Legal

Privacy notice

Last updated 4 October 2026

1. Who we are

This site is run by Sergey Nechaev, a sole trader in New South Wales, Australia, under the registered business name nuclr.dev (ABN 54 906 218 088) - "Nuclr", "we" and "us" in this notice. We decide what happens to the information below, so we are the data controller for it.

Privacy questions, requests and complaints: [email protected]. Email is the only contact channel we publish.

2. What this notice covers

It covers the nuclr.dev website and the downloads.nuclr.dev download host - including the requests the Nuclr Commander desktop application makes to those services, because those requests reach our servers.

It does not describe what the Nuclr Commander application does on your own computer. That is covered by the privacy document supplied with the download, and it is the document to read if you want to know what the software does locally or which other parties it contacts. This notice also does not cover third-party sites we link to, such as GitHub.

This notice is about personal information. The terms for using this website are in the website terms of use; the terms for using the software are in the licence agreement supplied with the download.

3. Information we collect

3.1 Feedback you send us

When you submit the form at /commander/feedback.html we store:

Please don't put passwords, keys, or other sensitive material into the message - if you need to report a security issue, email [email protected] instead.

3.2 Requests our services receive from the application

Nuclr Commander contacts our services to:

• check the latest published version, when update checking is enabled;
• download a new version, if you choose to update;
• fetch the signed plugin blacklist; and
• send optional usage analytics, but only after you allow them in Commander.

These requests carry no account, licence key or device identifier - but, like any network request, they reveal your IP address, the time, and your client's user agent, which appear in our server logs. They tell us nothing about your files: not their contents, names, paths, sizes, or which directories you opened.

When feedback or a user-initiated Commander download is announced to our team, we send the source IP address to MaxMind's country-level GeoIP service. MaxMind returns an approximate country. We keep that result in memory for up to 24 hours to avoid repeat lookups; Slack receives the country but not the IP address. Automated updater downloads, aggregate analytics summaries and release-system notifications do not trigger this lookup.

3.3 Error reports

When Nuclr Commander hits an unexpected error it offers to send us a report about it. Nothing is sent unless you choose to send it. The report is shown to you in full, in an editable box, before anything leaves your machine - you can change it, delete parts of it, or decline outright. There is no background reporting and no silent retry, and you can turn the offer off for good with a checkbox on that dialog or in Commander's settings.

The report we propose contains:

• the error and its stack trace;
• the Commander version;
• your operating system, Java version, locale, timezone, processor count and memory;
• the options the Java runtime was started with.

We don't attach an account, licence key or device identifier, and we don't ask who you are. Reports are grouped by a fingerprint of their content, so the same bug reported by many people is one entry with a counter rather than a pile of separate records. Your IP address is used to rate-limit the endpoint and is not stored on the report.

One thing to look at before you send. An error message can occasionally name a file that was involved - a file Commander couldn't open, say. We deliberately leave your username, home directory and file listings out of the report, but a path can still appear in an error message. That is exactly why the report is editable and why we show it to you first. Delete anything you'd rather keep.

3.4 Optional Commander usage analytics

Commander analytics are separate from the website analytics in section 3.6. Commander collects and sends nothing for this feature unless you first allow it. On the first startup where no choice is stored, Commander shows a notice before collecting anything. Allow and decline are equally available, declining does not affect application functionality, and accepting Commander's licence agreement does not consent to analytics.

If you allow it, Commander periodically sends only:

• the analytics schema version and Commander version;
• operating-system family: Windows, macOS, Linux or other;
• processor architecture: x86-64, ARM64, x86 or other; and
• aggregate counts from a fixed list of Commander events.

The fixed events are: application started; application closed; plugin management opened; panel console toggled; system console opened; computer information opened; themes opened; settings opened; feedback opened; update check requested; and About opened.

The payload has no name, email address, account, licence key, installation, device or session identifier, locale, client timestamp, arbitrary property, file content, file name or path, directory listing, command, feedback text or error-report content. We do not use Commander analytics for advertising, individual profiling, tracking people across services, or sale, and we do not link it to feedback, error reports or website analytics.

Like any internet request, an analytics request reveals its source IP address to our server and infrastructure providers. We use that address in an expiring, in-memory abuse limiter for one hour and do not store it with the analytics. Normal server and CDN logs can retain request metadata, including the IP address, for 90 days as described in section 3.8.

Each accepted batch is immediately added to UTC daily counters keyed only by date, Commander version, operating-system family, architecture and event. The submitted batch is not retained. The counters contain no user, device, installation or session identifier. We use them to understand broad feature usage, compatibility and release adoption, and decide what to improve.

Change your choice at any time under Commander Settings > Privacy. Turning it off stops future collection and discards unsent counters. It cannot remove a past contribution from an aggregate because there is no identifier with which to find it. Local and development Commander profiles send to localhost instead of Nuclr.

3.5 Downloads

We count how many times each release has been downloaded. That counter is a single number per release - it isn't linked to you, and we don't build download histories.

3.6 Website analytics

This website can use Google Analytics, which sets cookies and sends Google your IP address, the pages you view, and general device and browser information. Google processes this as our processor and may store it outside Australia.

It is off unless you switch it on. We ask on your first visit. Until you accept, Google Analytics is not loaded at all - no request goes to Google and no analytics cookie is set. If you decline we remember that and don't ask again.

Changed your mind? Use the button below. It forgets your stored answer, clears any _ga cookies, and reloads the page so you're asked again - whichever way you answered before. Clearing this site's data in your browser does the same thing.

Change my analytics choice

You can also block it at the browser end, with cookie blocking, tracking protection, a content blocker, or Google's opt-out browser add-on.

3.7 Cookies

Your answer to the analytics question is not a cookie - it's a single value (nuclr-analytics) kept in your browser's local storage. It stays on your device, is never sent to us, and clearing site data removes it.

3.8 Article counters, server logs and service diagnostics

When you open an article, we increment its first-party view counter and store the time and your browser's user-agent string with that view. We use this to understand readership and to distinguish browsers, search crawlers and feed clients when interpreting the total. The article counter does not store your IP address, account, cookie, device identifier or session identifier. It operates independently of optional Google Analytics and is not used for advertising or cross-site tracking.

Our servers and our CDN record requests: IP address, timestamp, path, response status, user agent and referrer. We use them to keep the service running and to investigate abuse. Where you submit feedback, our application log also records that a submission happened and the email address you supplied, if any.

When our website or application server fails, Sentry receives diagnostic events containing the error and stack trace, route and request method, response status, recent application breadcrumbs, and the Monolith release and deployment environment. A small sample of requests also supplies performance timings. We disable request-body collection, default personal-data collection and server-name attachment. Do not put passwords or secrets in URLs, because a URL may still form part of diagnostic request metadata.

3.9 Open-source contributors

When we publish a release, our build system records the release metadata Git already contains - including the commit author's name and email address as they appear in the public commit. If you've contributed to a Nuclr repository, that information is in our release records as well as in the public Git history.

3.10 Administrators

Administrator accounts used to manage this site are covered by the same protections; there is no public sign-up.

4. Why we use it

5. Who we share it with

We don't sell personal information. We share it only with the providers that run the service:

We will also disclose information where the law requires it, or to establish or defend legal claims.

Overseas disclosure. All of these providers are located outside Australia: our application server and database are in Germany, and the rest are in the United States or on a global network. Before disclosing personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, as required by APP 8. For transfers out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard; our primary hosting is itself within the EEA.

6. How long we keep it

We may keep information longer where we need it to resolve a dispute or meet a legal obligation.

7. How we protect it

Traffic to our sites is encrypted with TLS. Access to the database and to submitted feedback is limited to the people who need it. Released artifacts are cryptographically signed so you can verify that what you downloaded is what we published.

No system is perfectly secure, and we can't guarantee absolute security. If you believe your information has been compromised, tell us at [email protected]. Where an eligible data breach occurs we will notify affected individuals and the relevant regulator as the law requires.

8. Choices you have

Most of what we collect is optional by design: leave the name and email fields blank and your feedback is anonymous, you can decline or edit any error report before it is sent (section 3.3), you can decline or later disable Commander analytics as described in section 3.4, and you can block website analytics as described in section 3.6. Nothing on this site requires an account, and you never have to tell us who you are.

9. Your rights

9.1 Australia

Under the Privacy Act 1988 (Cth) you may ask us for access to the personal information we hold about you, and ask us to correct it if it's wrong. Write to [email protected] and we'll deal with it as soon as we reasonably can.

If you're unhappy with how we've handled your privacy, tell us first - we'd like the chance to fix it. If we can't resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9.2 EEA and the United Kingdom

If you are in the EEA or the UK, the GDPR gives you the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it (including where we rely on legitimate interests), to receive it in a portable form, and to withdraw consent at any time - withdrawing consent doesn't affect processing that already happened.

Website analytics cookies described in section 3.6 rely on your browser consent. Commander analytics described in section 3.4 rely on a separate choice inside Commander. You can withdraw either consent at any time using the control described in its section. Withdrawal stops future collection and does not affect processing that already occurred.

You also have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office.

9.3 Elsewhere

Other jurisdictions may give you similar rights. Ask us at [email protected] and we'll do what we reasonably can, wherever you're writing from.

10. Children

This site is aimed at software developers and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we'll delete it.

11. Changes to this notice

We'll update this page when our practices change and revise the "last updated" date above. If a change materially affects how we handle your information, we'll say so prominently on the site.

12. Contact us

Email [email protected]. That address reaches Nuclr and is the right one for any privacy request, correction or complaint.