Legal
Privacy Policy
Last updated 28 October 2026
This policy explains what NEXCORD collects when you visit nexcord.cc or use a NEXCORD account, why, how long it's kept and what you can do about it. The NEXCORD desktop app isn't publicly available yet; this policy will be updated before it is.
What we collect
When you create and use an account
- Account details: your email address, username, and, if you add them, a display name, status and About Me text.
- Your password, stored only as a one-way hash (argon2id). Nobody, including us, can read your password from it.
- Signed-in devices: for each browser or app you sign in with, the kind of client, the browser or app description it sends (its "user agent"), its IP address, an optional device name, and when it signed in and was last used.
- Security activity: sign-ins, wrong-password attempts, password and email changes, signed-out devices and deletion requests, with the IP address and user agent involved. You can see this list on your account page.
When you just visit the website
Our web server records each request (the page, time, IP address and browser description) to keep the site running and secure. The website itself has no analytics, advertising or tracking scripts, and loads nothing from other companies.
Cookies
We use one cookie, and only after you sign in: nx_refresh on api.nexcord.cc. It keeps you signed in for up to 30 days, can't be read by scripts on the page, and is only sent to NEXCORD's own servers. Signing out removes it. There are no advertising or analytics cookies.
Why we use it
- To create and run your account and keep you signed in.
- To protect accounts: limiting password guessing, spotting stolen sign-ins and showing you your devices and security activity.
- To email you about your account: confirming your address, resetting your password, and telling you when your password or email changes or your account is set to be deleted. We don't send marketing email.
Who else handles it
We don't sell or rent personal information, and we don't share it for advertising. Account emails are delivered through our email provider (Hostinger), which receives the recipient address and the message. The website and account service run on a server we rent; the provider hosts the machine but doesn't use the data. We'll disclose information if the law requires it.
How long we keep it
- Your account and profile: until you delete your account.
- Deleted accounts: deletion happens 7 days after you ask, so you can change your mind. Then your account, profile, devices and security activity are removed.
- Signed-out or expired devices: removed 30 days after they end.
- Security activity: 90 days.
- Email confirmation and password reset links: they expire after 24 hours or 30 minutes and are removed a day later.
- Database backups: kept for up to 7 days, so removed data can remain in a backup for up to a week.
Your choices
- See and change your details, devices and recent security activity on your account page.
- Sign out any device, or every device, at any time.
- Delete your account from the account page.
- For a copy of your information or any other request, email support@nexcord.cc from your account's address.
Security
Connections to nexcord.cc and api.nexcord.cc are encrypted (HTTPS). Passwords are hashed, sign-in tokens are stored only as hashes, links in emails work once and expire, and the database isn't reachable from the internet. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you.
Age
NEXCORD isn't for children under 13, or under the minimum age where you live if that's higher. We don't knowingly keep accounts of children under that age; if you believe we have one, email us and we'll remove it.
Changes
We'll update this page when what we collect or how we use it changes, and change the date at the top. Significant changes will be emailed to account holders before they apply.
Contact
Questions about privacy: support@nexcord.cc.