Privacy is architecture, not policy.

Our principles

Local-first by design

NexxusCRM stores your data on your Mac in an encrypted SQLite database. Your contacts, companies, interactions, reminders, emails, messages and notes live there. Nothing leaves your Mac unless you choose it: an export, a cloud AI model you add, or iPhone sync, which only ever sends data that is already encrypted. The app works offline for everything that does not need the internet, and needs no account.

Encrypted at rest

Your database is encrypted with SQLCipher. It uses AES-256 and checks every page with an HMAC, so a page that has been tampered with is refused rather than read. The key is derived from your passphrase with Argon2id. Your passphrase is never stored and never sent anywhere.

If you turn on Touch ID, the derived key is kept in your macOS Keychain, and the app asks for Touch ID (or your Mac's password) before it reads it. You don't need to type your passphrase every time.

No telemetry

NexxusCRM does not collect usage analytics, crash reports, or any behavioural data from the Mac app or the iPhone app. We have no tracking pixels, no session recording, and no third-party analytics SDKs embedded in either. The one thing the Mac app sends us is the update check below.

Update checks

When the app opens, it asks nexxuscrm.com whether a newer version exists. That request carries four things: the app version, the operating system (macOS), your Mac's processor type (Apple silicon or Intel), and a random install ID.

The install ID is a random number the app makes the first time it runs. It is not tied to your name, your email address, your Mac's serial number or anything in your database. Its only job is to let us count how many copies are in use without counting the same Mac twice. We do not store your IP address with it. The check is then passed on to Vercel, which serves our update information and download files, and like any web host it keeps standard request logs, IP addresses included.

You can turn update checks off in Settings. The app then sends nothing at all, and you can still check by hand when you choose.

No cloud dependency

Apart from the update check above, the app only connects to things you set up: your email provider, your calendars, the feeds you follow, a cloud AI model if you add one, and our sync relay if you turn on iPhone sync. Everything except the relay is a direct connection from your Mac to that service. We are not a proxy. The relay is described below.

What the app reads on your Mac

Each of these is something you switch on. Each is read on your Mac, and none of it is sent to us.

• Email: over IMAP, straight from your Mac to your provider (iCloud, Gmail with an app password, or any IMAP server). Replies you send go out over your provider's SMTP. Mail passwords are kept in your macOS Keychain.
• Calendars: iCloud over CalDAV, with the same app password as your iCloud Mail.
• iMessage and WhatsApp: read from the databases Messages and WhatsApp for Mac already keep on your Mac, with names looked up in your Mac's Contacts. This needs Full Disk Access, which you grant in System Settings. The app only reads these files; it never writes to them.
• Things 3: two way task sync, through AppleScript on your Mac.
• Feeds: RSS and Reddit feeds, fetched directly from their sites.
• LinkedIn: a browser extension passes LinkedIn profiles, messages and jobs to the app over a connection that never leaves your Mac (127.0.0.1), guarded by a secret only the two of them share.

Your AI stays local

The app has no AI until you add a provider. It works with Ollama, any OpenAI compatible server, and Anthropic. Ollama or an OpenAI compatible server counts as local only when it runs on your own Mac; anything else counts as cloud, and Anthropic is always cloud.

Background work such as feed scoring and feed summaries only ever runs on a local model. Email and message text is kept away from cloud models by default: the setting is on until you turn it off, and if no local model is set up, such a task refuses to run rather than fall back to the cloud. If you do add a cloud model and send other tasks to it, such as meeting prep, search questions or followup drafts, the data those tasks need goes to that provider, under its terms.

Search

Search uses Tantivy, a full text search engine that runs inside the app. The index lives in memory only and is rebuilt from your encrypted database after you unlock, so nothing readable is written to disk.

Your data, your export

You can export your contacts, interactions, reminders, feeds, tags and settings as a JSON file, and your contacts as vCard. These exports are not encrypted, so keep them somewhere safe. For everything else there are backups: a .nexxusbackup file holds an encrypted copy of your whole database, made by hand or on a schedule. If you stop using NexxusCRM, your data leaves with you.

The iPhone app and sync

Both are optional. The Mac app works fully without them.

The iPhone app keeps its own SQLCipher database. Its key is made on the phone and kept in the phone's Keychain, on that phone only.

What syncs: people, their email addresses, phone numbers and links, their photos, companies, tags, and your own notes about people. Your email, your messages and everything else stay on your Mac.

Every change is encrypted on your device with XChaCha20-Poly1305 before it leaves, using a sync key made on your Mac. The key reaches your phone in a QR code the phone scans from the Mac's screen. It never comes to us, so we cannot read what you sync, and we cannot recover it either.

What the relay sees

The relay passes encrypted changes between your devices. It runs on a server we operate. It stores:

• an account number, with no name or email address attached;
• for each device: a label (mac or iphone), a hash of its access token, when it was last seen, and whether it has been revoked;
• a hash of the sign up code that made the account, and when it was used;
• your encrypted changes, each with its size, its place in the order, which device sent it and when;
• one encrypted snapshot of your synced data, so a new device can catch up.

It never has your sync key or your passphrase. Like any web server, its logs record the IP address and time of each request. Error reports stay on the same server; they leave out request contents and access tokens.

Stopping sync on the Mac removes the key and the device token from that Mac. The encrypted copy on the relay stays until you ask us to delete it.

On the phone

• Card scan: a business card is read with Apple's text recognition, on the phone.
• Voice notes: what you say is turned into text on the phone, with Apple's on device speech recognition. The recording is never saved. If on device recognition is not available, the app will not record at all.
• Photos: a photo of a person is shrunk on the phone and syncs encrypted, like everything else.

No account required

You don't need to create an account, provide an email address, or authenticate with any external service to use NexxusCRM. The app is unlocked with a local passphrase. iPhone sync needs a sign up code from us, which makes the relay account described above. Downloading the beta does need an email address, so we can send you the link; using the app does not.

Technical architecture

For those who want the details:

• Database: SQLite with SQLCipher, AES-256 with HMAC page authentication, key derived via Argon2id from your passphrase
• Biometric unlock: Derived key stored in macOS Keychain, read only after Touch ID or your Mac's password
• Application: Tauri 2 native macOS app, no Electron
• Search: Tantivy full text search, in memory only, rebuilt after unlock
• AI inference: Ollama, OpenAI compatible servers or Anthropic; background tasks local only; email and messages kept from cloud models by default
• Email: IMAP and SMTP, provider-agnostic, direct device-to-server connection
• Sync: XChaCha20-Poly1305 with a 256 bit key made on your Mac and carried by QR code; the relay stores only ciphertext
• iPhone: SwiftUI app, SQLCipher database, on device text and speech recognition
• Data portability: JSON export, vCard for contacts, encrypted backups of everything

Website privacy

This website (nexxuscrm.com) uses Plausible Analytics, a privacy-focused, cookie-free analytics tool. No personal data is collected. No cookies are set. We don't track you across sites.

If you subscribe to our newsletter, your email is stored with our email provider. You can unsubscribe at any time and your data will be deleted.

If you ask for a beta seat, we store your email, which Mac you have, and what you use today (if you told us), so we can send you the build and the two emails the form describes. Your download link is personal, so when you use it we record that you downloaded the app, when, and which browser you used. The email address is also sent to our email provider, tagged as a beta applicant. Ask us and we will delete all of it.

Contact

Questions about privacy? Email us at hello@nexxuscrm.com.

Last updated: 20 October 2026