Privacy Policy

1. Scope and operator

This policy covers visitors and users of nexusah.com, the NexusAH PWA at app.nexusah.com, and related monitoring, notification, and support services. It does not govern independent websites you visit through a link or third-party accounts outside NexusAH.

The operators of NexusAH are responsible for deciding how personal information is used for these services and act as controller where that term applies. NexusAH is the current service name. The formal company name and business mailing address are being finalized and will be added to this notice when available; we do not represent that an entity with that legal name has already been incorporated.

Game and auction data shown in NexusAH, such as items, prices, and realms, comes from Blizzard Entertainment's public APIs and is provided “as is”. Blizzard can change or withhold that data, and NexusAH does not guarantee that it is complete, current, or accurate. This data is not personal information about you.

Contact the operators about privacy at [email protected]. This notice explains processing; it is not a request to consent to every use described below.

2. Information we collect

• Account and sign-in information: account identifiers supplied by Discord or Google, the profile and email information those providers return under the permissions you authorize, your NexusAH username, linked sign-in methods, and account/session status. We receive this from you, your login provider, and operation of the Service. We do not receive your Discord or Google password.
• Profile picture: if you upload a picture or import your Discord avatar, we keep a resized 256×256 copy; the original file and its metadata, such as photo location, are not kept. If you pick a NexusAH avatar, we store only that choice. Your picture is shown only to you.
• Monitoring and preferences: items or pets you track, selected region and realms, filters, price or variant criteria, notification preferences, and account settings. These are supplied by you and associated with your account so your requests can be processed.
• Notification information: match and notification history, delivery status, email or Discord destinations, and, if you enable push, browser/device subscription endpoints, delivery keys, and installation identifiers. These come from your settings, the Service, and delivery systems.
• Technical and usage information: requested pages and methods, timestamps, response status and timing, referrer, browser/user-agent, and account or session references where available. Our first-party page analytics use a daily salted hash derived from the IP address. This is pseudonymous information, not necessarily anonymous. Network, hosting, and security systems also receive IP addresses and request metadata and may record them in operational logs.
• Cookie choices: whether you allowed or declined each optional cookie category, which version of the choices was shown, where you made the choice (banner, Manage cookies, or Settings), and when. If you are signed in, this is saved to your account so it applies on all your devices.
• Support information: messages and contact details you send, assistant conversation content submitted for a response, optional transcripts included with support email, and support usage metadata such as account/session references and time of use.

We do not ask you to provide government identity documents, payment-card numbers, or sensitive personal information in tracking fields or support chat. Please do not send passwords, access tokens, or information about other people that is unnecessary for your request.

3. Purposes and legal bases

Where GDPR or UK GDPR applies, we rely on the following bases as appropriate to the particular processing:

• Providing the service you request — contract: authenticating your account, saving tracking criteria, matching auction data, delivering configured notifications, and responding to service requests.
• Operating and protecting the service — legitimate interests: preventing abuse (including keeping abusive usernames and explicit or offensive profile pictures off the Service), investigating errors, maintaining security, measuring first-party service usage and performance, and improving reliability. Our interests are to run a secure, usable service; they must be balanced against your rights and expectations. You may object as explained below.
• Optional processing — consent where required: non-essential storage, future advertising or analytics where consent is legally required, and other uses explicitly presented as optional. Withdrawing consent does not make earlier lawful processing unlawful.
• Legal obligations: responding to valid legal requirements and keeping records where a specific law requires it. Necessary handling of legal claims may also rely on legitimate interests.

A legitimate-interest basis does not override a separate legal requirement for cookie consent. Device permission for push delivery is also separate from consent to advertising. If you do not provide account or delivery information needed for a feature, that feature may not work.

Auction matching and notification delivery are automated according to your criteria. We do not use that matching to make decisions producing legal or similarly significant effects about you. Username and profile-picture checks are also automated; a refusal only means you choose a different name or picture. Contact support if you think a refusal was wrong.

4. Who receives information

• Sign-in providers: Discord and Google process authentication requests and provide the account information authorized during sign-in. Their own policies apply to their accounts and authentication services: Discord and Google.
• Hosting, network, and security providers: infrastructure providers process information needed to host and protect NexusAH. Cloudflare handles network delivery and security; see its Privacy Policy.
• Notification providers: Discord, email delivery services, and browser/device push services receive the destination and message information needed to deliver the channels you enable. Notification content can appear on a device's lock screen or in an external inbox; use device and account settings accordingly.
• Support providers and authorized operators: the team handles support and account administration, and Anthropic processes messages when you use the assistant and reviews usernames you choose and profile pictures you upload, as detailed below.
• Fonts and page scripts: NexusAH serves its own fonts and page scripts, so pages do not request them from Google Fonts or other font or script services. See the Cookie Policy for the remaining third-party connections.
• Item tooltips: the dashboard, notifications, and Browse pages use Wowhead's item-tooltip script. The first time you hover an item on those pages, your browser loads the script and then requests public game data and images from Wowhead (wowhead.com and zamimg.com), which discloses network metadata such as your IP address and browser information. We do not send your account information to Wowhead. See Wowhead's Privacy Policy.
• Legal or organizational recipients: we may disclose necessary information to advisers or authorities for valid legal requirements, disputes, fraud prevention, or protection of rights, and to a prospective or actual successor if the Service is transferred, subject to applicable safeguards and notice requirements.

Providers receive information for the functions they perform. Some act on our behalf; others, such as your login provider, also process information under their own responsibilities. We do not make your private tracking list public simply because you use the Service.

5. Nexus Assistant, support messages, and automated checks

The optional Nexus Assistant uses Anthropic's API. When you send a chat message, NexusAH transmits that message and recent conversation context to Anthropic to generate a response. The current integration sends up to the last ten messages for context. Do not put confidential or sensitive information into the chat.

Recent conversation state is kept in your browser's session storage. NexusAH also records support usage metadata, including account/session references and timestamps; its support usage metrics do not store the chat text. If you choose to include a transcript when sending a support email, that transcript is sent to the support team through the email channel.

Anthropic's handling and retention are governed by its applicable API terms and policies; we do not promise zero retention or that clearing your browser deletes provider records. See Anthropic's Privacy Policy. You can avoid using the assistant and contact [email protected] instead. Using the assistant is not required to use the monitoring tools.

Automated checks: when you choose a NexusAH username, NexusAH sends that username to Anthropic's API, and when you upload a profile picture or import your Discord avatar, NexusAH sends the resized 256×256 copy, to check that it is not abusive, explicit, or pretending to be staff. Only the username or picture is sent, not your account details. A picture that cannot be checked is not saved; you can try again later or pick a NexusAH avatar, which is never sent. The same Anthropic terms apply. Profile pictures are optional and not required to use the monitoring tools.

6. Advertising and payment plans

Google publisher advertising and an optional ad-free support subscription are planned but are not currently enabled. The planned paid benefit is ad removal only, not additional monitoring features or API-related advantages.

We do not currently run third-party advertising tags or send account information to advertising partners for targeted advertising. We do not sell your personal information for money. Some future advertising disclosures could nevertheless count as a “sale,” “sharing,” or “targeted advertising” under particular privacy laws even without a cash payment.

Before introducing such processing, we will identify the relevant providers, purposes, categories of information, and retention information, and implement required consent and opt-out controls. Where required, this includes recognition of applicable universal opt-out signals such as Global Privacy Control. There is currently no automated GPC workflow. Manage cookies lets you record advertising and analytics choices now, but neither is in use yet. You can contact us now using the request instructions below.

Before offering paid checkout, we will disclose the payment provider and billing information actually processed. This notice does not claim that card data or subscription payments are currently collected. Privacy rights will not depend on buying an ad-free subscription.

7. Cookies and device storage

We use a persistent sign-in cookie and browser storage for interface preferences, assistant continuity, and PWA functionality, plus a cookie that remembers your cookie choices. Optional analytics and advertising cookies are not in use; you can record your choice for them with the Manage cookies link on every page. The Cookie Policy inventory describes the main entries, purposes, and lifetimes, including the current configured session lifetime.

You can clear site data or revoke device permissions, but doing so may sign you out or disable a feature. Browser and PWA storage may be separate. Clearing local data does not itself close your account or delete server-side records.

8. Retention and account closure

Retention depends on the purpose and type of information rather than one universal period:

• Account, linked sign-in, tracking, and preference information is kept while needed to provide your account and requested features. A profile picture is deleted when you remove it in Settings or close your account.
• Notification history, usage analytics, and support records are kept for service operation, troubleshooting, abuse prevention, and support, subject to cleanup and the continuing need for those purposes.
• Security, moderation, and legal records may be retained as necessary to investigate abuse, meet legal obligations, or establish, exercise, or defend legal claims.
• Backups and independently delivered messages have separate lifecycles and are not all erased immediately when you close an account.

Current retention periods:

• Notification history, including server copies of delivered alerts: deleted after 30 days.
• First-party page analytics: deleted after 365 days.
• Scheduled database backups: replaced on a rolling schedule; the oldest is at most 30 days old. Occasional maintenance snapshots can be kept longer.
• Server and access logs: usually up to about five weeks.
• Account, tracking, and preference information: until you change it or close your account.
• Cookie choice records: until you close your account.

Use account closure in Settings or contact support if you cannot sign in. The current closure process removes the account and linked sign-in records, tracking and preferences, and registered push data, and removes direct account links from retained notification, analytics, and support-usage history. Removing those links is not a guarantee that every retained record is irreversibly anonymous.

Closure does not recall emails or Discord messages already delivered, remove all operational/audit records, or instantly erase backups or independent provider records. We assess any additional deletion request and explain applicable exceptions. Retained personal information should be limited to the remaining purpose and deleted or anonymized when it is no longer needed.

9. International processing

NexusAH is used across regions, and its providers may process information in the United States and other countries outside your place of residence. Selecting a WoW region chooses auction data; it does not select a data-residency location for your account.

Cross-border handling must meet the requirements of applicable law. Depending on the transfer, these may include an adequacy decision, approved contractual safeguards, or another permitted mechanism. Contact us for information about the destinations and safeguards relevant to your information, including how to obtain a copy of applicable safeguards.

For Korea and Taiwan, additional transfer notices, consent, or other conditions may be required depending on the processing. A general statement in this policy is not a substitute for any required specific notice or consent.

10. Your rights and how to make a request

Depending on where you live and which laws apply, you may have rights to access or obtain a copy of your information, correct it, request deletion or portability, restrict or object to processing, withdraw consent, and opt out of certain sales, sharing, targeted advertising, or significant profiling. These rights are subject to legal conditions and exceptions; they do not all apply identically everywhere.

Contact and verification

Email [email protected] with the subject “Privacy request,” the right you wish to exercise, and enough account information to locate your record, such as your NexusAH username and linked email. Do not send a password or identity document unless a necessary, proportionate verification method has been agreed. We may verify your identity or an authorized agent's authority to protect other users' information.

We will respond within the applicable legal deadline and explain any permitted extension, exception, or refusal. Requests are generally free unless the law permits a fee for a particular request. We will not unlawfully discriminate against you for exercising a privacy right.

EEA and UK

Responses are normally due within one month, with an extension of up to two additional months where legally justified and notified. You may object to processing based on legitimate interests and complain to your local data-protection supervisory authority; UK users may contact the Information Commissioner's Office. You do not have to contact us first before approaching a regulator.

Colorado and other U.S. states

State rights depend on applicable law, including its coverage rules. Where the Colorado Privacy Act applies, the normal response period is 45 days, with a further 45 days where permitted and notified. To appeal a refusal, reply with the subject “Privacy appeal” and explain why you request reconsideration. We will review the appeal within the applicable deadline and explain how to contact the relevant regulator if it is denied. Colorado users may consult the Colorado Attorney General's privacy information and complaint guidance.

We accept privacy questions and requests even where a particular state's statutory framework does not apply. This policy includes our current U.S. state disclosures; use the contact instructions above for a request or appeal.

Korea and Taiwan

Applicable rights may include inquiry and access, a copy, correction or supplementation, deletion, withdrawal of consent, and requests to stop collection, processing, or use. Contact us through the same request channel. Any applicable statutory limits, response deadlines, and rights to approach local authorities remain available.

11. Children and young users

The Service is not directed to children under 13 or a higher minimum age required by applicable law. We do not knowingly seek to collect information from children in violation of law. Where a young user requires a guardian's agreement or legally valid consent, those requirements still apply; a general age statement does not replace them.

If you believe a child has provided information improperly, contact support so we can investigate and take appropriate action. Any future advertising must account for applicable age-related restrictions and cannot rely solely on this age statement.

12. Security

We use technical and organizational measures intended to protect personal information, including encrypted network connections, protected sign-in sessions, and access controls. No system or transmission method is completely secure. If you suspect an account or privacy incident, contact support promptly and secure your linked login account.

We will assess incidents and provide notifications to affected individuals or authorities where required by applicable law.

13. Changes and contact

We will revise this policy when our practices change and update the date above. Material changes will receive additional notice where required, and new consent will be requested where necessary. Posting a revised policy does not itself authorize a new consent-based use of your information.

Privacy questions, requests, appeals, and legal correspondence: [email protected].