Privacy Policy

1. Who we are

This Privacy Policy applies to the Nadirect desktop application (the "Software"), the website at nadirect.co (the "Website") and the related online services (together, the "Service"), provided by Itay Nadir ("Nadirect", "we", "us" or "our"). We are the controller of the personal information described in this Policy. Contact: [email protected].

2. Summary

Audio files are transferred directly between users' devices, encrypted in transit, and never pass through or reside on our servers. We process only the limited information needed to provide user identifiers, profiles, friend connections, offline messages and aggregate usage statistics. We do not sell personal information, and we do not use advertising or tracking technologies.

3. Information we do not collect

• The audio files you add to or share through the Service, or what you listen to.
• The location of files on your device or the structure of your folders.
• The content of messages sent to friends, which is encrypted on your device before transmission.
• IP addresses. Our servers do not store them.

4. Information we collect

4.1 Account and profile information

A Nadirect ID and a public key generated on your device; the name you choose; and any profile information you provide, such as a photo, banner, biography, social media links and a featured song.

4.2 Social information

Your friend connections, pending friend requests and pending Group invitations.

4.3 Offline messages

Messages you send to a friend who is offline are held on our servers until delivered. They are end-to-end encrypted; we cannot read them. They are deleted after 30 days.

4.4 Crate information

If you choose to display a crate on your profile: the titles and artists of songs in the folders you select, and aggregate statistics about your library. Never the files themselves.

4.5 Usage statistics

Once a day, the Software reports its version, operating system, your profile name and the Groups it belongs to. A Group's administrator's Software also reports the Group's name, its members and its number of songs. We use this information to operate, secure and improve the Service.

4.6 Website

The Website uses no cookies and no advertising or cross-site tracking. To understand how many people visit and which pages they read, we use Cloudflare Web Analytics, which counts visits without cookies, without fingerprinting and without identifying individual visitors. Your light or dark display preference and your accessibility settings are stored only in your own browser. Our hosting provider processes standard technical request logs to deliver and protect the Website.

5. How we use information and legal bases

• To provide the Service, including identifiers, profiles, friends, invitations and message delivery: performance of our contract with you.
• To operate, secure and improve the Service, including usage statistics and preventing abuse: our legitimate interests.
• To enforce our Terms, including blocking users or Groups that breach them: our legitimate interests.
• To comply with legal obligations.

6. Information visible to other users

• Members of your Groups can see the songs you share in those Groups, your name and your online status.
• Your friends can see your profile, online status, typing indicator and read receipts.
• As with any peer-to-peer technology, users your device connects to directly can see your IP address.

7. Sharing and service providers

We do not sell or rent personal information. We share it only with:

• Cloudflare, Inc., which hosts our servers and the Website and provides cookie-free visit statistics for the Website, as our processor;
• GitHub, Inc., which hosts Software releases; the Software contacts GitHub to check for updates, which you may disable;
• authorities, where required by law or to protect the rights, safety or property of users or others.

Group members locate each other through a public distributed hash table (DHT). Only a value derived from the Group's secret key is published, which does not reveal the Group's name, its members or its contents.

8. International transfers

Our service providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

9. Retention

• Offline messages: until delivered, and no longer than 30 days.
• Usage statistics: deleted when an installation or Group has not reported for 60 days.
• Profile, crate and friend information: until you remove it or ask us to delete it.

10. Security

Connections between devices are end-to-end encrypted and authenticated. Keys stored on your device are protected by your operating system's secure storage (Windows DPAPI or the macOS Keychain). Software updates are cryptographically signed and verified before installation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Anyone with access to your device account may be able to use the Software as you.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent. You can edit or remove your profile, banner and crate at any time in the Software. To exercise any other right, including deletion of your Nadirect ID and all associated information, contact [email protected]. You also have the right to lodge a complaint with your local data protection authority.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date above shows when it was last changed. We will provide notice of material changes through the Software or the Website.

14. Contact

Questions or requests regarding this Policy may be sent to [email protected].