Privacy Policy
This policy explains what NexusRun Cloud (the hosted registry and dashboard at nexusrun.dev) collects, why, and who else handles it. The short version: we store the agents you push and the account details we need to run your account. We never see your prompts, inputs, outputs or secret values, because inference and the NexusRun runtime run on your own hardware.
We do not sell your personal information or share it for advertising.
This policy covers the hosted Service only. The open-source command line tool collects nothing and sends nothing to us unless you choose to log in to or push to NexusRun Cloud.
What we collect
| Data | Why we have it |
|---|---|
| Account details: your email address and name, and the organizations and roles you belong to | To create your account, sign you in, and let you collaborate. |
| Sign-in data: handled by Amazon Cognito (a one-way hash of your password, verification and multi-factor settings). We never see your password. | Authentication. |
| Your content: the units, model files and metadata you push | To store and deliver them to the people and machines you authorize. |
| Access tokens: a one-way hash and a short prefix of each token, its name, who created it and when it was last used. The secret itself is shown once and not stored. | To authenticate pushes and pulls and let you revoke tokens. |
| Usage: bytes stored and bytes pulled each month | To enforce plan limits and bill overage. |
| Activity log: who pushed, issued a token, invited or removed someone, connected a device or changed billing, and when | Security, support, and the Activity page your admins can see. |
| Billing details: your Stripe customer ID, plan and subscription status. Card numbers go directly to Stripe and never reach us. | To charge for paid plans. |
| Technical logs: IP addresses and request details when our abuse protection blocks a request, and error logs. Credentials are removed from these logs. | Security and reliability. |
What we do not collect: your prompts or any inputs and outputs of your agents; the values of your secrets; tracking or advertising data. The dashboard uses no analytics, no advertising cookies and no third-party trackers.
Cookies and local storage
The dashboard stores your sign-in session in your browser (session storage) and a few preferences, such as the organization and tab you last viewed (local storage). It does not set advertising or analytics cookies. Sign-in itself happens on Amazon Cognito's hosted page, which sets its own cookies to complete login.
How long we keep it
- Account and content: for as long as your account is active. You can ask us to delete your account and organization at any time, and we will delete your content and personal data, except what we must keep for legal or billing reasons.
- Unpaid trials: an organization whose trial ends without an upgrade becomes read-only, and we delete its stored artifacts after a grace period of at least 30 days from the end of the trial.
- Activity logs and billing records: kept with your organization, and billing records are kept as long as tax and accounting law requires.
- Abuse-protection logs: 30 days.
- Backups: our database is backed up for 7 days, so deleted records can persist in backups for up to that long.
Security
Our infrastructure is in the United States. Everything travels over HTTPS and is encrypted at rest. Customers' data is isolated from each other at the database level, access tokens and invitation links are stored only as hashes, and short-lived tokens authorize each registry request. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.
Your choices and rights
You can see and edit your account in the dashboard, revoke tokens and devices, remove teammates, and cancel billing. You can also email us to access, correct, export or delete your personal data, or to object to how we use it, and we will respond within a reasonable time. If you are in the European Economic Area, the United Kingdom or California, you may have additional rights under local law and we will honor them. You may also complain to your local data protection authority.
Children
The Service is for people 18 and older. We do not knowingly collect data from children.
Changes
We will post changes here and, for material changes, notify you by email or in the dashboard before they take effect.
Contact
hello@nexusrun.dev. See also our Terms of Service.