Privacy Policy

Account information. When you register, we collect your name and email address. If you sign in via Google, we receive your name, email address, and profile photo from Google's authentication service. We do not receive your Google password.

Financial data you enter. All financial data in Nilorax — assets, liabilities, income, expenses, investments, goals, bank accounts, and documents — is data you enter directly. We do not automatically pull data from banks, brokerages, or any financial institution. You are in full control of what is recorded.

Usage information. We do not collect analytics, page views, click tracking, or behavioural data. We do not use third-party analytics services such as Google Analytics.

Your financial data is stored in a database on the server where you or NovaNest Apps hosts Nilorax. It is not shared with third parties, not used for advertising, and not analysed by NovaNest Apps staff for any commercial purpose.

If you use the NovaNest-hosted version of Nilorax, your data resides on secure cloud infrastructure. Access to production databases is restricted to authorised NovaNest Apps engineers for maintenance and security purposes only. We do not inspect individual user financial records unless explicitly required to resolve a technical support issue you have raised, and only with your consent.

If you self-host Nilorax on your own server, your data never leaves your infrastructure and NovaNest Apps has no access to it whatsoever.

Nilorax uses JSON Web Tokens (JWT) for authentication. When you sign in, a token is issued and stored in your browser's local storage (if you choose "Remember me") or session storage (if you don't). This token is used to identify you for API requests and expires automatically.

If you sign in with Google, we use Google's secure OAuth 2.0 flow. We do not store your Google credentials. We only receive a confirmation that Google has verified your identity and your basic profile information.

Your password (if you use email/password sign-in) is hashed using a strong cryptographic algorithm before storage. We cannot recover your password if you forget it — we can only reset it via a secure token sent to your email address.

Nilorax does not use tracking cookies or advertising cookies. The application uses browser local storage or session storage exclusively to hold your authentication token so you remain signed in between visits. This data stays on your device and is never transmitted to third-party servers.

No cookies are set by NovaNest Apps for analytics, marketing, or cross-site tracking purposes.

Your account and all associated financial data is retained for as long as your account is active. If you delete your account, all your data is permanently removed from our systems within 30 days. Backup copies (if applicable) are purged on the same schedule.

Audit log entries (records of actions taken within your account) are retained for up to 12 months for security and accountability purposes.

Google OAuth. If you use Google sign-in, your authentication is processed by Google. Google's Privacy Policy applies to that interaction.

No advertising networks. Nilorax does not integrate with advertising networks, data brokers, or social media tracking pixels.

No data selling. We do not sell, rent, or trade your personal or financial information to any third party.

You have the following rights with respect to your personal data:

• Access: You can view all data associated with your account from within Nilorax at any time.
• Correction: You can edit or update your name, email address, and all financial data directly in the application.
• Export: You can export your data in CSV format from multiple modules within Nilorax.
• Deletion: You can request deletion of your account and all associated data by contacting us at the address below. We will process the request within 30 days.
• Portability: Your exported data is in standard CSV format and can be imported into other tools.

To exercise any of these rights, please contact us.

Nilorax is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: