Privacy Policy

1. Data collected

Describe what is collected — account details, usage data, cookies, and anything gathered by third-party scripts.

2. How data is used

Describe the purposes: providing the service, support, billing, analytics, and communication.

3. Legal basis

Describe the lawful basis for processing, if GDPR or a similar regime applies.

4. Sharing

List the processors and third parties data reaches, and why.

5. Retention

Describe how long each category of data is kept.

6. Your rights

Describe access, correction, deletion, portability, and objection rights, and how to exercise them.

7. Security

Describe the safeguards protecting personal data.

8. Contact

Provide a contact for privacy questions and, where required, a data protection officer. Write to legal@nnx0r.dev.

Appendix: what this application stores

Facts about the code as it ships, not legal advice — an inventory for whoever writes the sections above. Verify it against your own configuration, since most of it is switched on and off in starter.config.ts.

Account. Email address, display name, avatar image, role, the timestamps of email verification and terms acceptance. Held until the account is deleted, which removes them.

Sessions. One row per signed-in device holding its IP address, user agent and activity timestamps. Revoked rows and rows idle beyond 30 days are pruned daily; deleting the account deletes them outright.

Activity log. Sign-ins, credential changes and administrative actions, each with the IP address and user agent that produced it. Retention is activity.retentionDays — 90 days as shipped — after which a scheduled task deletes them.

Authentication tokens. Magic-link, password-reset and email-verification tokens are stored only as SHA-256 hashes, alongside the address they were issued for, and expire within minutes to a day. Redeeming one marks it spent immediately; the row itself is removed by the next sweep of expired tokens, or at once when the flow it belongs to clears them (a completed password reset, a confirmed email change, account deletion).

Payments (when enabled). The payment provider's customer and subscription identifiers, the plan held, and the raw webhook payloads that produced them. The card itself never reaches this application — the provider holds it.

Attribution (when marketing conversions are enabled). Landing on a page with an advertising click identifier in its URL writes it to an httpOnly _cid cookie, holding up to six identifiers for 90 days. It is written only after marketing consent. When a checkout begins, those identifiers are snapshotted onto the account with the IP address, user agent and consent state of that moment, so the payment provider's later webhook can be attributed.

On the visitor's device. Everything this application keeps in the browser, with the starter.config.ts key that brings it in:

• The session cookie — httpOnly and sealed, with no expiry of its own; the server ends a session idle for 30 days (auth.enabled).
• session-hint — 1 while signed in, so a cached page can draw the right navigation before it loads; no expiry of its own (auth.enabled).
• last-auth-method — the sign-in method used last, shown as a hint on the sign-in page; one year (auth.enabled).
• oauth-link-intent — httpOnly, ten minutes, only while linking a social account from settings (auth.oauth).
• oauth-sign-in-redirect — httpOnly, ten minutes, only during a social sign-in started from a page that asked to be returned to; the same-origin path to resume afterwards (auth.oauth).
• oauth-state-google and oauth-state-microsoft, or nuxt-auth-state for GitHub — httpOnly, ten minutes, only during a social sign-in; a one-time value proving the provider's answer belongs to the sign-in this browser started (auth.oauth).
• _ac and _mc — the visitor's analytics and marketing answers, written only once there is an answer to record; 180 days (analytics.enabled, marketing.enabled).
• _cid — the click identifiers above, only after marketing consent (marketing.enabled).
• i18n_redirected — the chosen language; one year, only with more than one locale (i18n.locales).
• nuxt-color-mode in local storage — the light or dark preference.
• social-proof:shown in session storage and social-proof:dismissed in local storage — how many recent-purchase cards this tab has shown, and whether the visitor closed them; written only once a card is shown or closed (socialProof.enabled).

Analytics (when enabled). Cookieless: a visitor is a daily-rotating HMAC of IP address and user agent, so the same person is a different identifier tomorrow and nothing is stored on their device. Cloudflare Analytics Engine retains data points for three months and cannot delete individual rows — worth stating plainly, because it bounds what an erasure request can reach.

Processors. Cloudflare hosts the application and stores its database, files and images. Whichever payment, email and analytics providers are enabled in starter.config.ts receive the data their function requires — the addresses mail is sent to, the identifiers a payment needs.

Rights already implemented. Settings → Profile offers a full data export (GET /api/auth/export) and account deletion. Both are self-service and need no request to a human.