Nexa: Exposed

Nexa is the chat app at nexa.pm. The homepage, fetched 8 November 2026, says "Private Chat with All the Fun Left In" and "Every feature is free for everyone. There's no subscription and no paid tier." The terms effective 7 November 2026 sell two plans, Supporter at $5 a month and Pro at $10 a month. The day before those terms, a goodbye signed nora said the platform had closed.

Checked 8 November 2026. Quotes are from the live site that day, from the English catalog in the bundle base-CTmj_B8a.js, from the terms and privacy modules that page loads, and from the public repo zeygoober/nexa at commit 3a2ceb95f007372cdcc70138afb247df6e204df6. The terms and privacy text on the live site match that commit byte for byte. A web search for the name Nexa mostly returns other products. The public record for this chat app is the goodbye pages, the git history, the legal documents, and the live instance. If a slop cannon can find this much contradiction, with citations, there is likely more under the hood.

On this page

What the homepage says

The HTML shell at nexa.pm is a Vite app. The title is "Nexa". The meta description is "Nexa: end-to-end encrypted chat, calls and servers." The Open Graph title is "Nexa: private chat with all the fun left in". The Open Graph description:

A free chat app with servers, voice and video calls, and custom emoji and stickers. Messages, files and calls are encrypted on your device, and signing up needs no email or phone number.

The page itself is drawn from the English catalog. The hero:

Private Chat with All the Fun Left In

Nexa is a free chat app with servers, voice and video calls, and emoji and stickers anyone can make. Messages, files and calls are encrypted on your device, so only the people you're talking to can read or hear them.

Sign up with a username and a password. No email, no phone number.

Under that, five groups of promises. The money group is titled "Nothing to Pay For". The line under the title:

Every feature is free for everyone. There's no subscription and no paid tier.

The tiles inside that group are emoji and stickers, screen share, files, and themes. The screen-share tile:

Screen Share at Full Quality

Share a window or your whole screen at its own resolution and up to 60 frames a second, with sound.

The file tile's title is "Files up to {size}", filled from the instance's max_upload_bytes. On 8 November that value was 1,073,741,824, which is 1 GiB. The body says "Send long videos and big files without shrinking them first." The next group is "Nothing to Hand Over", with "Nexa doesn't need to know who you are." Beside it, "No Ads or Tracking" and "Nothing about you is sold, and nothing follows you around." The code tile says "Inspect how Nexa works, build on it, or host your own instance." The GitHub link on that group points at github.com/zeygoober/nexa.

Further down, "The Server Can't Read" lists message text, files and pictures, calls, keys and the recovery key, and settings. "The Server Can See" lists the username, display name and profile picture, which servers and conversations you are in and their names, who sent each message and when, reactions and file sizes, and custom emoji and stickers. The caption on the comparison reads "The server can tell who wrote each message and when, but not what it says." The calls section says calls are "encrypted end to end like your messages."

Closed on 6 November

On 8 November 2026 the hosts nexa.fish, chat.evilion.xyz, and mathtest.lol each returned the same page. The files are 82,690 bytes and share SHA-256 d90a8cb75ea5da7946b2ceef18418284ee7ebfff59c01a1f6b922c43f7abae2e. The title is "Goodbye from Nexa". The meta description is "Nexa has closed. A goodbye from nora, with where to find Nexa's source code and where to go next." The letter is dated November 6, 2026, and signed nora. It opens "Hi, it's nora." Then:

Sadly, the platform has become too much for me to deal with. The moderation problems have stacked higher and higher, and the legal repercussions could be way too much for me to handle.

I want to say that I love this platform a lot, and I don't want it to go completely to waste.

On payments and the source:

All payments made to Nexa have been refunded and should arrive within 5 to 10 business days. If yours doesn't, email me at [email protected].

Nexa is fully open source at github.com/terrydavisthe2nd/nexa, and it will still take contributions.

You're all welcome to host your own version of Nexa, since it uses the MIT License.

The letter points readers at fluxer.com and away from a platform it calls Yapin. The last line of the page is "Nexa has closed, so no new messages can be sent." The closing line of the letter says "I don't have the time in my life to manage staff and the site's infrastructure."

The privacy policy at commit e978c9e843b69a97ad3d286a6c9f2ff2c523f29d, effective 2026-11-06, matches that letter's names. The header:

Site: nexa.fish (also at mathtest.lol, and formerly chat.evilion.xyz)

Contact the owner (nora) here: [email protected]

Effective: 2026-11-06

Section 9 of that policy names "the owner of Nexa (nora), in Alaska, United States" and says the server, and everything it stores, its backup included, is in Alaska, except encrypted files in Cloudflare R2. A lookup of evilion.xyz and www.evilion.xyz on 8 November returned no address. chat.evilion.xyz resolved and served the goodbye page. The homepage at nexa.pm is the pitch in the previous section. The English catalog shipped with that homepage still contains a changelog line, "Nexa Is Now at nexa.fish", whose body says Nexa has a new address, nexa.fish, and it works at mathtest.lol too.

Open on 7 November

The public RDAP record for nexa.pm, read 8 November 2026, says the domain was registered 2026-11-07 at 15:32:07 UTC, with registrar OVH, nameservers jasper.ns.cloudflare.com and shubhi.ns.cloudflare.com, and status client transfer prohibited, client delete prohibited, and add period. The registrant field is the text "Ano Nymous", and the address fields are blank. OVH publishes redacted records in that form. The domain was one day old on the day of this check. nexa.pm and www.nexa.pm both resolved, and nexa.pm returned the live app.

GitHub repo zeygoober/nexa was created 2026-11-07 at 18:30:24 UTC and last pushed 2026-11-07 at 22:05:37 UTC. The description is "Nexa, the end-to-end encrypted chat app at nexa.pm". The licence is MIT. At the time of this check the repo had 0 stars and 0 forks. The GitHub fork flag on that repo is false. The parent of the ownership commit is e978c9e843b69a97ad3d286a6c9f2ff2c523f29d, which is also the head of terrydavisthe2nd/nexa.

That ownership commit, ac472366da906c4d05e57aab46b4e9da793e4743, is timestamped 2026-11-07 at 18:32:35 UTC. The message says the owner is zey, in OWNER_USERNAME, the legal documents, and the contact convention. Then:

There is no public contact email for now: contact links go to @zey in the app (CONTACT_HREF).

The Privacy Policy says the server is in France (Contabo), not Alaska.

The terms and privacy policy effective 2026-11-07, on the live site and at that commit, open with "Site: nexa.pm" and "Contact the owner (zey) here: in the app, message @zey". A change note shown to someone whose last accepted terms are older than 2026-11-06.1 says "Nexa is now run by zey at nexa.pm, and its server is in France, in the European Union. To reach the owner, message @zey in the app." Section 9 of the new policy names the controller as "the owner of Nexa (zey)" and says the server, backup included, is hosted by Contabo in France, except encrypted files in Cloudflare R2 in western North America. Alaska and France are sentences in those two policies. This check did not locate the machine.

The three older domains publish one Cloudflare nameserver pair, chloe.ns.cloudflare.com and khalid.ns.cloudflare.com. nexa.pm publishes a different pair. A shared pair is consistent with one Cloudflare account. This check did not see the account. The older domains use different registrars: nexa.fish lists Cloudflare, Inc., evilion.xyz lists NameCheap, Inc., and mathtest.lol lists Dynadot Inc.

Nothing to pay for, and the price table

The homepage group "Nothing to Pay For" and the terms section "PLANS AND PAYMENTS" are in the same deployment. The terms, effective 2026-11-07:

Nexa is free to use, and chatting, calls, encryption, servers and everything else stay free. Two optional plans give more room and help pay for running it:

Supporter, $5 a month or $48 a year: bigger files, more uploads each 30 days, the Quality screen share, the Holo, Neon and Flame name effects, and a Supporter badge.

Pro, $10 a month or $96 a year: all of that with more room still, a Pro badge, and two server boosts. A boosted server lets everyone in it send bigger files.

The same section sells gifts, and pay what you want from $1. Each full month price of Pro ($10) buys 30 days of Pro. Each month price of Supporter ($5) left over buys a month of Supporter. Less than $5 buys no plan time and is a thank-you. Stripe is the merchant of record. Refunds, if asked within 14 days, are in full. The support page bundle stores supporter as 500 cents a month and 4,800 cents a year, and Pro as 1,000 cents a month and 9,600 cents a year. web/src/lib/plans.ts at that commit uses the same month prices as the defaults in payWhatYouWant, 500 and 1,000 cents, and sets the pay-what-you-want floor at 100 cents. The live file plans-CMJYMStO.js has the same floor.

The in-app support strings in the same English catalog are headed "Nexa Isn't Free to Run". The line under it says servers, storage and calls cost money every month, and a plan gives you more room. Another line says messages, calls, encryption, servers and everything else stay free. The upsell for screen share:

Quality Comes with a Plan

Sharing at your screen's own size, sharp enough to read, comes with Supporter and Pro. Performance stays free.

The Quality mode's own description is "Your screen as it is, at its own resolution and frame rate." Performance is "Up to 1080p at 60 fps", and the picture softens when the connection is short. The homepage tile inside "Nothing to Pay For" is titled "Screen Share at Full Quality" and promises the screen's own resolution. Holo, Neon and Flame are described the same way: they come with Supporter and Pro, and every other effect stays free.

internal/api/billing.go at that commit applies the caps in planLimitsFor whether or not Stripe is configured. Free is a 1 GiB file, 5 GiB uploaded in any 30 days, screen share at 6,000,000 bits per second, and ShareQuality false, with no name effects. Supporter is a 2 GiB file, 100 GiB in 30 days, Quality on, 12,000,000 bits per second, and name effects. Pro is a 4 GiB file, 500 GiB in 30 days, Quality on, 20,000,000 bits per second, name effects, and two boosts. A boosted server's file cap is 2 GiB. The comment on the too-large error says the apps offer a plan when they see it. The error text is "That file is bigger than your plan sends." The 30-day error is "You've uploaded all your plan allows in 30 days."

GET https://nexa.pm/api/v1/instance on 8 November 2026 returned those same numbers, with plans.enabled false, registration "open", and max_upload_bytes 1,073,741,824. The client copy of the table in plans-CMJYMStO.js starts with enabled false and the same caps. setPlans in web/src/lib/plans.ts replaces that table with the instance answer. The support page sets its buy flag from the billing object's enabled field, and falls back to that table. While the flag is false the page shows "Plans can't be bought yet. They open soon." and the buy button is disabled. GET /api/v1/billing without a login returned HTTP 401 and "You need to log in." This check did not sign in. The homepage file tile uses the 1 GiB figure. The 5 GiB cap over 30 days is in planLimitsFor and in the upload upsell.

The homepage says every feature is free, there is no subscription, and there is no paid tier, and it puts full-quality screen share in that group. The terms of 7 November sell the two plans, the Quality share, the name effects, and the larger caps. The live flag says checkout is off, and the support page says the plans open soon. The free caps in the code are in force either way.

Nothing tracked, and the IP list

The homepage tile is "No Ads or Tracking". The body is "Nothing about you is sold, and nothing follows you around." The sign-up gate says "No email, no phone number, nothing sold, nothing tracked." The privacy policy short version, effective the same day as the terms, says "No email, no phone number, no real name, no payment details, no location, no contacts, no tracking, and no push tokens are ever collected." The same short version also says Nexa keeps the IP addresses each account signs in and is active from, and that the apps send performance reports unless you turn them off.

Section 3e is the IP list. Each signed-in device has a session with the IP address it was last used from, the browser or app description, and the sign-in and last-active times. Sessions are deleted on sign-out or after 90 days without use. Separately, the policy keeps every IP address the account has signed in or been active from, with the first and last time it was seen there. The list stays after sign-out. An address is deleted 180 days after the account last used it, and the list is deleted with the account. The moderation panel shows staff which other accounts have used the same addresses, marked "Alt Accounts", with how many addresses they share. The policy's sentence:

The panel never shows the addresses themselves; the owner produces them only to answer a valid legal order (Terms section 5). Several people on one network (a home, a school, a VPN) can share an address, so staff treat a match as something to look into, not proof.

Terms section 4, rule 6, says staff can see which accounts have signed in from the same IP addresses in order to enforce the ban-evasion rule. Terms section 10 says legal requests "are answered with exactly what is held, as listed in the Privacy Policy. Anything not on that list does not exist to hand over." The homepage group beside this machinery is titled "Nothing to Hand Over".

Section 3l keeps daily call-usage amounts: media sent, media received, media relayed through Cloudflare TURN, and time in calls. Staff who are admins and up see it in the moderation panel. The policy says it "says nothing about which calls you were in, who was in them, or what was said." Section 7 keeps call usage for about two months: days older than 62 are deleted. Section 3m is performance reports, "on unless you turn them off". Every few minutes the app sends totals for startup, opening a conversation, decrypting, sending, connecting, request timings, and slow frames, plus the kind of app, a rough device class, and the kind of connection. The policy says the server adds each report to the totals for everyone and keeps nothing that names the account, the IP address, or the device. The switch is Settings, Privacy, Send performance reports.

The captcha on the live instance is Cloudflare Turnstile. The policy says the browser or app loads it from challenges.cloudflare.com, and Nexa sends Cloudflare the IP address when it checks one. Older apps keep using hCaptcha until they update. The homepage says "Nexa's server fetches previews for you, and pictures load through its proxy, so linked sites never see your address." The server sees the URL. YouTube, Spotify, Apple Music, Deezer, and SoundCloud playback go through the server. Linking a Discord account is optional. If you do, section 3i says Nexa keeps the Discord ID, username, display name, picture, and Discord's sign-in tokens, sealed with a key only the server has, so a bot can put the account in a small Discord server and read activity.

The contact line on the new terms and the new policy is only "in the app, message @zey". A person who cannot sign in has the address printed on the 6 November goodbye, [email protected], and no address on nexa.pm.

Who can read a message

The hero says messages, files, and calls are encrypted on your device, "so only the people you're talking to can read or hear them." Terms section 1, effective the same week:

Your messages, files, and calls are encrypted on your device with keys the server never has. Nobody who runs Nexa can read them, monitor them, or switch that off. That is how the software works, not a promise that could be quietly waived later. The one way around it is an app that you or a server's manager choose to add: what is meant for an app reaches it (section 3).

Section 3 then lists what is stored as ciphertext the server cannot read, and the exceptions. Public profiles, moderation cases and their threads, announcements from Nexa, bug reports, safety reports and the evidence the user chooses to share, webhook messages, and what apps post and receive are not end-to-end encrypted. On apps:

What reaches an app is not end-to-end encrypted from it: messages meant for it (the sender's app seals a copy for it, which the server opens to hand over), what you send it with its commands and forms, and, for an app made to read every message, every message in the channels it can see. An app shows what it can read before anyone adds it, and the start of each channel where one reads every message names it. Whoever made an app runs it and decides what it does with what it gets. Nexa does not check apps, so add only ones you trust.

Privacy section 3j says the same thing in the storage list. An app set to read every message holds the keys of the servers it is in, as a member does, and the server opens every message in the channels it can see, earlier ones included, to hand them to the app. "What reaches an app is readable to it, and to the server on the way." The bot's own key is sealed with a key only the server has. ENCRYPTION.md at the same commit says a channel in that state "cannot be described as hidden from the server while it has usable bot keys for it."

Terms section 5 credits a limit, and this page records it. Staff moderate what is public and what is reported to them. "Nobody goes looking through chats or inside servers, because nobody here can." When staff take down a server's public name or pictures, "Staff never see the channels, messages, or files inside a server." A legal order, the same section says, can be answered only with what the server holds. "Message text, file contents, and call audio still cannot be handed over, because nobody here has a way to read them, apart from what was opened for an app." A safety report is the path they describe for one message: the reporter's client sends the opened text and the files, and staff can remove that message without receiving the conversation keys. The homepage "can see" list names the account, the servers and conversation names, who sent a message and when, reactions and file sizes, and public emoji. Apps, webhooks, reports, and IP addresses are in the terms and the privacy policy of the same day.

ENCRYPTION.md also prints the limits around the safety-number tile. The homepage tile says "Compare a number or scan a code with a friend to make sure nobody is listening in between." The document says clients remember a key when they first see it and flag later changes, and "A first-seen key is not already verified." Membership checks "are not a cryptographic guarantee against a malicious server changing membership or permissions." On the web app itself:

The web client is delivered by the server. A compromised operator or delivery chain could serve modified JavaScript that reads passwords, keys or plaintext while the app is used.

The README at that commit says a peer-to-peer call reveals the participants' IP addresses to each other, and an optional Cloudflare Realtime path avoids that. The homepage calls paragraph says the calls are encrypted end to end. The README is where the participant IP addresses are named. Delivery metadata that the server can see, in the same document, includes mentions, reactions, file sizes, and poll voting data. Channel and server names are visible. The homepage says so for names, reactions, and file sizes.

The repo you are told to clone

The in-app GitHub link, the constant in legal-C_OpL9Ve.js, is https://github.com/zeygoober/nexa. The README at commit 3a2ceb95 still tells a reader to clone the previous repo, and it still copyrights that account:

git clone https://github.com/terrydavisthe2nd/nexa.git

Copyright (c) 2026 terrydavisthe2nd / Nexa.

The project blurb in the catalog says "Nexa's web, desktop and Android apps and server are open source under the MIT license." The licence file is MIT. The Go module on the first line of go.mod is evilion.xyz/chat, Go 1.27.3. The Android applicationId in android/app/build.gradle.kts is fish.nexa. ENCRYPTION.md says that, without an app passcode, the web client persists the unwrapped identity private key in IndexedDB, in a database named evilion-chat. The old repo terrydavisthe2nd/nexa still lists its homepage as https://nexa.fish. It was created 2026-10-27, last pushed 2026-11-07 at 02:45:30 UTC, and at this check had 7 stars and 7 forks. Neither repo had a GitHub release. The live instance's version field was the string caebe5a. A lookup of that string as a commit on zeygoober/nexa returned no commit.

The names on the documents

The 6 November privacy policy and the goodbye page name the owner nora, print [email protected], and point at github.com/terrydavisthe2nd/nexa. Commits on that history through e978c9e843 are authored by the GitHub account terrydavisthe2nd. That account was created 2026-08-24, has no name field, no bio, 2 public repositories, and 0 followers.

The 7 November terms name the owner zey. The move commit's author name is zeynal-ismayilzada. The GitHub login on that commit is zeygoober, user id 33985751, created 2017-11-25, with the name field "zey", 1 public repository, 0 followers, and no bio. The public registrant text on nexa.pm is "Ano Nymous".

These documents use those names as they appear. This page leaves nora, the account terrydavisthe2nd, and zey as separate names.

Dates

WhenWhat the record says
13 March 2025evilion.xyz registered, registrar NameCheap. Last changed 1 October 2026. Nameservers chloe and khalid at Cloudflare.
24 August 2026GitHub account terrydavisthe2nd created.
30 September 2026mathtest.lol registered, registrar Dynadot. Same nameserver pair.
1 October 2026nexa.fish registered. RDAP names the registrar Cloudflare, Inc. Same nameserver pair.
27 October 2026Repo terrydavisthe2nd/nexa created. Homepage field https://nexa.fish.
6 November 2026Privacy policy effective that day names nora, nexa.fish, mathtest.lol, formerly chat.evilion.xyz, and a server in Alaska. Goodbye page dated this day, signed nora, now served on all three hosts.
7 November 2026, 02:44 UTCLast commit authored by terrydavisthe2nd, e978c9e843. Old repo last pushed 02:45 UTC.
7 November 2026, 15:32 UTCnexa.pm registered at OVH. Registrant field "Ano Nymous".
7 November 2026, 18:30 UTCRepo zeygoober/nexa created. Ownership commit ac472366da at 18:32 UTC. Head 3a2ceb95 at 20:39 UTC. Pushed 22:05 UTC.
8 November 2026This check. nexa.pm serves the app. Instance plans.enabled is false. The three old hosts serve the same goodbye page.

Sources

Opened 8 November 2026 unless a line says otherwise.

Corrections

This page records what those URLs said on 8 November 2026. A later edit on nexa.pm does not rewrite the text quoted here. A correction to this page belongs next to the sentence it fixes, with the date of the check.

Ordinary message text, file contents, notes, and call media are described as ciphertext in the terms, the privacy policy, and ENCRYPTION.md. This check did not cryptanalyze that scheme, did not sign in, and does not claim that production direct messages are stored in plaintext. Staff, on the terms' own account, moderate public material and reports. The app path, the webhook path, and a report the user chooses to send are the exceptions the same documents print.

Alaska and France are sentences in the two privacy policies. This check did not geolocate a server. The goodbye says payments were refunded and should arrive in 5 to 10 business days. This check did not confirm that the money arrived. The instance version string caebe5a was not a commit on zeygoober/nexa. The legal text and the plan caps were checked against the commit named above. "Ano Nymous" is the registrant text on the RDAP record. This page does not treat nora, terrydavisthe2nd, and zey as one person. Other products that use the name Nexa, including a cryptocurrency, a mortgage brokerage, a trading terminal, and other chat apps, are out of scope.