Privacy

Website and hosting

JAO Nexus runs on a netcup VPS. Delivering the website and API requires technical connection information, including IP address, time, requested address and HTTP status. The hosting provider and any appointed technical service providers may receive this information.

The community database and operational logs are separate. A raw IP address is not stored as a permanent community identity. The operator must confirm actual operational log retention and hosting contracts, locations and subprocessors; this notice does not promise an unverified deletion period or exclusively German processing.

Accounts and sign-in

An account stores username, display name, email address, stable public ID, role, status, setup state and creation/update times. Passwords are stored only as salted scrypt hashes. All new public accounts receive the member role. Email addresses are excluded from public user responses; only administrators can access user management.

Account data supports sign-in, permissions and attribution of contributions. Email supports requested account recovery and security notifications, not advertising. A public account cannot be created without the required information. Public reading remains possible without an account.

Sign-in sessions store only the random token's hash, user association and creation, expiry and last-use times. Sessions last at most eight hours. Logout, password reset and role changes revoke affected sessions. Expired tokens cannot be used; expiry does not itself mean immediate physical deletion of every associated record.

Password recovery and email

A reset request uses an email address and interface language. Its response does not reveal whether an account exists. Eligible active accounts receive a random one-time link. PostgreSQL stores only its hash and timestamps; it is valid for at most 15 minutes. A newly issued link replaces the previous one; use or a password change invalidates it. Successful reset revokes all previous sign-in sessions.

For delivery, Brevo receives the recipient address, sender, localized subject and necessary plain-text message, including the complete one-time reset link. Normal email and connection metadata also arise, such as message ID, sending time and the connection from the Nexus mail server. The recipient's mail provider also processes the message. The link is a temporary access secret: storing only its hash in the Nexus database does not prevent mail providers from processing the link in the message. Please do not share it.

Nexus does not send passwords, password hashes, session tokens, roles, status values, forum contributions or reports for these emails. The recipient's username and display name are not included either. SMTP credentials are runtime secrets used only to authenticate to the mail service over an encrypted connection, never part of the email. Successful reset also schedules a separate security notification without a password or reset link.

Brevo is enabled for transactional email. The sender is JAO Nexus <noreply@jaonexus.de>. Nexus generates German/English plain-text messages and requires STARTTLS with certificate verification for SMTP on port 2525. The operator confirms domain authentication, DKIM and DMARC are configured. No newsletter feature is in production. Contractual arrangements, any third-country transfers and safeguards remain subject to personal review. Email verification is not implemented; a supplied address is not yet proof of ownership.

Nexus inserts neither tracking pixels nor tracked links into its plain-text emails and does not synchronize marketing contact lists for this purpose. On 15 September 2026 the operator confirmed these Brevo settings: transactional logs for one month, email previews never stored. Provider-side tracking requires separate review; the Nexus templates do not establish what every Brevo setting does or guarantee exclusively European processing.

The bounded delivery queue exists only in memory, without a permanent local message copy. Process restarts can lose pending jobs. Reset hashes are deleted when a replacement link is issued, a reset succeeds or a relevant password change occurs. An expired reset record or one whose email failed to send may remain until then; a global cleanup job is not implemented.

The reset link's 15-minute validity is not a deletion deadline for emails, delivery logs, audits or backups. The confirmed Brevo settings do not replace review of other provider data, deletion procedures, subprocessors or existing message copies. Retention in the recipient's mailbox is not under Nexus's sole control.

Necessary cookies and browser storage

The API uses __Host-nexus_session for explicitly requested sign-in (at most eight hours) and __Host-nexus_guest for explicitly requested guest participation (at most seven days). Both use HttpOnly, Secure, SameSite=Lax and Path=/, and are restricted to the API host. The database holds token hashes, not raw cookie tokens.

Public lobby, forum and activity reads do not create a guest cookie. It is created only by selecting “Join as guest”. Existing cookies may be sent on subsequent API requests for recognition.

The reviewed site code uses no localStorage, sessionStorage, IndexedDB, analytics, advertising cookies or automatically loaded external embeds. The cookie notice is not a consent selector: “Understood” dismisses it only on the current page and stores no preference. Ordinary technical browser caching is separate.

The exception in section 25(2) TDDDG concerns only storage strictly necessary for an explicitly requested service. It is not blanket permission for future optional providers. Any new optional storage must be assessed separately before introduction.

Guests, lobby, forum and resources

Guests are distinct from registered users. Records contain a random public guest ID, a server-generated display name, language, active/muted/blocked status, token hash, activity times, message counters and moderation version. Guest identity permits the intended lobby participation only; forum writing requires a Nexus account.

Lobby/forum text, display name, actor type, language and timestamps are public unless content is hidden. Messages remain in their original language, without automatic translation. Page limits are not deletion periods. Please do not publish confidential or unnecessary personal information.

Resources include author, licence and description metadata and controlled ownership associations. Download permission is separate from licence and ownership. Administrators may diagnose and manage resources; this does not automatically authorize public redistribution.

Forge distribution and plugin permissions

Browser approval can link Forge to the existing Nexus account. A pairing is valid for five minutes and records the device public key, chosen name, verifier challenge, account/browser-session association and timestamps. Native desktop sessions last at most 30 days and store only the secret hash, public session ID, account/device associations, revisions and timestamps. Logout, password changes or reset, suspension, relevant role changes and device revocation invalidate affected sessions. No hardware fingerprint is collected. Forge must protect the credential in its operating system storage and keep it out of the renderer. Through the plugin delivery routes, a connected Forge can use this session to read the account's own plugin entitlements and download plugins already enabled; no new data categories arise. Linking itself grants no publisher or administrator rights; separately authorized publisher workflows are unchanged. An “Open in Forge” link transfers only the plugin ID and version.

Publisher mutations require an operation-specific device proof valid for exactly 120 seconds. The server stores the nonce hash and request digest, not the full nonce or private key. Pairing, approval, session and security changes are recorded in a restricted audit. Expired or revoked records and audit entries are not automatically erased; their retention and erasure, including backups and account relationships, require controlled operator handling.

The distribution extension stores a public device ID, account association, a chosen device name, public key/fingerprint, status and timestamps for registered Forge devices. Registration does not grant publisher authorization. Private device or release-signing keys are never transferred to Nexus. Only administrators can access device management. Release-signing public keys and published package metadata are intentionally publicly verifiable.

A device challenge is valid for at most 120 seconds; Nexus stores only nonce and session hashes. Expiry limits usability, not automatically retention. Plugin entitlements associate an account with an explicitly enabled plugin. Users see their own permissions; administrators manage them through controlled actions. Publication, device, key and entitlement changes are audited with actor, target, timestamp and state details, without passwords, private keys or raw session tokens.

This extension requires no new cookies, tracking or additional external providers. Automated erasure of device, entitlement and distribution-audit data is not implemented. The operator must assess purpose-based retention, access and controlled erasure, including backups. Implementation is not automatic production approval; legal grounds and operator review remain separate prerequisites.

Reports, moderation and audit

Forum reports are visible only to authorized moderators and administrators. They contain reason/text, reporting user, target content, status and handling information. Moderation records identify the acting user, affected content or guest, timestamp and state change.

Registration, reset requests, successful resets and explicitly confirmed role changes are audited without passwords, tokens or mail credentials. Only administrators may switch member and moderator roles; this revokes the affected account's previous sessions.

Hiding or archiving is not deletion. Content, ownership associations and necessary moderation records may be retained for accountability. Public accounts, contributions and audits do not yet have a complete automated retention or deletion workflow.

Security and abuse prevention

The API validates inputs, origins, permissions and request formats on the server. Short-lived rate-limit counters use HMAC-derived connection signals keyed randomly per process, and normalized email addresses for reset requests. These counters do not permanently store raw IP or email addresses. Windows last at most one hour depending on the function; counters expire on later requests or process termination.

For existing accounts, the token's database issue time additionally limits repeated reset emails. Application logs contain no session tokens, reset links, passwords or mail credentials. Security checks are not a public profiling or reputation system.

Purposes and legal assessment

Processing supports the requested account/community functions, recovery of account access and secure, accountable moderation. No marketing consent is collected because those functions are not operated.

The operator must finalize the legal grounds before activation. Article 6(1)(b) GDPR may apply to processing necessary for a user agreement or requested pre-contractual steps. Article 6(1)(f) may apply to necessary security and abuse prevention only after a documented balancing assessment. Statutory retention may be invoked only where an applicable obligation actually exists.

These assignments are a draft for operator review, not a claim that every legal requirement has been conclusively assessed. Registration remains disabled pending the corresponding approval.

Retention and erasure requests

Retention is assessed against purpose, account use, security needs, unresolved reports and legitimate evidential or statutory obligations. Token lifetimes limit usability, not automatically every storage period. Contributions do not disappear from the archive solely because of age.

Automated export, complete account erasure across all relationships, and regular cleanup of all expired records are not yet available in this alpha. A new login removes that user's expired and excess sessions; it does not delete expired guest sessions or community content. Access, correction and erasure requests should be sent to the contact above for controlled review. Before activation, the operator must establish retention criteria, periodic reviews, responsibilities and practical handling. This includes operational logs, provider records and protected backups; erasure from the live database does not automatically erase existing backups.

Recipients, links and your rights

Recipients may include the hosting provider, authorized administrators/moderators within the scope described, Brevo as the transactional mail provider and the recipient's mail provider. Publicly posted content is visible to other visitors. Direct contact emails are handled through the Hotmail mailbox shown above. External links load the third-party service only when followed.

Subject to applicable conditions, you have rights of access, rectification, erasure, restriction and portability, and objection, particularly where processing relies on legitimate interests. You may complain to a competent data protection supervisory authority. For access, correction or erasure, please contact the controller above.