Nexus Pen LLC ("Nexus Pen," "we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Nexus Pen hardware device, Donna AI assistant, our mobile application, and our website at nexuspen.org (collectively, the "Services").
01Data We Collect
We collect the following categories of information:
Account Information
- Name and email address (provided at registration)
- Password (stored as a salted hash, never in plaintext)
- Subscription tier and billing history
- Profile preferences and selected AI mode
- Organization affiliation (for School and Enterprise accounts)
Usage Data
- Query counts and timestamps
- AI modes used and session durations
- App version and device operating system
- Crash reports and performance diagnostics
- Feature interactions (which settings you adjust)
Device Data
- Nexus Pen firmware version
- Wireless connection events (connect/disconnect timestamps)
- Battery level readings (for diagnostics)
- color display interaction events
Payment Information
Payment card details are processed entirely by Stripe. We never store raw card numbers, CVVs, or full account numbers. We retain only the last 4 digits, card brand, and expiration date as provided by Stripe for display purposes.
02Voice Recordings
We do not store your voice recordings. Audio captured by your Nexus Pen microphone is streamed in real time to our backend, transcribed using OpenAI Whisper, and immediately discarded. The raw audio is never written to disk or retained after transcription is complete.
Specifically:
- Audio is processed in memory only, no audio files are saved on our servers
- Transcribed text (your query) is sent to our AI pipeline
- Transcribed text may be retained as part of your conversation history (see Data Retention)
- We do not use your voice for voice-print identification or biometric profiling
- We do not share audio recordings with any third party
Push-to-talk is the only activation method. The microphone is never open without you holding the button.
03How We Use Your Data
We use your information to:
- Provide the Services, authenticate your account, process queries, deliver AI responses, manage subscriptions
- Improve Donna AI, aggregate, anonymized usage patterns help us tune response quality and add new modes
- Provide customer support, resolve issues and respond to inquiries
- Send transactional communications, receipts, password resets, subscription renewal notices
- Maintain security, detect and prevent abuse, enforce rate limits, protect accounts
- Comply with law, respond to lawful requests from government authorities
We will never sell your data. We will never use your data for advertising targeting. We will never share your conversation history with third parties for marketing purposes.
04Data Storage & Security
All user data is stored in Supabase, a cloud database platform with encryption at rest (AES-256) and encryption in transit (TLS 1.2+).
- Databases are hosted in the United States
- Access is restricted to authenticated backend services only
- Passwords are hashed using bcrypt before storage
- API authentication uses short-lived JWT tokens with refresh rotation
- We conduct periodic security reviews and promptly patch known vulnerabilities
While we implement industry-standard security measures, no system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly to NexuspenLLC@gmail.com.
05Third-Party Services
We share limited data with the following service providers, solely to operate the Services:
| Provider | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI query processing, speech transcription (Whisper), text-to-speech (TTS) | Transcribed query text, AI responses |
| Stripe | Payment processing and subscription management | Name, email, billing address |
| Supabase | Database and authentication infrastructure | All account and usage data |
| Render | Cloud hosting for our API backend | All API traffic, including transcribed queries and AI responses in transit |
| Expo (EAS) | Mobile app distribution and push notifications | Push token, device ID |
| Shopify | E-commerce (hardware purchases only) | Name, shipping address, purchase data |
We do not permit third parties to use your data for their own marketing or purposes beyond the scope of what is described above. Each provider is bound by a data processing agreement.
06FERPA Compliance
For School accounts used by educational institutions, Nexus Pen acts as a "school official" under the Family Educational Rights and Privacy Act (FERPA). We:
- Use student data only to provide the Services to the school
- Do not disclose student education records to third parties without consent, except as permitted by FERPA
- Allow schools to access, review, and delete student data upon request
- Do not build profiles on students for non-educational purposes
- Return or delete student data upon termination of a school agreement
Visibility for school-managed accounts: if your account was created or is managed by a school or organization (a "School" or "Enterprise" account), your teacher or school administrator can view your AI mode settings, usage activity, and query history through their Teacher Dashboard as part of their obligation to supervise student use of the Services. This visibility does not apply to individually-created Free, Plus, or Family accounts.
Schools are responsible for obtaining any required parental consents under FERPA before using Nexus Pen with students.
07COPPA & Children's Privacy
Nexus Pen complies with the Children's Online Privacy Protection Act (COPPA). Children under 13 may only use the Services with verifiable parental consent, obtained as described below, or through a school account with institutional oversight.
Age screening & parental consent
- Age screening at signup. We ask for a date of birth when an account is created. If the date of birth indicates the user is under 13, a parent or guardian email address is required to complete signup.
- Consent before use. We email the parent or guardian a consent request. Until the parent confirms via the emailed link, the child's account cannot use any AI features (Donna queries, quizzes, or flashcards), the account can only pair the pen, adjust settings, and log out.
- What we collect from children. For an under-13 account we collect the account email, display name, date of birth, and the parent's email address. After consent is granted, we collect the same usage data described in Section 1, subject to the same voice-recording policy in Section 2 (audio is never stored).
- No advertising. We do not serve advertising in the Services and do not use children's data for marketing or profiling.
Parents' rights
- Review the personal information we hold about your child
- Revoke consent and require deletion of your child's account and data at any time
- Refuse to permit further collection or use of your child's information
To exercise any of these rights, email NexuspenLLC@gmail.com from the parent email address on file. We will verify your identity and respond promptly.
School accounts
- School accounts with students under 13 require the school to act as the authorized representative and to obtain any required consents (see Section 6, FERPA)
- If you believe we have inadvertently collected data from a child under 13 without proper consent, contact us at NexuspenLLC@gmail.com and we will delete it promptly
08Data Retention
| Data Type | Retention Period |
|---|---|
| Voice audio | Not stored, discarded immediately after transcription |
| Conversation history (Free tier) | 7 days |
| Conversation history (Plus tier) | 90 days |
| Conversation history (Family tier) | 1 year |
| Usage logs (query counts, timestamps) | 90 days |
| Account information | Until account deletion |
| Billing records | 7 years (required by tax law) |
| Crash & diagnostic logs | 30 days |
| Parental consent records (under-13 accounts) | Life of the account, kept as proof of consent, deleted with the account |
09Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access, request a copy of the personal data we hold about you
- Correction, request correction of inaccurate data
- Deletion, request deletion of your account and associated data
- Portability, receive your data in a machine-readable format
- Objection, object to certain types of processing
- Restriction, request that we limit processing of your data
California residents have additional rights under the CCPA, including the right to know what categories of personal information are sold or disclosed (we do neither).
To exercise any of these rights, contact us at NexuspenLLC@gmail.com.
10Data Export & Deletion
You have full control over your data:
- Export, go to Settings → Account → Export My Data in the Nexus Pen app to download all your conversation history, usage data, and account information as a JSON file
- Delete account, go to Settings → Account → Delete Account to permanently delete your account and all associated data. This action is irreversible. Billing records are retained for legal compliance per the retention schedule above.
Deletion requests are processed within 30 days. You will receive an email confirmation when deletion is complete.
12Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Send an email notification to registered users
- Display an in-app notice for 30 days after the change
Continued use of the Services after changes take effect constitutes acceptance of the revised policy.
13Contact Us
For privacy-related questions, requests, or concerns:
Nexus Pen LLC
Privacy Team
Illinois, United States
We aim to respond to all privacy inquiries within 5 business days.