Privacy Policy

This Privacy Policy explains what information nxyz sources (“nxyz,” “we,” “us”) collects when you use the service at sources.nxyz.art (the “Service”), how we use it, and the choices you have. It is a general-purpose draft and not a substitute for advice from a qualified privacy professional in your jurisdiction.

1. Information we collect

Account information. When you sign up, we (via our authentication provider) collect your email address and, if you use a social sign-in, basic profile information from that provider.

Content you save. Notes, web pages, PDFs, images, audio, video, and links you save to your vault, along with any tags, collections, highlights, or annotations you create. This is the core of the Service — it exists to store and make this content searchable for you.

AI-derived data. Summaries, embeddings (vector representations used for semantic search), extracted text, and other outputs generated when the Service processes your saved content.

Billing information. If you subscribe to a paid plan, our payment processor (see Section 4) collects and processes your payment details. We do not see or store your full card number.

Usage and device data. Basic technical data needed to operate the Service — IP address, browser type, and request logs — retained briefly for security, abuse prevention, and debugging.

2. How we use your information

• To provide, maintain, and improve the Service — storing your content, generating summaries and embeddings, and powering search and “Ask this source.”
• To authenticate you and keep your account secure.
• To process subscription payments and manage billing.
• To respond to support requests sent to hey@nxyz.art.
• To detect, prevent, and investigate abuse, fraud, or security incidents.

We do not sell your personal information or your saved content. We do not use your saved content to train AI models.

3. AI processing & third-party model providers

To generate summaries, answer questions, and power semantic search, the Service sends relevant content to one or more third-party AI providers for processing. Depending on the feature and the model you select, this may include OpenAI, Anthropic, Google, DeepSeek, or OpenRouter. Embeddings (the vectors used for semantic search) are always generated via OpenAI’s API.

If you supply your own API key for a provider (“bring your own key”), requests made with that key are billed directly by that provider to your own account, and are subject to that provider’s own data-use terms. Where no personal key is configured, we use a platform-level key and the same data-use protections apply to the request as a service we operate on your behalf.

4. How we share information

We share information only with the service providers that operate the Service on our behalf, under their own data protection terms:

• Paddle.com Market Ltd — our payment processor and merchant of record for subscriptions. Paddle collects and processes payment details directly; see Paddle’s own privacy policy.
• Neon (Neon Auth / Postgres) — authentication and database hosting for your account and saved content.
• Vercel — application hosting, file storage (Vercel Blob), and infrastructure.
• AI model providers (OpenAI, Anthropic, Google, DeepSeek, OpenRouter) — process content you explicitly act on (save, summarize, ask) to generate AI features, as described in Section 3.
• Sentry — error monitoring, to help us detect and fix bugs. Error reports may include limited technical context but are not used for tracking or advertising.

We do not use third-party advertising or analytics trackers, and we do not run cross-site tracking cookies. We may disclose information if required by law or to protect the rights, property, or safety of nxyz, our users, or others.

5. Data storage & security

Your account data and saved content are stored in a managed Postgres database (Neon) and object storage (Vercel Blob), both encrypted at rest and in transit. We use reasonable technical and organizational measures to protect your data, but no method of transmission or storage is 100% secure.

6. Cookies

The Service uses strictly necessary cookies for authentication and session management. We do not use cookies for advertising or cross-site tracking. If that changes, we will update this policy and request consent where required.

7. Data retention

We retain your account and saved content for as long as your account is active. If you delete an item, it is removed from your vault and permanently deleted from underlying storage within a reasonable period. If you delete your account, we delete your personal data and saved content within 30 days, except where retention is required for legal, billing, or fraud-prevention purposes.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can export your saved content, delete individual items, or permanently delete your entire account (Settings → Data → Delete account) directly from the app — this cancels any active subscription and removes your sign-in along with everything you saved. For anything else, email hey@nxyz.art and we will respond within a reasonable time.

9. Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them.

10. International transfers

Our infrastructure providers operate data centers in multiple regions. By using the Service, you understand your information may be processed and stored outside your country of residence.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate, we will notify you directly.

12. Contact

Questions about this policy or your data: hey@nxyz.art.

This document is a general template and does not constitute legal advice. nxyz has not yet specified its registered legal entity name or jurisdiction in this draft — review and complete those details (and have this reviewed by counsel) before relying on it for compliance purposes.