This policy explains how NXT ("NXT", "we", "us") handles information when you use the NXT Discord bot, the website at nxtnft.app, the dashboard, and our developer interfaces (the "Service"). We collect only what the Service needs to work, and we do not sell personal data.
What we collect
From Discord
- Your Discord user ID, username, display name, and avatar when you log in or interact with the bot.
- If you create an email login: your email address, a salted scrypt hash of your password (never the password itself), and the Discord access and refresh tokens that let your email login open your Discord session, encrypted with AES-256-GCM.
- For servers that use NXT: membership in that server, the roles you hold, when you joined, and whether you are boosting or pending membership screening.
- The list of servers you can manage, read during login so we can show which servers you can configure. We do not store your full server list.
- Content you send to NXT features, such as ticket messages, attachment links, and answers to intake questions, captcha solves, and giveaway entries with the wallet you chose for the prize.
Wallets and on-chain data
- Public wallet addresses you choose to prove, the proof method (same-wallet transfer, OpenSea profile, or delegation), and the related public reference such as a transaction hash, OpenSea username, or delegating hot wallet.
- Public blockchain data needed to evaluate rules, such as token balances, token ownership, metadata, and transfer events. This data is already public on the relevant networks.
We never ask for, receive, or store private keys, seed phrases, or wallet signatures.
Billing
Paid plans are processed by Stripe. Stripe collects your payment details directly. We receive limited billing information such as the customer and subscription identifiers, plan, billing email, and payment status, but never your full card number.
Technical data
We use encrypted, HTTP-only cookies to keep you signed in (a session cookie, and a second one if you use email login), plus short-lived cookies that protect the Discord login step. We keep server logs (such as IP address, request path, and timestamps) for security and troubleshooting. We do not use advertising or cross-site tracking cookies.
How we use it
- To verify wallet ownership and grant or remove Discord roles according to each server's rules.
- To run the features server administrators enable, such as captcha, tickets, giveaways, onboarding, and the bots.
- To show server administrators their member directory, role history, and activity logs.
- To bill paid plans and enforce plan limits.
- To secure the Service, prevent abuse, and fix problems.
- To contact administrators about their server, their plan, or important changes to the Service.
Who can see it
- Server administrators of a server you belong to that uses NXT can see your Discord profile, your roles in that server, your proven wallets, your role history, and tickets you opened there. They can export this data as CSV, and read it through the Members API, which includes your wallets only once you have verified in their server.
- Other servers that use NXT can recognize your proven wallets when you click Verify there, so you do not have to prove them again. Admins of a server only see your data once you are a member of it.
- Applications using Login with NXT receive your Discord ID, username, and only the wallets you choose to share on the consent screen.
- Service providers that host and operate the Service for us, such as hosting, database, RPC, and payment providers, under agreements that limit their use of the data.
- Authorities when required by law, or when needed to protect the rights, safety, or property of our users, the public, or NXT.
We do not sell personal data or share it with third parties for their own marketing.
How long we keep it
- Proven wallets are kept until you remove them or delete your data.
- Server membership records are marked as departed when you leave a server. They are not deleted automatically.
- Role history and ticket transcripts are kept for the server's administrators and are not deleted automatically, including after NXT is removed from a server. Email us to have a server's data deleted.
- Unfinished wallet proof requests are deleted about a day after they expire.
- Server logs are kept for a limited period for security purposes.
- Billing records are kept as long as required for tax and accounting.
Your choices and rights
- You can remove any proven wallet from your account page or with the My wallets button in any NXT verify panel. Roles that depended on it are re-checked.
- You can stop NXT from processing your server data by leaving the server or by asking its admins to remove the bot.
- Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict some processing. Email support@nxtnft.app from your account or include your Discord ID, and we will respond within the time required by law.
Public blockchain data cannot be changed or deleted by anyone, including us. Removing a wallet from NXT unlinks it from your Discord account in our records.
Security
Data is encrypted in transit. Session cookies are encrypted (AES-256-GCM) and HTTP only. Passwords are hashed with scrypt, stored Discord tokens are encrypted with AES-256-GCM, and API keys, OAuth client secrets, and OAuth tokens are stored only as SHA-256 hashes. Access to production systems is restricted. No system is perfectly secure, so please report any concern to support@nxtnft.app.
International transfers
We and our providers may process data in countries other than yours. Where required, we use appropriate safeguards for those transfers.
Children
The Service is not directed to children under 13, or under the minimum age Discord requires in your country.
Changes
We will post updates to this policy here with a new effective date.
Contact
NXT, support@nxtnft.app.