Nixel Back to Nixel

Privacy policy

Last updated: 4 October 2026

Nixel is a browser extension published by SD Software LLC, 3 Getapnya Street, Goris, Armenia ("we"). We are the controller of the personal data described here. This policy describes exactly what the extension does with data, and what we receive when you buy a licence or write to us.

What we collect

From the extension, nothing. We operate no servers and receive no data from the extension. We cannot see the pages you visit, what Nixel found on them, or that you use it at all. There is no analytics, no telemetry and no crash reporting.

If you buy a licence or email us, we do receive a few details about you. Buying a licence below says which.

What stays on your device

Page content. Read in your browser to find sensitive text, and never transmitted. It is not written to disk or kept after the page closes.
Your settings. Which kinds to hide, how masks look, which sites are switched off. Stored locally by your browser.
Screenshots. A capture passes through your browser's temporary storage on its way to the editor and is deleted the moment the editor has it. Nothing is uploaded, and the redacted PNG is saved only where you put it.

Network requests the extension makes

Two, and only these:

Downloading the detection model, once The optional on-device language model (about 100 MB) is downloaded from the Hugging Face CDN the first time you enable it, then cached and used offline. It carries nothing about you or the pages you visit, though like any download it shows Hugging Face your IP address. You can decline it, remove the model at any time, and the rest of the extension keeps working.

Checking your licence, once a week Once you buy a licence, the extension confirms it with Lemon Squeezy, our payment provider, about once a week. The request contains the licence key and a device label such as "Nixel on Mac", and like any request it shows Lemon Squeezy your IP address. It never contains page content, and the extension keeps working for a month if the check cannot be made.

Permissions, and why

Chrome will warn you that Nixel can read and change your data on all websites. That is accurate, and unavoidable: an extension cannot find a leaked key on a page without reading the page. What it does with that access is the whole of this policy. Reading happens in your browser and stops there.

Access to the pages you open: to find sensitive text and cover it.
activeTab / scripting: to read and mask the page you are looking at.
storage: to remember your settings.
offscreen: to run the detection model without slowing the page down.
alarms: to schedule the weekly licence check.
Access to api.lemonsqueezy.com: to make that licence check, and nothing else.

Buying a licence

Licences are sold by Lemon Squeezy, who act as merchant of record: they take the payment, handle tax and email you the licence key. To do that they collect your name, email address, billing country and payment details, under their own privacy policy. We never see or store your card details.

Lemon Squeezy shares with us what an order needs: your name, email address, country and the order itself. We use them to deliver and support your licence and to keep the records tax law requires. If you email us, we keep the conversation so we can answer you.

Why we use it, and for how long

Delivering and supporting your licence, including the weekly check: needed to perform our contract with you. Kept while your licence is active.
Order records: a legal obligation. The Armenian Tax Code requires us to keep them for five years from the reporting period they belong to. They are deleted after that.
Your emails to us: our legitimate interest in answering you, or our contract if they are about your licence. Deleted two years after the last message.
Your licence key on your device: stays in your browser until you release the licence or remove the extension.

We do not sell your data, use it for advertising, or make automated decisions about you.

Where your data is stored

We are based in Armenia, and Lemon Squeezy, GitHub and Hugging Face are in the United States. Neither country is one the EU or UK treats as offering equivalent protection by default, so when your data leaves the EU or UK it relies on the safeguards those providers maintain, such as the EU-US Data Privacy Framework or Standard Contractual Clauses. The order details that reach us in Armenia are handled as this policy describes, wherever you live.

This website

nixel.org is hosted on GitHub Pages. It sets no cookies and runs no analytics or scripts. Like any web host, GitHub receives your IP address when you load a page and handles it under its own privacy statement.

Your rights

If you are in the EU, the UK or another country with similar law, you can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Write to support@nixel.org and we will answer within a month. Records tax law makes us keep cannot be deleted before that period ends.

You can also complain to the data protection authority where you live, or in the UK to the Information Commissioner's Office (ico.org.uk).

Changes and contact

If this policy changes, the date above changes with it. Questions, or a request about your data: support@nixel.org.