Privacy Policy

Nexa SQL · Effective 2026-10-12 · Last updated 2026-10-12

Nexa SQL (the “Software”) is a database SQL client for Windows, macOS, and Linux (a GUI plus the command-line tool nsql) distributed by SosomLab (the “Company”). This Privacy Policy explains what data the Software handles, where it is stored, what goes over the network, and how the Company handles license requests — the only case in which the Company receives personal information.

1. Summary

  • The Software contains no analytics, telemetry, advertising, tracking, or crash reporting of any kind. There is no account sign-up and no automatic update check.
  • The Software connects only to database servers that you specify. SQL statements, result data, and schema information travel only between your PC and that database server; the Company never receives or sees them.
  • The only exception is the Extension Manager. It is off by default, and even when you turn it on it downloads lists and files from extension repositories only when you open the extensions panel or run a refresh or install (Section 4).
  • Saved connection passwords are stored on your device encrypted with ChaCha20-Poly1305 (Section 3).
  • Licenses are verified with an offline file and never contact a server. The Company receives your name, email address, and related data only when you email a license request code yourself (Section 5).

2. Data Stored on Your Device

The Software creates files in your user configuration folder: %APPDATA%\nexa-sql on Windows, ~/Library/Application Support/nexa-sql on macOS, and ~/.config/nexa-sql on Linux. If the NSQL_HOME environment variable is set, that folder is used instead. The GUI and the CLI (nsql) share the same folder.

ItemContentsStorage
SettingsDisplay, editor, grid, execution, logging, and other options (settings.conf)Plain text
Connection profilesProfile name, DBMS type, host, port, database, user name, role (profiles/)Plain text (password excluded)
Connection passwordsOnly when you choose to save themEncrypted (ChaCha20-Poly1305 · Section 3)
Device key32-byte random key used to encrypt passwords (device.key)Windows: protected with DPAPI · macOS/Linux: owner-only file (0600)
Connection-attempt listNames of profiles you have tried to connect with at least once (connected.list) — used to show server status in the connection windowPlain text
Object-name cacheSchemas, object types, and object names of databases you connected to (meta/) — to speed up search and completion on the next launch. File names are hashes; no passwords are storedPlain text
Workspace and edit historyOpen tabs and project state (workspaces/), per-file undo history (undo/), snapshots of unsaved tab contents (backups/files/ · cleaned up after 7 days by default), persisted variables (vars/)Plain text
DDL backup before object dropDDL generated before you drop an object from the explorer (backups/drop/ · setting explorer.drop_backup, on by default)Plain text
License fileOnly if installed (license/) — license ID, licensee name/email, device ID hash, tier, validityPlain text (Ed25519-signed)
Log fileOnly if you set a path in log.file (empty by default = nothing written to disk)Plain text

When launched in folder mode (nexa-sql <folder>), some workspace state such as bookmarks is stored under .nsql/ in that folder.

The execution log and transaction log (statements sent, bind values, elapsed time, row counts) are kept in memory only while the Software runs and are not written to disk unless you specify a log file or copy/export them yourself. Logs, settings, and the transaction log are designed not to record passwords.

None of these files leave your device. You may delete any of them, and deleting the configuration folder removes all data permanently. Uninstalling the Software may not delete the configuration folder automatically.

2-1. Query Results and Your Data

The Software keeps the results of queries you run in memory in order to display them. Exporting results to files (CSV, JSON, etc.) or copying them to the clipboard happens only when you do it, and you are responsible for managing those files. Data in your database servers and query results are never sent to the Company.

3. Protection of Connection Passwords

  • When you save a password in a connection profile, only the password is sealed with ChaCha20-Poly1305 and written to the profile file. The seal is bound to the profile name, so ciphertext moved from one profile to another will not open.
  • The sealing key derives from device.key. On Windows this key is protected with DPAPI (CryptProtectData, scoped to the current Windows account), so it can be unlocked only by the same Windows account; copying the folder to another PC or account will not open it. On macOS and Linux the key is kept in an owner-readable-only file (permission 0600). The Software does not integrate with the operating system keychain.
  • Therefore, on macOS and Linux, if the whole configuration folder is leaked, the saved passwords can be opened with the device.key in the same folder. This scheme protects against leaks of profile files alone; it does not protect against an attacker who has access to your user account or device.
  • Passwords you do not save are kept, for reconnection, only in memory during the session, encrypted with a random key, and are never written to disk.

4. Network Communication

4-1. Database Servers You Specify

The Software connects to the database servers (Oracle, SQL Server, PostgreSQL) you specify in a connection profile or on the command line, sends credentials and SQL statements, and receives results. SQLite is a local file and uses no network. While the connection window is open, the Software also attempts a TCP connection only (no login) to the host and port of profiles you have tried to connect with at least once, to show whether the server is reachable. All of these communications go to servers you specified; the Company receives none of their contents by any route.

Encryption in transit depends on the DBMS and server configuration. SQL Server uses TLS (full session or login only, via the mssql.encrypt setting); Oracle follows the Oracle Instant Client you installed and its network configuration. In the current version, PostgreSQL connections do not support TLS and are transmitted in plain text. On untrusted networks, please use a VPN, SSH tunnel, or similar.

4-2. Extension Manager (Optional · Off by Default)

The Extension Manager setting extensions.enabled is off by default, and while it is off the Software contacts no extension repository. Even when you turn it on, the Software downloads the following with the operating system’s curl only when you open the extensions panel or run a refresh or install. There is no automatic or periodic lookup.

  • Official extension repository: https://raw.githubusercontent.com/SosomLab/nexa-sql/main/extensions (hosted by GitHub)
  • Any separate address specified by an extension file (e.g., a GitHub Releases asset)
  • Repositories you add yourself (extensions.repositories)

These are GET requests only, reading the index (index.json) and extension files; no user data is sent. As with any web request, however, the party hosting the repository (such as GitHub) can see your IP address and the time of the request, subject to that host’s policies. Downloaded files are verified with SHA-256 before installation, and code extensions run in a sandbox (WASM).

4-3. Other Communication

Apart from the above, the Software does not communicate over the internet. There is no license check, update check, or usage reporting.

5. Personal Information Processed for License Requests

The Software can be used with all features for personal and noncommercial purposes without a license (the license feature-gate setting license.gates is off by default). Only users who want a license file go through the procedure below, and this is the only case in which the Company receives personal information.

5-1. How It Works

You create a request code in the Software (Help ▸ License) or with nsql license request, and you send it yourself by email to [email protected]. The Software sends nothing automatically.

5-2. Items Processed

ItemContents
Name and email addressThe values you enter in the request code, and the address you send the email from
Device ID hashA 20-byte value obtained by hashing the operating system’s machine identifier (Windows MachineGuid · macOS IOPlatformUUID · Linux machine-id) with SHA-256 and a domain tag. The original identifier is not included in the request code and cannot be derived from the hash
Request metadataApp version, operating system type, request date
Email contentsAnything you add in the email body (organization, intended use, etc.)
Paid (commercial) licensesInformation needed for the contract and payment (purchaser, organization, order details, etc.) — explained separately in that transaction

5-3. Purposes

  • Issuing and reissuing a license file bound to your PC (adding, replacing, or renewing devices)
  • Keeping an issuance record (a ledger of license ID, device ID hash, licensee, and issue date) and verifying reissue requests after loss
  • Responding to license-related inquiries

This information is not used for advertising or marketing and is not sold or provided to third parties, except where required by law.

5-4. Retention

The information is kept for as long as needed to issue and manage the license (the license validity period and the period for handling reissues), and is deleted without delay upon your request. Information that applicable law requires to be retained for a certain period (e.g., contract and payment records of paid transactions) is kept for that period. After deletion, verifying a reissue for that license may be difficult.

5-5. Processors and International Transfer

Because license requests arrive by email, their contents are stored on the servers of the email service provider used by the Company. The Company does not otherwise outsource processing or provide the information to third parties.

6. Third-Party Components

The Software uses no third-party analytics, advertising, or crash-reporting services. Oracle connections use the Oracle Instant Client that you install separately, whose behavior and data handling follow Oracle’s policies. The curl used by the Extension Manager is a tool included with the operating system, and third-party extensions you install are the responsibility of their authors.

7. Children

The Software is a tool for database professionals and is not directed at children. The Company does not knowingly collect personal information from children.

8. Your Rights

  • All data described in Sections 2–4 resides on your device under your control, and you can delete it yourself. The Company has no access to it.
  • For information you sent to the Company for a license (Section 5), you may request access, correction, deletion, or suspension of processing. Contact us below and we will act on your request without delay after verifying your identity.

9. Contact

10. Changes to This Policy

If this Privacy Policy changes, the revised text and its effective date will be posted on this page. Material changes — in particular, if the Software begins any new network communication or the scope of personal information processed by the Company expands — will be announced at least 7 days before they take effect.