Privacy notice

Nexus asks Google for the OpenID, email, and basic profile scopes. It uses the Google account identifier and verified email address to sign in. School membership requires an invitation issued for that exact email; Google sign-in or an email domain does not enroll an account.

Nexus stores the Google access and refresh credentials issued for the sign-in connection. This sign-in connection does not request access to Google Drive, Gmail, Calendar, contacts, or other Google product data.

If your school enables Google Classroom and you choose to connect a teaching account, Nexus asks for separate permission to read courses, coursework, class materials, and announcements. Nexus does not request or use access to Google Drive. When a course item has a Google Drive file attached, Nexus keeps only its title and link and does not read the file. Nexus stores the connection credentials for authorized refreshes. Connecting a teaching account does not change school membership or grant administrator access.

Nexus stores school account records, chat history, assignments, source connections and file metadata in its deployment database, uploaded files in object storage, and extracted search content in its index. Saved assignments and connections are private to their owner. Teachers and school operators cannot routinely read full student chats or their attachments. Students can deliberately share selected messages with a named recipient. The separate authorized safety process may retain and show a limited excerpt to designated safety contacts. Personal workspaces remain separate.

To generate a response, Nexus may send your prompt, relevant chat history, agent instructions, and uploaded file content or extracted passages through OpenRouter to the upstream model you select. Those providers process the material needed to answer your request under their own terms and privacy practices.

When you use enabled voice tools, Nexus sends your recording for transcription, or selected answer text for read-aloud, through OpenRouter. Transcription uses OpenAI's Whisper model and read-aloud uses Hexgrad's Kokoro model. Nexus refuses school voice requests through any other connection, including OpenAI directly. Voice needs class permission, follows the same age rules as chat models and counts toward school spending limits. Transcribed text becomes part of chat history when you send it. Image generation is off for schools, because the image provider can't promise not to keep prompts. Providers handle submitted material under their own terms and retention settings.

• Google Cloud hosts Nexus, its database, files, search index and cache. The school deployment is configured for the us-east4 region (zone us-east4-c).
• OpenRouter routes model requests to inference hosts. Reviewed model publishers include OpenAI, Anthropic, Google, DeepSeek, Moonshot AI, Mistral AI and Meta. School and age rules limit available models.
• Voice tools use OpenAI and Hexgrad models through OpenRouter. The company serving a model can differ from its publisher.
• Sentry receives filtered error diagnostics when configured. Filters aim to remove identifiers and classroom content.
• Stripe processes school checkout and payment data when billing is used. Chat content is not included in checkout requests.
• Google handles sign-in. Separately authorized connections to Google Classroom, Canvas and, where a school sets it up, Blackbaud let Nexus read account and course data. Classroom and Canvas grade connections also read class rosters and grades.
• Configured email services use SendGrid or an SMTP provider. Optional Braintrust or Langfuse tracing can receive model inputs and outputs. Active connections, processing locations and retention outside the school cluster need operator confirmation.

A question can send your message, relevant history, class instructions, material excerpts, file content or descriptions and your written preferences to the model. Nexus does not add your account name, email or other account details, and your uploads reach the model without their file names. Names in messages, preferences, files or class materials can still reach the model. Nexus checks the draft with a separate review by a model before showing an approved answer. Saved chats and files are stored in school storage.

Nexus sends school text and voice requests only through OpenRouter, and asks it to route them with data collection denied. This request setting is not a contract or a guarantee of zero retention.

Nexus relies on recorded school authorisation before students marked under 13 can use AI. Nexus stores account and school membership records, prompts, chat messages, submitted files, and service logs. School staff cannot routinely read full student chats. Students can choose to share selected messages. Safety flags send excerpts to named school contacts. The school can request student data deletion.

Under-13 access requires the school to enable the reviewed Claude models, routed through OpenRouter to Anthropic’s own host only. Other external models are blocked for this age group. Staff AI requests omit under-13 records unless they use this approved route.

Schools can record a chat retention period for students under 13. Approval copies the period into a policy version; later edits need a new approval. It is not enforced until retention execution is enabled and the policy is activated. It covers eligible registered class-chat text, subject to holds and dependency checks. Files, provider copies, backups, and other interaction logs are outside this setting.

When a school uses Work check, students install the Work check extension for Microsoft Edge or Google Chrome. It records only in the assignment a student has linked, only on sites the school approved, and only while its recording label is visible on the page. It records the text of the selected editor as the student types, pastes, deletes or rewrites, with timestamps and pause gaps.

It does not record other tabs or browsing history, passwords, screenshots or screen video, and it does not read anything outside the linked assignment. Students can pause recording at any time.

The student's teacher for that class sees a replay of the writing sessions, pasted blocks and rewrites, and one label: Steady drafting, Worth a look or Talk with student. Labels start a conversation; they are not proof. Students can see what their teacher sees. If the teacher turns on Explain your work, the teacher also sees the student's three answers.

Recordings are stored in the school's own deployment and encrypted at rest. The replay and labels are computed without AI. Explain your work sends the student's work and answers to the school's approved AI model with provider data collection denied; student work is not used to train AI models.

Recordings follow the school's deletion schedule described below. Removing the extension stops recording, and the school can ask for records to be deleted at any time.

Google Cloud encrypts persistent storage at the infrastructure layer. OAuth credentials for assignment sources are also encrypted separately before database storage. Other application database fields and object payloads rely on infrastructure encryption. Traffic to the public site uses HTTPS, and application services communicate inside the school deployment.

Nexus application and service access logs may retain request paths, status codes, timing, and service errors while omitting query strings and request bodies. Google Cloud may process URL parameters, IP addresses, user-agent details, and related request metadata in its infrastructure logs.

When the deployment enables Sentry, the web app, server and edge services send error diagnostics to Sentry. These can include app versions and stack traces. Nexus filters identifiers and classroom content. This notice does not confirm that diagnostics are enabled in your school.

The Nexus mobile apps send error and crash diagnostics to Sentry. Reports can include app and operating-system versions, device model, and stack traces. We configure filtering to remove user identifiers and classroom content. Mobile session replay, screenshots, and performance tracing are disabled.

Nexus has no default retention period. Deleting a chat hides it from the chat list but may retain its stored messages. Deleting a chat never removes a safety flag about one of its messages. File deletion runs asynchronously and retries when storage cleanup fails. In the school web app, open Settings, then Accounts & Access to download your profile, preferences, saved chats and alternate responses, memories, projects, upload details and original uploads, plus your available private assignments, source connection details and own Canvas grade history from your current school. The archive also lists the safety notices you were shown, with the date and whether the message went to a safety contact. Original files are encoded inside the archive, up to 32 MiB combined. The archive can include chats hidden by deletion. Credentials, private-session uploads, files pending deletion, generated files, tool activity, connected documents, safety flags, safety contacts' notes and other school-managed records are excluded. Where your school has turned on account deletion, you can request it in Settings, then Account deletion: your personal data, including the safety notices you were shown, is deleted; class records are erased after your school's retention period; safety flags about your messages stay with your school's safety contacts until that period ends, and then their excerpts, notes and the link to you are erased; and backups and copies held by other services are not erased. Otherwise, contact support for deletion or data that is not included in the archive.

Contact support@narb.cc with privacy, account, or data questions.