Scope and operator
This policy describes NEXORA Watch Party at https://nexorawatch.app. A verified legal operator name and public privacy contact have not yet been supplied. Administrators must complete those details. This policy describes current functionality, not a certification or security guarantee.
Accounts and profiles
Registration processes email, authentication credentials and account identifiers. Google sign in processes information needed to authenticate you. Profiles contain a display name, handle, biography and optional avatar. Social onboarding records date of birth and privacy preferences. Discoverable profiles may be shown to other users; private messages are not public profiles.
Google and YouTube authorization
Connecting YouTube is separate from signing in. With consent, NEXORA requests the YouTube read only scope to retrieve API accessible playlists, uploads and video information. Authorization codes are exchanged on the server. Access and refresh tokens are encrypted in server controlled storage, associated with your account and used for authorized requests and renewal. Disconnecting requests Google revocation and removes the stored connection, not your Google account or previously shared metadata. You can revoke access in Google account settings. Google testing, verification, quotas and content restrictions can limit access.
Messages, voice and social activity
The service stores private and room messages, sender identifiers, timestamps, replies, friendship requests, blocks, reports and notifications. Account permissions restrict private conversations to participants. Voice notes are uploaded for transcription and contextual safety review through Lovable AI infrastructure and its configured transcription model, then stored with message bound access. Audio and transcripts are not anonymous. Authorized moderation processes relevant evidence. This is not a promise of end to end encryption or that only recipients can ever access data.
Rooms, playback and streaming
Room participation, codes, queues, official links, playback position, synchronization events, stream metadata and errors support watch parties. Public rooms are discoverable; private and solo rooms have restricted admission. Capture starts with your action and browser permission where required. LiveKit infrastructure transports shared media and audio to participants. A selected screen may expose everything visible in it. Local file selection does not store the original file as a saved media library. NEXORA does not implement default stream recording, but cannot prevent recipients or devices from recording received content.
Technical information, cookies and sessions
The app processes browser capabilities, connection health, timestamps, playback errors and browser information submitted with diagnostics. Hosting providers may process IP addresses and request logs for delivery and security. Authentication uses provider managed session storage mechanisms; browser storage also retains sign in destinations and preferences. The installable web app caches permitted static assets and an offline fallback, not private messages, account secrets or live room state. Optional push uses Firebase device registration tokens. Browser controls can revoke notification, microphone and capture permissions. This policy does not assert a verified inventory of every infrastructure cookie or log.
Infrastructure and sharing
NEXORA uses Lovable Cloud, whose authentication, database and storage infrastructure is based on Supabase, hosting infrastructure, Google and YouTube, configured LiveKit infrastructure, Firebase messaging and Lovable AI processing. Services receive data needed for their functions under their own policies and may process it internationally. Deployment regions and provider retention settings have not been verified for this policy. Other users receive the profiles, messages and media intentionally shared with them. Relevant data may be processed for legal obligations, authorized administration and safety investigations.
External providers and advertising
Netflix and Prime Video links open official external services. NEXORA does not connect their consumer libraries, collect passwords or read their cookies. Each participant needs eligible access. Embedded and external providers process data under their own policies and may display official advertisements. NEXORA does not sell personal information for advertising or use viewing activity for advertising and does not introduce advertiser tracking. This does not remove official provider advertisements.
Security, storage and retention
Account permissions, server authorization and encrypted provider credentials are implemented; absolute security is not guaranteed. Messages, voice notes, account data, room metadata and moderation records may persist until applicable deletion or administrative processes remove them. No universal automatic deletion schedule is published. Removing a visible item or disconnecting a provider does not necessarily remove related records, recipients copies, evidence or backups. Necessary enforcement evidence is retained with restricted access. Specific retention and backup deletion periods require operator confirmation.
Your choices and rights
Available controls let you edit profiles, manage discovery and contact preferences, block users, disconnect YouTube, revoke Google access and disable push or browser permissions. Depending on law, you may have rights to access, correction, deletion, restriction or objection. There is no complete self service account deletion or data export flow currently implemented. Requests require operator review and identity verification; legal duties, safety evidence and technical retention can limit deletion. No immediate complete deletion guarantee is made.
Contact and changes
A verified privacy and account deletion contact has not yet been supplied. Administrators must publish a working contact and legal operator information here before this becomes a complete privacy contact notice. Enforcement appeals are available from the notice but are not a substitute for a privacy contact. Published versions and effective dates are retained; changes appear with an updated date.