The short version
We collect what's needed to know you're you and let you back in: your name, your email, and the mechanics of your sign-in. We don't sell it, we don't advertise with it, and we don't track you across the web.
What we collect
When you create an account:
- Your first and last name
- Your email address
That is the complete list, and it is enforced rather than promised — the account schema rejects any field outside it, so there is no quiet place for a third thing to appear later.
We also keep basic account metadata: when your account was created, when it was last updated, when you last signed in, and whether your email address has been verified.
What we don't ask for
No phone number, no date of birth, no address, no job title, no profile photo. Until August 2026 this system had an optional phone number field; it was removed, and the numbers that had been entered were deleted from the account records.
If an application you use needs your phone number — a cleaning service that has to call you about site access, say — it asks you for it directly and keeps it in its own records, under its own policy. The identity layer holds only what establishes who you are.
How you sign in
You can sign in with a password, or — if you choose to — with your Google account. Nothing else: no Apple, no Microsoft, no Facebook. If another option is ever added, this policy will describe it before it goes live.
Passwords
If you sign in with a password, we store a cryptographic hash of it (bcrypt). We never store the password itself, no one at Corellon Digital can read it back, and we cannot recover it — a forgotten password is reset, never retrieved.
When you choose or change a password, we check it against a public catalog of passwords exposed in known data breaches, so you aren't handed an account secured by something already circulating. That check is run against Have I Been Pwned using a method called k-anonymity: our server sends only the first five characters of a hash of the password, receives back a list of candidate matches, and the actual comparison happens on our side. Your password itself never leaves our infrastructure, and Have I Been Pwned never receives your password, your full password hash, your email address, or anything identifying you.
Sign in with Google
Using Google is optional. If you do, Google confirms who you are and sends us your name, your email address, and confirmation that the address is verified — the same two fields we would otherwise ask you to type, taken from your Google profile instead. We never see your Google password, and Google gains no access to your Nexus account or the applications behind it.
The trade is visibility: Google necessarily learns that you sign in here, and when. That is inherent to how "sign in with Google" works, anywhere it appears. If you'd rather Google not know, use a password — either way, your account record lives on our infrastructure, and Google never holds it.
If you sign in with Google using an email address that already belongs to a Nexus account, the two are not quietly merged: you're asked to sign in to the existing account first, and only then is Google linked to it. You can link or unlink Google from your account settings at any time; unlinking only requires that you keep at least one other way to sign in.
Two-factor and passkeys
If you turn on extra sign-in security, here's what we hold:
Authenticator apps (TOTP)
We store the shared secret that lets us verify the six-digit codes your app generates. The codes themselves are generated on your device and checked against that secret; nothing about your device or your authenticator app is sent to us.
Passkeys and security keys (WebAuthn)
We store the public half of a cryptographic key pair, an identifier for the credential, and the name you give it. The private half never leaves your device or security key. If your device asks for your fingerprint or face to approve a sign-in, that check happens entirely on your device — no biometric information is ever sent to us, and we couldn't receive it if we wanted to. What we get is a signature proving the right key approved the sign-in, and nothing more.
Backup codes
If you generate backup codes, we store them the way we store passwords: hashed, never readable back.
Cookies and your browser
Two cookies, both strictly functional. A session cookie (ory_kratos_session) is
what keeps you signed in, and a CSRF cookie protects the sign-in forms from being submitted by
another site on your behalf. They're set when you sign in and cleared when you sign out. Both
are scoped to corellon.digital and its subdomains, which is how one sign-in carries across
the applications hosted there.
Your light/dark theme choice is saved in your browser's local storage, not a cookie, and is never sent to us.
There are no analytics cookies, no advertising cookies, and no cross-site tracking — so there's no consent banner, because there's nothing to consent to. The page you're reading loads no scripts, fonts, or images from anyone else's servers.
Logs
Like nearly every service on the internet, our servers keep request logs: the IP address a request came from, the browser's user-agent string, the page or endpoint requested, and the response. We use them to investigate failures and abuse, and for nothing else — they are not profiled, not aggregated into behavioral records, and not shared.
Logs are collected centrally on our own infrastructure and deleted automatically after fourteen days.
Who sees your information
The applications you sign in to
When you use your Nexus account to access an application, that application learns who you are: your user id, your name, your email, and that your sign-in is valid. What it does from there is covered by its own policy.
Cloudflare
Traffic to our sites passes through Cloudflare, which sits in front of our servers to absorb attacks and filter hostile traffic. Because it terminates the encrypted connection at its edge, Cloudflare processes every request to the sign-in pages — including your IP address and the contents of the forms you submit — before passing it to us. This is the one outside company in the path between your browser and our infrastructure. Cloudflare handles what it sees under its own privacy policy; it is a security and delivery provider, not an advertising one.
Have I Been Pwned
Only as described above, and only in a form that identifies neither you nor your password.
Only if you use "sign in with Google," and only in the direction you'd expect: Google tells us who you are; we send Google nothing about your account or what you do with it. Google learns that your account signs in here, and when, and handles that under its own privacy policy. If you never touch the Google button, Google is not involved at all.
When the law requires it
If we receive a valid legal demand, we comply with it. If we're allowed to tell you about it, we will.
That's the whole list.
Where it lives
Nexus Accounts runs on hardware and infrastructure operated by Corellon Digital. There is no third-party identity provider behind it, and no outside vendor holds your account record on our behalf. The emails this system sends you — verification codes, recovery codes — are delivered by our own mail server, not a mailing service.
How long we keep things
Your account information is kept for as long as your account exists. The rest is short-lived by design:
- A sign-in session lasts 24 hours, then you sign in again.
- A recovery code expires 4 hours after we send it.
- An email verification code expires 24 hours after we send it.
- An unfinished sign-in or registration attempt expires after 10 minutes.
- Request logs are deleted after 14 days.
Deleting your account
You can delete your account yourself, from your account settings, whenever you choose. Deletion removes the identity record — your name, your email, and every way you sign in — along with your active sessions, the standing sign-ins that let applications recognize you, and your memberships in those applications. None of it is kept in a recoverable form, and there is no grace period in which we hold it for you: if you return, you start with a new account.
One mechanical honesty: an application you were signed in to at the moment of deletion may continue to accept that existing sign-in for up to an hour before it expires on its own. No new sign-in is possible from the moment you delete.
The applications you used may retain their own records of your activity under their own policies — deleting the account closes the door, it doesn't reach through it. If you were the sole owner of an application's membership, deletion will ask you to hand that over first rather than leave the application ownerless.
Your choices
You can change your name and email address yourself, at any time, from your account settings — and you can delete your account there too, as described above, without asking anyone. You can also ask what information we hold about you or ask us to correct it: email [email protected] and we'll sort it out. No forms, no runaround.
Changes to this policy
If we change this policy in a way that matters, we'll tell you — a notice at sign-in or an email, not a silent edit. The "last updated" date at the top always reflects the current version.