Privacy Policy

Overview

This policy covers three things: the Nextly marketing website, the Nextly CLI you run on your machine, and apps you build with Nextly.

• Website (nextlyhq.com). We use optional analytics. Where the rules require consent we ask first, and where they do not we say so below and give you a way to switch it off.
• Nextly CLI. Sends anonymous usage events when you run it, with consent and easy opt-out.
• Apps you build with Nextly. Your app does not report anything to us. Nothing in the Nextly runtime calls home.

Website

When you visit nextlyhq.com:

• We may use analytics to understand traffic patterns (page views, referrers).
• We do not sell your data to third parties.
• We do not use advertising trackers.
• We do not collect personally identifiable information unless you provide it (for example, through a contact form).

Cookies

Where the rules require it, and only there, we ask for your consent before setting any non-essential cookie. Where we ask, you can choose from two categories:

• Essential: Required for the site to function correctly. These are always active and cannot be disabled.
• Analytics: Optional. When enabled, we collect usage analytics, session recordings, and may display surveys to help us improve the product. This data is processed by PostHog on EU servers (Frankfurt, Germany). No data is sold to third parties. IP addresses are not stored.

Page views are also counted by Vercel Web Analytics. Vercel is the platform this site runs on, and this is its own counter rather than a second copy of PostHog. It sets no cookies and stores nothing on your device. To tell one visit from another it uses a hash computed from the incoming request, which Vercel discards after 24 hours, and page views are recorded without being tied to an IP address. What it records is the page, and coarse information taken from the request: the referring site, country, browser, operating system, device type, and any UTM parameters in the link you followed. It counts the public site only, never the admin panel and never our API routes. It stops when you switch analytics off, and it does not run at all if your browser sends Do Not Track or Global Privacy Control.

Whether we ask depends on where you are. These rules follow the visitor rather than the server, so where we store analytics data does not change them. We do not ask in the United States, Japan, Australia and New Zealand, whose rules require notice rather than permission in advance. Everywhere else we ask: the UK, the EEA and Switzerland, and the many countries outside Europe whose own laws require it, among them China, Brazil, India, South Korea, Canada and Turkey. If we cannot work out where you are, we ask.

If you see the banner, then before you answer it and if you decline, we record two things: the pages you view, and any JavaScript error our own code produces. Page views are the part both counters described above record. Nothing is stored on your device for this: no cookies, no local storage. To tell one visit from another within a single day, PostHog's servers compute a one-way hash from your IP address, your browser's user-agent string, our domain and a secret that is replaced every 24 hours. Your IP address is not stored. We do not record what you click, search for, or where you move your cursor unless you accept.

If you do not see the banner, your country's rules do not require us to ask, and analytics runs in full from your first page view: a cookie holding a visitor id, the pages you view, what you click, session recordings, click heatmaps, surveys, and JavaScript errors. You can switch all of it off at any time using the button below, and we honour the Global Privacy Control signal if your browser sends one.

We treat the daily hash as personal data, because it distinguishes one device from another within a day even though it cannot be reversed. Pseudonymised is not the same as anonymous. We rely on our legitimate interests in understanding and improving this site, and you have the right to object at any time: write to privacy@revnix.com and we will stop.

You can change your cookie preference at any time using the button below.

CLI Telemetry

When you run the Nextly CLI (for example, create-nextly-app or commands like nextly migrate), it sends anonymous usage events to PostHog on EU servers (Frankfurt, Germany). This helps us see which templates and databases people use, and catch failures early during alpha.

• Anonymous. A random ID is generated on first run and stored locally. It is not linked to any account or email.
• Project paths are hashed. We never see your project name, directory, or file paths.
• Source code, schemas, and credentials never leave your machine. No file contents, no .env values, no database URLs, no error messages or stack traces.
• Off by default in CI, Docker, production, and non-interactive shells.
• Easy opt-out. Run nextly telemetry disable, or set NEXTLY_TELEMETRY_DISABLED=1, or set DO_NOT_TRACK=1.

For the full event list, base context, and source code links, see /docs/telemetry.

Apps you build with Nextly

The Nextly runtime sends nothing to us. When the app you build runs in production, it does not call home, does not report telemetry, and does not contact any Nextly service.

• All data stays on your servers.
• You handle your users' data privacy and compliance.
• Nextly does not have access to your instance or its data.

Contact Information

If you submit information through our contact form, we use it solely to respond to your inquiry. We do not add you to marketing lists without consent.

Open Source

Nextly is open-source under the MIT license. You can audit exactly what the software does at any time. The telemetry code is in the public repo too.

Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

Questions about this policy? Contact us.