Who Controls Your Information
Nova, the operator of externals.gg and the Nova software, is responsible for the processing described here. Privacy questions and rights requests can be submitted through the official Nova Discord at https://discord.gg/xternal.
Do not include passwords, authentication tokens, session cookies, license keys, recovery codes, or unnecessary sensitive information in a privacy request.
Information Nova Collects
Nova collects the minimum information needed to identify customers, deliver paid access, link an approved device, protect the service, provide support, and maintain the product.
- Discord identity: Discord user ID, username, display name, avatar, verified email address, and identity information returned by the authorized Discord sign-in flow.
- Account and entitlement: plan, account status, lifetime-access status, redemption records, purchase or license delivery state, and device-reset history.
- Device and desktop authorization: a device public key, protected device-fingerprint hash, Nova release identity, authorization transaction state, and short-lived session records.
- Security and operations: keyed hashes of observed IP addresses, request identifiers, rate-limit state, security events, moderation state, and administrative audit records.
- Content you submit: support messages, community-script submissions, and saved presets or other product data you intentionally upload.
- Purchase information: order and entitlement details received from SellAuth as needed to deliver or support the purchase. Nova does not directly collect full payment-card details in its checkout.
- Referral and payout information: referral-code enrollment, link clicks without plaintext IP storage, account attribution, commission and adjustment ledger entries, payout requests, payout method, applied fees, non-sensitive payment references, and annual paid totals used for accounting review.
Information Nova Does Not Need
Nova does not ask for your Roblox password. The website does not persist plaintext Discord OAuth tokens, plaintext license keys, plaintext desktop session tokens, plaintext device fingerprints, or plaintext IP addresses. License keys and opaque tokens are stored as separate keyed hashes, observed IP addresses are stored as keyed hashes, and protected secondary authentication values are encrypted at rest.
Do not provide Roblox credentials, Discord tokens, browser cookies, backup codes, or recovery credentials to Nova support or any seller claiming to represent Nova.
Why Nova Uses Information
Nova processes account, entitlement, device, and purchase information to perform the customer agreement: authenticating you, delivering the purchased plan, providing downloads and updates, linking a device, and supporting the account.
Nova processes security, hashed network, moderation, and audit information for legitimate interests in preventing fraud, credential abuse, unauthorized distribution, attacks, service disruption, and unsafe releases. Information may also be processed to meet legal obligations, resolve disputes, enforce agreements, and act with your consent where consent is the appropriate basis.
Retention
Short-lived authorization transactions, nonces, rate limits, install grants, and native sessions expire automatically. Browser sessions normally expire after seven days unless renewed through normal sign-in activity.
Account, entitlement, device-link, release, audit, fraud-prevention, and purchase-support records are retained for as long as reasonably necessary to provide lifetime access, protect customers and the service, meet legal or accounting requirements, resolve disputes, and enforce agreements. Records are deleted or de-identified when they are no longer needed, unless retention is required or permitted by law.
Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information; object to certain processing; withdraw consent; and appeal or complain to a data-protection authority. Nova will verify that a requester controls the relevant Discord account before disclosing or changing account data.
Some records cannot be deleted immediately when they are needed to preserve a lifetime entitlement, complete a transaction, prevent fraud, maintain security, meet a legal obligation, or establish or defend legal claims. Nova will explain an applicable limitation when responding to a verified request.
International Processing and Security
Nova and its providers may process information in countries other than the one where you live. Where required, Nova relies on appropriate contractual or legal safeguards for international transfers.
Nova uses access controls, encryption or keyed hashing for sensitive stored values, signed and encrypted native-service responses, short-lived sessions, rate limits, release verification, and audit records. No service can promise absolute security, so protect your Discord account and contact official support if you suspect unauthorized access.
Children and Policy Changes
Nova is not directed to children under 13 and does not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact official support for review and deletion where required.
This policy may be updated as Nova, its providers, or applicable law changes. Material revisions will appear with a new last-updated date and an additional notice when appropriate.