Privacy policy
Last updated: November 4, 2026
This is a starting template that describes how this software actually handles data. Have it reviewed for your company and country before launch.
What we store
- Account: your name, email address and a scrypt hash of your password. We never store the password itself.
- API keys: a SHA-256 hash and the first characters of each key, so you can recognise it. The full key is shown to you once and not kept.
- Request logs: for each API or playground call we keep the endpoint, status, duration, credits used and the URL or search query you sent (first 200 characters). Logs are deleted after 90 days.
- Billing: your Stripe customer and subscription IDs and the plan you're on. Card details are entered on Stripe's page and never reach our servers.
What we don't store
We don't store the content of the pages you extract or the search results we return. They are sent back to you and then discarded. Visitor IP addresses are kept in memory for up to an hour for rate limiting and are not written to the database.
Cookies
We use one cookie, nbx_session, to keep you logged in. It is HttpOnly, lasts up to 7 days and is removed when you log out. There are no advertising or analytics cookies.
Services that process data for us
- Stripe: payments and invoices (Stripe privacy policy).
- Resend: sends account emails such as confirmation and password reset links.
- Brave Search API / Wikipedia: receive the search queries you send to
/v1/search. - The websites you extract: receive a request from our servers, identified as NebulixBot.
- Google Fonts: serves the fonts on this website.
Your choices
You can change your password from the dashboard and revoke API keys at any time. To export or delete your account and its data, email us and we'll do it within 30 days.
Contact
Questions about privacy: use the email address listed on our website.