Effective: 9 Sep. 2026

Privacy Policy

Last updated: 9 Sep. 2026

1. Introduction

1.1. This Privacy Policy explains how personal data is processed in connection with Nexus, a team and group messaging service consisting of a web application at nexus.dozy.site, an iOS application, and an Android application (together, the "Service" or "Nexus").

1.2. The Service is operated by David Kelen, an individual established in France, trading under the name "Dozy" ("Operator", "we", "us" or "our"). For the processing described in this Policy for which we determine the purposes and means, the Operator is the data controller.

1.3. This Policy covers personal data processed through your use of the Service. It does not cover the creation, authentication, management, or billing of your Dozy account, which are described in the Dozy Privacy Policy available at dozy.site. Where this Policy refers to information "from your Dozy account", that information is provided to the Service by the Dozy account system so that the Service can function.

1.4. Capitalised terms that are not defined in this Policy have the meaning given in the Nexus Terms of Service.

2. Controller roles

2.1. Spaces. When you use a Space, the Space Owner determines the purposes and means of the processing of personal data within that Space, including Content posted in its Channels, membership, roles, and moderation. In respect of that data the Space Owner acts as controller and the Operator acts as a processor on the Space Owner's instructions, and also as an independent controller for the limited operational purposes set out in section 5 (for example security, abuse prevention, and diagnostics).

2.2. Direct Messages. For Direct Messages and Group Direct Messages, the Operator processes the data as described in this Policy in order to deliver the messages to their recipients.

2.3. Service level data. For account-derived identity data, technical and log data, notification data, and diagnostics, the Operator is the controller.

2.4. If you are a member of a Space run by an organisation, that organisation's own privacy notice may also apply to your use of that Space. Contact the Space Owner for information about their processing.

3. Categories of personal data we process

We process the following categories of personal data:

3.1. Identity data from your Dozy account. Your account identifier, display name, nickname, email address, profile picture, and Plan tier. Your name or nickname, profile picture, and Plan tier are visible to other members of Spaces and conversations you share with them. Another User who knows your exact email address can use it to start a Direct Message with you.

3.2. Content. The messages you send in Channels, Direct Messages, and Group Direct Messages, the files and images you upload, message edits, reactions, custom emoji you add, pinned messages, saved items, bookmarks, channel names and topics, role and group names, and nicknames.

3.3. Membership and activity data. The Spaces and Channels you create or join, your role and permissions in each Space, join requests you make or decide, invitations and join codes you create, ownership transfers, and the times of these events.

3.4. Presence and delivery metadata. A periodic signal indicating that you have the Service open and active, typing indicators, read receipts, message delivery receipts, unread and mention counts, and last-read timestamps. Some of this information is visible to other participants in the relevant Channel or conversation.

3.5. Moderation data. Reports you submit about a message, including the reason text you provide and the identifier of the reported message and its author; reports submitted by others that concern your Content; your list of blocked Users; and mutes, removals, and bans applied to you or by you within a Space.

3.6. Notification data. If you enable notifications, a web push subscription associated with your browser, and on mobile a device push token issued by the Apple Push Notification service (iOS) or by Firebase Cloud Messaging (Android), together with your per-Channel and per-conversation notification preferences. Notification messages we send through these services contain the sender's name and a preview of the message.

3.7. Link preview data. When you send a message containing a web address, our server retrieves that web page in order to generate a preview. The resulting preview, consisting of the page title, description, a preview image, and the source name, is stored in a cache keyed by the web address and is reused for any User who later sends the same address. The fact that a preview was generated is associated with your message.

3.8. Diagnostics. In the production versions of the applications only, we collect error and crash diagnostics and a small sample of performance traces. A diagnostic event may include your account identifier and email address, the error message and stack trace, the application version, the platform (web, iOS, or Android), the page or action involved, and technical device and environment information. Diagnostics are processed by our error-reporting provider identified in section 7.

3.9. Technical and log data. Internet protocol (IP) address, request metadata, timestamps, and server logs generated when your device communicates with the Service, and operational logs of notification delivery (including sender and recipient identifiers, the relevant Space, Channel, or conversation identifier, and delivery counts).

3.10. On-device data. The applications store data on your device, including cached copies of messages and media for offline access and faster loading, a local search index for your Direct Messages, your preferences (such as theme and last opened Space), and, if you enable the in-development encryption beta, your encryption keys. This data remains on your device and is described in the Nexus Cookie and Storage Notice. It is not transmitted to us except where it forms part of a normal request to the Service.

We do not intentionally collect special categories of personal data. You should not post such data in Content unless it is necessary and lawful for you to do so.

4. Message storage and encryption

4.1. Data transmitted between your device and the Service is encrypted in transit using industry standard transport encryption (HTTPS and secure WebSocket connections).

4.2. Content is stored on infrastructure operated on our behalf and is encrypted at rest by that infrastructure provider. Access to stored data by the infrastructure provider's personnel is governed by our agreement with that provider.

4.3. Content in Channels, Direct Messages, and Group Direct Messages is not currently end-to-end encrypted. This means that, in addition to the intended recipients, the Operator and its administrators are technically able to access Content where necessary to operate the Service, to respond to reports and enforce the Terms and the Acceptable Use Policy, to maintain security, or to comply with law.

4.4. End-to-end encryption for one-to-one Direct Messages is in development and is not active. When it becomes available it will be optional, will apply only to genuine one-to-one Direct Messages, and will rely on a key that is protected by a passphrase you choose. If you enable it and lose that passphrase, the affected message history cannot be recovered by us or by anyone else. We will update this Policy before any such feature is activated.

5. Purposes and legal bases

We process personal data for the following purposes. Where the General Data Protection Regulation or the UK GDPR applies, the legal basis for each purpose is indicated.

5.1. To provide the Service, including authenticating your session with your Dozy account, displaying Spaces and Channels, delivering and storing messages and files, showing membership and roles, and generating link previews. Legal basis: performance of a contract with you; and our legitimate interests in operating the Service for Users who are not party to a contract with us.

5.2. To deliver notifications you have asked to receive. Legal basis: your consent, given through the browser or operating system notification permission; and performance of a contract.

5.3. To operate moderation and safety features, including handling reports, blocks, mutes, removals, and bans, and reviewing Content where a risk is identified. Legal basis: our legitimate interests, and those of other Users and Space Owners, in a safe service; performance of a contract; and compliance with legal obligations.

5.4. To secure the Service and prevent abuse, including enforcing capacity and rate limits, detecting and responding to unauthorised access and misuse, and keeping operational logs. Legal basis: our legitimate interests in the security and integrity of the Service; and compliance with legal obligations.

5.5. To diagnose and fix problems and improve reliability, using error and crash diagnostics and performance samples. Legal basis: our legitimate interests in a functioning and reliable service.

5.6. To communicate with you about the Service, including service and policy notices. Legal basis: our legitimate interests in keeping Users informed; performance of a contract; and compliance with legal obligations.

5.7. To comply with law and to establish, exercise, or defend legal claims, including responding to lawful requests from public authorities. Legal basis: compliance with legal obligations; and our legitimate interests in protecting our rights.

Where we rely on legitimate interests, you may object as described in section 10.

6. How personal data is disclosed

6.1. To other Users. By design, your identity data, Content, and certain activity and presence metadata are shown to the other members of the Spaces, Channels, and conversations you participate in, as described in section 3.

6.2. To Space Owners and administrators. A Space Owner and the Users they authorise can see membership, roles, Content, and reports within their Space, and can configure retention and moderation for it.

6.3. To service providers (subprocessors). We share personal data with the providers listed in section 7, who process it on our behalf and under contract in order to host and deliver the Service.

6.4. For legal and safety reasons. We may disclose personal data where we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or enforceable governmental request, to enforce the Terms or the Acceptable Use Policy, to detect, prevent, or address fraud, security, or technical issues, or to protect the rights, property, or safety of the Operator, our Users, or the public.

6.5. In a business transfer. If the Operator is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy.

6.6. We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not use your Content to build advertising profiles, and we do not use third-party advertising or analytics tracking in the Service.

7. Subprocessors

We use the following service providers to process personal data on our behalf:

We may add or change subprocessors as the Service develops. Where a material change of subprocessor affects how your personal data is processed, we will update this section and, if the change is material, provide notice in accordance with section 13.

8. International transfers

8.1. Personal data is primarily stored and processed in the European Union.

8.2. Some of our subprocessors, in particular those providing web application delivery, push notification delivery, and diagnostics, are located in or transfer personal data to the United States or other countries outside the European Economic Area and the United Kingdom.

8.3. Where personal data is transferred outside the European Economic Area or the United Kingdom to a country that has not been recognised as providing an adequate level of protection, the transfer is made subject to appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, the United Kingdom International Data Transfer Addendum, together with additional measures where necessary. You may request information about these safeguards using the contact details in section 15.

9. Retention

9.1. Messages and files are retained until they are deleted by a User, removed by a moderator, removed by a Channel's automatic retention setting, or removed on closure of a Space. Automatic retention periods are configured by Space Owners within the Plan-based maximums described in the Terms (currently 15 days for the Free and Silver tiers, 30 days for the Gold tier, and 90 days for the Diamond and Enterprise tiers). Announcement channels are not subject to automatic retention. When Content is deleted it is removed for all members and attached files are deleted from storage; residual copies may persist for a limited time in routine backups and in device caches and age out in the ordinary course.

9.2. Membership, role, and moderation data is retained for as long as you are a member of the relevant Space and, after you leave, for as long as needed for the Space's records, dispute handling, and safety purposes.

9.3. Notification registrations are retained until the push token or subscription becomes invalid, you disable notifications, or you sign out, after which they are deleted.

9.4. Link preview caches are retained for as long as they remain useful for generating previews and are refreshed or purged periodically.

9.5. Diagnostics are retained by our error-reporting provider for a limited period, after which they are deleted or aggregated.

9.6. Technical and operational logs are retained for a limited period for security, troubleshooting, and abuse-prevention purposes and are then deleted or aggregated.

9.7. We may retain personal data for longer where required to comply with a legal obligation or to establish, exercise, or defend a legal claim.

10. Your rights under the GDPR and UK GDPR

10.1. If the GDPR or the UK GDPR applies to the processing of your personal data, you have the right to:

(a) request access to the personal data we hold about you;

(b) request rectification of inaccurate or incomplete personal data;

(d) request restriction of processing;

(e) object to processing that is based on our legitimate interests;

(f) request portability of personal data you provided to us, in a structured, commonly used, machine-readable format; and

(g) withdraw any consent you have given, without affecting the lawfulness of processing carried out before withdrawal.

10.2. You can exercise some of these rights directly in the Service: you can edit or delete your Content, leave Spaces, manage blocks and notification settings, and export the messages you have posted in a Space as a data file.

10.3. For other requests, contact privacy@dozy.site. We may need to verify your identity before acting on a request. We will respond within the period required by applicable law.

10.4. Where the Space Owner is the controller for data within a Space, we will refer your request to that Space Owner or ask you to contact them directly.

10.5. You have the right to lodge a complaint with a supervisory authority. In France this is the Commission Nationale de l'Informatique et des Libertes (CNIL), www.cnil.fr. You may also complain to the supervisory authority in your country of residence or place of work.

11. California privacy rights

11.1. This section applies to residents of California and supplements the rest of this Policy. Terms used in this section have the meanings given in the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

11.2. Categories of personal information collected in the last 12 months: identifiers (such as account identifier, name, email address, IP address, and device push tokens); internet or other electronic network activity information (such as activity and presence metadata, and diagnostics); geolocation data (approximate location inferred from IP address); and other information you provide, namely the Content you post. The sources, purposes, and disclosures for these categories are described in sections 3, 5, 6, and 7.

11.3. No sale or sharing. In the last 12 months we have not sold personal information and have not shared personal information for cross-context behavioural advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

11.4. Your rights. Subject to verification and to exceptions in the CCPA, you have the right to know the personal information we have collected about you and how we have used and disclosed it, the right to request deletion of your personal information, the right to request correction of inaccurate personal information, and the right to limit the use of sensitive personal information (we do not use sensitive personal information for purposes that would trigger this right).

11.5. Non-discrimination. We will not discriminate against you for exercising your CCPA rights.

11.6. How to exercise. Submit a request to privacy@dozy.site. You may use an authorised agent to submit a request on your behalf, in which case we may require proof of authorisation and verification of your identity.

12. Children

12.1. The Service is intended for Users aged 13 and over and is not directed to children under 13.

12.2. We do not knowingly collect personal data from a child under 13. If we become aware that we have collected personal data from a child under 13, we will delete that data and remove the child's access to the Service. If you believe a child under 13 has provided personal data to the Service, contact privacy@dozy.site.

13. Security

13.1. We use technical and organisational measures designed to protect personal data, including transport encryption, encryption at rest by our infrastructure provider, row-level access controls in the database, authentication controls, and restricted administrative access.

13.2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13.3. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected Users to the extent and within the time required by applicable law.

14. Changes to this Policy

14.1. We may amend this Policy from time to time. The current version is identified by the effective date at the top.

14.2. If we make a material change, we will provide notice through the Service or by email before the change takes effect, except where an immediate change is required to comply with law or to address a security or safety risk. Your continued use of the Service after a change takes effect constitutes acknowledgement of the updated Policy.

15 Contact

For questions about this policy, to exercise your rights, or to report a privacy concern, please contact us.

Name: David Kelen
Email: privacy@dozy.site
Response time: Within 30 days

Page updated

Google Sites

Report abuse