What stays on your device.

01 · Operator

Know who handles your information.

NexaraTech is an independent Canadian software development business specializing in mobile and desktop applications. NexaraTech uses this business name for this website and Kroma. For privacy questions and requests, contact support@nexaratech.ca.

02 · Information handled

Data depends on what you choose.

Kroma can handle these categories for the purposes below:

• Local creator content: videos, images, files, URLs, captions, notes, tags, OCR text, transcripts, publishing records, platform selections, and related metadata. These support saving, organizing, searching, reviewing, exporting, and publishing.
• Connection data: platform account authorization, access or refresh data, and requested publish fields. These support account connection and publishing actions you start.
• Purchase data: purchase history and entitlement status received through Apple or the subscription entitlement service. Apple processes payment details.
• Diagnostic data: limited technical events when you enable diagnostic sharing. These support crash and workflow debugging.
• Support data: your email address, message, selected topic, and device or app details you choose to send. These support replies and privacy requests.

Information comes from you, your device, Apple, connected platforms, and service providers involved in requested features. Kroma does not use advertising identifiers or cross-context behavioral advertising in the reviewed source.

This website stores your light or dark theme choice in browser local storage. Reviewed website source shows no account sign-in, cookie-based analytics, advertising tracker, or website ticket database.

03 · Local app data

Creator content is stored locally.

Kroma stores its catalog in a local SwiftData store and stores media in local CreatorVault directories. Imported media files use AES-GCM encryption. The vault key uses device-only Keychain protection. The local store can contain plaintext metadata such as titles, notes, OCR text, transcripts, source URLs, and publishing records, protected by iOS file protection.

The reviewed source shows no NexaraTech database for the local catalog or private media. Kroma does not upload that local catalog or private media as part of ordinary local use. Device backups and operating-system services can have separate handling outside Kroma’s control.

04 · Platform connections

Connections run when you start them.

Kroma supports direct publishing to YouTube and LinkedIn when account permissions, network access, credentials, and platform state allow it. Kroma also prepares assisted sharing for TikTok, Instagram, X, and Facebook. Assisted sharing hands prepared content to a platform or system share surface. Kroma cannot confirm the final post there.

Account credentials and refresh data used by reviewed flows are stored in the device Keychain. OAuth exchange routes use provider client secrets server-side. Reviewed source shows no database-backed token storage. OAuth requests may still be processed by the exchange provider while the request runs.

A publish or share action can send selected media, caption, tags, and required fields to the platform you selected. That platform then acts as its own data controller under its own policy and terms.

05 · Instagram Direct Publishing

Instagram publishing stays user-initiated.

Kroma supports connecting Instagram professional accounts. When you connect one, Kroma requests instagram_business_basic to identify the connected professional account and instagram_business_content_publish to publish Reels at your request. Instagram publishing is user-initiated: Kroma does not publish unattended Instagram posts. Its scheduling workflow can remind you to complete publishing.

Kroma accesses the Instagram account ID, Instagram username, and the authorization information required for the connection and publishing operation. The Instagram access credential is stored in the macOS Keychain. Kroma's backend temporarily processes credentials for authorized Instagram operations and can process the Instagram account ID; it does not store the access credential.

To let Instagram retrieve a selected video, Kroma temporarily uploads it to private Supabase storage and gives Instagram a time-limited signed URL. The signed URL expires after approximately two hours. Anyone possessing a valid signed URL can access the video while it remains valid, so Kroma shares it with Instagram for the requested publishing operation. Temporary video files are deleted after a confirmed publishing outcome. Unresolved uploads are generally removed through daily cleanup within 24–48 hours.

You can disconnect Instagram in Kroma. Disconnecting removes the credential from your Mac, but does not automatically delete videos saved locally on your Mac. You can also revoke Kroma inside Instagram, which causes Instagram to send a deauthorization notice to Kroma's backend. Kroma then refuses new uploads for the deauthorized account and attempts to remove temporary hosted media.

Instagram data-deletion requests are received at the https://creator-vault-rho-ruby.vercel.app/oauth/instagram/data-deletion callback. Deauthorization notices are received at the https://creator-vault-rho-ruby.vercel.app/oauth/instagram/deauthorize callback. Kroma validates signed Meta requests, removes temporary hosted media through the appropriate deletion process, and returns a confirmation code and a deletion-status link. The status is displayed on a readable web page. Locally stored Mac content is managed by you. Reels already published remain on Instagram.

Certain compliance records retain the raw Instagram account ID. Confirmation codes are stored as irreversible codes. Activity logs use a hashed account identifier. Each record is kept for 90 days. The 90 days are counted from the day we recorded the deauthorization or deletion on your account, from the day we received a deletion request (or, if we completed it, the day we completed it), and from the day an activity log entry was written. Daily cleanup removes eligible records, so a record is removed by the first cleanup after its 90 days have passed, which can be up to about a day later.

A deletion request is normally finished as soon as we receive it. If one is still unfinished after seven days, we close it as not completed, never as complete. The status page then says it could not be completed, and you can email us so we can finish it. Contact support@nexaratech.ca.

06 · Diagnostics

Diagnostics are optional and off by default.

Kroma has a Privacy & Security setting for diagnostic sharing. If you enable it, Kroma may send limited error and workflow events to Sentry for crashes, failed imports, publishing, OAuth, transcription, transcoding, export, deletion, payment, and known action taps.

Payloads use closed event values and approved technical fields such as app version, build, OS version, platform, provider, reason, operation, product or entitlement identifier, result, and duration bucket. The reviewed source disables screenshots, view hierarchy, session replay, automatic breadcrumbs, network breadcrumbs, default personal data, stacktraces, request data, user data, and free-form error text.

Sentry retention depends on the configured Sentry account and provider terms. The website does not promise a fixed Sentry retention period. Diagnostic sharing can be turned off in Kroma settings.

Separately, the Kroma backend may send limited server error events to Sentry when its error-reporting configuration is enabled. This backend reporting is distinct from Kroma's user-controlled diagnostic setting.

07 · Sharing and providers

Limited providers support requested features.

NexaraTech may disclose information to providers only as needed for a requested feature, support, security, legal compliance, or business administration. OpenAI Sites provides hosting infrastructure for this website. Reviewed Kroma providers include Apple, RevenueCat, Supabase, Vercel, Upstash, Sentry, OAuth exchange infrastructure, and connected publishing platforms. Supabase provides private temporary storage for Instagram videos and stores the compliance records used for Instagram deletion and deauthorization handling. Vercel runs the backend functions that process authorized OAuth and Instagram callback operations. Upstash provides short-lived rate-limit counters whose client identifiers are hashed before storage. Providers process information under their own terms and privacy notices.

NexaraTech does not sell personal information or share it for cross-context behavioral advertising in the reviewed app source. Kroma does not use an advertising analytics SDK in the reviewed source.

Providers may process information outside your country. Exact provider locations, transfer mechanisms, and regional retention settings must be confirmed before final publication. NexaraTech may also disclose information when required by law, to protect rights or safety, or during a business transfer, subject to applicable law.

08 · Retention and deletion

Keep data only as long needed.

• Local app data remains until you delete it, clear it, or remove app data.
• OAuth exchange requests are not stored in a reviewed Kroma database.
• Sentry diagnostics follow configured provider retention.
• Apple and RevenueCat purchase records follow their provider retention.
• Support correspondence is kept only as needed for support, security, legal, and recordkeeping purposes. No fixed period is currently verified.

Deleting content in Kroma does not delete copies already sent to a platform, Apple, a provider, a recipient, or a device backup. Ask the relevant provider for deletion where that provider controls the copy.

09 · Privacy rights

Ask for access or control.

Depending on where you live, you may have rights to know what personal information is handled, access it, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and complain to a privacy regulator. You may also have rights against certain automated decisions. Rights vary by region and may have legal limits.

Email a request to support@nexaratech.ca. We may ask for reasonable information to verify the request. Do not send private media, credentials, tokens, or account secrets. Requests are handled within timelines required by applicable law. The reviewed source does not show a separate privacy inbox or appointed data protection officer.

10 · Your controls

Use settings to manage local access.

• Delete saved clips, collections, variants, and publishing records.
• Disconnect connected platform accounts in Settings.
• Clear thumbnail or other local caches.
• Turn diagnostic sharing off at any time.
• Manage or cancel subscriptions through Apple account settings.
• Contact support about privacy questions or data concerns.

11 · Children

Kroma is not directed to children.

Kroma and this website are intended for general audiences and are not directed to children. Do not use Kroma to submit another person’s information without authority. If you believe a child provided personal information, contact support so the request can be reviewed under the law that applies.