Terms of Service & Privacy Policy

By creating an account, browsing, or otherwise using Nexus - the mobile app, its backend APIs, the trusted-contact web portal, and related services - you agree to be bound by these Terms of Service and by our Privacy Policy, incorporated by reference. If you don't agree, don't use the Service.

You must be at least 18 years old to use Nexus, in either flavor. There's no upper age limit on the main nexus app; nexus_mec is additionally capped at 27, matching its campus scope. Age is self-attested at signup - a slider, not an ID check - and enforced server-side against your variant's range at every layer (API validation plus a database trigger as a backstop), but we do not verify identity or run age-estimation on photos. If you're aware of an account misrepresenting its age, report it in-app (Report → "Underage"); we act on that the same way we act on any other Trust & Safety report.

nexus_mec additionally requires a verified email address on that flavor's configured campus domain - the main nexus app has no email-domain restriction.

nexus and nexus_mec share one backend and one privacy/security architecture. A nexus_mec account can generate a one-time export code to migrate into the main nexus app; the reverse isn't supported. Your flavor determines which age range, email-domain rule, and Spotify OAuth redirect apply - it never changes how your data is stored, encrypted, or protected.

Nexus has no password-based login. You sign in with Google Sign-In or a passwordless one-time email code. We never ask for, store, or have access to a password for your account.

A phone number is required to complete signup - the app verifies it by SMS one-time code before it will finish creating your profile. This exists specifically to make it harder to spin up large numbers of duplicate accounts off disposable email addresses alone; it is not a login credential by itself, and sign-in itself remains Google/email-OTP only.

The source is free; using our hosted instance is a privilege - one that comes with real people's intimate profile data and emergency-safety information riding on it. You agree not to:

• Abuse the API - script, scrape, or bot past normal usage patterns, or send more requests than a human could reasonably generate.
• Attack device/security integrity - bypass, spoof, or reverse-engineer App Check, Play Integrity, App Attest, or any anti-abuse control.
• Attack encryption - attempt to decrypt other users' encrypted profile fields, Signal-Protocol-encrypted chat messages (we can't read them either), or Meetup Safety evidence.
• Weaponize Meetup Safety - file a false SOS/inform alert or harass a trusted contact through the escalation/portal flow. This notifies real people who believe someone may be in danger.
• Evade moderation - create a new account to route around a suspension, ban, or block.
• Harass, impersonate, or endanger other users, via profile, chat, or the discovery system.
• Upload malware or attempt to compromise our infrastructure.
• Misrepresent your identity, age, or campus affiliation (nexus_mec).

We may suspend, restrict, or terminate access for any violation, with or without notice, per §9.

You retain ownership of what you post. By posting it, you grant Nexus a license to store, display, and process it as needed to run the Service - e.g. showing your photo to a match, running it through discovery/matching. You're responsible for having the rights to anything you upload and for it not violating §6 or applicable law.

We may suspend or terminate access for a Terms violation, at our discretion, with or without notice. You may delete your own account any time from Settings → Delete Account - see Privacy Policy §11 for exactly what happens to your data, including the recoverable grace window and what's retained under a time-boxed legal hold for safety-incident records.

Nexus integrates Google Sign-In, optional Spotify music-taste sync, and the other services in Privacy Policy §9. Your use of those is also subject to that provider's own terms - we're not responsible for their availability, changes, or any enforcement action against your account with them.

Beyond the AGPLv3 disclaimer in §5, the hosted Service is provided "as is" and "as available." We don't guarantee discovery/matching will produce compatible matches, that the Service will be uninterrupted or error-free, or that any safety feature will prevent harm. Your use of the Service - including any decision to meet another user in person - is at your own risk and judgment.

To the maximum extent permitted by law, Nexus and its creators, maintainers, and contributors are not liable for indirect, incidental, special, consequential, or punitive damages arising from your use of the Service - including harm arising from an in-person meetup, a failed or delayed safety alert, or reliance on another user's profile information.

You agree to defend, indemnify, and hold harmless Nexus's creators, maintainers, and contributors from claims, damages, and reasonable legal fees arising from (i) your use of the Service, (ii) your breach of these Terms, or (iii) your violation of any law or a third party's rights (including a campus's own policies, for nexus_mec users).

We version these Terms (current version: 1). When we ship a materially updated version, you'll see a full-page re-consent screen the next time you open the app - accept the update or delete your account; there's no silent-continue path. Every acceptance and decline is logged with a timestamp, visible in your own data export.

These Terms are governed by the laws of India, without regard to conflict-of-law principles. Disputes are subject to the exclusive jurisdiction of the courts at Kochi, KL, India.

For legal inquiries, Terms violations, or data requests: [email protected]. Per DPDP §13, our Grievance Officer is named in Privacy Policy §16.

Nexus is a social-discovery app - browse, like, match, and chat, with real in-person meetups as the point, which is why intimate profile data and physical-safety data are both first-class here, not footnotes. Under DPDP, Nexus is the "Data Fiduciary" for the data described below; you - and, in one specific case (§4), the people you list as trusted contacts - are the "Data Principal(s)."

Account & identity - sign-in via Google or passwordless email OTP (never a password); a phone number, verified by SMS one-time code as part of completing signup - an anti-abuse measure so duplicate accounts can't be created off disposable emails alone, encrypted at rest and never a login credential itself; name and self-attested age (range-checked per flavor); campus year/branch/institute name on nexus_mec (encrypted); which flavor your account is on.

Music taste (Spotify, optional) - read-only access (user-top-read, playlist-read-private, playlist-read-collaborative). We store top artists and, from playlists, track/artist names only - never album art, previews, popularity, or audio-feature analysis, per Spotify's Developer Policy. Feeds a matching-only "artist affinity" score, never shown to other users. Your refresh token is encrypted; we never see your Spotify password.

Discovery, likes, matches, reports - every pass/like/superlike/hide/block is recorded (passes auto-expire in 14 days); mutual likes become a match; reports carry a structured reason, and if you file one, your identity is stripped from what the reported user's own data export could ever surface.

Chat - end-to-end encrypted via the Signal Protocol; see the dedicated breakdown below.

Meetup Safety & emergency data - trusted contacts (name/phone, encrypted, likely non-users - see §4), SOS/check-in alerts with encrypted location, Digital Witness audio/video evidence with an encrypted decryption key, and check-in session state (battery/connection readings, escalation history).

Device & technical data - push token and platform, Play Integrity/App Attest device-attestation tokens (via Firebase App Check), and standard request metadata (IP, app version).

Support communications - your message, category, optional screenshots, and (bug reports) app version/device info.

Consent records - every accept/decline of general, special-category, or safety-data consent, with version and timestamp - included in your own data export.

No server-side AI/ML content moderation, image scanning, or biometric/facial-recognition analysis on your photos - the only AI processing your photos ever undergo is the on-device aesthetic vibe-tagging in §2, which runs locally on your phone, never on our servers. No advertising trackers or third-party analytics SDKs. We do not sell your data, to anyone, for any reason.

• Discovery & matching - the core service; see §8 for exactly what drives it.
• Delivering Meetup Safety - composing/sending alerts, running escalation, decrypting evidence for an authenticated trusted contact.
• Trust & Safety - reviewing reports, enforcing Acceptable Use, maintaining the re-signup blocklist for accounts removed for cause.
• Notifications - push and, per your preferences, email.
• Legal compliance - lawful requests, Terms enforcement, retention/legal-hold handling (§11).
• Operating the service - error monitoring (PII scrubbed before it reaches our tooling), abuse rate-limiting.

We do not use your data for third-party advertising, and we do not sell it.

Not one bundled checkbox. The first time you use Nexus, and again whenever a consent version changes, you're shown three separate choices:

Every accept and decline is logged and exportable.

• Encryption at rest - sensitive fields (profile attributes, phone numbers, chat-event scheduling data, Spotify tokens, safety contacts/alerts/evidence keys) Fernet-encrypted with rotation support - an old key can be retired without a hard cutover.
• Blind indexing - fields we need to query for exact matches (e.g. the deletion blocklist) use a deterministic HMAC-SHA256 index rather than ever running equality search against decrypted values.
• End-to-end chat encryption - Signal Protocol (X3DH + Double Ratchet). Your device holds the only copy of your private key material.
• Pseudonymized matching embeddings - semantic vectors for bio/career/identity similarity are stored keyed by a random pseudonym id, not your real profile id; the mapping lives in a separate, deny-all table. A raw leak of the embeddings table alone can't be trivially traced back to you.
• Transport security - TLS for everything in transit.
• Device attestation - Firebase App Check (Play Integrity / App Attest) distinguishes real app traffic from scripted abuse.
• Access control - row-level security scoping every table to its owner; internal tables (embeddings, pseudonym map, audit logs) deny all client-side access.
• Rate limiting - per-endpoint limits on auth, discovery, safety actions, OTP requests, and more.
• Error monitoring - redacts emails and token/secret-shaped strings before anything is sent; never receives message content.
• Authentication audit logging - our auth provider keeps a security audit log of sign-in events (timestamps, event type) for detecting account-takeover attempts and unusual sign-in patterns - a standard, retained security control, not a feature we turn off to save storage.

Discovery across Dating, Friends, and Professional is powered by a scoring engine we can describe, not a black box. It blends structured profile fields (values, interests, lifestyle, career/identity signal, location, age) with AI-derived semantic similarity on your bio/career/identity text (pseudonymized, §7), weighted differently per tab. Two hard exclusion rules exist on Dating (drinking/smoking mismatches), applied before scoring, not learned.

None of the providers below see your data for anything beyond the specific job listed.

Your data is stored in Mumbai, India. Twilio, Brevo, Google/Firebase, Apple, Spotify, and Sentry are each headquartered (and process data) outside India, so parts of the flow above cross borders in the ordinary course of sending an SMS, a push notification, or a monitored error. If you're in the EU: India has no European Commission adequacy decision, so a formal transfer mechanism (e.g. Standard Contractual Clauses) may be required for your data specifically - this is under review rather than something we assert is already fully in place.

If you're in the EU, two more things are under active review rather than settled: whether GDPR Art. 37 requires formally designating a Data Protection Officer (plausible, given the scale of special-category processing in §2 and §8), and naming an EU representative under Art. 27 if we have no EU establishment. Separately, where DPDP treats nearly everything here as consent-based, GDPR offers other legal bases - core matching plausibly sits on "necessary for performance of a contract" (Art. 6(1)(b)) rather than withdrawable consent, while special-category data and marketing (§14) stay consent-based either way. This mapping is being finalized, not asserted as complete today.

Deleting your account starts a 14-day recoverable grace window - sign back in and it's fully reversed, matches and chats intact. After that, your account is anonymized in place (every profile field wiped, email/phone unlinked) rather than row-deleted, so your former matches' own chat history stays intact on their end. A phone-number hash is added to a re-signup blocklist only if your account was actually flagged at deletion time - a good-standing account leaves no such trace. Three years after anonymization, the account is hard-deleted for good.

• Access & export - Settings → Export My Data: a structured export of your profile, matches, chat metadata (never content), safety data (evidence via signed link, never the raw key), and consent history. OTP-verified, rate-limited.
• Correction - edit your profile directly, any time.
• Erasure - delete your account (§11).
• Withdraw consent - decline an updated Terms version (routes to deletion, since general consent is structurally required to use Nexus at all); turn special-category consent or Meetup Safety data off any time - neither requires deleting anything, both just lock their respective fields/features until re-granted.
• Object to marketing - toggle "Product Updates" / "Promotions & Offers" off independently; security/transactional email is never optional.
• Grievance redressal - §16.
• Nomination (DPDP §14) - naming someone to exercise your rights after death or incapacity isn't implemented yet; a genuinely new right with little settled practice, tracked rather than ignored.

Nexus is not for anyone under 18, on either flavor. We do not knowingly collect data from minors. Age is self-attested, not ID-verified (Terms §2) - an accepted residual risk of the product category rather than something we pretend doesn't exist. "Underage" reports are handled the same as any other Trust & Safety report.

Five independently toggleable email categories: new matches/likes, new messages, an activity digest, product updates, promotions/offers. All five currently default to on for a new account - turn any off any time, no justification required. Security and account-lifecycle email is never gated by these toggles.

Versioned alongside the Terms of Service. A materially updated version triggers the same full-page re-consent flow described in Terms §14 - you'll always know when something changed and get a real choice about it.

Per DPDP §13, our designated Grievance Officer:

DEVANARAYANAN
Email: [email protected]
Phone: +91 88917 50777
Website: https://nexus.devakesu.com/grievances

General privacy questions: [email protected].