Privacy Policy.

0. Abstract

This privacy policy describes what information is collected when someone uses nitlix.com, creates an account, or signs into a product that shares that account layer — why that information is kept, and how it can be accessed or deleted.

Products differ. Some are content platforms, some are tools, some are client work. This document covers the shared account layer and the general kinds of data the infrastructure handles. It is not a product-by-product inventory.

1. Information collected

Account information. On signup, a name and email may be stored if provided. Signing in with Google, Discord, or Microsoft stores that provider's account ID and the email attached to it, so the same person can be recognized next time. One account works across products that use this identity layer, so the same record is used wherever that account is accepted.

Passkeys. Registering a passkey stores the public key and credential identifier the device or browser provides, plus optional metadata (nickname, device type, backup status, approximate registration location). Biometrics and device PINs never leave the device and are not stored here.

Sessions and devices. Each sign-in creates a session so the user stays logged in and can review or revoke that login later. The record typically includes browser, OS, device type from the user agent, IP address, approximate location derived from that IP (country, sometimes city), and when the session was created and last used. Nothing GPS-precise.

Uploads. Images and files attached through a product (avatars, cover images, and similar) sit in object storage with basic metadata (size, type, resized variants where needed). Shared upload path defaults to a 10MB cap; individual products may set their own limits.

Content. Posts, pastes, and other material created inside a given product are stored and tied to the account that created them.

Support mail. Messages sent for support are kept so they can be answered and followed up on.

Security fingerprint. At first signup, a one-time internal fingerprint (a hash of IP and browser at that moment) is recorded to help flag suspicious account-recovery attempts. It is not shown to users and is not used for tracking.

Payment details, government IDs, and precise real-time location are not collected. Location data comes from standard IP geolocation, not device GPS.

2. How information is used

Collected data is used to:

• Create and secure accounts, including OAuth and passkey sign-in.
• Keep sessions active and show an accurate list of devices so unrecognized access can be revoked.
• Detect and limit unauthorized access.
• Store and serve uploads and content the account holder chose to put there.
• Respond to support requests.
• Keep the infrastructure running reliably.

Data is not sold. It is not handed to third parties for their marketing or advertising. Account data lives on infrastructure operated directly (Postgres and Cloudflare R2, with requests served through Cloudflare Workers). It is not passed to data brokers or ad networks.

3. Cookies and similar technologies

A small set of first-party cookies runs the service. They do not track people across other sites:

• A session cookie that identifies the login session.
• A short-lived token cookie that caches identity briefly to avoid an extra database hit on every request.
• A session-hint cookie readable by the page (not httpOnly) that only indicates whether a session might exist. It does not carry session data.

Third-party analytics, advertising, and cross-site tracking scripts are not in use. If that changes, this section will be updated.

4. Retention and security

Account, session, upload, and content data are kept while the account is active. Passkeys and OAuth links stay until removed from settings. On account deletion, the account is marked deleted and associated sessions, passkeys, and uploads are removed or queued for removal. Some records may remain briefly afterward for security or legal reasons.

Session codes and the signup fingerprint are stored hashed, not in plain text. Passkey records hold the public material needed to verify a sign-in — not biometrics or PINs. Standard measures (encrypted connections, hashed secrets, scoped access) are used to limit unauthorized access, loss, or misuse. No system is perfectly secure.

5. Rights

Depending on jurisdiction, individuals generally may:

• Access or receive a copy of personal data held about them.
• Correct or update it (most account fields can be edited from settings).
• Request deletion (handled within 30 days).
• Object to or restrict certain processing.
• Withdraw consent where processing was based on consent.

Requests go to legal@nitlix.com. Identity may need to be verified first so the wrong account is not exposed or erased.

6. Changes

This policy may change as features change. The date at the top of the page is updated when it does. Disagreeing with a future version is fine — closing the account remains an option.

7. Contact

Questions: legal@nitlix.com.