Privacy Policy

Last updated: February 1, 2026

This privacy policy describes how Cynaptic Technologies LLC ("we", "us", or "our") collects, uses, and protects your information when you use Nix It ("the Service"), including all Nix It websites (www.nixit.app, my.nixit.app) and associated services.

What We Collect and Why

Account Information

When you sign up for Nix It, we collect basic account information through Microsoft OAuth authentication:

• Name: To personalize your experience and display in the application
• Email address: To identify your account and communicate important service updates

Email Data

With your authorization, we access your email through the Microsoft Graph API to provide the core functionality of the Service:

• Email messages: Subject lines, sender/recipient information, message bodies, and metadata
• Email folders: Folder structure and organization
• Attachments: File attachments associated with your emails

This data is used solely to display and organize your email within Nix It and to enable task creation from email content.

Calendar Data

With your authorization, we access your calendar through the Microsoft Graph API:

• Calendar events: Event titles, times, locations, and descriptions
• Attendee information: Names and email addresses of event participants

This data is used to display your schedule and integrate calendar events with your task management workflow.

User-Created Content

We store content you create within the Service:

• Tasks and to-do items
• Notes and checklists
• Tags and categorization
• Custom organization and workflow preferences

Payment Information

Payment processing is handled by Lemon Squeezy, our payment processor. We receive and store:

• Your email address associated with the payment
• Subscription status and billing period
• Transaction identifiers

We do not store credit card numbers, bank account details, or other sensitive payment credentials. All payment data is processed and stored by Lemon Squeezy in accordance with PCI DSS standards.

File Attachments

When you upload or sync file attachments, they are stored with the following protections:

• All attachments are encrypted using AES-256-GCM encryption
• Each file has a unique encryption key
• Encrypted files are stored on Cloudflare R2

Website Analytics

We use PostHog to collect anonymous usage analytics on our websites to understand how visitors use our Service and to improve the user experience. This includes:

• Pages visited and navigation patterns
• Session duration and frequency
• General device and browser information
• Approximate geographic location (country/region level)

We configure PostHog to minimize data collection and do not use it to build individual user profiles. Analytics data is not linked to your account or personal identity.

What We Don't Collect

Third-Party Processors

We use the following third-party services to operate Nix It. Each processor only receives the minimum data necessary to provide their service:

Convex

Our database and backend infrastructure provider. Convex stores your account data, tasks, and application state. Convex Privacy Policy

Cloudflare R2

Cloud storage provider for encrypted file attachments. Files are encrypted before upload; Cloudflare cannot read your attachment contents. Cloudflare Privacy Policy

Lemon Squeezy

Payment processing for subscriptions. Lemon Squeezy handles all payment card data and billing. Lemon Squeezy Privacy Policy

Microsoft Graph API

Email and calendar synchronization. We access your Microsoft account data only with your explicit OAuth authorization, and only the scopes you approve. Microsoft Privacy Statement

PostHog

Website analytics to understand usage patterns and improve the Service. PostHog receives anonymized page view and session data. PostHog Privacy Policy

Data Security

We implement multiple layers of security to protect your data:

• OAuth tokens: Microsoft OAuth tokens are encrypted at rest in our database
• File attachments: Encrypted using AES-256-GCM with unique per-file keys
• Transport security: All connections use HTTPS/TLS encryption
• Access controls: Strict authentication required for all data access

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to data portability: Request a machine-readable copy of your data
• Right to object: Object to processing of your personal data
• Right to restrict processing: Request limitation of how we use your data

To exercise any of these rights, contact us at support@cynaptic.tech. We will respond to your request within 30 days.

When you request deletion of your account and data, we will complete the deletion within 30 days of your request.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). Please see our CCPA Notice for detailed information about:

• Categories of personal information we collect
• Your right to know what data we have
• Your right to delete your data
• Your right to opt-out of sale (we do not sell personal information)
• Your right to non-discrimination

Data Retention

Active Accounts

While your account is active, we retain all data necessary to provide the Service, including your email sync data, tasks, and preferences.

Deleted Accounts

When you delete your account, we will permanently delete all your personal data within 30 days. This includes:

• Account information
• All tasks and user-created content
• Email and calendar sync data
• File attachments
• OAuth tokens and credentials

Attachment Cache

Cached attachment files that have not been accessed for 30 days are automatically cleaned up from our storage systems.

Children's Privacy

Nix It is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@cynaptic.tech.

Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email if the changes materially affect your rights
• Provide at least 30 days notice before significant changes take effect

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

Contact Us