Privacy Policy
In short
- Nexus reads your Gmail with a read-only permission. It never sends, deletes or changes mail.
- Your mail and everything Nexus builds from it stay on your computer. Our servers never receive or store your mail.
- One exception: to read your mail, Nexus sends mail text to an AI model. On a plan with AI included, that request passes through our relay to a model provider. Our relay counts tokens and keeps no text.
- Our cloud stores your account, your encrypted Google tokens, your licence, your AI usage counts and your invitation. Nexus also sends us crash reports, session records and usage counts, which never contain your mail or anything you type.
- We do not sell your data, use it for advertising or use it to train AI models.
- You can withdraw Nexus’s Gmail access at any time at myaccount.google.com/permissions.
1. Who we are
DecimaWorks makes Nexus and is the data controller for the personal data this policy describes. You can reach us at george@decimaworks.com.
This policy covers the Nexus desktop application, the DecimaWorks account service at auth.decimaworks.com, and the website decimaworks.com.
2. What Nexus is
Nexus is a desktop application for macOS. It reads one person’s own Gmail mailbox and builds a private knowledge layer on that person’s own computer: the Projects they work on, the Commitments they and others have made, and the Network of people they work with. It then shows what needs their attention, in a daily briefing and in pages the person can search.
The knowledge layer is a file on your computer. It is written by the application and read by the application. It is yours.
3. The Google data Nexus reads
When you sign in with Google, Nexus asks for four permissions:
| Permission (scope) | What it gives Nexus | Why Nexus needs it |
|---|---|---|
openid, email, profile | Your Google account ID, your email address, your name and your profile picture. | To create your DecimaWorks account and sign you in. |
https://www.googleapis.com/auth/gmail.readonly | Read-only access to your Gmail mailbox. | To read your mail and build the knowledge layer. |
With the Gmail permission, Nexus reads:
- Message headers: sender, recipients (To and Cc), subject and date, and the mailing-list headers that tell Nexus a message is a newsletter or an automated notice.
- Message bodies: the plain text of each message. When a message has only an HTML body, Nexus converts it to plain text.
- Which mail: your Inbox, your Sent mail and your Trash. Nexus does not read Spam, Drafts, or mail Gmail sorts into the Promotions and Social categories. On first connection it reads the last 7 days; after that it reads new mail as it arrives.
Nexus does not download attachments. It does not keep attachment names, types or sizes. It does not read your labels, your contacts or your calendar.
Nexus never sends, deletes, archives, labels or changes any mail. The permission it holds does not allow it to.
4. Where your mail goes
Your computer reads your mail directly from Google’s Gmail service. The mail, and the knowledge layer Nexus builds from it, are stored in the application’s data folder on your computer. Our servers never receive, relay or store your mail or your knowledge layer. There is no copy at DecimaWorks.
To read your mail, the application needs a short-lived Gmail access token. Our cloud holds your Google sign-in tokens (section 6) and hands the application a fresh access token when it asks. Only the token travels between our cloud and your computer; your mail does not.
When new mail arrives, Google sends our cloud a notice that your mailbox changed, through Google Cloud Pub/Sub, the only delivery method Gmail offers. That notice carries your Gmail address and a change number. Our cloud uses the address to find your running application and sends it a one-word signal to sync. The notice carries no mail content, and we do not keep it.
The one path on which mail text leaves your computer is AI processing, described next.
5. AI processing
Nexus uses an AI language model to read each mail thread and extract the projects, commitments and people in it, and to write the pages you see. For that, the application sends the model the text of the thread: the sender, recipients, subject and date, and the body with quoted reply chains and footers removed. Where that text goes depends on your plan:
- Plan with AI included. The application sends the request from your computer to the DecimaWorks AI relay, with a short-lived credential tied to your account. The relay forwards it to OpenRouter, which runs the model on one of a short list of inference providers we choose (at the time of writing: Parasail, Reka and CoreWeave, in that order). The provider returns the answer through the relay to your computer. Our relay records only your account ID, a request ID and the number of tokens used. It does not store the text of the request or the answer.
- Plan with your own AI key. The application sends the request from your computer directly to the AI provider you configured, using your own key. At the time of writing Nexus supports MiniMax. That provider’s privacy policy governs what it does with the text. DecimaWorks does not see these requests.
In both cases the model’s answer, and the request that produced it, are recorded in your local knowledge layer so that you can see what the AI was shown and what it said.
We do not use your mail or the model’s output to train any AI model. OpenRouter and the inference providers process the text only to answer the request. OpenRouter's privacy policy and terms govern what they retain (openrouter.ai/privacy).
6. What our cloud stores
Our cloud service runs on Cloudflare. It stores the following about you:
| Record | What it holds | Why |
|---|---|---|
| Account | Your name, email address, whether the address is verified, your profile picture address, your role, and your plan, seat count and entitlements. | To run your account and show you your plan. |
| Google sign-in | Your Google account ID, the permissions you granted, and your Google access token, refresh token and ID token. | To sign you in and to hand your application a Gmail access token when it needs one. The access and refresh tokens are encrypted at rest (section 12). |
| Session | A session identifier, its expiry, and the IP address and browser or application version that opened it. | To keep you signed in and to spot misuse. |
| Licence | Your plan, its seats, the connectors and features it allows, and when it expires. | To decide what the application may do. |
| Invitation | The invitation code you redeemed, the email address it was made for, a note from the person who made it, and the date you redeemed it. | Accounts are invitation-only. |
| AI usage | Your account ID, a billing period, and the total number of tokens used in it (plans with AI included only). | To apply your plan’s AI limit. |
| Push registration | A one-way hash of your Gmail address, and your account ID. | To match Google’s “mailbox changed” notice to your running application. |
| Crash reports and sessions | Error reports and session records, as described below the table, keyed by your account ID and a random install ID. | To find and fix crashes, and to see whether a Nexus version is safe to keep. |
| Usage counts | Which parts of Nexus you open and when, sync results and counts, and the codes of error messages you saw, as described below the table, keyed by your account ID and a random install ID. | To see whether people use Nexus and come back to it, and which parts to improve. |
The automatic update check. Every copy of Nexus fetches a small file from decimaworks.com to learn whether a newer version exists. That request carries no account information, no version and no device identifier. Like any web request it reveals your IP address to our hosting provider, Cloudflare.
Crash reports and session records. When Nexus crashes or meets an error, it sends a report to our crash-report service, Decimetry, which runs in our own Cloudflare account. It also records each session: when Nexus started and stopped, and whether it crashed. Nexus always sends both. On your computer, before a report leaves, Nexus removes email addresses and quoted text from it and replaces your home folder in each path with ~. Our service removes email addresses again. A report holds the error and where in our code it happened, the Nexus version, your operating system and its version, the processor type, a random install ID, your account ID, which part of Nexus was open and which task Nexus was running (each by its name only), and the last 50 lines that Nexus wrote to its log before the error. Only log lines of fixed text from the app go in a report: a line with a value from your data in it stays on your computer. A report never contains your mail, your knowledge layer or your name.
Crash files. When Nexus itself crashes, it writes a crash file in its data folder on your computer. The crash file never leaves your computer. It holds part of Nexus’s memory at the moment of the crash, so it can hold text from your mail, as the rest of the data folder does. At its next start, Nexus reads from the crash file where in our code the crash happened, and sends a crash report. This report holds where in our code the crash happened, the crash reason and, on a Mac, the memory address of the crash, the Nexus version, your operating system and its version, the processor type, the install ID and your account ID. Like every crash report, it never contains your mail. Then Nexus deletes the crash file.
Usage counts. Nexus also sends five kinds of usage event to Decimetry: you opened the Nexus window (and whether Nexus started at login), a screen came into view (named by the kind of screen, for example “an article page”), a sync ended (its source, whether it worked and how long it took), your first build ended, and an error message was shown (named by a short code). Nexus always sends them. Each event holds the time, the Nexus version, your operating system, a random install ID and your account ID, and otherwise only numbers, yes/no values and short codes. Our service refuses any other value, so a usage event never contains your mail, your knowledge layer, a name, a subject or anything you type. A usage event also holds no number taken from your Gmail data, such as how many messages a sync read.
7. Google API Services User Data Policy
Nexus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. How we limit our use of your Gmail data
- We use Gmail data only to provide and improve the features of Nexus that you see and use: the knowledge layer, the briefing, the pages and the search.
- We do not sell Gmail data. We do not share it with anyone except the AI provider that processes your request (section 5).
- We do not use Gmail data for advertising, and we do not let anyone else use it for advertising.
- No person at DecimaWorks reads your Gmail data. Your mail is on your computer, and our staff cannot reach it. The only exceptions are when you ask us for help and show us something yourself, when we must investigate a security problem, or when the law requires it.
- We do not use Gmail data to train generalised AI or machine-learning models.
9. AI tools you connect to Nexus
Nexus has an Agent access setting. It is off by default. When you turn it on, an AI tool you run on the same computer can read your knowledge layer, including the text of the mails Nexus has read, and can record facts in it as you. Nexus makes that data available only to programs running under your user account on your computer. What a connected tool then does with the data, including sending it to its own AI service, is governed by that tool’s privacy policy. Turn the setting off to stop all access.
10. Companies that process data for us
| Company | What it does for us | What it sees |
|---|---|---|
| Sign-in and the Gmail service. | Your Google account. Google’s own privacy policy applies. | |
| Cloudflare | Hosts our cloud service, its database, Decimetry (our service for crash reports and usage counts), the DecimaWorks AI relay and this website; runs the bot check on the contact form. | The records in section 6, each AI request in transit through the relay, and the IP address of every request. |
| OpenRouter and its inference providers | Run the AI model on plans with AI included. | The mail text in each AI request (section 5). |
| Resend | Sends our transactional email: sign-up verification, password reset, and messages from the website contact form. | Your email address and the content of those messages. |
We share personal data with no one else, except when the law requires it or to protect the rights and safety of DecimaWorks and its users.
11. How long we keep data, and how to delete it
Your mail and knowledge layer
They are on your computer, and you control them. Nexus keeps them until you delete them. Signing out of Nexus does not delete them. To remove them, quit Nexus and delete the application’s data folder, ~/Library/Application Support/works.decima.nexus/, then move Nexus to the Trash. The folder holds the knowledge layer, the application’s settings database, its log, crash reports and usage counts that wait to be sent, a random install ID, and, after a crash, a crash file that the next start of Nexus reads and deletes.
Nexus’s access to your Gmail
Withdraw it at any time at myaccount.google.com/permissions. Nexus then stops reading new mail at once, and the tokens our cloud holds stop working. Signing out of Nexus also forgets the connection on your computer.
Your DecimaWorks account
We keep your account records for as long as your account exists. There is no self-service “delete my account” button yet. To close your account, email george@decimaworks.com from the address on the account. We delete the account, its sessions, its Google tokens, its licence and its push registration within 30 days, and we confirm by email. AI usage counts are kept without your account ID for accounting only.
Crash reports and session records
We keep each report and each session record for 90 days, then delete it. We keep the link between an error and your account ID until 90 days after the last report of the same error. Daily totals without your account ID are kept for 13 months. When we delete your account, its reports and session records go within 90 days, and its links to errors within 90 days after the last report of each error.
Usage counts
We keep each usage event for 90 days, then delete it. We keep the daily counts of each account’s usage events for 100 days. We keep a summary of each account (its last app open, the screens and sessions of its last 7 days, its last sync) and the day of its first app open until 13 months after the last usage data or session record from the account. Daily totals and return rates without your account ID are kept for 13 months. When we delete your account, its usage events and daily counts go within 100 days, and its summary and first-open day within 13 months.
Website contact form
Messages you send through the contact form arrive in our mailbox and are kept as ordinary business correspondence.
12. Security
- Your mail and knowledge layer never leave your computer except for AI processing (section 5). Your computer’s own security protects them.
- The application stores your DecimaWorks sign-in and your AI key in the operating system’s keychain. The application’s web view can use them but cannot read them back.
- Your Google access and refresh tokens are encrypted at rest in our database with authenticated encryption (XChaCha20-Poly1305), with a key held only by our cloud service. Your Google ID token, a signed statement of your name, email address and Google account ID, is stored in the same database without additional encryption.
- All traffic between the application, our cloud, Google and the AI providers uses TLS.
- The application only talks to a fixed list of hosts: Google, DecimaWorks, and the AI provider your plan uses. It opens no network ports, except one on your own computer for a few seconds during sign-in.
- Updates are signed. The application installs an update only when its signature matches the key built into the application.
No system is perfectly secure. If we learn of a breach that affects your data, we tell you without undue delay and as the law requires.
13. Cookies and the website
The application does not use cookies. It signs in with a token kept in your keychain.
The sign-in pages at auth.decimaworks.com set a session cookie and two short-lived cookies that carry your sign-in mode and your invitation code through the Google sign-in flow. All are HttpOnly, and the two short-lived cookies expire within 15 minutes.
This website sets no cookies of its own and runs no analytics. The contact form uses Cloudflare Turnstile, a bot check, which may set its own cookie. The site loads the Inter typeface from Google Fonts, which sends your IP address to Google.
14. Children
Nexus is for adults at work. It is not directed at children, and we do not knowingly collect data from anyone under 16 (or under 13 where that is the legal age). If you believe a child has created an account, email us and we will delete it.
15. Your rights
Depending on where you live, you may have the right to access, correct, delete or export the personal data we hold about you, to object to or restrict its processing, and to complain to a data-protection authority. Most of your data is on your own computer, where you already have all of these. For the records in section 6, email george@decimaworks.com and we respond within 30 days.
Our legal basis for processing, where one is required: performing our contract with you (running your account and the application), our legitimate interest in keeping the service secure, in finding and fixing crashes, and in learning which parts of Nexus people use and whether they come back to it, and your consent for the Gmail access you grant at Google, which you can withdraw at any time.
Our cloud runs on Cloudflare. Cloudflare stores our account database in one of its data centres, chosen when the database was created. If you are in the European Economic Area or the United Kingdom, transfers outside your region rely on standard contractual clauses or an equivalent safeguard.
16. Changes to this policy
We may change this policy. When we do, we post the new version here with a new effective date. For a material change, we tell you in the application or by email before it takes effect. The effective date at the top of the page is the date the current version took effect.
17. Contact
Questions or requests about this policy: george@decimaworks.com.
DecimaWorks · george@decimaworks.com