What stays on your device.

01 · At a glance

The short version.

• Kroma keeps your media library on your device. We do not run a database of your clips, collections or captions.
• Data leaves your device when you choose to publish, share, export, connect an account, or contact us.
• We do not sell personal information, show ads, or use advertising trackers.
• Kroma for Mac posts to TikTok only when you press Post, with the visibility and settings you choose.
• Crash and error reporting on iPhone and iPad is off by default and only runs if you turn it on. Kroma for Mac does not include it.
• This website uses hosting-managed cookies, may use browser session storage for navigation recovery, and stores cookie preferences in this browser.
• You can ask us to access, correct, or delete your information at any time.

02 · Who we are

NexaraTech is responsible for your information.

NexaraTech is an independent software studio based in Ontario, Canada. We are responsible for personal information handled through this website, our support, and our apps. Apple, connected platforms and our service providers handle some information under their own policies, as explained below.

The person accountable for privacy at NexaraTech is the studio’s founder, who can be reached at support@nexaratech.ca. Please put “Privacy” in the subject line so your message is routed correctly.

03 · This website

Hosting cookies and browser storage.

Our hosted website uses Cloudflare security services. Cloudflare documents __cf_bm for bot protection and cf_clearance for security challenge clearance. These cookies are managed by hosting and security services, not by this website’s preference panel, and may be set before that panel appears.

We have also observed a host-only cookie named __Host-appgarden-visitor on pages delivered through OpenAI Sites. Independent site notices associate it with hosting and sometimes discuss possible visitor identification or measurement, but do not verify its purpose on this website. OpenAI’s Sites documentation says the platform records traffic and provides site owners with unique-visitor and page-view metrics; it does not say whether this cookie is used for those metrics. OpenAI has not confirmed this cookie’s exact purpose, retention period, or available controls in the documentation we reviewed. We do not classify it as essential or optional.

The site framework may use browser session storage in limited navigation-recovery cases. The cookie preference panel stores the choice you make in this browser’s local storage when browser storage is available; otherwise, it may not persist after your current visit. It does not control hosting-managed cookies. The website application currently has no optional analytics or advertising technologies enabled and does not offer sign-in. Our hosting provider also receives standard request information, such as IP address, browser type and the page requested, to deliver pages and protect the site from abuse. See the ChatGPT Sites documentation on traffic analytics.

The support form on this website does not send or store anything. It builds an email in your own mail app, and nothing reaches us until you press Send there.

04 · Support requests

What you send, we use to help.

When you email us, we receive your email address, your message, and any details you choose to include, such as your device, operating system, app version, or screenshots. We use this only to reply, fix problems, and handle privacy requests.

Please do not send private media, passwords, authentication tokens, recovery codes, or account secrets. We never need them to help you.

05 · Kroma Creator Vault

Your creator library stays on your device.

Kroma can handle the following, depending on the features you use:

• Your content: videos, images, files, links, captions, notes, tags, text recognised in images (OCR), transcripts, collections, and publishing records. Used to save, organise, search, export, and publish your work.
• Platform connection data: the access granted when you connect an account, and the basic profile details listed in section 06. Used to show which account you are connected to and to publish when you ask.
• Purchase data: your subscription status and an anonymous app user identifier. Used to unlock the features you paid for and restore purchases.
• Diagnostics (optional): limited technical events, only if you turn diagnostic sharing on. Used to find and fix crashes and failed actions.

Stored on your device

Kroma stores its catalogue in a local database and your media in its own storage on the device. Imported media files are encrypted with AES-GCM, using a key held in the device Keychain that never leaves the device. Titles, notes, recognised text, transcripts, links and publishing records are protected by iOS file protection. Kroma does not upload your library to NexaraTech. Device backups you make, such as iCloud backups, are handled by Apple under its own terms.

Analytics (Kroma 1.4 and later)

Kroma’s analytics are built on your device from your own publishing history. If you connect TikTok, they also include the public counts for your TikTok videos described in section 06. Analytics are not sent to NexaraTech.

Purchases

Apple processes all payments; we never see your card details. Kroma uses RevenueCat to confirm subscription status. RevenueCat receives an anonymous app user identifier and your purchase and subscription history from Apple, not your name or email.

Diagnostics (iPhone and iPad)

Diagnostic sharing is off by default and can be turned on or off in Kroma’s Privacy & Security settings. When it is on, Kroma sends limited events to Sentry about crashes and failed imports, publishing, sign-ins, transcription, export, deletion, and purchases. Events contain technical values only, such as app and OS version, the action and its result. Screenshots, screen recordings, view layouts, network details, your content, and free-text error messages are excluded.

No account required

Kroma does not require a NexaraTech account, so there is no account to create or delete. You can remove all Kroma data from your device by deleting it in the app or deleting the app.

Kroma for Mac

Kroma for Mac is in development. Version 1.0 handles information as described above for Kroma, with these differences:

• Storage: your library is kept in Kroma’s own sandboxed storage on your Mac. Imported media files are encrypted with AES-GCM, using a key held in your Mac’s Keychain. Kroma can open only the files and folders you choose to import into it or export to.
• Publishing: Kroma for Mac 1.0 connects to TikTok only, and posts directly to your TikTok account when you press Post. Section 06 explains what this involves.
• Diagnostics: Kroma for Mac 1.0 does not include Sentry or any other crash or error reporting service.
• App settings: Kroma for Mac downloads a small settings file from our server that turns features on or off. The request contains no account, device or advertising identifier. Like any web request, our host receives your IP address in order to deliver it.

06 · Connected platforms

Connections run only when you start them.

On iPhone and iPad, you can connect YouTube and LinkedIn to publish directly from Kroma. On Mac, you can connect TikTok to post directly from Kroma for Mac. Sign-in credentials and access tokens are stored in your device’s Keychain. For LinkedIn and TikTok, the sign-in exchange, and for TikTok also disconnecting, passes through our server so that our private app keys stay off your device. That server does not store your tokens or profile. To prevent abuse, it keeps a short-lived request counter keyed to a one-way hash of your IP address, and it may report server errors to Sentry. When you publish, Kroma sends the media, caption and settings you chose to that platform, which then handles it under its own terms and privacy policy.

On iPhone and iPad, TikTok, Instagram, X and Facebook use assisted sharing: Kroma prepares your post and opens Apple’s share sheet, where you choose the app to post with. You then choose the post’s visibility and publish it in that app. Kroma cannot confirm whether the post was published there.

YouTube

Kroma uses YouTube API Services. When you connect YouTube, Kroma asks Google for permission to upload and manage videos on your channel. It uses that permission only to upload the videos you choose, with the title, description and privacy setting you set, and to check their upload status. Kroma does not share YouTube data with anyone else.

By using YouTube features in Kroma, you agree to the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy. You can disconnect YouTube in Kroma’s settings at any time, and revoke Kroma’s access from your Google security settings.

LinkedIn

When you connect LinkedIn, Kroma receives your name, email address, profile photo and LinkedIn member identifier, and permission to post on your behalf. These are kept on your device to show the connected account and to publish the posts you create. You can disconnect in Kroma’s settings, which deletes the stored connection from your device, and remove Kroma under Permitted services in your LinkedIn settings.

TikTok

On iPhone and iPad, posting to TikTok uses assisted sharing: you choose TikTok in Apple’s share sheet and finish publishing in the TikTok app. If you connect your TikTok account, Kroma receives your TikTok account identifier, display name and profile photo. From Kroma 1.4, it can also read your list of TikTok videos for analytics: their titles, length and public counts such as views, likes, comments and shares. These counts are held in memory for a few minutes to display them and are not stored on your device or sent to us. You can disconnect in Kroma’s settings and remove Kroma under Manage app permissions in TikTok’s security settings.

On Mac, Kroma for Mac 1.0 posts directly to TikTok using TikTok’s Login Kit and Content Posting API. To connect, you sign in on TikTok’s own page in your browser, which then returns you to Kroma through a temporary address on your Mac (127.0.0.1). Kroma asks TikTok for two permissions only:

• Basic profile (user.info.basic): your TikTok account identifier, display name and profile photo, used to show which account is connected.
• Post videos (video.publish): permission to post the videos you choose to your TikTok profile.

Each time you prepare a post, Kroma asks TikTok for your current creator details: your nickname and username, profile photo, the visibility options your account allows, whether comments, Duets and Stitches are turned off in your TikTok settings, and the longest video you can post. Kroma uses them to show which account you are posting to and to offer only the choices TikTok allows. When you press Post, Kroma uploads the video file directly from your Mac to TikTok, with the caption and settings you chose. It then checks with TikTok whether the post has finished processing, and keeps the TikTok post identifier and its status in the publishing history on your Mac.

Kroma uses TikTok data only to connect your account and publish what you ask. It is not sent to NexaraTech, used for advertising or profiling, sold, or shared with anyone else. Disconnecting TikTok in Kroma for Mac deletes its tokens and profile details from your Mac and asks TikTok to revoke Kroma’s access. You can also remove Kroma under Manage app permissions in TikTok’s security settings. TikTok handles the content you post under its Terms of Service and Privacy Policy.

Deleting platform data

Disconnecting a platform in Kroma deletes its tokens and profile details from your device straight away. If you would like us to confirm that no platform data is held anywhere on our side, email support@nexaratech.ca. Posts you already published remain on that platform until you delete them there.

07 · Apps in design

VEYRA Media Vault and ReceiptWise.

VEYRA Media Vault and ReceiptWise are not released and collect no personal information. Before either app is released, this policy will be updated to describe exactly what it handles. Kroma for Mac, also in development, is covered in sections 05 and 06.

08 · Purposes and legal bases

Why we handle information.

We use personal information only for the purposes in this policy and do not repurpose it for anything unrelated without telling you and, where required, asking first. Where the EU or UK GDPR applies, we rely on these legal bases:

• Providing the app and features you ask for, including publishing and purchases: performance of our contract with you.
• Optional diagnostics: your consent, which you can withdraw in settings at any time.
• Answering support and privacy requests: our legitimate interest in helping you, and our legal obligations for privacy requests.
• Security, fraud prevention and protecting the website: our legitimate interests.
• Meeting tax, legal and regulatory requirements: legal obligation.

We do not make decisions about you based solely on automated processing.

09 · Sharing and providers

We share only what a feature needs.

We share personal information only with:

• Apple: App Store distribution, payments, and refunds.
• RevenueCat: subscription status.
• Sentry: optional diagnostics on iPhone and iPad, only if you turn them on. Data stored in the United States.
• Vercel: hosts the server that completes LinkedIn and TikTok sign-ins, disconnects TikTok, and serves Kroma for Mac’s settings file, in Washington, D.C., United States.
• Upstash: short-lived, hashed rate-limit counters on that server.
• Our website host and email provider: delivering this website and our support mail.
• Platforms you connect (YouTube, LinkedIn, TikTok): when you publish to them.

Our providers may use the information only to provide their service to us. We may also disclose information where the law requires it, to protect people’s rights, safety or property, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply.

NexaraTech does not sell personal information or share it for cross-context behavioural advertising.

10 · International processing

Information may be processed outside your country.

We are based in Canada. Our sign-in server (Vercel) and diagnostics (Sentry) are located in the United States, and other providers, such as Apple and RevenueCat, also process information in the United States and other countries. Your information may therefore be stored or processed outside the country where you live, where it may be accessible to courts, law enforcement and national security authorities under local law. Where the EU or UK GDPR applies, we rely on adequacy decisions or standard contractual clauses offered by our providers to protect information transferred out of the EU or UK.

11 · Retention

We keep information only as long as needed.

• Data on your device, including publishing history and TikTok post identifiers on Mac, stays until you delete it in Kroma or delete the app.
• Platform tokens stay on your device until you disconnect or delete the app. Our sign-in server does not keep them, and its hashed rate-limit counters expire within minutes.
• Support emails are kept for 12 months after your last message, unless needed longer for an open issue or a legal claim.
• Records of privacy requests and security incidents are kept for at least 24 months, as Canadian law requires for incident records.
• Diagnostics are kept by Sentry for its standard retention period, then deleted.
• Purchase records are kept by Apple and RevenueCat under their own retention rules.

Deleting content in Kroma does not delete copies you already published, shared, or exported, or copies in device backups. Delete those where they are stored.

12 · Security and breaches

Protection proportionate to sensitivity.

We protect information with measures suited to its sensitivity, including on-device encryption, Keychain storage for credentials, encrypted connections, and limiting who can access support mail. No system is perfectly secure.

If a security incident affects personal information, we will contain it, assess the risk, and keep a record of it. Where there is a real risk of significant harm, or where the law otherwise requires, we will notify the people affected and the relevant authorities, such as the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or an EU or UK data protection authority.

13 · Privacy rights

Ask for access or control.

Wherever you live, you can ask us what personal information we hold about you, how we use it and who we have shared it with, and ask us to correct or delete it. You can withdraw consent, for example by turning diagnostics off, at any time.

Canada, including Quebec

You have rights of access and correction under federal and provincial privacy law. In Quebec, you can also ask for a copy of your information in a structured, commonly used format, and be informed about any automated decisions. We use none.

European Union and United Kingdom

You also have rights to data portability, to restrict or object to processing, and to complain to your local data protection authority.

United States

Depending on your state, you may have rights to know, access, correct, and delete your information, and to appeal our decision on a request by replying to it. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of.

How to make a request

Email support@nexaratech.ca with “Privacy” in the subject line. We may ask for information to verify your request, and we will reply within 30 days, or sooner where the law requires. Requests are free. Because Kroma keeps your library on your device, much of your information can only be viewed or deleted there, and we will explain how.

14 · Children

Our apps are not directed to children.

Kroma Creator Vault is intended for people aged 16 and older. Our other apps are not intended for children under 13. Connected platforms and features may have additional age and eligibility requirements. We do not knowingly collect personal information from people under 16 through Kroma Creator Vault, or from children under 13 through our other apps. If you believe someone below the applicable minimum age has provided personal information to us, contact us and we will delete it.

15 · Changes

We will tell you about important changes.

We will post any update here and change the date above. If a change materially affects how we handle your information, we will give notice on this website, and in the app where practical, before it takes effect.