Privacy Policy
Effective upon publication · Version 2.2
← Back to homepage
Effective upon publication · Version 2.2
← Back to homepageNixora is built to minimize how much of your data we collect, retain, and expose. Raw document images stay on your device during OCR, documents you share with other users are end-to-end encrypted, chat messages are deleted from our servers after 7 days, and we do not sell your personal data or use your content to train AI models. This policy explains what data we handle, why we handle it, and where it is stored.
Nixora is a language accessibility platform developed and operated by Nixora.ai ("we," "us," or "our"). Nixora.ai is based in Denver, Colorado, United States.
For any privacy-related inquiries, you may reach us at: privacy@nixora.ai
This Privacy Policy applies to the Nixora mobile application ("the App") and all services provided through it, including:
This policy does not apply to third-party services that Nixora integrates with (such as Google services). Those services are governed by their own privacy policies, which are referenced in Section 9.
This policy also covers live audio calls between two users who share a language, where calling is available. Live calls are separate from recorded voice messages.
Nixora is designed around data minimization. We try to keep sensitive processing on-device where practical, limit what is transmitted to our backend, retain operational data only as long as necessary, and avoid using customer content for model training or advertising personalization.
When you photograph or upload a document, optical character recognition (OCR) is performed on your device. The raw image of your document is not uploaded to our backend for analysis. Instead, the extracted text is sent securely for the analysis you requested.
Chat messages are encrypted in transit and at rest, and are deleted from our servers 7 days after they are sent. For performance, and so that you can recover your account and recent conversations without losing encryption keys, chat messages are not end-to-end encrypted. Documents you share with other users are end-to-end encrypted, and our servers cannot read them.
You can enable or disable remote diagnostics in Profile. User-testing builds enable it by default unless you have disabled it; ordinary builds default to off. You can view the details or turn it off in Profile. Your choice to disable is remembered. Signing out stops capture and clears unsent reports; signing in again applies the testing default unless you have opted out. During testing, it includes detailed technical events, outcomes, timings, device model, operating system and app build information so we can investigate reliability problems. It does not include conversation or document content, live or recorded audio, contacts, credentials, raw network addresses or raw error messages.
Reports use a random installation reference. A restricted server index groups reports using a pseudonymous account reference to distinguish affected installations and accounts. These references are not anonymous; authorized operators can correlate technical events for troubleshooting. Authentication credentials are verified during upload and are not stored in diagnostic reports. Turning diagnostics off stops new capture, cancels pending uploads and clears the local queue. Bytes already transmitted may still arrive and expire under the normal retention period.
Nixora does not keep the full text of analyzed documents as a long-term backend record. Document analysis results are currently stored locally on your device so you can reopen your history there. Other operational data is retained only for the periods described in this policy.
Raw document images stay on your device during OCR. We do not sell your data. We do not use your content to train AI models. We aim to keep collection and retention limited to what the service actually needs.
Live calls use encrypted audio transport between devices. Nixora does not record, store, transcribe or translate live-call audio.
We collect the minimum data necessary to provide the service. The table below describes every category of data Nixora handles.
| Data Category | What It Is & Why |
|---|---|
| Account identity | Your Google account display name and email address, collected when you sign in. Used solely to identify your account and enforce usage limits. Never sold or shared with third parties for marketing. |
| Language preference | The language you select in the app. Stored on your device and in your account to deliver analysis and translation in your chosen language. |
| Usage counters | Counts of analyses and translated tokens used in the current period. Stored to enforce free-tier limits and detect abuse. No content is associated with these counters. |
| Document analysis results | The plain-language summary, key points, and red flag assessment generated from your document. These results are currently stored locally on your device so you can reopen your history there. The underlying document text is not stored as a long-term backend record. |
| Message metadata | Routing data needed to deliver messages: sender ID, recipient ID(s), timestamp, and delivery/read status. Stored with the message and deleted with it after 7 days. |
| Chat message content | The text of chat messages, translated summaries of voice messages, and photos you send in chat. Stored on our servers so they can be delivered, and automatically deleted 7 days after sending. Encrypted in transit and at rest, but not end-to-end encrypted (see Section 6). Your device keeps its own copy of your conversation history. Never used for advertising or to train AI models. |
| Shared documents | Documents and document analyses you share with other users are end-to-end encrypted on your device. Our servers store only encrypted data they cannot read, and delete it 7 days after it is sent. |
| Contacts (optional) | If you allow contacts access, the phone numbers and email addresses in your address book are sent to our servers to find which of your contacts already use Nixora. They are used only for that match and are not stored. If you invite someone, we keep the name you have for them and a one-way digest of their phone number so the invite can be matched when they join; the invite link expires after 30 days. |
| Push notification tokens | A device token used to send you notifications through Firebase Cloud Messaging. Message notifications include the sender's name and a short preview of the message text. |
| Voice message audio | When you send a voice message to someone who uses the same language as you, the recording is stored in encrypted cloud storage only so it can be delivered. Nixora's server copy is deleted once the recipient's device confirms receipt; any server copy that remains, for example because a deletion failed or the message is never delivered, becomes eligible for automatic deletion once it is 7 days old. When you send a voice message to someone who uses a different language, the recording is sent to our servers and from there, through an AI request-routing service, to AI service providers, which process it on our behalf to produce a translated text summary in the recipient's language. When processing finishes, Nixora deletes its server copy of the recording promptly. If processing fails in a way that can be retried, Nixora keeps its server copy of the recording so that the message can be retried. Any server copy that remains, for example because a deletion failed or the message is never processed, becomes eligible for automatic deletion by a storage clean-up rule once it is 1 day old. A voice message you have recorded but not yet sent stays on your device until you send it, you discard it, or 7 days pass; the app removes older recordings when it starts, when you return to it and when you sign out. These statements describe the copies held on Nixora's servers; they do not describe copies on devices, or how long AI service providers keep data under their own terms. The recipient sees only the summary. Audio is not indexed and is not used for any purpose other than delivery or producing the summary. We do not use voice recordings to train AI models, and we do not create voiceprints or identify anyone from their voice. |
| Voice usage records | To apply your daily voice allowance and to operate the service, we record how many seconds of voice messages you had translated each day. For each translation request we also record technical details: the length of the recording, the state of the request, the conversation and recipient it was sent to, both languages, which processing models handled it, how long it took, its estimated cost and whether it succeeded. Request records contain no audio and no summary text. Each becomes eligible for automatic deletion 7 days after the request is made; later activity on the request does not extend that period. |
| Live-call records | Who called whom, conversation, start and end times, duration, outcome and end reason; short-lived cancellation records prevent a canceled call attempt from starting later. Call-history entries are readable by our service, like other chat metadata. |
| Live-call setup data | Technical connection details, including IP addresses, encrypted-transport fingerprints and ephemeral connection credentials. We also hold private installation identifiers to bind a call to the device that starts or answers it. |
| Call-alert device registrations | A random installation identifier, push token, Android and app versions, supported call protocol and whether incoming-call notifications are enabled. |
| Call abuse controls and relay connection logs | Call blocks, attempt counters, and relay connection logs containing IP addresses and ports, timestamps, temporary credential labels and data volumes; no audio. Limited operational logs contain a random call identifier, outcome and durations, not audio, setup data or account identifiers. |
| Subscription status | Whether your account is on the Free or Pro tier, managed via Google Play Billing. We receive subscription state from Google — no payment card data is ever handled by Nixora.ai directly. |
| Device attestation | Firebase App Check with Play Integrity API is used to verify that requests originate from genuine Nixora installations on real Android devices. This prevents automated abuse. The attestation check does not store a hardware identifier. Separate call-alert registrations store the limited installation information described above. |
| Crash and error reports | If the app crashes, Firebase Crashlytics collects a crash report including device model, OS version, and the stack trace. No personal data or document content is included in crash reports. |
| Analytics events | Anonymized events (e.g., "document analysis completed," "subscription started") collected via Firebase Analytics. Used to understand how the app is used and improve it. Events do not contain document content or message content. |
We use the data described above for the following specific purposes, and no others:
We do not sell your personal data. We do not use your data to train or fine-tune any AI model. We do not share your data with third parties for their own marketing purposes.
We use call records, setup data and alert registrations to connect calls, keep an ongoing session working, deliver incoming and missed-call alerts, and apply blocking and attempt limits to prevent abuse.
All data exchanged with Nixora is encrypted in transit, and data stored on our servers is encrypted at rest. Beyond that, Nixora treats chat messages and shared documents differently:
When you share a document or document analysis with another user, it is encrypted on your device with keys held only by you and your recipients. Nixora's servers store and relay only the encrypted data and cannot read your shared documents. If you reinstall the app or change devices, documents shared with you before that point may no longer be readable, because the keys stay on the original device.
Chat messages (text, translated voice summaries, and photos) are encrypted in transit and at rest, but they are not end-to-end encrypted. We made this choice for performance, and so that you can sign in on a new device without losing access because of lost encryption keys. This means our systems can access chat content. We process it only to run the service: delivering messages, sending notifications, translating messages when you ask, and preventing abuse or complying with the law. We do not use it for advertising or to train AI models. Chat messages are deleted from our servers 7 days after they are sent.
Voice message audio is not end-to-end encrypted either. It is encrypted in transit and at rest, and our systems and the AI service providers we use can process it, as described in Section 7.
Live-call audio uses DTLS-SRTP encrypted transport between the devices. When a connection relay is needed, it forwards encrypted audio without recording it. Nixora does not record or store live-call audio. Our servers coordinate the connection and hold readable setup information, so calls do not have the verified end-to-end encryption protection described above for shared documents. An “Encrypted” call label refers to established audio transport encryption, not an independently verified identity or security code.
Your shared documents can only be read by you and the people you share them with. Your chats are protected in transit and at rest and are removed from our servers after 7 days. Your device keeps your conversation history.
When you analyze a document using Nixora:
AI training: The text content of your documents is never used to train, fine-tune, or evaluate our AI models. Every AI request (document analysis, translation and voice messages) goes only to AI service providers that operate under zero-data-retention terms: they do not store your content after returning the result and do not use it to train their models. This restriction is enforced in our account with the AI request-routing service, so a request cannot be sent to a provider that does not meet it. We do not use your content to train our own models.
When messages are translated, the text content is transmitted from our servers, through an AI request-routing service, to an AI service provider for translation. This transmission is encrypted. The request goes only to an AI service provider that operates under zero-data-retention terms: it returns the translation, does not store the content afterwards and does not use it to train its models. We do not log the content of translated messages.
Voice messages between people who use the same language are delivered as audio and are not transcribed or translated. When you send a voice message in a chat where the other person uses a different language:
A voice message you have recorded but not yet sent stays on your device until you send it, you discard it, or 7 days pass. The app removes older recordings when it starts, when you return to it and when you sign out.
The summary is a condensed translation, not a word-for-word transcript, and it can contain errors. Nixora does not use voice recordings or summaries to train AI models.
First-use notice. The first time you send a voice message to someone who uses a different language on a device, the app shows a notice that explains what happens to the recording, with the actions Continue and Not now. Translated voice messages in chats with people who use a different language stay unavailable until the notice is continued. Text chat and voice messages between people who share a language are not affected. You can contact privacy@nixora.ai about data related to your voice messages.
Live calls involve no AI processing, speech recognition, transcription, translation or summarization. The voice-message processing described in this section applies only to recorded messages.
We retain data only as long as necessary to provide the service or as required by law. The following table describes our retention schedule for each data type:
| Data Type | Retention Period & Deletion Trigger |
|---|---|
| Document text (extracted) | Retained only for short-lived processing needed to return the requested analysis, and not kept as a long-term backend document record. |
| Document analysis results | Currently stored locally on your device until you delete them, clear app data, or remove the app. |
| Voice message audio | These statements describe our server copies. Voice messages between people who share a language: deleted once the recipient's device confirms receipt; any server copy that remains becomes eligible for automatic deletion once it is 7 days old. Voice messages processed for translation: deleted promptly when processing finishes; kept if processing fails in a way that can be retried, so that the message can be retried; any server copy that remains becomes eligible for automatic deletion once it is 1 day old. Recordings on your device that you have not sent stay there until you send them, you discard them, or 7 days pass. |
| Voice usage records | Request records (recording length, state, the conversation and recipient, both languages, processing models, timing, estimated cost, outcome) contain no audio and no summary text. Each becomes eligible for automatic deletion 7 days after the request is made; later activity on the request does not extend that period. Your daily allowance counter is a single small record, kept only as long as needed to apply the allowance. Voice request records and the voice allowance counter are removed as part of processing an account-deletion request, within the same period as described under Deleting Your Account. Translated voice summaries are chat messages and follow the 7-day chat retention described above. |
| Chat messages and their metadata (including photos and shared documents) | Automatically deleted from our servers 7 days after sending (deletion normally completes within a day after that). Your device keeps its own copy until you delete it or remove the app. If you reinstall the app or sign in on a new device, only messages from the last 7 days can be restored. Messages sent to someone who does not open the app within 7 days are not delivered. |
| Live-call records and history entries | Eligible for automatic deletion 7 days after creation or sending; deletion normally completes within a further day. Call history already received may remain on your device until you delete it or remove app data. |
| Live-call connection setup data | Connection signals, including IP addresses and transport setup details, are deleted when the call ends and in any case within 2 days. Private device-binding and abuse state associated with the call follows the call-record period; canceled-attempt records become eligible for deletion 7 days after cancellation. |
| Registered call-alert devices | Removed when you sign out where the device can contact the service; otherwise ignored after 30 days without refresh and eligible for automatic deletion. A new account registration replaces the old account binding. |
| Call blocking and attempt limits | Blocks remain until you unblock or delete your account. Short-lived pair attempt counters expire after their abuse-control window. These records and associated registrations/tokens are removed with account deletion. |
| Optional remote diagnostics | Local queued events expire within 7 days. Uploaded reports and their account-attribution index expire within 7 days after server receipt. Only authorized operators may inspect them. Errors remain eligible for capture when routine logging for a stable feature is reduced, but the Profile setting always applies. |
| Relay connection logs | IP addresses, ports, times, temporary labels and data volumes are kept for at most 7 days. Audio is never logged. Limited call operational logs, without account identifiers or setup data, are kept for up to 30 days. |
| Group conversation data | Group name and membership are retained while the group exists. Group messages follow the 7-day rule above. |
| Document share previews | Public share links expire after 7 days and can no longer be opened; their preview files are deleted after 7 days. |
| Account data | Retained while your account is active. Upon account deletion (see below), all associated data is deleted within 30 days, except where retention is legally required. |
| Usage counters | Daily counters reset daily; weekly counters reset weekly; monthly counters reset monthly. Automatically managed by our systems. |
| Crash reports | Retained for 90 days by Firebase Crashlytics, then automatically deleted. |
| Analytics events | Retained for up to 14 months by Firebase Analytics in aggregated, anonymized form, consistent with Google's data retention policies. |
You may request deletion of your account and all associated data at any time by:
Upon account deletion, all data associated with your account on our servers — including message data, account credentials, call records, private state and canceled-attempt records, connection signals, call blocks, attempt counters and call-alert registrations — will be deleted within 30 days, except where retention is legally required. Analysis history and conversation history stored on your device are removed when you delete them in the app, clear app data, or uninstall the app.
Nixora uses the following third-party services. Each is governed by its own privacy policy, linked below. We have selected each service based on its privacy commitments and our contractual ability to restrict their use of data.
| Service | Purpose & Data Handled |
|---|---|
| Google Firebase Auth | User authentication via Google Sign-In. Handles your Google account credentials. Firebase Privacy Policy |
| Google Firestore | Storage of account data, chat messages (deleted after 7 days), and end-to-end encrypted shared documents (deleted after 7 days). Google Cloud Privacy |
| Firebase Cloud Messaging | Push notifications for new messages, including the sender's name and a short preview of the message text. Firebase Privacy Policy |
| Google Cloud Storage | Encrypted storage of voice message audio, chat photos, and share-link previews. Chat photos and share-link previews become eligible for automatic deletion after 7 days; voice audio follows the retention described in Sections 4 and 8. Google Cloud Privacy |
| Google ML Kit | On-device OCR (text recognition from document images). Runs entirely on your device — no data leaves your phone during OCR. ML Kit Terms |
| AI service providers | Used to analyze document text, support translation features, and process voice messages sent in different-language chats to produce translated summaries. Requests go only to providers that operate under zero-data-retention terms: they process your content to return the requested result, do not store it afterwards and do not use it to train their models. We do not use your submitted content to train our own models. |
| AI request-routing services | Used to pass document-analysis, translation and voice-message processing requests from our servers to AI service providers. |
| Google Play Billing | Subscription and in-app purchase processing. Nixora never receives or stores your payment card information. Google Payments Privacy |
| Google AdMob | Advertising displayed to some free-tier users in supported parts of the app. AdMob may use your device's advertising ID. We do not use the contents of your documents or messages to personalize ads. Google Ads Privacy |
| Firebase App Check (Play Integrity API) | Device integrity verification to prevent bot abuse. Verifies that requests come from genuine Nixora installations. No personal data is retained by Nixora from this process. Firebase Privacy Policy |
| Firebase Crashlytics | Crash reporting. Collects device model, OS version, and stack trace data when the app crashes. No personal data or document content is included. Firebase Privacy Policy |
| Firebase Analytics | Anonymized, aggregated usage analytics. No document content or message content is included in any analytics event. Firebase Privacy Policy |
Nixora's servers, and the AI service providers and AI request-routing services described in this policy, may be located in countries other than the one where you live, including the United States. Where the law requires safeguards for such transfers, we put in place the safeguards the law recognizes.
Calls use Google Firebase Cloud Messaging for alerts containing the caller's name and a call identifier, without audio. Nixora operates its own connection relay on Google Cloud infrastructure. Connection infrastructure may process data outside your country. When you answer a call, network connection details may reveal your IP address to the other participant, even if the relay was used before you answered. The relay operator can see the IP addresses of devices connecting to it; it forwards encrypted audio only.
Depending on your location, you may have certain rights regarding your personal data. Nixora honors the following rights for all users regardless of jurisdiction:
You may request a summary of the personal data Nixora holds about your account. Email privacy@nixora.ai and we will respond within 30 days.
You may request deletion of your account and associated server-side data at any time by emailing privacy@nixora.ai. Deletion of locally stored analysis results on your device may also require removing them in-app, clearing app data, or uninstalling the app. Deletion is permanent and irreversible.
You may update your language preference and display name at any time from within the app. To correct other account information, contact privacy@nixora.ai.
You can manage advertising preferences through your device's Android advertising settings and any privacy controls made available by Google or your device manufacturer. Where Nixora offers additional in-app advertising controls, those controls will apply as described in the app.
You may opt out of Firebase Analytics data collection through your device's Google account settings or by contacting privacy@nixora.ai.
California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. Nixora does not sell personal information. To exercise your CCPA rights, contact privacy@nixora.ai.
If you are located in the European Economic Area or United Kingdom, you have rights under GDPR including access, rectification, erasure, restriction, portability, and the right to object. Our legal basis for processing your data is performance of the contract (providing the service you requested) and legitimate interests (security and abuse prevention). For translated voice messages, we process your recording to provide the translation feature you use when you send a voice message to someone who uses a different language, which is necessary to perform our agreement with you. To exercise your GDPR rights, contact privacy@nixora.ai.
You can block a person's calls from the chat menu or Settings > Calls and remove that block later. Calling uses microphone permission; incoming alerts use notification and, where allowed, full-screen alert access. Bluetooth or nearby-device permission enables compatible headsets, and an ongoing call uses a foreground service with a visible notification. You can change these permissions in Android settings; disabling alerts may prevent incoming calls from being presented.
Nixora is intended for adults. You must be at least 18 years old to use Nixora, and we do not knowingly collect personal information from anyone under 18.
If you believe someone under 18 has created an account with Nixora, please contact us immediately at privacy@nixora.ai and we will promptly delete the account and all associated data.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
We encourage you to review this policy periodically. Your continued use of Nixora after a policy update constitutes acceptance of the updated terms, except where law requires explicit consent.
Previous versions of this policy are available upon request by emailing privacy@nixora.ai.
For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:
For urgent security-related matters, please use the subject line "URGENT: Security" and we will prioritize your message.
The following summarizes the information required for the Google Play Data Safety form. This section is provided as a reference for completeness and transparency.
| Data Type | Collected · Shared · Required · Purpose |
|---|---|
| Personal info → Email address | Collected via Google Sign-In · Not shared · Required · App functionality, account management, fraud prevention and security |
| Personal info → Name | Collected · Not shared · Optional · App functionality, account management |
| Personal info → Phone number | Collected if you set one, used for contact discovery · Not shared · Optional · App functionality |
| Personal info → User IDs | Collected · Not shared · Required · App functionality, account management, fraud prevention and security |
| Messages → Other in-app messages (chat text, translated voice summaries, photos) | Collected · Not shared · Required · App functionality · Stored on our servers for 7 days, then deleted · Encrypted in transit and at rest (not end-to-end); shared documents are end-to-end encrypted |
| Audio → Voice or sound recordings (voice messages) | Collected · Not shared (AI service providers process the audio only on our behalf, to produce the summary) · Optional · App functionality · Same-language: stored only for delivery; our server copy is deleted once the recipient's device confirms receipt · Different-language: processed to produce a translated summary; our server copy is deleted promptly after processing and kept only so that a failed message can be retried · Not end-to-end encrypted |
| Audio → Voice or sound recordings (live calls) | Processed ephemerally in real time · Optional · App functionality · Not recorded or stored · No verified end-to-end collection exemption · No AI processing. |
| App activity → Other actions (call records and setup data) | Collected · Not shared for an independent third-party purpose · Optional call functionality · App functionality, fraud prevention and security · Retention described in Section 8. |
| App activity → Other actions (voice allowance counters and request records) | Collected · Not shared · Optional · App functionality, fraud prevention and security · Daily allowance counters and per-request records (seconds, state, conversation and recipient, both languages, models used, timing, estimated cost, outcome); no audio or text; request records become eligible for automatic deletion 7 days after the request is made |
| Contacts → Contacts | Collected only if you grant access · Only hashed digests are sent for matching · Not shared · Optional · App functionality |
| Device or other IDs | Collected for device attestation, push notification delivery and call-alert registrations · Automatic call registration is required where used; the Advertising ID is optional and shared with Google AdMob · App functionality, advertising or marketing, analytics, fraud prevention and security |
| App activity → App interactions | Collected (ad interactions, rewarded-video events) · Shared with the ad network (Google AdMob) · Optional · Advertising or marketing, analytics |
| App info and performance → Crash logs | Collected through Firebase Crashlytics · Not shared · Optional · Analytics |
| App info and performance → Diagnostics | Collected through Firebase Crashlytics · Not shared · Optional · Analytics |
| Financial info → Purchase history | Collected (server-verified entitlement from Google Play Billing; we never receive payment card data) · Not shared · Optional · App functionality |
Raw document images are processed on-device for OCR and never leave the device. Extracted document text and live-call audio are processed ephemerally for the requested service. We do not collect your precise or approximate location.