[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"legal-en-\u002Flegal\u002Fpolicy":3},{"id":4,"title":5,"body":6,"description":509,"draft":510,"extension":511,"meta":512,"navigation":513,"path":514,"seo":515,"sitemap":516,"stem":518,"updatedAt":517,"__hash__":519},"legal_en\u002Flegal\u002Fpolicy.md","Privacy Policy",{"type":7,"value":8,"toc":493},"minimark",[9,14,21,30,33,37,44,55,61,67,73,76,79,85,91,101,107,111,114,136,140,143,194,197,201,204,337,340,344,430,436,440,443,447,450,456,459,462,466,469,473,476,480,483,487],[10,11,13],"h2",{"id":12},"_1-who-we-are","1. Who we are",[15,16,17,18],"p",{},"Devilos LLC, a Wyoming limited liability company (\"we\"), runs nuxter.app and\nsells Nuxter licenses there. We decide how the data in this policy is used. Our\nregistered address is 30 N Gould St, Ste N, Sheridan, WY 82801, United\nStates. ",[19,20],"contact-line",{},[15,22,23,24,29],{},"This policy covers the site, your account on it and the seats on your licenses.\nIt does not cover the apps you build with the kit. Those are yours to look\nafter, as section 9 of the ",[25,26,28],"a",{"href":27},"\u002Flegal\u002Flicense","Nuxter Commercial License"," says.",[15,31,32],{},"It also covers the demo at demo.nuxter.app, where anyone can make an account and\ntry the kit. The demo keeps its own database, apart from the site's, and we wipe\nit every day at 03:40 UTC, with every account and everything in it, and the\nphotos uploaded there. A Cloudflare Turnstile check confirms that a person is\nsigning up, signing in or asking for a new password. The demo stores your email\naddress, your name if you give one, your password as a one-way hash, and any\npasskey or authenticator app you add. Each sign-in records its IP address and\nbrowser. Photos uploaded there are open to anyone with their link until the\nwipe. The demo sends its email, such as the link that confirms your address,\nthrough Cloudflare from mail.demo.nuxter.app. Its checkout runs in Stripe's test\nmode and charges no card. Stripe receives what you enter there and, from the\ndemo, the plan, a checkout reference, any coupon you use, your email address and\nyour account and organization IDs. After a test purchase, the demo's home and\npricing pages can show other visitors the buyer's country. When the demo's code\nfails on the server, Sentry receives the report section 4 describes. The demo\ncounts visits, sends them to PostHog in a project apart from the site's, and\nkeeps request logs as this policy describes for the site, and\nsets its own cookies for signing in and for your preferences, none of them for\nadvertising or tracking. The wipe doesn't reach analytics, request logs or error\nreports, which last as section 6 says, or what Stripe holds.",[10,34,36],{"id":35},"_2-what-we-collect-and-why","2. What we collect and why",[15,38,39,43],{},[40,41,42],"strong",{},"Your account."," Your email address, which you sign in with and which we write\nto. A name and a profile photo if you add them. Anyone with the photo's link can\nopen it. If you buy while signed out, the license goes to the account for the\nemail address you paid with, and we make that account if it doesn't exist yet,\nnamed with the name you gave at checkout.",[15,45,46,49,50,54],{},[40,47,48],{},"Purchases and licenses."," You enter your payment details at Stripe's checkout,\nand they never reach us. Stripe sends us the details of the payment, including\nthe name, email address and billing details you entered, the amount, tax and\ncurrency, and Stripe's references for you and the payment. We keep them as the\nrecord of the sale. Each license also keeps its licensee name, the email address\nits notices go to, which versions of the ",[25,51,53],{"href":52},"\u002Flegal\u002Fterms-of-sale","Terms of Sale","\nand the License you accepted and when, whether you asked for immediate delivery,\nand a history of its changes. Your purchases are filed under an internal billing\nrecord named after you, or after the part of your email address before the @.\nWhile a checkout is open, we keep a draft of the order with a hash of a key your\nbrowser holds, so the browser that paid can open the new license.",[15,56,57,60],{},[40,58,59],{},"Seats on GitHub."," For each seat, the GitHub username and the numeric id\nGitHub gives the account, when the seat was added and removed, and where its\ninvitation to the repository stands. If someone adds your GitHub account to\ntheir license, this is what we hold about you, and it came from them and from\nyour public GitHub profile. Seat photos in the dashboard load straight from\nGitHub.",[15,62,63,66],{},[40,64,65],{},"Sign-in and security."," Each signed-in device has a session record with its IP\naddress, browser (user agent) and times of use. An activity log records\nsign-ins, changes to your account and purchases, each with the IP address and\nbrowser of whoever did it, where a person did. An email change also records the\nold and new address. A sign-in link is stored as a one-way hash with the address\nit was sent to, and stops working after 15 minutes. To stop abuse, we count\nattempts per email address, account or IP address, and a Cloudflare Turnstile\ncheck may confirm that a person sent a sign-in, checkout or contact form.",[15,68,69,72],{},[40,70,71],{},"Analytics."," We count visits on our own server. For each page view we record\nthe page, the page you came from on our site with how long it was open and how\nfar down you scrolled it, the domain of the site that sent you, your country,\nyour device type (desktop, mobile or tablet), whether your browser looks like a\nbot, any campaign tags in the link and whether you were signed in. Sign-up, checkout, purchase and refund events also record what\nhappened, such as the sign-in method, the plan or a coupon code. Each visitor\ngets an identifier made from the IP address and browser with a key that changes\nevery day, and a session identifier that changes every 30 minutes. We don't\nstore the IP address or browser with them, and analytics puts nothing on your\ndevice. When you start a checkout signed in, we note on your account whether\nanalytics was on, so the purchase is counted the way you chose.",[15,74,75],{},"Our server also sends these events to PostHog, with your IP address, the\naddress of the page with only its campaign tags and ad click identifiers kept\nfrom the query string, the address of the page that sent you and the session\nidentifier. While you're signed in, an event carries your account ID in place\nof the visitor identifier, so PostHog links your signed-in events to your\naccount. When you leave the site or close its tab, your browser also reports\nhow long the last page was open and how far down you scrolled it, and only\nPostHog receives that. PostHog receives no name, email address or cookie.",[15,77,78],{},"You can turn analytics off under Privacy settings in the footer, or Privacy\npreferences in your account menu. We also don't count you when your browser\nsends a Global Privacy Control signal. A purchase made while signed out is the\nexception: it may be counted either way, with the plan but no visitor\nidentifier.",[15,80,81,84],{},[40,82,83],{},"Logs."," Cloudflare keeps a log of the requests the site handles, with details\nof each request, our response and any error our code reports.",[15,86,87,90],{},[40,88,89],{},"Messages to us."," The contact page asks for your name, your email address and\nyour message. If you're signed in, it also adds the email address of your\naccount, and whether that address is confirmed yet. The site keeps no copy of\nthe message: it sends it to us as an email, through Cloudflare, with your\naddress to reply to. The contact page can also show our email address. Before a\nmessage is sent or our address is shown, a Cloudflare Turnstile check confirms\nthat a person is asking, and we count the attempts per IP address to slow down\nabuse. When you write to us, from the contact page or by email, we keep the\nconversation to answer you.",[15,92,93,96,97,100],{},[40,94,95],{},"Free tools."," The tools under ",[25,98,99],{"href":99},"\u002Ftools"," run in your browser, and we\nstore nothing you type into them. A few send something from your browser\nstraight to a public service; our server takes no part, and each of those tools\nnames the service at the top of its page. The SPF, DKIM and DMARC checker, the\nDMARC record generator and the custom hostname checker send the domain names and\nDKIM selectors you enter, and the names those records point to, to Cloudflare's\npublic DNS resolver (cloudflare-dns.com), or to Google's (dns.google) when\nCloudflare's doesn't answer. For the custom hostname checker those names are the\nhostname and its parent names, your CNAME target, and the hostname's\n_cf-custom-hostname and _acme-challenge records, and it also sends the hostname\nto crt.sh, which searches public certificate logs. The Nuxt upgrade checker\nsends nothing until you press its check button. It then downloads Nuxt's list of\nmodules from Nuxt's API (api.nuxt.com), asks the npm registry\n(registry.npmjs.org) for the latest version of Nuxt and of each Nuxt module in\nthe package.json you paste, and sends each of those modules' names and versions\nto jsDelivr (cdn.jsdelivr.net). The Workers compatibility checker and the\npackage.json vulnerability scanner also wait for their check button. The first\nsends the names and versions of the packages you paste to the npm registry and\nto jsDelivr, which lists each package's files (data.jsdelivr.com) and serves the\nentry files it reads (cdn.jsdelivr.net); the second sends them to the OSV\nvulnerability database (api.osv.dev), which Google runs, and asks the npm\nregistry for their versions and licences. The HTML email preview blocks remote\nimages unless you turn them on; then the preview loads the email's https images\nfrom their own hosts, which see your request the way an email's tracking pixel\nwould. Those services see your IP address and browser as any site you visit\ndoes, under their own privacy policies. Some tools keep their settings in the\npage address so you can share a result: the numbers you enter and the options\nyou pick, the domain names, DKIM selectors and DMARC report addresses in the\nemail tools, the hostname, CNAME target, validation method and wildcard setting\nin the custom hostname checker, the compatibility date in the Workers\ncompatibility checker, and the expression, task names and time zone in the cron\ngenerator. When a page loads from such an address, the address reaches\nCloudflare's request logs; the tool fills in its fields and sends nothing until\nyou press its button. No tool puts a secret, a webhook payload, an email's HTML,\na pasted package.json or a pasted config file in the address.",[15,102,103,106],{},[40,104,105],{},"Email."," We send only the email the service needs: sign-in links, order\nconfirmations and notices about your license and your account. Your settings\nhave switches for product and offer emails, and we keep your choice, but we send\nnone today. The receipt for a payment comes from Stripe.",[10,108,110],{"id":109},"_3-legal-bases","3. Legal bases",[15,112,113],{},"Where the GDPR or the UK GDPR applies, we rely on:",[115,116,117,124,130],"ul",{},[118,119,120,123],"li",{},[40,121,122],{},"contract",", to run your account, take your order, issue your license and\ngive its seats access;",[118,125,126,129],{},[40,127,128],{},"legal obligation",", to keep purchase records for tax and accounting;",[118,131,132,135],{},[40,133,134],{},"legitimate interests",", to keep the site and its accounts secure, prevent\nfraud and abuse, keep logs, answer your messages and count visits to learn\nhow the site is used. You can object to these, as section 8 says.",[10,137,139],{"id":138},"_4-who-receives-it","4. Who receives it",[15,141,142],{},"These companies process personal data for us:",[115,144,145,151,157,170,182,188],{},[118,146,147,150],{},[40,148,149],{},"Cloudflare"," runs the site and its code, stores profile photos, sends our\nemail, including the messages you send from the contact page, runs background\njobs, counts visits, keeps request logs, runs Turnstile checks and connects\nthe site to its database.",[118,152,153,156],{},[40,154,155],{},"The company that hosts our database"," stores the account, purchase and\nlicense records.",[118,158,159,162,163,169],{},[40,160,161],{},"Stripe"," takes payments. It receives what you enter at its checkout, and\nfrom us the plan, a checkout reference, any coupon you use, and your email\naddress and account ID if you are signed in. Stripe also uses payment data for\nits own purposes, such as preventing fraud, under the\n",[25,164,168],{"href":165,"rel":166},"https:\u002F\u002Fstripe.com\u002Fprivacy",[167],"nofollow","Stripe Privacy Policy",".",[118,171,172,175,176,181],{},[40,173,174],{},"GitHub"," receives the usernames added as seats, so it can invite them to the\nprivate repository, and emails each one its invitation. The\n",[25,177,180],{"href":178,"rel":179},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fsite-policy\u002Fprivacy-policies\u002Fgithub-general-privacy-statement",[167],"GitHub Privacy Statement","\ncovers GitHub accounts.",[118,183,184,187],{},[40,185,186],{},"PostHog"," receives the analytics events section 2 describes, from our\nserver, and stores them in its EU region in Frankfurt, Germany. Turning\nanalytics off stops them too, with the same exception for a purchase made\nwhile signed out.",[118,189,190,193],{},[40,191,192],{},"Sentry"," receives a report when our code fails on the server: the error,\nwhere in our code it happened, the address of the page or request without its\nquery string, and a request reference. It receives no IP address, cookies,\nform contents or account details, though an error message can quote the value\nthat caused it.",[15,195,196],{},"People at Devilos LLC see these records to run the site and help you. We also\ndisclose data when the law requires it, for example to a court or a tax\nauthority. We don't sell personal data.",[10,198,200],{"id":199},"_5-cookies-and-local-storage","5. Cookies and local storage",[15,202,203],{},"The site sets no advertising or tracking cookies. This is everything it keeps in\nyour browser:",[205,206,207,223],"table",{},[208,209,210],"thead",{},[211,212,213,217,220],"tr",{},[214,215,216],"th",{},"Name",[214,218,219],{},"What it's for",[214,221,222],{},"How long it lasts",[224,225,226,241,258,271,284,297,310,323],"tbody",{},[211,227,228,235,238],{},[229,230,231],"td",{},[232,233,234],"code",{},"nuxt-session",[229,236,237],{},"Keeps you signed in. It is encrypted and hidden from the page's scripts.",[229,239,240],{},"Until you sign out or close your browser. We end a session after 30 days without use.",[211,242,243,248,255],{},[229,244,245],{},[232,246,247],{},"session-hint",[229,249,250,251,254],{},"Holds ",[232,252,253],{},"1"," while you're signed in, so the page draws the right menu before it loads.",[229,256,257],{},"Until you sign out or close your browser.",[211,259,260,265,268],{},[229,261,262],{},[232,263,264],{},"last-auth-method",[229,266,267],{},"Remembers that you last signed in by email, to show a hint on the sign-in page.",[229,269,270],{},"One year.",[211,272,273,278,281],{},[229,274,275],{},[232,276,277],{},"license_checkout",[229,279,280],{},"Lets the browser that paid open the new license. Sent only with the request that opens it, and hidden from the page's scripts.",[229,282,283],{},"One day.",[211,285,286,291,294],{},[229,287,288],{},[232,289,290],{},"dashboard-sidebar-…",[229,292,293],{},"Remembers the dashboard sidebar's width and whether it is collapsed.",[229,295,296],{},"Until you close your browser.",[211,298,299,304,307],{},[229,300,301],{},[232,302,303],{},"coupon",[229,305,306],{},"Holds a coupon code from a link you opened, for checkout.",[229,308,309],{},"Seven days.",[211,311,312,317,320],{},[229,313,314],{},[232,315,316],{},"_ac",[229,318,319],{},"Remembers that you turned analytics off.",[229,321,322],{},"180 days.",[211,324,325,331,334],{},[229,326,327,330],{},[232,328,329],{},"nuxt-color-mode"," (local storage)",[229,332,333],{},"Your light or dark choice.",[229,335,336],{},"Until you clear it.",[15,338,339],{},"Stripe's checkout and GitHub set their own cookies on their own sites.",[10,341,343],{"id":342},"_6-how-long-we-keep-it","6. How long we keep it",[115,345,346,352,358,364,370,376,382,388,394,400,406,412,418,424],{},[118,347,348,351],{},[40,349,350],{},"Account:"," until you delete it. Deletion becomes final 30 days after you\nask. Until then the account can't be used, and we email you a link that\nrestores it.",[118,353,354,357],{},[40,355,356],{},"Sessions:"," until you sign out, or after 30 days without use.",[118,359,360,363],{},[40,361,362],{},"Activity log:"," 90 days.",[118,365,366,369],{},[40,367,368],{},"Sign-in links:"," removed the next time a link is sent after they expire.",[118,371,372,375],{},[40,373,374],{},"Abuse counters:"," within a day of the last attempt.",[118,377,378,381],{},[40,379,380],{},"Checkout drafts:"," until the payment arrives, or 30 days if it never does.",[118,383,384,387],{},[40,385,386],{},"Purchase records:"," at least seven years after the purchase, for tax and\naccounting.",[118,389,390,393],{},[40,391,392],{},"Licenses, seats and their history:"," as long as the license lasts, and at\nleast seven years after it ends.",[118,395,396,399],{},[40,397,398],{},"Analytics:"," three months, after which Cloudflare deletes them. PostHog\nkeeps its copy for as long as our PostHog plan keeps events: one year on the\nfree plan and up to seven years on a paid one.",[118,401,402,405],{},[40,403,404],{},"Request logs:"," up to seven days.",[118,407,408,411],{},[40,409,410],{},"Error reports:"," up to 90 days, after which Sentry deletes them.",[118,413,414,417],{},[40,415,416],{},"Background jobs",", such as an email waiting to be sent again: until they run\nor are given up, which Cloudflare's queues limit to four days.",[118,419,420,423],{},[40,421,422],{},"Messages and emails with us:"," as long as we need them to answer you, or as\nlong as the license records when they concern a license.",[118,425,426,429],{},[40,427,428],{},"The demo:"," until its next daily wipe, except analytics, request logs and\nerror reports, which last as above.",[15,431,432,433,435],{},"Deleting your account removes the account, its sessions, its activity log, its\nsign-in links and its profile photo. Purchase records stay, without your email\naddress and without the raw details Stripe sent. Your licenses stay too, with\ntheir licensee, notice address and seats, because deleting an account does not\nend a license (section 8 of the ",[25,434,53],{"href":52},"). The\nbilling record your purchases are filed under also stays, with its name and, in\nits history, your name or email address. Copies in database backups last until\nthose backups expire.",[10,437,439],{"id":438},"_7-international-transfers","7. International transfers",[15,441,442],{},"We are in the United States, and our providers process data in the United\nStates and in other countries where they operate. When personal data leaves the\nEuropean Economic Area, the United Kingdom or Switzerland, we rely on the\nEuropean Commission's standard contractual clauses, with the UK addendum, in our\nproviders' data processing terms, or on another safeguard the law allows.",[10,444,446],{"id":445},"_8-your-rights","8. Your rights",[15,448,449],{},"Depending on where you live, you can ask to see, correct, delete or take a copy\nof your personal data, and to object to or limit how we use it.",[15,451,452,453,455],{},"In your dashboard's settings you can change your name, photo and email address,\ndownload a copy of your account data and delete your account. Anything else,\nincluding license and seat records, comes to us by email. ",[19,454],{}," Send\nyour request signed in to the account it is about if you can. If you write\nsigned out, signed in to an account whose email address isn't confirmed yet, or\nfrom an address that is not on the account or the license, we first confirm the\nrequest at the address we have.",[15,457,458],{},"Analytics records hold no name or email address. Those counted while you were\nsigned out can't be traced back to you. PostHog's records of your signed-in\nevents carry your account ID, so we can find and delete them if you ask.",[15,460,461],{},"In the EU or the UK, you can also complain to your data protection authority.",[10,463,465],{"id":464},"_9-california","9. California",[15,467,468],{},"We don't sell your personal information or share it for cross-context\nbehavioral advertising, as California law defines those terms. You have the\nrights in section 8, and using them won't change how we treat you.",[10,470,472],{"id":471},"_10-children","10. Children",[15,474,475],{},"nuxter.app is for developers and businesses, not children. We don't knowingly\ncollect data from anyone under 16. If you think a child gave us data, tell us\nand we'll delete it, except records the law makes us keep.",[10,477,479],{"id":478},"_11-changes","11. Changes",[15,481,482],{},"We may change this policy. The date at the top shows when it last changed.",[10,484,486],{"id":485},"_12-contact","12. Contact",[15,488,489,490,492],{},"Questions about this policy or your data come to us by email. ",[19,491],{},"\nOur postal address is in section 1.",{"title":494,"searchDepth":495,"depth":495,"links":496},"",2,[497,498,499,500,501,502,503,504,505,506,507,508],{"id":12,"depth":495,"text":13},{"id":35,"depth":495,"text":36},{"id":109,"depth":495,"text":110},{"id":138,"depth":495,"text":139},{"id":199,"depth":495,"text":200},{"id":342,"depth":495,"text":343},{"id":438,"depth":495,"text":439},{"id":445,"depth":495,"text":446},{"id":464,"depth":495,"text":465},{"id":471,"depth":495,"text":472},{"id":478,"depth":495,"text":479},{"id":485,"depth":495,"text":486},"What personal data nuxter.app collects, why, who receives it, how long we keep it and how to use your rights.",false,"md",{},true,"\u002Flegal\u002Fpolicy",{"title":5,"description":509},{"loc":514,"lastmod":517},"2026-10-10","legal\u002Fpolicy","0CtVtyuLauREmFA5_PuALvdr3SBvbHnTu3oFF4yMJYE"]