Privacy Policy
NeXaKriya stores a local task copy in the browser for every plan. Free stays on one device. Plus (Device Sync) and Premium also store a cloud copy in Firebase after the user accepts the cloud-sync disclosure, so the workspace can sync across signed-in devices. Google Calendar access is separate and optional. Calendar events created outside NeXaKriya are read-only in NeXaKriya; only guests the user explicitly enters on a NeXaKriya-created meeting receive Google Calendar invitations or updates.
1. Information NeXaKriya processes
| Information | Purpose | Where it is handled |
|---|---|---|
| Verified identity details, such as name and email address, and an optional Google profile image | Authenticate the user and keep local workspaces separated. Users may choose a secure email link or Google identity. | An encrypted, authenticated and time-limited NeXaKriya session token is stored in the browser. Google identity is optional and is verified by NeXaKriya’s server endpoint when selected. |
| Task titles, dates, times, notes, status, closure history, activity-group membership, calendar references and guest email addresses entered for a NeXaKriya-created meeting | Provide task capture, cross-device sync, status management, and send calendar invitations or updates only to guests the user selected. | A local copy is stored in the browser. For Plus (Device Sync) and Premium, task snapshots, guest email addresses saved on meeting records, and deletion markers are also stored in Firebase after cloud-sync consent. Google access tokens remain in browser session storage and are not included in the Firebase workspace. |
| Named activity-group names | Let Premium users organize selected activities into named groups. | Stored in the browser and synced to Firebase for Premium users who have accepted cloud-sync consent. |
| Subscription status and Stripe customer reference | Manage Plus (Device Sync) and Premium subscription access and billing settings. | Stripe processes checkout and payment details. NeXaKriya stores the account email, Stripe customer and subscription references, plan, status, consent timestamp and update metadata in Firebase; it does not receive full card details. |
| Firebase Cloud Messaging device token | Send an optional generic notification when the workspace changes on another device. | Stored in Firebase only after the user enables browser notifications. Push messages contain no task title, note, calendar event or invitee details. |
| Google Calendar events, account email labels and event metadata | With optional Calendar access, read events from separately authorised accounts and link selected items to the personal workspace. A private NeXaKriya marker identifies events created by NeXaKriya. Only those events can be updated through NeXaKriya. Google-created or other-user events remain read-only and are never updated, cancelled, declined or answered by NeXaKriya. On a NeXaKriya-created event, only guest email addresses the user explicitly enters are sent to Google Calendar as attendees; Google sends their invitations and updates. NeXaKriya task notes are not sent to guests. Family sharing is a separate, explicit flow. | Requested directly from Google by the browser after each account is authorised. Google access tokens are kept in browser session storage and are not placed in the NeXaKriya task database. Linked event source/account references and user-entered guest email addresses are stored with the task locally and, for paid cloud sync after consent, in Firebase. Updates are only written to an event with the NeXaKriya private marker. |
| The account owner’s email address and an open-task reminder snapshot | Premium email reminders, when enabled, use the owner’s verified email address and the open-task details needed to prepare scheduled digests. | Sent to NeXaKriya’s email delivery provider for scheduling and delivery. Only the account owner’s verified address is used. |
| Spoken daily briefing and voice-captured task text | Premium spoken daily briefings read today’s task titles aloud after the user opts in. Voice task capture prefills text for review and never saves automatically. | Browser speech capabilities or the native device speech service process the content. In the iPhone app, device authentication protects access before the briefing opens. Any workspace task data also follows the selected plan’s local/cloud storage model. |
2. How Google user data is used
NeXaKriya works without Google Calendar. To build a unified view, the user may connect up to five Google accounts one at a time. Every account presents its own Google consent screen and can be disconnected separately. Full integration requests event access so NeXaKriya can read the selected day, label events by account, reconcile changes into linked local tasks, and send user-confirmed NeXaKriya changes back to the source Google account. NeXaKriya does not request Gmail inbox access, use Google user data for advertising, sell Google user data, or use it to train general-purpose artificial intelligence models.
Family collaboration is invitation-based and limited to a selected NeXaKriya event. The invitation shares the event title, schedule, duration and NeXaKriya status. Local notes, task history and other calendar entries are not included. Invited changes are held for review before changing the organiser’s local task.
NeXaKriya’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. Sharing and service providers
NeXaKriya shares information only as needed to provide user-requested functionality, comply with law, protect users and the service, or support the business with contracted service providers. Current providers include Vercel hosting, Firebase Firestore for paid workspace sync and account/subscription records, Firebase Cloud Messaging for optional push delivery, Stripe subscription checkout, Google Calendar and email delivery. These providers process information under their own security and privacy obligations.
4. Retention and user controls
- A local task copy remains in the browser. Free is limited to one device; Plus (Device Sync) and Premium also keep a Firebase workspace copy after cloud-sync consent. Closed items are kept forever by default; users may explicitly select automatic permanent deletion after 7, 30 or 90 days.
- Paid-plan cloud sync can be paused by clearing the cloud-sync consent control in Settings. Pausing stops future synchronization but retains the existing Firebase workspace copy. Use Delete cloud task copy to delete synced tasks, deletion markers, activity-group data and registered push tokens; local tasks remain on that device.
- Subscription status and Stripe customer references are retained as needed to manage a paid plan. Payment card details are handled by Stripe.
- Push tokens remain until the user disables push, pauses cloud-sync consent or deletes the cloud task copy.
- Reopening a closed item requires a recorded reason and explicit acknowledgement. Reopening does not silently restart Calendar or email reminders.
- Google Calendar access tokens for each connected account are held in session storage for the browser session and expire or can be revoked.
- Users can disconnect one source Google account within NeXaKriya or remove NeXaKriya from that Google Account’s third-party connections.
- Users can delete imported Calendar data from the device without deleting the NeXaKriya account or changing the source Google events.
- Users with Basic access can separately delete the NeXaKriya-created Google calendar after an explicit permanent-deletion confirmation.
- Premium users can cancel future email reminders and clear the local NeXaKriya profile from Settings. Clearing local data does not delete the Firebase cloud copy; use the separate cloud-data deletion control for that.
- Automatic spoken briefings are off by default. Users can enable or disable them in Settings; clearing the local profile also removes this preference.
- Information retained by infrastructure providers is governed by operational, security and legal retention requirements.
5. Security and local-device responsibility
NeXaKriya uses verified identity, encrypted and time-limited application session tokens, HTTPS-hosted services, restrictive browser security headers and session-only Google access tokens. Free task data is stored locally in the browser. Plus and Premium sync a task workspace to Firebase only after explicit consent; Firebase also holds plan/account records, and Premium workspace activity-group names. In the native iPhone app, Face ID, Touch ID or the device passcode can unlock an existing verified session; biometrics do not bypass NeXaKriya identity verification. Task data is not protected by a separate NeXaKriya encryption PIN. Spoken task titles may be heard by people nearby. Secure the device, keep the browser updated and use the plan’s data controls. No internet service or storage method can be guaranteed to be completely secure.
6. International processing
NeXaKriya and its service providers may process information in countries other than the user’s country. Where required, reasonable safeguards will be used for cross-border processing.
7. Children
NeXaKriya is not directed to children under the age at which they can independently consent to online services in their jurisdiction. A parent, guardian or authorised institution should supervise use where applicable.
8. Changes and contact
This policy may be updated when NeXaKriya’s functionality or legal obligations change. Material changes will be reflected by an updated effective date. Privacy or data-control questions can be sent to support@omnexagoc.com.