1. Who operates the project
NexaCloudHub is independently operated under the public name Vlad D., based in Romania. Contact: contact@nexacloudhub.com.
This policy covers the Flluet Windows and Android editions described on this website. Windows supports Gmail through Google OAuth and NexaCloudHub IMAP/SMTP. The Android edition described here supports NexaCloudHub IMAP/SMTP and does not include Google OAuth. This notice distinguishes information processed locally by the application from information received by NexaCloudHub through a hosted service or support request.
2. Email data used by the app
To display and manage a mailbox you connect, Flluet processes account addresses, provider and profile identifiers, message IDs, sender and recipient information, subject lines, dates, labels or folders, read state, message bodies and attachments. It processes the content and addresses you choose when composing, replying, forwarding, searching or applying a mailbox action.
Mailbox data remains with its provider, except for processing, caches, drafts, downloads and other records on the device or transfers needed for the action you request. Flluet does not send your mailbox to NexaCloudHub merely for using the local app. A NexaCloudHub-hosted mailbox is also subject to the hosted service notice.
3. Google OAuth on Windows
Google sign-in happens in your browser. Flluet does not ask for or store your Google password. The Windows app receives account-scoped access and refresh tokens after authorization and uses them for Gmail features. The full-mail scope https://mail.google.com/ allows the mail operations offered by this build, including permanent deletion when you select and confirm it.
Gmail tokens are associated with the local Flluet profile where access was granted. Connecting the same Gmail address in another profile requires separate authorization. Local token removal does not, by itself, revoke all grants in Google; you can revoke the application’s access through Google Account permissions.
4. Profiles, credentials and local files
Windows uses secure storage protected for the current Windows user for IMAP credentials, Gmail tokens and local drafts. Android uses the platform secure-storage integration for account secrets and app records. An optional profile PIN gates access through the app; it is not a separate guarantee against someone who controls the same device or operating-system account.
Local drafts can include message text, recipients, reply details and attachment references. Attachments saved to a destination you choose and cached WebView resources are not covered by the claim that account secrets use secure storage. Removing an account or profile removes its related app records but does not automatically delete separately saved downloads or every operating-system cache. Encrypted .flluet imports concern IMAP accounts and exclude Google OAuth grants.
5. Android permissions and mail actions
Android uses network access for the configured mail service, WebView to display supported HTML, file access through the system picker for attachments or imports, and notification permission where offered. The edition can move or restore messages with its swipe action; permanent deletion is a separate confirmed mailbox action. Mail synchronization operates while the relevant app/profile view is active, not through an always-running closed-app mail service.
6. External images, links and translation
Loading a remote email image contacts the host selected by the sender and can reveal your IP address, viewing time and embedded tracking identifier. Remote images may be enabled by default; hiding them prevents subsequent loads for the view, not requests already sent. Inline images embedded in the message do not require the same external image request.
Opening an external link sends you to that service, which has its own data handling. If you choose Translate to English, the selected text is previewed and is sent to Google Translate in a browser URL only after you confirm. The text can appear in browser history. The whole message is not automatically submitted for translation.
7. Purposes, recipients and legal grounds
Mail data is used for the mail features you request: reading, composing, sending, organizing, searching, drafts, attachments, recovery and account access. Your chosen mail provider and recipients receive the data needed for those actions. NexaCloudHub receives mailbox content as a mail host when you use its hosted mailbox, or as support material if you deliberately send it; an app installation alone does not give the operator remote access to every local profile.
For processing by the operator, relevant GDPR grounds are providing the requested service, legitimate interests in security and support, consent where a distinct optional use requires it, and applicable legal obligations. Third-party mail, image and translation services determine their own processing under their policies; their processing locations can differ from your location. Contact us about infrastructure or applicable transfer arrangements used for NexaCloudHub-hosted mail.
8. Google data and Limited Use
Flluet’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Gmail data is used for the mail functions described here, not sold, used for advertising or supplied to data brokers.
Transfers of Google data are limited to what is needed for the user-facing feature, your specific instruction, security, applicable law or another purpose allowed by Google’s policy. Human access is limited to the exceptions permitted by that policy, such as your affirmative permission to inspect specified support material or a necessary security or legal case. The app does not use Gmail data to train generalized AI models. This statement does not represent Google verification, endorsement or a security certification.
9. Retention, removal and your controls
Local profile records and drafts remain until removed through the app or device controls. Downloads, browser caches, exported files and user-made backups can remain separately; uninstalling Windows software can leave local data behind. Removing a Flluet account does not delete the provider’s mailbox. Mailbox deletion, retention and recovery depend on the provider and the actions you select.
You can remove local accounts, discard local drafts, choose image loading, stop using translation or revoke Google access. For data actually held by NexaCloudHub, including hosted-mail or support records, contact contact@nexacloudhub.com. Provider-held data and local copies under your control require the corresponding provider or device action. Support material is retained as needed to resolve and document the request or meet a legal requirement.
10. Your rights and requests
Where GDPR applies, you may request access, correction, erasure, restriction or portability of your personal data, subject to the conditions of those rights. You may object to processing based on legitimate interests and withdraw consent for consent-based processing without affecting earlier lawful processing. Contact contact@nexacloudhub.com and identify the service and account concerned. We may ask for proportionate information to verify the request; do not send passwords, access tokens or your entire mailbox.
Requests are handled within the applicable legal time limits, normally within one month; an extension may apply to complex or multiple requests, with an explanation. You may complain to a competent supervisory authority, including Romania’s ANSPDCP. These projects do not make solely automated decisions intended to produce legal or similarly significant effects about you.
11. Contact and changes
NexaCloudHub is independently operated under the public name Vlad D., based in Romania. Contact: contact@nexacloudhub.com.
For privacy questions, rights requests or security concerns, use the contact address above and name the relevant project. This notice may change when features or processing change. The revision date identifies the version; a material new use of data will be explained before it begins, with a new choice where required.