1. Who operates the project
NexaCloudHub is independently operated under the public name Vlad D., based in Romania. Contact: contact@nexacloudhub.com.
This policy covers ORA Calendar on Windows, Android and the browser Calendar hosted at NexaCloudHub. Local native use and optional account synchronization are distinct data flows. This notice distinguishes information processed locally by the application from information received by NexaCloudHub through a hosted service or support request.
2. Local calendar and native apps
Events and tasks can contain titles, dates and times, category, location, notes, completion state and synchronization metadata. Native apps store the calendar and pending changes locally, together with account-specific profiles and recovery copies. View preferences and reminder history are device-specific.
Windows protects the saved account session token using Windows DPAPI. Android protects its saved session token using Android Keystore-backed encryption. Calendar content files, exports and user-created backups are not all encrypted merely because session tokens are protected. You can use the native local calendar without an account; doing so does not upload it to the sync service.
3. Accounts and synchronization
Account creation uses a username and password. The server stores a password hash, session records and request-security metadata. Connecting an account sends calendar changes for synchronization and retrieves authorized data for that account. Item content is encrypted in the server database using a server-held key; the service can decrypt it to operate. This is not end-to-end encryption.
Synchronizing includes stable item identifiers, revisions, operation IDs, deletion markers and conflict copies where necessary to reconcile devices. Connecting a native app can join existing local plans to that account. On a new device, Load sync brings in existing account data; new changes may already be saved after sign-in.
4. Browser sessions and cache
The browser service uses an authentication cookie scoped to /calendar, with a lifetime of up to 30 days, and an account-specific local-storage cache and synchronization queue. Logout revokes the session and clears that browser account cache; it does not erase the account’s server data. Security controls or logout can end access before a token expires.
Windows and Android can retain a separate local account profile at logout so reconnecting can restore it. Device-local data, browser cache, hosted data and exported files are separate copies. Do not clear a local copy containing unsent changes before syncing or saving a usable export.
5. Reminders and exports
The Windows reminder engine processes dates and completion state locally to display reminders and play its notification sound while ORA is running. Android and the browser edition described here do not provide that Windows reminder behavior. Changes on them affect Windows reminders after synchronization.
PNG, PDF and calendar backups are created from the plans you select and saved to the destination you choose. Local preview and export do not require uploading the generated document for rendering. Sharing an exported file discloses its contents, including notes if selected, to whoever receives it.
6. Why data is processed
Data is used to provide the functions you request, maintain access and synchronization, respond to support messages and protect services against misuse. Where GDPR applies, the relevant grounds are performance of the requested service or steps you ask for before using it; legitimate interests in security, maintenance and handling correspondence; consent where an optional processing activity requires it; and compliance with applicable legal obligations. An operating-system permission or an OAuth authorization is a technical permission and is not, by itself, the legal basis for every processing activity.
8. Retention and data controls
Local calendars, recovery copies and profiles remain until removed through the app or device controls. Hosted account data remains while the account is used, until records are removed or account closure is handled, subject to limited necessary retention. Session expiry ends access rather than erasing the calendar. To request account closure or erasure of data held by NexaCloudHub, contact contact@nexacloudhub.com and identify the account; this version has no self-service account-deletion control.
Deleting an event can leave synchronization markers and operation history needed to reconcile devices. Undo and conflict copies may preserve related content. Backups, if made, can retain earlier records until replaced or removed and are separate from live deletion. Security/operational information and support messages are retained for the time needed for service protection, the issue concerned or a legal obligation. Ask the operator for the current hosted-backup and operational-retention arrangements.
9. Your rights and requests
Where GDPR applies, you may request access, correction, erasure, restriction or portability of your personal data, subject to the conditions of those rights. You may object to processing based on legitimate interests and withdraw consent for consent-based processing without affecting earlier lawful processing. Contact contact@nexacloudhub.com and identify the service and account concerned. We may ask for proportionate information to verify the request; do not send passwords, access tokens or your entire mailbox.
Requests are handled within the applicable legal time limits, normally within one month; an extension may apply to complex or multiple requests, with an explanation. You may complain to a competent supervisory authority, including Romania’s ANSPDCP. These projects do not make solely automated decisions intended to produce legal or similarly significant effects about you.
10. Contact and changes
NexaCloudHub is independently operated under the public name Vlad D., based in Romania. Contact: contact@nexacloudhub.com.
For privacy questions, rights requests or security concerns, use the contact address above and name the relevant project. This notice may change when features or processing change. The revision date identifies the version; a material new use of data will be explained before it begins, with a new choice where required.