeals you send, and anything you write to us.
Information created when you use the service
- Sessions: for each device you sign in on, the IP address, the browser or app description (user agent), and when it was created and last used.
- Activity needed to run the chat: which servers, channels and DMs you are in, what you have read, friends and blocked users, online status, typing, and who is in a voice call. Typing and voice presence live only in memory while they happen.
- Moderation records: reports about your messages (with a copy of the reported message), strikes, account restrictions and a security audit log of sensitive actions (for example sign-ins to admin tools, deletions by moderators).
- Technical logs: the server logs requests (time, address, path, result) to keep the service working and secure.
What we don't collect
No advertising or tracking cookies, no analytics, no fingerprinting, no contact-list uploads, no location, and no recording of voice or video calls.
3. Why we use it, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating your account, delivering messages, files and calls, showing your profile, syncing your settings | Performance of our agreement with you (6(1)(b)) |
| Service emails: verifying your address, sign-in codes, password resets, important notices about your account | Performance of the agreement (6(1)(b)) |
| Keeping accounts safe: sessions, two-factor sign-in, rate limits, abuse and spam prevention, security logs | Legitimate interest in a secure service (6(1)(f)) |
| Moderation: handling reports, removing illegal content, strikes and account restrictions, appeals | Legitimate interest in a safe community (6(1)(f)), and legal obligations for illegal content under the EU Digital Services Act (6(1)(c)) |
| Answering lawful requests from authorities, and defending legal claims | Legal obligation (6(1)(c)) and legitimate interest (6(1)(f)) |
We don't rely on consent for anything, so there is nothing to opt in to. Where we rely on legitimate interest you can object (see your rights).
We do not use your data for advertising, profiling or training AI models, and we do not make automated decisions that have legal or similarly significant effects on you. Rate limits and spam checks are automatic but only slow down or block a request.
4. Who can see your data
- Other people see what you share with them: your public profile, messages in the servers, channels, DMs and groups you post in, and your online status (you can appear invisible).
- Server moderators can see and remove content in their own server, as any member could see it, and handle reports about it.
- The operator (instance administrator) does not browse private conversations or files. The admin tools only show content that someone has reported, and every time they are opened it is written to the audit log. The operator also sees account details needed to run the service (for example your email, sign-in history and storage use) when handling support, security or moderation.
How your messages and calls are protected
Voice and video calls and screen shares are end-to-end encrypted, in DMs, groups and server voice channels alike. The devices in a call make temporary keys and agree on a call key among themselves; the server only relays encrypted audio and video it can't decode. The key changes whenever someone joins or leaves, and nothing is stored: the keys disappear when the call ends. Calls are never recorded.
Text messages and files are encrypted in transit (HTTPS/TLS) but not end-to-end, as on most community chat apps: they are stored on the server so it can deliver them, show history on your other devices and search them. This means the operator could technically access them, which is why access is limited to reported content and every look is logged, as described above.
5. Other companies involved
We don't sell or rent personal data. Only these outside services are involved:
- Email delivery: IONOS SE (Germany, EU) sends our service emails. It receives your email address and the content of the email, as our processor under a data processing agreement (GDPR art. 28).
- Spotify, GitHub and Roblox, only if you link them. You sign in on their site and they tell us which account is yours. For Spotify, while you're online and have "Display Spotify as your status" on, our server asks Spotify every few seconds what you're playing, and shows the song to people who can see you're online (never while you appear invisible). The song isn't stored after it stops. Each service handles your data under its own privacy policy; you can disconnect at any time, and also remove our access on their site.
- GIFs: KLIPY. GIF searches go through our server, so KLIPY gets the search words but not your identity or IP address. When a GIF from KLIPY is shown, your device downloads the image from KLIPY's servers, so KLIPY receives your IP address and browser details like any website would. KLIPY handles that under its own privacy policy and may be located outside the EU. If you don't want this, don't open the GIF picker or GIF messages.
- Links: link previews are fetched by our server, not your device, and preview images are stored on our server. Opening a link takes you to that site, which has its own policy; we ask before you leave for a site you haven't trusted.
- Authorities: we disclose data only when the law requires it (for example a valid order from an Italian or EU authority), and only what is required.
Fonts, emoji images, the desktop app and its updates are all served by our own server. Apart from GIF images and the services you choose to link (GitHub and Roblox are in the United States; Spotify is in the EU), as described above, your data isn't transferred outside the European Economic Area.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile and settings | Until you delete your account |
| Linked accounts and their tokens | Until you disconnect them or delete your account |
| What you're listening to | Only while it's playing (it expires within a minute of stopping) |
| Messages, reactions and files | Until you (or a moderator) delete them, or you delete your account. Deleted content is removed from the database right away |
| Sessions (IP address and device) | While you're signed in, then 30 days after you sign out or the session expires (sessions last at most 30 days without use) |
| IP addresses in the security audit log | 90 days (the entry stays, without the address) |
| Reports, including the copy of the reported message | While open, then 365 days after they're closed |
| Strikes | 365 days after they stop counting |
| Appeals | 365 days after they're answered |
| Disabled accounts | Kept while the decision stands, so it can be enforced and appealed; you can still ask us to delete it |
| Server logs | Rotated automatically and overwritten, normally within a few weeks |
| Backups | 14 days, so deleted data disappears from backups within 14 days |
7. Your rights
Under the GDPR (arts. 15–22) you can:
- Get a copy of your data (access and portability): Settings → Privacy & Safety → Your data → Download my data gives you a machine-readable file straight away.
- Correct it: edit your profile and account in Settings, or ask us.
- Delete it: Settings → Privacy & Safety → Your data → Delete my account deletes your account and everything you posted.
- Restrict how we use your data, or object to uses based on legitimate interest.
For anything you can't do in the app, write to [email protected]. We answer within one month (GDPR art. 12), and may ask you to confirm it's really you.
If you think we're handling your data unlawfully, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live or work in the EU.
9. Age
You must be at least 14 to use Nexur, the age at which you can agree to online services on your own in Italy (art. 2-quinquies of the Italian Privacy Code). If you are under 18, please make sure a parent or guardian is happy with you using it. If we learn that an account belongs to someone under 14, we delete it. Parents can contact us at [email protected].
10. Security
We protect your data with, among other things:
- encryption in transit for all connections;
- password hashing with Argon2, optional two-factor sign-in and passkeys;
- private files: every file link is signed and expires, and files are only shown to people who can see the message;
- admin access to content limited to reports, with an audit log;
- rate limits, regular updates and daily backups kept for a short time.
No system is perfectly secure. If a breach affects your data in a way that is likely to put you at risk, we will tell you and the Garante as the GDPR requires (arts. 33–34).
11. Changes to this policy
If we change this policy in a way that matters, we'll show you the new version in the app and ask you to agree before you continue. The date at the top shows when it last changed. See also the Terms of Service.