Privacy Policy

Nexa Dir · Effective 2026-08-02 · Last updated 2026-10-12

Nexa Dir (the “Software”) is a file explorer published by SosomLab (“we”, “us”). This Privacy Policy explains what data the Software handles, where it is stored, and how you can remove it.

1. Scope by Edition

The Software has been distributed in two editions, and different sections of this policy apply to each. You can check which version you are using in the Software’s information screen or in your package manager.

EditionVersionsSupported OSNetwork communicationApplicable sections
Current edition (cross-platform)v0.23.0 and laterWindows · macOS · LinuxNoneSection 2, Section 3-1, Section 4, Section 6 onward
Windows-only editionv0.22.0 and earlierWindowsOnly if you explicitly connect a cloud accountSection 2, Section 3-2, Section 5 (Cloud Connection), Section 6 onward
  • The current edition has no cloud connection feature and makes no network connection of any kind. License checks are performed offline, by verifying a digital signature on your device. No data reaches us, except when you choose to email us a license request yourself (Section 4).
  • The cloud connection (OneDrive, Google Drive, Dropbox) provisions of the Windows-only edition are retained unchanged in Section 5 and continue to apply to users of that edition.

2. Summary

  • The Software runs entirely on your device. SosomLab operates no server for it and receives no data from it automatically.
  • The Software contains no analytics, telemetry, advertising, tracking, or automatic update check of any kind. Error records and logs stay on your device.
  • The current edition is fully offline. The Windows-only edition makes no network connection unless you explicitly connect a cloud account (see Section 5); when you do, your device communicates directly with that provider (Microsoft, Google, or Dropbox). Nothing is routed through us.
  • The only case in which we receive personal information is when you email us yourself to request a license (Section 4).

3. Data Stored on Your Device

3-1. Current edition (v0.23.0 and later)

The Software stores its files in a single settings folder:

CaseSettings folder
Windows%APPDATA%\nexa-dir
macOS~/Library/Application Support/nexa-dir
Linux~/.config/nexa-dir
Portable useA writable data folder next to the executable, if one already exists
Environment variableThe folder named by NDIR_HOME, if set (takes precedence over the rules above)
ItemContentLocation
SettingsOptions you changed from the defaults (theme, language, columns, toolbar, shortcuts, favorites, etc.)settings.conf
SessionOpen tabs, panel paths, window layoutsession.conf
Your own additionsBulk-rename presets, plugins, icons, new-file templates, and language files you created or addedrenames/, plugins/, icons/, templates/, etc.
LicenseA license file you installed (may contain the licensee’s name and email address)license/
Error recordsOn an abnormal exit: error message, version, OS, and the name of the last command (may include file paths)crash/

If a device administrator has placed a machine-wide license, the Software only reads it (Windows %ProgramData%\nexa\nexa-dir, macOS /Library/Application Support/nexa/nexa-dir, Linux /etc/nexa/nexa-dir).

These files never leave your device. Deleting the settings folder removes all of them permanently. The Software does not store its settings in the Windows registry (the installer registers only the standard information the operating system needs to install and uninstall programs). The contents of the log window are held in memory only and are not written to a file unless you save them yourself.

3-2. Windows-only edition (v0.22.0 and earlier)

The Software stores its working files only in the data\ folder next to the executable:

ItemContentLocation
SettingsOptions you chose (theme, language, columns, toolbar order, etc.)data\settings.cfg
SessionOpen tabs, panel paths, window layoutdata\
Cloud connectionsService type, connection label, and the account display name or email address of a connected cloud accountdata\
Cloud tokensOAuth refresh/access tokens for connected cloud accounts (encrypted with Windows DPAPI, see Section 5-5)data\secrets\cloud<N>.tok

These files never leave your device. Deleting the data\ folder removes all of them permanently. The Software does not write to the Windows registry.

4. License Requests (Current Edition)

The Software is free for personal and other noncommercial use; commercial use requires a license. License checks are performed offline by verifying the digital signature of an installed license file on your device, and no data is transmitted in the process.

To request a license, you generate a request code in the Software’s license screen, copy it to the clipboard, and email it to us yourself ([email protected]). The Software never sends the request code automatically. A request code contains:

ItemContent
Device codePart of a one-way SHA-256 hash of the operating system’s device identifier (Windows MachineGuid, macOS IOPlatformUUID, Linux machine-id). The original identifier is not included
EnvironmentOperating system type, Software version, and date of the request
Name and email addressOnly if you enter them (optional)

When you send the email, we receive the information above together with whatever the email itself contains, such as your email address. We use it solely to issue or reissue licenses and to respond to related inquiries, keep it for as long as needed to manage the license, and do not share it with third parties or use it for marketing or advertising. You may ask us to delete it at any time using the contact in Section 9 (information we are legally required to retain is deleted after that period).

5. Cloud Connection (Windows-only Edition, Optional Feature)

This section applies only to the Windows-only edition (v0.22.0 and earlier). The current edition (v0.23.0 and later) has no cloud connection feature.

The Software offers two separate ways to work with cloud storage.

Link — overlays a sync folder that is already on your PC (OneDrive, Google Drive, or Dropbox desktop client). This is ordinary local file access and involves no network request and no authentication.

Connect — signs in to a cloud provider’s API directly so you can browse and transfer files without a sync client. This is the only feature that transmits data, and it runs only after you start it and complete the provider’s own sign-in screen.

5-1. How sign-in works

Sign-in uses the OAuth 2.0 Authorization Code flow with PKCE. Your browser opens the provider’s own login page; the Software never sees, receives, or stores your password. The provider returns an authorization code to a one-time listener bound to http://127.0.0.1 on your machine only, which is closed immediately after use.

5-2. Permissions requested

ProviderScopes requestedWhy
Microsoft OneDriveFiles.ReadWrite, User.Read, offline_accessBrowse, download, upload, rename, and delete your files; show which account is connected; keep the session alive without repeated sign-in
Google Drivehttps://www.googleapis.com/auth/driveA general-purpose file explorer must be able to list and operate on the files already in your Drive. The narrower drive.file scope exposes only files the app itself created, which cannot serve this purpose
Dropboxfiles.metadata.read, files.metadata.write, files.content.read, files.content.write, account_info.readBrowse, download, upload, rename, and delete your files; show which account is connected

5-3. What the Software does with your cloud data

File names, folder listings, and file contents are read from the provider and shown to you, or transferred as you direct. This data is held in memory and, for transfers, written to the destination you chose. Opening a cloud file by double-click, and copying between two cloud accounts, stage the file in your Windows temporary folder before delivering it.

The Software never sends your cloud file names or contents to SosomLab or to any third party, and does not use them for advertising, profiling, or training artificial-intelligence or machine-learning models. From your account profile it reads only the display name or email address, and uses it solely to label the connection in the interface.

5-4. Limited Use disclosure (Google)

Nexa Dir‘s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5-5. How credentials are protected

Refresh and access tokens are encrypted with Windows DPAPI (CryptProtectData) before being written to data\secrets\. The encryption key is bound to your Windows user account and to that specific machine. Consequently, if you move the portable folder to another PC the tokens cannot be decrypted and you will be asked to sign in again — this is an intentional safeguard, so that a lost USB drive does not expose usable credentials.

All communication with cloud providers uses HTTPS/TLS.

5-6. Withdrawing access

5-7. Using your own Client ID

The Software ships with default OAuth client IDs so that connecting works without setup. You may substitute your own credentials in data\settings.cfg. Doing so changes only which developer registration the provider attributes the requests to; it does not change what data the Software handles or where it is stored.

6. Third-Party Services

When you use the Connect feature of the Windows-only edition, your data is processed by the cloud provider you chose, under that provider’s own privacy policy:

The Software integrates no other external service. When you open a file or run the built-in terminal or another program (a default app, git, etc.) from the Software, that program’s behavior and any communication it makes are governed by its own policies.

7. Children

The Software is a general-purpose desktop utility and is not directed at children. We do not knowingly collect personal information from anyone, including children.

8. Your Rights

Using the Software does not by itself give us any personal information about you. The on-device data described in this policy is under your direct control and can be removed by deleting the relevant files, as described in Sections 3 and 5-6. If you have sent us information in a license request email (Section 4), you may ask us to access, correct, or delete it using the contact in Section 9.

9. Contact

10. Changes to This Policy

If this Privacy Policy is amended, we will post the revised version on this page together with its effective date. Material changes will be announced at least 7 days before they take effect.

11. Revision History

DateChanges
2026-10-12Reflects the cross-platform current edition (v0.23.0 and later · Windows, macOS, Linux): added Scope by Edition (Section 1); separated storage locations by edition (Section 3); added disclosure of the information you send when requesting a license (Section 4); clarified that the cloud connection provisions apply only to the Windows-only edition (v0.22.0 and earlier) (Section 5, content unchanged). No expansion of the data collected or the purposes of use.
2026-08-02Initial version (Windows-only edition).