Data protection

Privacy Policy

Effective 2026-09-29

This policy explains how personal data is processed under the EU General Data Protection Regulation (GDPR) when you use nyxia.ai, Nyxialith OS, the game Elsewhere, or your Nyxia ID. Sections 1 to 3 apply to everyone. Sections 4 to 6 apply to the product you use.

1. Controller

The controller responsible for all Nyxia products is:

Heiko Trenkle

Rosenthaler Straße 43–45

10178 Berlin

Germany

Email: hello [at] nyxia [dot] ai

Privacy requests go to hello [at] nyxia [dot] ai. We may need to confirm that you control the relevant account before acting.

2. Hosting and server logs

Our products are hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104, USA. When you load any of our pages or use our applications, the hosting infrastructure processes technical request data: IP address, browser type and version, operating system, referrer URL, requested URL and the time of the request. We use it to deliver the service and to keep it secure and reliable, on the basis of our legitimate interests (Article 6(1)(f) GDPR), and keep it only as long as that purpose requires.

3. Nyxia ID (your account)

Nyxia ID is one account for all Nyxia products. You create it by signing in; there is no separate password. Nyxialith OS uses it today. Elsewhere will use it once game sign-in is released; until then, section 6 applies.

// Google sign-in

If you sign in with Google, we request only the openid and email scopes. We receive your Google account ID, your email address, and whether Google has verified it. We use this only to create and secure your account and to sign you in. We do not request access to your Gmail, Drive, contacts, or any other Google data.

We do not sell this data, use it for advertising, or share it with anyone except our hosting provider. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

// Telegram sign-in

Nyxialith OS plans to offer sign-in with Telegram. When it does, we will receive your Telegram user ID and username, and this policy will be updated.

// One account, separate product data

Your Nyxia ID identifies you to each product. Each product stores its own data (for example your Nyxialith workspace or your Elsewhere progress), and no product reads another product's data. A necessary signed session cookie keeps you signed in; we do not use advertising cookies.

Legal basis: performance of the contract (Article 6(1)(b) GDPR). Deleting your Nyxia ID deletes your account and your data in every product, subject to the retention described in section 7.

4. nyxia.ai website

You can use the website without an account.

// Advertising measurement

We use advertising pixels to measure how our ads perform. They load without a cookie banner.

  • X Pixel (X Corp., USA), only on the music landing pages under /listen. It records pages viewed and device data for ad reporting. x.com/privacy
  • Meta Pixel (Meta Platforms, USA / Ireland), only on /listen/space-cat and /listen/arabesque. It records page views and clicks on streaming links. facebook.com/privacy/policy

Legal basis: our legitimate interest in measuring the reach of our ads (Article 6(1)(f) GDPR). You may object at any time.

// YouTube

/music and /listen load YouTube video embeds or preview images. When a video or its preview loads, your browser connects to Google/YouTube (USA), which may set cookies. policies.google.com/privacy

5. Nyxialith OS

The Nyxialith OS landing page at nyxia.ai/nyxialith uses no advertising pixels or analytics scripts; your display theme may be stored in your browser. The processing below applies when you use the application at nyxialith.nyxia.ai.

// What we process

  • Your Nyxia ID (section 3) and sign-in timestamps.
  • Prompts, conversations, voice recordings and transcripts, uploaded files, generated images and music, workspace names, and technical generation records.
  • Catnip balances and ledger entries.
  • Security and operations data such as session IDs, IP address, user agent, request timing, errors, model usage, token counts and estimated provider cost. We do not intentionally place prompt or response content in operational telemetry.
  • Local device preferences.

// Why and on what basis

  • Your account, creative tools and storage: performance of the contract (Article 6(1)(b) GDPR).
  • Securing, debugging, rate-limiting and improving the service: our legitimate interests in a reliable and abuse-resistant service (Article 6(1)(f)).
  • Where we specifically ask permission: consent (Article 6(1)(a)), which you may withdraw for the future.

We do not use your content to train AI models.

// AI providers

Depending on the feature you use, your prompts, uploads and voice recordings are sent to the provider that handles the request: Google (Gemini), OpenAI, Microsoft (Azure speech), Meta, Black Forest Labs, Replicate, Runware, fal.ai (video generation, where enabled), Z.ai, Tempolor, Comfy, and the model routers OpenRouter and TypeSafe. Each provider receives only the data needed for its role.

// Bug reports

When you submit a bug report, you choose whether to include a technical snapshot, screenshot, or selected text. The recent action history stays in memory on your device until you submit it. Reports are available only to authorized administrators. Report content is retained for 30 days and basic report records for 90 days; deleting your account also removes your reports.

// Deleting your workspace and account

Open Settings, choose Account, select “Delete Account”, then type DELETE. This permanently removes your account access and workspace content. Backups and object-storage cleanup may take a limited additional period to complete.

6. Elsewhere

Elsewhere is a browser game in preview. The game shows no ads and uses no analytics or tracking scripts.

// In your browser

The game stores your device preferences (such as look sensitivity and inverted look) in your browser. They do not leave your device.

// Game progress

When progress saving is enabled, our game server stores your progress:

  • your drone's battery level and how often it has been recharged at the dock;
  • the relics you hold and how many of each;
  • the distances your drone has travelled since the previous update (walking and boosting, in metres), which the server uses to calculate battery use. We do not store where you went.

Progress belongs to your Nyxia ID. Before game sign-in is released, progress is tied to a random identifier that the game creates and keeps in your browser.

The server checks every change against the game rules, so that progress and items cannot be manipulated. Legal basis: performance of the contract (Article 6(1)(b) GDPR) for saving your progress, and our legitimate interest in fair play and in protecting the game from cheating (Article 6(1)(f)).

Progress tied only to a browser identifier is deleted after 90 days without activity, or earlier on request.

// Purchases

Elsewhere has no purchases yet. Before we introduce any, we will update this policy.

7. Recipients, transfers and retention

Recipients are named in the sections above: our hosting provider Railway, the identity provider Google, and, for the features that use them, X, Meta, Google/YouTube, and the AI providers of Nyxialith OS.

Several of these providers are based in the USA or process data there. Transfers rely on the European Commission's adequacy decision where the provider is certified under the EU-US Data Privacy Framework, and otherwise on appropriate safeguards such as the Standard Contractual Clauses.

We keep data only as long as its purpose requires, as described for each product. When you delete your account, we erase identities, sessions and product data.

8. Your rights

Under the GDPR you may request access, correction, deletion, restriction of processing and data portability, and you may object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it for the future. Write to hello [at] nyxia [dot] ai.

You may lodge a complaint with a data-protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

There is no solely automated decision-making that produces legal or similarly significant effects.

9. Changes

We update this policy when our products or the law change. The date at the top shows the current version.

// End of Line