1. The short version

Nyktos uses no advertising cookies, no analytics cookies, and no third-party trackers. Everything stored on your device exists to make the app work: your login session, your encryption keys, and your preferences. Clear your browser data and it's all gone.

2. What we store on your device

All of this lives in your browser's local storage — never sent anywhere except where noted:

• Login session (Supabase auth token) — keeps you signed in. Expires when you log out or the session lapses.
• Encryption keys — your X25519/Ed25519 keypair and per-contact key cache. Generated on your device, never uploaded. Lose them and old messages can't be decrypted, by anyone.
• App-lock PIN hash + salt — a PBKDF2 hash of your PIN, used only to unlock the app locally. The PIN itself is never stored.
• Theme, muted chats, archived chats, chat folders — your display preferences.
• Message drafts — unsent text, per conversation, so you don't lose it.

3. What the server sets

Supabase (our backend host) may set its own session cookies for authentication. To keep bots out, signup is protected by email verification codes (one-time passcodes), request rate limits, and a block on disposable email addresses. Neither is used for advertising or cross-site tracking.

4. What we don't do

No ad networks. No analytics beacons. No fingerprinting. No selling or sharing device data. Our Privacy Policy covers what the server sees — this page is only about what's on your device.

5. How to clear everything

Log out of Nyktos, then clear your browser's site data (in most browsers: settings → privacy → clear browsing data → select this site). Warning: clearing storage without exporting anything deletes your encryption keys permanently — messages encrypted to those keys become unreadable everywhere.

6. Contact

Questions: info@nyktos.tech.