Privacy Policy
Nexa Dir (the “Software”) is a file explorer published by SosomLab (“we”, “us”). This Privacy Policy explains what data the Software handles, where it is stored, and how you can remove it.
1. Scope by Edition
The Software has been distributed in two editions, and different sections of this policy apply to each. You can check which version you are using in the Software’s information screen or in your package manager.
| Edition | Versions | Supported OS | Network communication | Applicable sections |
|---|---|---|---|---|
| Current edition (cross-platform) | v0.23.0 and later | Windows · macOS · Linux | None | Section 2, Section 3-1, Section 4, Section 6 onward |
| Windows-only edition | v0.22.0 and earlier | Windows | Only if you explicitly connect a cloud account | Section 2, Section 3-2, Section 5 (Cloud Connection), Section 6 onward |
- The current edition has no cloud connection feature and makes no network connection of any kind. License checks are performed offline, by verifying a digital signature on your device. No data reaches us, except when you choose to email us a license request yourself (Section 4).
- The cloud connection (OneDrive, Google Drive, Dropbox) provisions of the Windows-only edition are retained unchanged in Section 5 and continue to apply to users of that edition.
2. Summary
- The Software runs entirely on your device. SosomLab operates no server for it and receives no data from it automatically.
- The Software contains no analytics, telemetry, advertising, tracking, or automatic update check of any kind. Error records and logs stay on your device.
- The current edition is fully offline. The Windows-only edition makes no network connection unless you explicitly connect a cloud account (see Section 5); when you do, your device communicates directly with that provider (Microsoft, Google, or Dropbox). Nothing is routed through us.
- The only case in which we receive personal information is when you email us yourself to request a license (Section 4).
3. Data Stored on Your Device
3-1. Current edition (v0.23.0 and later)
The Software stores its files in a single settings folder:
| Case | Settings folder |
|---|---|
| Windows | %APPDATA%\nexa-dir |
| macOS | ~/Library/Application Support/nexa-dir |
| Linux | ~/.config/nexa-dir |
| Portable use | A writable data folder next to the executable, if one already exists |
| Environment variable | The folder named by NDIR_HOME, if set (takes precedence over the rules above) |
| Item | Content | Location |
|---|---|---|
| Settings | Options you changed from the defaults (theme, language, columns, toolbar, shortcuts, favorites, etc.) | settings.conf |
| Session | Open tabs, panel paths, window layout | session.conf |
| Your own additions | Bulk-rename presets, plugins, icons, new-file templates, and language files you created or added | renames/, plugins/, icons/, templates/, etc. |
| License | A license file you installed (may contain the licensee’s name and email address) | license/ |
| Error records | On an abnormal exit: error message, version, OS, and the name of the last command (may include file paths) | crash/ |
If a device administrator has placed a machine-wide license, the Software only reads it (Windows %ProgramData%\nexa\nexa-dir, macOS /Library/Application Support/nexa/nexa-dir, Linux /etc/nexa/nexa-dir).
These files never leave your device. Deleting the settings folder removes all of them permanently. The Software does not store its settings in the Windows registry (the installer registers only the standard information the operating system needs to install and uninstall programs). The contents of the log window are held in memory only and are not written to a file unless you save them yourself.
3-2. Windows-only edition (v0.22.0 and earlier)
The Software stores its working files only in the data\ folder next to the executable:
| Item | Content | Location |
|---|---|---|
| Settings | Options you chose (theme, language, columns, toolbar order, etc.) | data\settings.cfg |
| Session | Open tabs, panel paths, window layout | data\ |
| Cloud connections | Service type, connection label, and the account display name or email address of a connected cloud account | data\ |
| Cloud tokens | OAuth refresh/access tokens for connected cloud accounts (encrypted with Windows DPAPI, see Section 5-5) | data\secrets\cloud<N>.tok |
These files never leave your device. Deleting the data\ folder removes all of them permanently. The Software does not write to the Windows registry.
4. License Requests (Current Edition)
The Software is free for personal and other noncommercial use; commercial use requires a license. License checks are performed offline by verifying the digital signature of an installed license file on your device, and no data is transmitted in the process.
To request a license, you generate a request code in the Software’s license screen, copy it to the clipboard, and email it to us yourself (kiros33@sosomlab.com). The Software never sends the request code automatically. A request code contains:
| Item | Content |
|---|---|
| Device code | Part of a one-way SHA-256 hash of the operating system’s device identifier (Windows MachineGuid, macOS IOPlatformUUID, Linux machine-id). The original identifier is not included |
| Environment | Operating system type, Software version, and date of the request |
| Name and email address | Only if you enter them (optional) |
When you send the email, we receive the information above together with whatever the email itself contains, such as your email address. We use it solely to issue or reissue licenses and to respond to related inquiries, keep it for as long as needed to manage the license, and do not share it with third parties or use it for marketing or advertising. You may ask us to delete it at any time using the contact in Section 9 (information we are legally required to retain is deleted after that period).
5. Cloud Connection (Windows-only Edition, Optional Feature)
This section applies only to the Windows-only edition (v0.22.0 and earlier). The current edition (v0.23.0 and later) has no cloud connection feature.
The Software offers two separate ways to work with cloud storage.
Link — overlays a sync folder that is already on your PC (OneDrive, Google Drive, or Dropbox desktop client). This is ordinary local file access and involves no network request and no authentication.
Connect — signs in to a cloud provider’s API directly so you can browse and transfer files without a sync client. This is the only feature that transmits data, and it runs only after you start it and complete the provider’s own sign-in screen.
5-1. How sign-in works
Sign-in uses the OAuth 2.0 Authorization Code flow with PKCE. Your browser opens the provider’s own login page; the Software never sees, receives, or stores your password. The provider returns an authorization code to a one-time listener bound to http://127.0.0.1 on your machine only, which is closed immediately after use.
5-2. Permissions requested
| Provider | Scopes requested | Why |
|---|---|---|
| Microsoft OneDrive | Files.ReadWrite, User.Read, offline_access | Browse, download, upload, rename, and delete your files; show which account is connected; keep the session alive without repeated sign-in |
| Google Drive | https://www.googleapis.com/auth/drive | A general-purpose file explorer must be able to list and operate on the files already in your Drive. The narrower drive.file scope exposes only files the app itself created, which cannot serve this purpose |
| Dropbox | files.metadata.read, files.metadata.write, files.content.read, files.content.write, account_info.read | Browse, download, upload, rename, and delete your files; show which account is connected |
5-3. What the Software does with your cloud data
File names, folder listings, and file contents are read from the provider and shown to you, or transferred as you direct. This data is held in memory and, for transfers, written to the destination you chose. Opening a cloud file by double-click, and copying between two cloud accounts, stage the file in your Windows temporary folder before delivering it.
The Software never sends your cloud file names or contents to SosomLab or to any third party, and does not use them for advertising, profiling, or training artificial-intelligence or machine-learning models. From your account profile it reads only the display name or email address, and uses it solely to label the connection in the interface.
5-4. Limited Use disclosure (Google)
Nexa Dir‘s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5-5. How credentials are protected
Refresh and access tokens are encrypted with Windows DPAPI (CryptProtectData) before being written to data\secrets\. The encryption key is bound to your Windows user account and to that specific machine. Consequently, if you move the portable folder to another PC the tokens cannot be decrypted and you will be asked to sign in again — this is an intentional safeguard, so that a lost USB drive does not expose usable credentials.
All communication with cloud providers uses HTTPS/TLS.
5-6. Withdrawing access
- In the Software: Cloud → {account} → Disconnect. The stored tokens are deleted at the same time.
- Deleting
data\secrets\removes all stored tokens. - You can also revoke the Software’s access from the provider’s own account settings, which takes effect regardless of the state of your device. If you have moved from the Windows-only edition to the current edition, access you granted earlier can still be revoked on these pages:
- Microsoft — https://account.live.com/consent/Manage
- Google — https://myaccount.google.com/permissions
- Dropbox — https://www.dropbox.com/account/connected_apps
5-7. Using your own Client ID
The Software ships with default OAuth client IDs so that connecting works without setup. You may substitute your own credentials in data\settings.cfg. Doing so changes only which developer registration the provider attributes the requests to; it does not change what data the Software handles or where it is stored.
6. Third-Party Services
When you use the Connect feature of the Windows-only edition, your data is processed by the cloud provider you chose, under that provider’s own privacy policy:
The Software integrates no other external service. When you open a file or run the built-in terminal or another program (a default app, git, etc.) from the Software, that program’s behavior and any communication it makes are governed by its own policies.
7. Children
The Software is a general-purpose desktop utility and is not directed at children. We do not knowingly collect personal information from anyone, including children.
8. Your Rights
Using the Software does not by itself give us any personal information about you. The on-device data described in this policy is under your direct control and can be removed by deleting the relevant files, as described in Sections 3 and 5-6. If you have sent us information in a license request email (Section 4), you may ask us to access, correct, or delete it using the contact in Section 9.
9. Contact
- Email: kiros33@sosomlab.com
10. Changes to This Policy
If this Privacy Policy is amended, we will post the revised version on this page together with its effective date. Material changes will be announced at least 7 days before they take effect.
11. Revision History
| Date | Changes |
|---|---|
| 2026-10-12 | Reflects the cross-platform current edition (v0.23.0 and later · Windows, macOS, Linux): added Scope by Edition (Section 1); separated storage locations by edition (Section 3); added disclosure of the information you send when requesting a license (Section 4); clarified that the cloud connection provisions apply only to the Windows-only edition (v0.22.0 and earlier) (Section 5, content unchanged). No expansion of the data collected or the purposes of use. |
| 2026-08-02 | Initial version (Windows-only edition). |