Privacy Policy

Mikias Jeza (“Nexus”, “we”, “us”) operates this service and is the controller of your personal data. Questions or requests: mikiasjeza@gmail.com.

Information you give us

• Account: name, email address and password. Passwords are stored only as a one-way bcrypt hash.
• Optional profile details: bio, avatar and custom profile link, only if you add them.
• Skills and evidence: skill names, levels, notes, links, code snippets and files you choose to submit, plus a change history so you can see how a skill evolved.
• Skill assessments: the work you submit (code, queries or writing) and your answers to the follow-up questions. While an assessment is open we also record when you paste or copy text and when you leave the page, to help check that the work is your own.
• Onboarding answers (optional): the goals and starter skills you pick during setup.
• AI career assistant: the messages you type into the chat.
• Messages: anything you send us by email or through the contact form. Contact-form messages are forwarded to our support inbox and not stored in our database.
• Employer accounts: if you sign up as an employer, your company name, website, logo and description, your role, the job listings you post and the talent pools you create.
• Waitlists: if you ask to hear when a plan opens, which plan, and a company name if you give one.

Information created when you use Nexus

• AI verification results: the confidence score, explanation and suggestions returned for your evidence, plus token usage so we can enforce plan limits.
• Assessment results and credentials:your scores and, if you pass, a credential. Anyone with a credential's link can check it. It shows your name, the skill and level, your score, how the assessment was taken and its dates, and links to your profile if your profile is public.
• Activity log: in-product events such as “skill added” shown on your dashboard.
• Billing status: your plan, subscription status, billing dates and Stripe customer ID, and whether you have used a promotional price (so each offer is used only once). We never receive or store card numbers.
• Plan usage:how many formal assessments and practice rounds you use each month, so your plan's limits can be applied and shown to you.
• Sign-in session: a random session token stored in an HTTP-only cookie.

If you choose “Continue with GitHub”

• Your GitHub user ID, username, display name, avatar and email. We request read-only access to your profile and email, use it once to sign you in, and don't store the access token. You can revoke Nexus's access at any time in your GitHub settings.

Technical data

• Your IP address is used briefly in memory to rate-limit sign-in and other sensitive requests. We don't store it in our database. Our hosting provider keeps standard request logs for security and reliability.
• When an error occurs, our error monitor (Sentry) receives the error details, page address (with tokens and emails removed) and browser type. It does not receive your IP address, cookies or account details.
• Only if you allow “Diagnostics” in cookie settings: a short replay of the moments before an error, with all text, form inputs and images hidden.

What we deliberately don't collect

• No advertising or cross-site tracking cookies, tracking pixels or device fingerprinting.
• No precise location, contacts, or data from other apps.
• No product-analytics scripts, and no session recording unless you opt in to diagnostics.

We do not send marketing emails. If we ever offer them, they will be opt-in only.

We use one AI provider at a time: currently Groq, otherwise Google Gemini, OpenAI or Anthropic. Depending on the feature you use, we send it:

• Verification: the skill name, claimed level and the evidence content you submitted.
• Skill assessments: the task, the work you submitted and your answers to its questions, so it can score the parts that need judgement.
• Career assistant and job matching: your skill names, levels and verification status, the message you typed, and public job listings.

We never send your name or email. We only use API terms under which the provider may not train its models on our API data. Groq does not store request content by default, apart from logs it may keep for up to 30 days to fix errors or investigate abuse. We store only the results we show you (score, explanation, suggestions, matches) and token usage, not the provider's full raw response.

AI results are informational and can be wrong. No legal or similarly significant decision is made about you solely by automated means. You can re-run a verification, edit your evidence, or ask us for a human review at mikiasjeza@gmail.com.

We don't sell or rent personal data, and we don't “share” it for cross-context behavioral advertising (as those terms are defined under California law). We share data only with the service providers below, who process it on our behalf. Apart from our error monitor (Sentry), we call them from our servers and none of them load scripts on Nexus pages. Sentry's browser reporting goes through our own domain. (Stripe's checkout and billing pages are hosted by Stripe under its own privacy policy.)

Public profile: if you turn on public sharing, anyone with your link can see your name, bio, avatar and the skills you marked public. Your email is never shown. Turn sharing off in Settings at any time.

Employers: employers on Nexus can search for candidates only if you turn on both your public profile and “Discoverable by employers” in Settings. They see the same information as your public profile (name, bio, avatar, public skills and verification status), never your email or private skills, and they can save you to a shortlist (“talent pool”). If you switch either setting off or delete your account, you disappear from search and from every shortlist straight away. Employers must use what they see only for recruiting, as required by our Terms.

We may also disclose data if required by law, or to protect the rights and safety of our users, and to a successor if Nexus is merged or acquired (we will notify you first).

Our providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses.

• Account, skills, evidence, AI results, activity: until you delete them or your account.
• Assessments and credentials: until you delete your account. A credential stops being valid 24 months after it is issued.
• Plan usage, promotion records and waitlists: until you delete your account.
• Company, job listings and talent pools: until deleted, or until the last member of the company deletes their account.
• Error reports (Sentry): up to 90 days.
• Sign-in sessions: expire after 7 days.
• Password reset tokens: expire after use or within a short time.
• Billing records: kept by Stripe for as long as tax and accounting law requires.
• Backups: deleted data may remain in encrypted backups for up to 30 days before being overwritten.

Wherever you live, you can:

• Access and export: Settings → Privacy & data → Download my data gives you a machine-readable copy.
• Correct: edit your profile and skills at any time.
• Delete: Settings → Delete account permanently removes your account and content. It takes effect immediately and cancels any active subscription.
• Withdraw consent: change cookie choices any time via Cookie settings.
• Object or restrict processing based on legitimate interests.

For anything else, email mikiasjeza@gmail.com. We respond within 30 days and won't treat you differently for using your rights. If you're in the EU/UK, you can also complain to your local data protection authority.

We use TLS for all traffic, store passwords only as salted hashes, keep session cookies HTTP-only and limit access to production data. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

Nexus is not intended for anyone under 16, and we don't knowingly collect their data. If you believe a child has signed up, contact us and we'll delete the account.

If we make a material change, we'll email you and show a notice in the app at least 14 days before it takes effect. The effective date at the top always reflects the current version.