Privacy Policy

1. Who we are

Devilos LLC, a Wyoming limited liability company ("we"), runs nuxter.app and sells Nuxter licenses there. We decide how the data in this policy is used. Our registered address is 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Write to us from the contact page.

This policy covers the site, your account on it and the seats on your licenses. It does not cover the apps you build with the kit. Those are yours to look after, as section 9 of the Nuxter Commercial License says.

It also covers the demo at demo.nuxter.app, where anyone can make an account and try the kit. The demo keeps its own database, apart from the site's, and we wipe it every day at 03:40 UTC, with every account and everything in it, and the photos uploaded there. A Cloudflare Turnstile check confirms that a person is signing up, signing in or asking for a new password. The demo stores your email address, your name if you give one, your password as a one-way hash, and any passkey or authenticator app you add. Each sign-in records its IP address and browser. Photos uploaded there are open to anyone with their link until the wipe. The demo sends its email, such as the link that confirms your address, through Cloudflare from mail.demo.nuxter.app. Its checkout runs in Stripe's test mode and charges no card. Stripe receives what you enter there and, from the demo, the plan, a checkout reference, any coupon you use, your email address and your account and organization IDs. After a test purchase, the demo's home and pricing pages can show other visitors the buyer's country. When the demo's code fails on the server, Sentry receives the report section 4 describes. The demo counts visits, sends them to PostHog in a project apart from the site's, and keeps request logs as this policy describes for the site, and sets its own cookies for signing in and for your preferences, none of them for advertising or tracking. The wipe doesn't reach analytics, request logs or error reports, which last as section 6 says, or what Stripe holds.

2. What we collect and why

Your account. Your email address, which you sign in with and which we write to. A name and a profile photo if you add them. Anyone with the photo's link can open it. If you buy while signed out, the license goes to the account for the email address you paid with, and we make that account if it doesn't exist yet, named with the name you gave at checkout.

Purchases and licenses. You enter your payment details at Stripe's checkout, and they never reach us. Stripe sends us the details of the payment, including the name, email address and billing details you entered, the amount, tax and currency, and Stripe's references for you and the payment. We keep them as the record of the sale. Each license also keeps its licensee name, the email address its notices go to, which versions of the Terms of Sale and the License you accepted and when, whether you asked for immediate delivery, and a history of its changes. Your purchases are filed under an internal billing record named after you, or after the part of your email address before the @. While a checkout is open, we keep a draft of the order with a hash of a key your browser holds, so the browser that paid can open the new license.

Seats on GitHub. For each seat, the GitHub username and the numeric id GitHub gives the account, when the seat was added and removed, and where its invitation to the repository stands. If someone adds your GitHub account to their license, this is what we hold about you, and it came from them and from your public GitHub profile. Seat photos in the dashboard load straight from GitHub.

Sign-in and security. Each signed-in device has a session record with its IP address, browser (user agent) and times of use. An activity log records sign-ins, changes to your account and purchases, each with the IP address and browser of whoever did it, where a person did. An email change also records the old and new address. A sign-in link is stored as a one-way hash with the address it was sent to, and stops working after 15 minutes. To stop abuse, we count attempts per email address, account or IP address, and a Cloudflare Turnstile check may confirm that a person sent a sign-in, checkout or contact form.

Analytics. We count visits on our own server. For each page view we record the page, the page you came from on our site with how long it was open and how far down you scrolled it, the domain of the site that sent you, your country, your device type (desktop, mobile or tablet), whether your browser looks like a bot, any campaign tags in the link and whether you were signed in. Sign-up, checkout, purchase and refund events also record what happened, such as the sign-in method, the plan or a coupon code. Each visitor gets an identifier made from the IP address and browser with a key that changes every day, and a session identifier that changes every 30 minutes. We don't store the IP address or browser with them, and analytics puts nothing on your device. When you start a checkout signed in, we note on your account whether analytics was on, so the purchase is counted the way you chose.

Our server also sends these events to PostHog, with your IP address, the address of the page with only its campaign tags and ad click identifiers kept from the query string, the address of the page that sent you and the session identifier. While you're signed in, an event carries your account ID in place of the visitor identifier, so PostHog links your signed-in events to your account. When you leave the site or close its tab, your browser also reports how long the last page was open and how far down you scrolled it, and only PostHog receives that. PostHog receives no name, email address or cookie.

You can turn analytics off under Privacy settings in the footer, or Privacy preferences in your account menu. We also don't count you when your browser sends a Global Privacy Control signal. A purchase made while signed out is the exception: it may be counted either way, with the plan but no visitor identifier.

Logs. Cloudflare keeps a log of the requests the site handles, with details of each request, our response and any error our code reports.

Messages to us. The contact page asks for your name, your email address and your message. If you're signed in, it also adds the email address of your account, and whether that address is confirmed yet. The site keeps no copy of the message: it sends it to us as an email, through Cloudflare, with your address to reply to. The contact page can also show our email address. Before a message is sent or our address is shown, a Cloudflare Turnstile check confirms that a person is asking, and we count the attempts per IP address to slow down abuse. When you write to us, from the contact page or by email, we keep the conversation to answer you.

Free tools. The tools under /tools run in your browser, and we store nothing you type into them. A few send something from your browser straight to a public service; our server takes no part, and each of those tools names the service at the top of its page. The SPF, DKIM and DMARC checker, the DMARC record generator and the custom hostname checker send the domain names and DKIM selectors you enter, and the names those records point to, to Cloudflare's public DNS resolver (cloudflare-dns.com), or to Google's (dns.google) when Cloudflare's doesn't answer. For the custom hostname checker those names are the hostname and its parent names, your CNAME target, and the hostname's _cf-custom-hostname and _acme-challenge records, and it also sends the hostname to crt.sh, which searches public certificate logs. The Nuxt upgrade checker sends nothing until you press its check button. It then downloads Nuxt's list of modules from Nuxt's API (api.nuxt.com), asks the npm registry (registry.npmjs.org) for the latest version of Nuxt and of each Nuxt module in the package.json you paste, and sends each of those modules' names and versions to jsDelivr (cdn.jsdelivr.net). The Workers compatibility checker and the package.json vulnerability scanner also wait for their check button. The first sends the names and versions of the packages you paste to the npm registry and to jsDelivr, which lists each package's files (data.jsdelivr.com) and serves the entry files it reads (cdn.jsdelivr.net); the second sends them to the OSV vulnerability database (api.osv.dev), which Google runs, and asks the npm registry for their versions and licences. The HTML email preview blocks remote images unless you turn them on; then the preview loads the email's https images from their own hosts, which see your request the way an email's tracking pixel would. Those services see your IP address and browser as any site you visit does, under their own privacy policies. Some tools keep their settings in the page address so you can share a result: the numbers you enter and the options you pick, the domain names, DKIM selectors and DMARC report addresses in the email tools, the hostname, CNAME target, validation method and wildcard setting in the custom hostname checker, the compatibility date in the Workers compatibility checker, and the expression, task names and time zone in the cron generator. When a page loads from such an address, the address reaches Cloudflare's request logs; the tool fills in its fields and sends nothing until you press its button. No tool puts a secret, a webhook payload, an email's HTML, a pasted package.json or a pasted config file in the address.

Email. We send only the email the service needs: sign-in links, order confirmations and notices about your license and your account. Your settings have switches for product and offer emails, and we keep your choice, but we send none today. The receipt for a payment comes from Stripe.

3. Legal bases

Where the GDPR or the UK GDPR applies, we rely on:

• contract, to run your account, take your order, issue your license and give its seats access;
• legal obligation, to keep purchase records for tax and accounting;
• legitimate interests, to keep the site and its accounts secure, prevent fraud and abuse, keep logs, answer your messages and count visits to learn how the site is used. You can object to these, as section 8 says.

4. Who receives it

These companies process personal data for us:

• Cloudflare runs the site and its code, stores profile photos, sends our email, including the messages you send from the contact page, runs background jobs, counts visits, keeps request logs, runs Turnstile checks and connects the site to its database.
• The company that hosts our database stores the account, purchase and license records.
• Stripe takes payments. It receives what you enter at its checkout, and from us the plan, a checkout reference, any coupon you use, and your email address and account ID if you are signed in. Stripe also uses payment data for its own purposes, such as preventing fraud, under the Stripe Privacy Policy.
• GitHub receives the usernames added as seats, so it can invite them to the private repository, and emails each one its invitation. The GitHub Privacy Statement covers GitHub accounts.
• PostHog receives the analytics events section 2 describes, from our server, and stores them in its EU region in Frankfurt, Germany. Turning analytics off stops them too, with the same exception for a purchase made while signed out.
• Sentry receives a report when our code fails on the server: the error, where in our code it happened, the address of the page or request without its query string, and a request reference. It receives no IP address, cookies, form contents or account details, though an error message can quote the value that caused it.

People at Devilos LLC see these records to run the site and help you. We also disclose data when the law requires it, for example to a court or a tax authority. We don't sell personal data.

5. Cookies and local storage

The site sets no advertising or tracking cookies. This is everything it keeps in your browser:

Stripe's checkout and GitHub set their own cookies on their own sites.

6. How long we keep it

• Account: until you delete it. Deletion becomes final 30 days after you ask. Until then the account can't be used, and we email you a link that restores it.
• Sessions: until you sign out, or after 30 days without use.
• Activity log: 90 days.
• Sign-in links: removed the next time a link is sent after they expire.
• Abuse counters: within a day of the last attempt.
• Checkout drafts: until the payment arrives, or 30 days if it never does.
• Purchase records: at least seven years after the purchase, for tax and accounting.
• Licenses, seats and their history: as long as the license lasts, and at least seven years after it ends.
• Analytics: three months, after which Cloudflare deletes them. PostHog keeps its copy for as long as our PostHog plan keeps events: one year on the free plan and up to seven years on a paid one.
• Request logs: up to seven days.
• Error reports: up to 90 days, after which Sentry deletes them.
• Background jobs, such as an email waiting to be sent again: until they run or are given up, which Cloudflare's queues limit to four days.
• Messages and emails with us: as long as we need them to answer you, or as long as the license records when they concern a license.
• The demo: until its next daily wipe, except analytics, request logs and error reports, which last as above.

Deleting your account removes the account, its sessions, its activity log, its sign-in links and its profile photo. Purchase records stay, without your email address and without the raw details Stripe sent. Your licenses stay too, with their licensee, notice address and seats, because deleting an account does not end a license (section 8 of the Terms of Sale). The billing record your purchases are filed under also stays, with its name and, in its history, your name or email address. Copies in database backups last until those backups expire.

7. International transfers

We are in the United States, and our providers process data in the United States and in other countries where they operate. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses, with the UK addendum, in our providers' data processing terms, or on another safeguard the law allows.

8. Your rights

Depending on where you live, you can ask to see, correct, delete or take a copy of your personal data, and to object to or limit how we use it.

In your dashboard's settings you can change your name, photo and email address, download a copy of your account data and delete your account. Anything else, including license and seat records, comes to us by email. Write to us from the contact page. Send your request signed in to the account it is about if you can. If you write signed out, signed in to an account whose email address isn't confirmed yet, or from an address that is not on the account or the license, we first confirm the request at the address we have.

Analytics records hold no name or email address. Those counted while you were signed out can't be traced back to you. PostHog's records of your signed-in events carry your account ID, so we can find and delete them if you ask.

In the EU or the UK, you can also complain to your data protection authority.

9. California

We don't sell your personal information or share it for cross-context behavioral advertising, as California law defines those terms. You have the rights in section 8, and using them won't change how we treat you.

10. Children

nuxter.app is for developers and businesses, not children. We don't knowingly collect data from anyone under 16. If you think a child gave us data, tell us and we'll delete it, except records the law makes us keep.

11. Changes

We may change this policy. The date at the top shows when it last changed.

12. Contact

Questions about this policy or your data come to us by email. Write to us from the contact page. Our postal address is in section 1.