Privacy policy

Last updated: October 17, 2026

This policy says what Nullivex LLC ("we") collects when you use Nextweb, nextwebjs.com, and your Nextweb account, and what we do with it. We don't sell personal data, and we don't use it for advertising.

What Nextweb sends us

• Your email address, the first time Nextweb starts, so we can issue your free license.
• Your license key, each time Nextweb starts and when it downloads a package, so we can check that the license is valid.
• A machine ID: a one-way hash of the ID your operating system gives the computer (/etc/machine-id on Linux), or, where there is none, of a random ID Nextweb creates once and keeps in its folder. Copies of Nextweb older than build 149 (October 2026) send a one-way hash of your computer's hostname, operating system, processor, and machine ID instead. We can't turn either back into those details. We use it to count the machines a license is used on.
• The IP address your requests come from, and the name and version your copy of Nextweb reports.
• Which packages you download, when, and how large they were.
• If Nextweb detects that it has been tampered with, a report of that event with your license key, hostname, operating system, and processor.

On its first start, Nextweb also asks api.ipify.org, a third-party service, for your public IP address.

Nextweb never sends us your applications, your sites, their databases, or other files on your machine, unless you publish a package (below).

What your account holds

If you buy a license, we keep your email address, a one-way hash of your password (never the password itself), the name you choose to give us, your orders and licenses, and the customer ID Stripe gives you. Payments are handled by Stripe: your card details go to Stripe and never reach our servers. When you buy a license, we email the key to the address you give at checkout.

If you publish packages

Publishing uses the nextweb-dev package. When you use it, our license server keeps:

• Your developer handle, and the email address of your license. Each time a new device key is added to your account, we send a notice there.
• For each copy of Nextweb you publish from: its public key, the device name it reports (the computer's hostname unless you choose another), the IP address it enrolled from, and when.
• The organizations you create or join, and your role in each. For an organization, the licenses of the servers linked to it.
• For each package you build with pkg create: its name, version, and build, the hash of the file, and which key registered it. The file stays on your machine until you publish it.

pkg publish uploads the package to our content server, encrypted. The keys that open it are held by our license server, which releases them only to the licenses allowed to install it.

A published package's name, version, and type, its owner's handle, and the handle and key ID of the developer who published it are public, for internal packages too. The members of an organization see each other's handles and roles; its owners also see a short fingerprint of each linked license.

Our websites

www.nextwebjs.com counts visits with Google Analytics, and asks first. If you allow it, Google sets cookies in your browser (named _ga, and _ga_ followed by an id) and receives your IP address, the pages you open, the browser and device you use, and which of four next steps you take on a page: a click on Download, Pricing or a lesson, or the copy button on the install command. We don't use it for advertising, and Google's privacy policy says what Google does with it. If you decline, nothing from Google loads. Your answer stays in your browser's storage for a year, and the Cookies link in the footer lets you change it. The site sets no other cookies, and its fonts and files come from our own servers.

The shop and account pages set one cookie, which keeps you signed in. It ends when you close your browser, after 30 minutes without activity, or 12 hours after you signed in, whichever comes first. Our server keeps your IP address and browser details with that session and deletes them with it.

To show My account instead of Sign in, pages on www.nextwebjs.com ask our account server, from your browser, whether you are signed in. The request carries your sign-in cookie if you have one, and the answer is yes or no. Asking does not count as activity, so it does not extend your sign-in.

Our servers log each request, with the time, the address requested, and your IP address, to keep the service running and secure.

How we use it

To issue and check licenses, deliver Nextweb and its packages, take payments, answer you when you write to us, and prevent abuse. Nothing else.

Who else sees it

• Stripe, to take payments.
• DigitalOcean, which hosts our servers.
• SendGrid, which delivers the email we send you.
• Google, through Google Analytics on this site.
• Anyone the law requires us to give it to.

We don't sell, rent, or trade personal data.

How long we keep it

Your account, licenses, and download records stay while your account or license exists, and afterwards for as long as tax and accounting law requires. Developer and organization accounts, their keys, and their build records stay while the account exists, and packages you publish stay on the content server until you ask us to remove them. We delete any of it sooner if you ask, unless the law requires us to keep it.

Your choices

You can ask what we hold about you, have it corrected, or have it deleted. Write to privacy@nextwebjs.com.

Children

Nextweb is not meant for children under 13, and we don't knowingly collect their data.

Changes

We'll post any change to this policy here with a new date.

Contact

Privacy questions go to privacy@nextwebjs.com.