Privacy policy

The short version

Who we are

Nox is provided by Nox Technologies Ltd. ("Nox", "we", "us" or "our"). We are the controller of the personal information described in this policy. This policy applies to the Nox apps for iPhone, iPad, Android, Mac, Windows and the web, and to this website (together, the "Service").

Information we collect

Information you give us

• Account details. Your username and password when you sign up. We do not store your password in readable form; we keep only a cryptographic value that lets us check it.
• Profile. The name, profile photo, bio and birthday you choose to add. All of these are optional except your name.
• Phone number and email address. Both are optional. If you add a verified email address, we use it to help you reset a forgotten password. If you add a phone number and your settings allow it, people who already know your number can find you.
• Messages and content. The messages, photos, videos, voice messages, files, polls, reactions and drafts you send or save. We store them on our servers so you can reach them from any of your devices.
• Contacts you add. The people you save as contacts in Nox, which you add one at a time by username or phone number.
• Settings. Your privacy settings, blocked accounts, notification and download preferences.
• Reports and support. Content you report to us, appeals you submit, and anything you tell us when you contact us.

Information we collect automatically

• Devices and sessions. For each device you sign in on: the device model, operating system and version, app version, IP address, the approximate country or region derived from that IP address, and when the session was created and last active. You can see this list in Settings → Privacy and security → Devices.
• Service logs. Technical records such as errors, request times and IP addresses, which we use to keep the Service running and secure.

Information stored only on your device

To work quickly and offline, the app keeps a cache of your recent messages and media, your app preferences, and the keys that keep you signed in. Sign-in keys are held in your device's secure storage, such as the iOS Keychain or Android Keystore. Signing out removes them.

What we do not collect

• We do not upload or read your phone's address book.
• We do not collect your precise location.
• We do not use advertising identifiers or track you across other companies' apps and websites.
• The apps do not contain advertising or third-party analytics tools.

Device permissions

The app asks for a permission only when you use the feature that needs it, and you can turn each one off in your device settings at any time.

How we use information

• To create and secure your account, sign you in, and help you reset a forgotten password.
• To deliver your messages and files and keep them in sync across your devices.
• To show your profile to other people according to your privacy settings.
• To prevent spam, abuse and fraud, to review content reported to us, and to enforce our terms of service.
• To fix problems, measure the Service's reliability and improve it.
• To answer your questions and send you important notices about your account or the Service.
• To comply with the law and respond to valid legal requests.

If you are in the European Economic Area, the United Kingdom or another region with similar laws, we rely on these legal bases: performing our contract with you to provide the Service; our legitimate interests in keeping the Service safe, reliable and improving, where those interests are not overridden by yours; your consent, where we ask for it, which you can withdraw at any time; and compliance with our legal obligations.

What other people can see

• The people you chat with see the messages you send them. A message you send to a group is seen by its members.
• Your username, name and profile photo can be seen by people you interact with. Your phone number, last seen time, profile photo, birthday and other details are shown according to Settings → Privacy and security.
• Anyone who knows your username can look you up. People can find you by phone number only if your settings allow it.
• Messages someone else has received remain on their devices and in their chats according to their own choices, even if you later change your settings.

How we share information

We do not sell your personal information, and we do not share it for targeted advertising. We share it only in these cases:

• Service providers. Companies that host our servers and stored files, and that deliver verification and password-reset codes by SMS or email, process information on our behalf, under contracts that limit its use to providing their service to us.
• QR code scanning on Android. The Android app uses Google ML Kit to read QR codes. Images are processed on your device, and Google may collect limited diagnostic information about how ML Kit performs, as described in Google's own privacy policy.
• Legal reasons. When we believe in good faith that disclosure is required by law, or necessary to protect the safety, rights or property of our users, the public or Nox.
• Business transfers. If Nox Technologies Ltd. is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that deal, and this policy will continue to apply to it.
• With your permission. In any other case where you ask us to share it.

How long we keep information

• Account and profile. For as long as your account exists.
• Messages and files. Until they are deleted. When you delete a message for everyone, it is removed from our servers and from the other people's chats. When you delete it only for yourself, the other people keep their copy.
• Sessions. Until you sign out. A device that has not been used for six months is signed out automatically.
• Service logs. For a limited period, typically no longer than 90 days, unless we need them longer to investigate a security incident or abuse.
• Reports and appeals. For as long as needed to handle them, keep the Service safe and meet our legal obligations.

Deleting your account

You can delete your account at any time:

• In the app. Go to Settings → Privacy and security → Account → Delete account. If you enter your password, your account is deleted straight away. If you can't enter it, the deletion is scheduled for seven days later, and you can cancel it during that time.
• By email. If you can't use the app, email privacy@nox.example with your username, from the email address linked to your account if you have one. We will confirm that the account is yours before deleting it.

Deleting your account removes your profile, username, contacts, settings and sessions. Messages you sent remain in the chats of the people who received them, shown as coming from a Deleted Account. If you want them gone, delete them for everyone before you delete your account. Deletion cannot be undone. Copies in our backups are removed within 30 days.

Security

Everything sent between the app and our servers is encrypted in transit. We limit who can access our systems, protect sign-in keys on your device with its secure storage, and let you see and sign out every device signed in to your account. Messages are stored on our servers so they can sync across your devices, and they are not end-to-end encrypted. No system is perfectly secure, so please use a strong, unique password and add a verified email address so you can recover your account.

Your rights and choices

You can see and change most of your information yourself in the app, including your profile, privacy settings and signed-in devices. Depending on where you live, you may also have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct or delete it;
• object to or ask us to restrict certain processing;
• receive your information in a portable format;
• withdraw consent you have given, without affecting earlier processing.

To make a request, email privacy@nox.example. We will respond within the time the law requires, usually within 30 days, and we may need to confirm your identity first. We will not treat you differently for exercising your rights. If you are in the EEA or the UK, you can also complain to your local data protection authority.

If you are a California resident: we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information to infer characteristics about you.

Children

Nox is not intended for children. You must be at least 13 years old to use it, or older if your country requires a higher age to agree to the processing of personal information. We do not knowingly collect information from children under that age. If you believe a child has given us personal information, contact us and we will delete it.

International transfers

We and our service providers may process your information in countries other than the one you live in, which may have different data protection laws. When we transfer personal information out of the EEA or the UK, we use safeguards recognized by law, such as standard contractual clauses.

Changes to this policy

We may update this policy as the Service changes. We will change the effective date above, and if a change is significant we will tell you in the app or on this website before it takes effect.

Contact us

For questions about this policy or your personal information, email privacy@nox.example or write to us: