Privacy Policy

• Nexivo shows a screen from one device on another, and, when the person sharing allows it, lets the other person control it.
• We never see, record or store your screen. The picture, the mouse and keyboard input and any copied text travel encrypted between the two devices. Our servers only help the two devices find each other.
• Sharing your screen needs no account. Your device gets a random Computer ID and nothing else is asked of you. Viewing or controlling someone else’s device works without one too. An account is optional: if you create one, we ask for your name, your email and a password.
• The person sharing always sees who is asking (their Computer ID and device name, plus their name and verified email if they have logged in) and must approve every session. They can stop it at any time.
• We have no ads, no analytics, no crash reporting and no tracking. We do not sell or share your information for advertising.
• Records of connections are deleted automatically after 90 days.
• You can delete your account in any Nexivo app or on the website at https://nexivo-link.pages.dev/account/.

Nexivo is provided by Crocent Web Services Private Limited, a company registered in India, at E-237AA, Phase 8B, Industrial Area, Sector 74, SAS Nagar, Punjab 140307, India (“Crocent”, “we”, “us”).

We decide why and how your information is used. Under India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary. Under the EU and UK General Data Protection Regulation (GDPR) we are the controller.

Contact details, including our Grievance Officer, are in section 17.

Every device that runs Nexivo gets a 9-digit Computer ID. To connect, one person either types the other device’s Computer ID or sends a one-time link. The device being shared shows a request with the asker’s Computer ID and device name, plus their name and verified email if they have logged in, and its owner chooses View only or View and control, or denies it.

Once a request is approved, the two devices connect to each other directly. If a direct connection is not possible, or if you turn on Force relay, the encrypted traffic passes through a relay server run by Cloudflare. Our backend, run on Supabase, keeps the list of devices, accounts, requests and sessions, and passes the short technical messages the two devices need to set up their connection.

4.1 Your device’s Nexivo identity (everyone)

When you first open a Nexivo app, or a page of the website that connects, shares or manages your account (/connect/, /share/, /account/, /j/ and /s/), Nexivo signs in to our backend with a random anonymous identity. It contains no name, email or phone number. We then keep a device record with:

• the random user ID of that anonymous identity;
• the device’s Computer ID, a random 9-digit number;
• the device’s name, which is what the person you connect with sees. On a Mac this is the computer name from System Settings. On a Windows PC it is the computer name. On an iPhone it is “iPhone” and on an Android phone it is “Android phone”. In a browser it is the type of computer and browser, such as “Windows PC (Chrome)”;
• when the record was created, and when the device was last seen. While Nexivo is open it tells our backend every 20 seconds that it is online. We keep only the latest time, not a history.

4.2 Your account (only if you create one)

An account is optional. With one, the person whose device you view or control sees your name and verified email. If you create one, we keep:

• your email address, and whether you have confirmed it with the 6-digit code we email you;
• the name you choose (1 to 64 characters). You can change it at any time;
• your password, stored only as a secure one-way hash by our sign-in provider. We cannot read it;
• when the account was created and when you last signed in;
• your login sessions: the sign-in service records each login, the time it was last used and, for security, the IP address and the app or browser it came from;
• which of your devices your account is logged in on, and through which login.

4.3 Connection records

To run Nexivo we keep records of who asked to connect to whom, and what happened:

• Requests: the asking device’s Computer ID and name; if the asker is logged in, their account ID and the name and email the account had at that moment; the device asked; whether View only or View and control was asked for and granted; the outcome (approved, denied, cancelled or expired); and the times. A request that nobody answers expires after 60 seconds.
• Sessions: the two devices and their users, the viewing account, the mode, when the session started, connected and ended, and why it ended (for example “the viewer left” or “sharing stopped”). Sessions end after 8 hours at most. For iPhone screen sharing we also keep a one-way hash of a key the iPhone uses to check that its session is still allowed.
• Links: the code of each one-time link, which device and account made it, the Computer ID of the device that used it, its mode, its status, its times, and how many requests through it were denied. Links last 10 or 30 minutes and work once.
• Limits: to stop abuse we record the user or device ID and the time of each attempt to connect, open a link or log a device in. A device can try to connect at most 10 times a minute.
• Logging a device in: when you log in on a device, the app creates a one-time code that lasts 2 minutes. We store only a one-way hash of it.

4.4 Your screen, input and clipboard

We do not collect, see, record or store any of these:

• The picture of the shared screen. It is sent as an encrypted video stream (WebRTC with DTLS-SRTP) straight to the other device, or through Cloudflare’s relay, which passes along encrypted data it cannot read. Nexivo does not currently send sound.
• Mouse, keyboard and touch input sent by the person controlling. It travels on the same encrypted connection and is applied on the shared device only while the session allows control.
• Copied text. In a View and control session, text copied on the shared computer is sent to the controlling device’s clipboard, on the same encrypted connection. It goes one way only, never in View only sessions, only for copies made after the session starts, and never for copies a password manager marks as secret. It never passes through our servers.

4.5 Network and technical information

• IP addresses and request details. Whenever your device or browser talks to our backend or website, our providers receive its IP address and basic technical details such as the app or browser type, and record them in short-lived server logs.
• Connection setup. To connect, the two devices exchange technical details through our backend in real time, including their network (IP) addresses and ports. We do not store these messages. If the devices connect directly, each can see the other’s IP address. With Force relay on, the other device sees only the relay’s address.
• Relay. To use Cloudflare’s relay, our server asks Cloudflare for relay credentials that expire after 24 hours. The request includes your device’s random user ID, so that misuse of the relay can be traced to one device. Cloudflare sees the IP addresses of the devices that use the relay and how much data passes through it.
• Address discovery. To find its public address, your device contacts Cloudflare’s public address-discovery (STUN) server. If relay credentials cannot be obtained, it also contacts Google’s public STUN server. Both receive your IP address.
• Update check. When a Nexivo app starts, it sends our backend its platform (for example “android”) and build number. We use this only to tell you when you must update.

4.6 Emails and messages to us

• We email you 6-digit codes to confirm your email, reset your password or confirm a change. Our email provider receives your email address and the message.
• If you write to us, we keep your message, your email address and anything you choose to include, to answer you.

4.7 Information kept only on your device

These stay on your device and are not sent to us, except where a login is used to talk to our backend:

• In the apps: the anonymous sign-in that keeps your Computer ID the same from one launch to the next, your account login if you have one, and your Force relay setting.
• On the website, in your browser’s local storage: the same sign-in, your account login, Force relay, and the Ctrl and Command key swap. For the length of a browser tab, the website also remembers the current session (so a reload can reconnect) and, while you sign up or reset a password, the email you typed and the step you reached.
• The one-file Windows program stores nothing on the PC. It runs from a temporary folder that is removed when it closes.

The website uses no cookies. Its pages load nothing from other websites.

4.8 What we do not collect

We do not collect your location, contacts, photos, files, camera, microphone, health or payment information, advertising identifiers, or your browsing history. Nexivo contains no advertising, analytics or crash-reporting software. On iPhone, Nexivo never uses the camera or microphone.

4.9 Permissions Nexivo asks for

• Mac: Screen Recording, so a person you approve can see your screen, and Accessibility, so a person you approve can control it. You can turn either off in System Settings.
• iPhone: iOS asks you to start a screen broadcast each time you share. iPhone screens can be viewed but not controlled.
• Android: Android asks for permission to capture the screen each time you share. While you share, a notification says so and takes you back to Nexivo to stop; Nexivo asks to show notifications so that it can appear. Accessibility is optional and off until you turn it on. It is used only to perform the taps, swipes and typing sent by a person you have approved, during a session. Nexivo does not use it to read your screen’s contents, and nothing it does is sent to us.
• Browser: the browser asks you which screen or window to share. The sharing page may ask to show notifications, so you notice a request while the tab is in the background.

Under India’s Digital Personal Data Protection Act, 2023, we process your information with your consent, given when you use Nexivo after reading this notice, or for a legitimate use allowed by the Act, such as a purpose for which you gave us the information yourself. You can withdraw consent at any time by deleting your account and stopping using Nexivo. Withdrawing does not affect what was done before.

We do not use your information for advertising, profiling or automated decisions that have legal or similarly significant effects on you.

• The person you connect with. If you ask to view or control a device, the person sharing sees your device’s name and its Computer ID, and, if you have logged in, your name and your verified email. If you share, the person viewing sees your screen and everything on it, your device’s name and its Computer ID. With a direct connection, each device can see the other’s IP address. The person who made a link sees the Computer ID of the device that used it.
• Our team, only as needed to run Nexivo, answer you and keep the service secure. We cannot see your sessions.
• Our service providers (section 7), only to provide their service to us.
• Authorities, when the law requires it, for example under a valid court order or a lawful request under Indian law, or when needed to protect someone’s safety or our rights. We cannot hand over screen content, because we never have it.
• A buyer or successor, if Crocent is involved in a merger or sale. They must keep this policy’s protections, and we will tell you before your information becomes subject to a different policy.

We do not sell your personal information, and we do not share it for advertising.

Each provider processes your information under its own privacy terms and, where they apply, data processing terms with us: Supabase, Cloudflare, Brevo and Google.

Apple, Google and Microsoft run the app stores you may download Nexivo from. They handle your download and store account under their own privacy policies. A download from our website is served by Cloudflare, like the rest of the site, except the Mac app, which comes from Supabase.

Crocent is in India, and your information is processed in Japan today (in India if we move our database to Mumbai), in the United States, and wherever our providers’ networks carry it. When we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an adequacy decision (the EU has one for Japan) or on safeguards such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework, where a provider is certified under it. We do not transfer information to any country the Government of India restricts under the Digital Personal Data Protection Act, 2023. You can ask us for details of these safeguards.

We may keep information longer if the law requires it, or to deal with a legal claim or a report of abuse. Backups made by our database provider may keep deleted information for a short time, at most 30 days, before they are overwritten.

In any Nexivo app: open your account in the app’s settings and choose Delete account.

Without the app: go to https://nexivo-link.pages.dev/account/ in any browser, log in, and choose Delete account.

If you cannot log in: email resource@crocentwebservices.com from the address on the account and ask us to delete it. We may ask you to confirm the request. We will delete it within 30 days.

When your account is deleted:

• your email, name, password and logins are deleted, and every device is logged out of it;
• any session in which you are viewing or controlling ends;
• the name and email copied onto records of requests you made are removed from them at once, and the records themselves are deleted on their normal 90-day schedule.

Your devices keep their Computer IDs, because those belong to the device and not to your account. To have a device record deleted, email resource@crocentwebservices.com with its Computer ID. We may ask you to show that the device is yours.

Wherever you live, you can ask us to:

• tell you what personal information we have about you and how we use it, and give you a copy;
• correct, complete or update it. You can change your name yourself in the app or at https://nexivo-link.pages.dev/account/;
• delete it (section 10);
• stop using it, or use it only in limited ways, where the law gives you that right;
• withdraw your consent.

In India, under the Digital Personal Data Protection Act, 2023, you also have the right to have your grievances handled by our Grievance Officer (section 17), and to nominate someone to exercise your rights if you die or become unable to. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

In the EU, the EEA and the UK, you also have the right to object to processing based on our legitimate interests, to receive your information in a portable format, and to complain to your local data protection authority.

In California, see section 15.

To use any of these rights, email resource@crocentwebservices.com. We will check that the request comes from you, and we will answer within one month at the latest. We do not charge for this, and we will not treat you differently for using your rights.

Nexivo is not intended for anyone under 18. Under India’s Digital Personal Data Protection Act, 2023, a person under 18 is a child, and a child’s personal information may be processed only with the verifiable consent of a parent or lawful guardian. A person under 18 may use Nexivo only with the consent and supervision of a parent or lawful guardian, who agrees to our Terms of Service for them.

We do not knowingly collect information from children without that consent. We do not track or monitor the behaviour of children, and we show no advertising to anyone. If you believe a child is using Nexivo without a parent’s or guardian’s consent, email resource@crocentwebservices.com and we will delete their information.

We protect your information with measures that include:

• encryption in transit: HTTPS (TLS) to our servers, and DTLS-SRTP between devices for screens, input and copied text;
• passwords stored only as one-way hashes, and one-time codes stored only as one-way hashes;
• database rules that let each device read only the records it is part of, with every change made through checked server functions;
• requests that expire after 60 seconds, links that work once and expire, sessions capped at 8 hours, and limits on repeated attempts;
• relay credentials that expire, and a relay that cannot read what it carries;
• a requirement that the person sharing approves every session and can stop it at any time.

No system is perfectly secure. If we learn of a personal data breach that affects you, we will tell you and the authorities as the law requires.

You can help: only approve people you know, check the verified email before you say yes, turn on Force relay if you do not want the other device to see your IP address, and stop sharing whenever you want.

You decide what the other person sees. Anything on your screen, including other people’s messages or information, is visible to them while you share. Close or hide what you do not want them to see, and only share other people’s information when you are allowed to.

Nexivo does not record sessions. It cannot stop the other person from taking photos or screenshots of what you show them with their own device or tools.

This section applies if you live in California and the California Consumer Privacy Act, as amended, applies to us.

• What we collect: identifiers (name, email, account ID, device ID and Computer ID, IP address); internet or other electronic network activity (connection records, login sessions, server logs); and account login details (email and password), which the law treats as sensitive personal information. Section 4 describes each, and section 9 says how long we keep it.
• Where it comes from: from you, from your devices, and from the other people you connect with.
• Why: the purposes in section 5. We use sensitive personal information only to provide Nexivo and keep it secure.
• Who receives it: the people and service providers in sections 6 and 7, for business purposes.
• No sale or sharing: we have not sold or shared personal information for cross-context behavioural advertising in the last 12 months, and we do not do so. We do not knowingly sell or share the information of anyone under 16.
• Your rights: to know what we collect, use and disclose; to get a copy; to delete; to correct; and not to be discriminated against for using these rights. You can use an authorised agent. Email resource@crocentwebservices.com to make a request. We will verify it, usually by checking that it comes from the email address on your account.

We will update this policy when Nexivo or the law changes. The effective date at the top shows the current version. If a change materially affects how we use your information, we will tell you in the apps, on the website, or by email if you have an account, before it takes effect. Where the law requires your consent to a change, we will ask for it.

Crocent Web Services Private Limited
E-237AA, Phase 8B, Industrial Area, Sector 74, SAS Nagar, Punjab 140307, India

• Privacy questions and requests: resource@crocentwebservices.com
• Help with Nexivo: resource@crocentwebservices.com

Grievance Officer: Sahil Singh, Crocent Web Services Private Limited, E-237AA, Phase 8B, Industrial Area, Sector 74, SAS Nagar, Punjab 140307, India. Email: resource@crocentwebservices.com

Write to the Grievance Officer with any complaint about how we handle your information or about Nexivo. We will acknowledge your complaint within 24 hours and resolve it within 15 days.