Privacy policy
Version 1.0, last updated 2026-10-05. Published by the developer of Nimbus.
Nimbus runs on your computer and keeps your decks in a file on your disk. If you never create an account, nothing you do in the app is ever sent anywhere, and there is nothing for anyone to hand over, sell, or lose. An account exists only to sync your own decks between your own machines, and the only personal data it needs is your name, your email address, and a password you choose. If you subscribe to Nimbus Pro, Stripe handles the payment and Nimbus never sees your card.
Who is responsible
Nimbus is published by the developer of Nimbus, an individual developer rather than a registered company. Payments for Nimbus Pro are processed by Stripe, which is an independent controller for the payment data it handles. No payments are taken, so no payment processor is involved.
For anything in this policy, including a request to see or delete your data, write to hello@getnimbus.org. The source code is public at github.com/laziithedev/Nimbus, so every claim on this page can be checked against the code rather than taken on trust.
The desktop app, with no account
This is the default, and most people never leave it.
- Your decks, cards, review history, study sessions and settings are written to a single JSON file in your operating system's application data directory. Settings, then "Where is it stored", prints the exact path.
- Nothing is transmitted. The app's content security policy blocks every outbound request the interface could make, which is why an imported deck cannot contact anyone either.
- There is no analytics, no telemetry, no crash reporting, no advertising identifier, and no usage ping.
- The one exception is the update check described below, which you can turn off.
The update check
Once a day, four seconds after launch, the app requests a small file from the Nimbus website to see whether a newer version exists. That request carries what any web request carries: your IP address, and the fact that a copy of Nimbus asked. It carries nothing about you, your decks or your study. It is logged by the hosting provider as an ordinary web request and is not linked to any account.
You can switch it off in Settings, under About. The app works identically with it off.
If you create an account
An account turns on sync. It is optional, it is not required for any study feature, and signing out leaves every deck on your machine untouched.
There are no accounts
Nimbus has no hosted service running, so there is nothing to sign up for and no personal data of yours is held on any server. There is no database with your name in it. Everything below about accounts describes what will be stored if and when sync launches, and this page will say so plainly on the day that changes.
| What | Why it is needed |
|---|---|
| Your email address | It is how you sign in, and the only way to reach you about the account. |
| Your name | Shown in the app so you can tell which account you are signed into. |
| A password hash and its salt | Hashed with scrypt. Your actual password is never stored and cannot be recovered from this, only checked against it. |
| Your plan and daily goal | Settings that have to follow you between machines. |
| Your decks and cards | The content you asked to sync. Stored as the text you typed. |
| Your review and session history | What the Progress view is computed from. A row per review: which card, what you graded it, how long it took, when. |
| A confirmation that you accepted the terms and are old enough | Recorded once at sign-up, with its timestamp, so that consent can be evidenced. |
| A Stripe customer id and subscription id | Only if you subscribe. Two opaque strings that let this server ask Stripe whether your subscription is active. They are not readable as anything about you. |
| Your plan, its status and its renewal date | So the app knows whether to sync, and so your account page can tell you when the next payment is due. |
| Whether you bought Lifetime, and when | Only if you buy it. A date, nothing more. It is what tells the server you have Nimbus Pro with no renewal to check, and it is kept separate from the subscription fields on purpose, so that a subscription ending can never take away something you paid for once. |
| The Stripe payment id for that purchase | Only if you buy Lifetime. One opaque string. It is how a refund finds the right account: a refund message from Stripe names the payment and nothing else that identifies you, so without this a refunded payment could not end the thing it paid for. It is not readable as anything about you or your card. |
| If it was refunded, when, and which kind of reversal it was | Only if you bought Lifetime and the payment came back. A date, plus one word recording whether it was a refund or a chargeback. The original purchase date is kept rather than erased, because “never bought it” and “bought it and was refunded” are different facts and the second one is the one somebody writes in to ask about. |
| A share code, if you create a link to a deck | Only for decks you deliberately share. One random string per deck, plus the date you created it. It is what makes /d/<code> resolve to that deck, and deleting the link deletes both. Nothing records who opened it. |
| A count of how many AI requests you made today | Only if you use the AI features. Two numbers per day: how many questions you asked about a card, and how many times you generated cards from a file. They exist so one account cannot exhaust a shared allowance. Your questions, the answers, the cards they were about and the files you uploaded are not stored, here or anywhere else. The table has no column for any of them; it is ai_usage in server/src/db.js. |
| A record of each billing message Stripe sent us | Only if you subscribe. The event's id, its type (“subscription renewed”, “payment failed”), and when it arrived. Stripe can deliver the same message twice, and keeping the ids is what stops a repeat being applied twice; it is also the answer to “what changed my plan, and when”. It carries no payment detail. |
That is the complete list. It is the database schema in
server/src/db.js, and you can read it. There is no field for a
phone number, a birth date, a location, a device fingerprint or a contact
list, because none of those are needed to sync flashcards.
What is deliberately not collected
- No IP address is stored in the database. The sign-in rate limiter holds one in memory for at most a minute to slow down password guessing, then discards it.
- No browsing history, no data from other applications, no files other than the one Nimbus writes.
- No marketing profile, and no marketing email. There is no mailing list, so there is nothing to unsubscribe from. The only email Nimbus can cause to be sent is a payment receipt from Stripe, which is a transactional message about a charge you made and is not something you can be opted out of while a subscription is running. If a marketing list ever exists it will be opt-in, separate, and every message will carry a one-click unsubscribe link, which is both the law and the decent minimum.
- Nothing is sold, rented, or shared with an advertiser or a data broker. Not as a promise about current intentions: there is no mechanism in the code to do it.
Payments
Nimbus Pro is billed through Stripe, which acts as our payment processor. Stripe is PCI DSS Level 1 certified, which is the highest level there is.
Nimbus Pro is sold through Stripe Managed Payments, which means a Stripe company is the seller of record and not merely our payment processor. Stripe takes the payment, works out and pays the sales tax, VAT or GST, issues the receipt and the invoice, handles fraud checks and disputes, and answers payment questions through Link support. Stripe is PCI DSS Level 1 certified, which is the highest level there is.
That changes Stripe's role in data-protection terms, so this policy says it plainly: for the sale itself Stripe is an independent controller of your purchase, not a processor acting on our instructions. What it does with that information is described in Stripe's privacy policy, which is the one to read about the payment. This policy continues to describe everything Nimbus itself holds, which is the table above and nothing else.
What Nimbus never has
Your card number, its expiry date and its security code never
touch a Nimbus page or a Nimbus server. Checkout happens on a page
hosted by Stripe at checkout.stripe.com, and your browser
talks to Stripe directly. There is no field in the Nimbus database for a
card number, a last four, a card brand or a billing address, and you can
read the schema in server/src/db.js to check.
What Stripe receives
- Your card details, which you give to Stripe, not to us.
- Your email address and name, so the receipt reaches you and the payment can be matched to your account.
- An internal Nimbus account id, so the confirmation that comes back can be matched to the right account.
- Whatever Stripe collects on its own for fraud prevention and tax, which is described in Stripe's privacy policy. Stripe is an independent controller for that.
Stripe does not receive your decks, your cards, your review history or anything else about how you study. There is no mechanism for it to.
What comes back
Stripe tells this server, over a signed webhook, that a subscription started, renewed, failed or ended. That message carries a customer id, a subscription id, a status and a renewal date. It carries no payment detail of any kind.
For a Lifetime purchase the same thing happens once: Stripe says a payment completed, and that message carries a payment id and the amount. And if that payment is ever refunded or charged back, Stripe says so, which is what ends Lifetime Pro automatically. Those messages carry no card detail either.
If you cancel or delete
Deleting your Nimbus account cancels any active subscription for you, so an account you have deleted cannot keep being charged. Stripe keeps its own record of the transactions after that, because tax and accounting law requires it to, and that retention is Stripe's to describe rather than ours.
A Lifetime purchase has no subscription to cancel. Deleting the account removes everything in the table above, including the three rows that recorded the purchase, and ends the access it bought. That is irreversible and it is not a refund, which the app says in the confirmation before it happens and the refund policy repeats: ask for a refund before deleting, not after.
You can also ask Stripe to delete the information it holds about your purchases, through Link. If you do, Stripe cancels any subscription it sold you and deletes its own records of those transactions, including the customer record it keeps inside our Stripe account. Nimbus is told that it happened. It does not delete your Nimbus account, your decks or your review history, because those are not Stripe's: to remove those, delete your account in the app, or write to the contact address.
The AI features
Nimbus Pro includes two features that use a language model: asking a question about the card you are studying, and generating draft cards from a PDF or a PowerPoint file. Both are optional, both are off until you press the button, and the rest of the app does not use a model for anything.
Who processes it
The model is run by Groq, which acts as our processor for this. The Nimbus server holds the API key and makes the request; the desktop app never contacts Groq directly and the website never contacts it at all. Groq's own terms describe what it does with an API request, and at the time of writing it states that it does not train models on API inputs. That is Groq's commitment rather than ours, so read it yourself if it matters to you: Groq's privacy policy.
What is sent, exactly
- Asking about a card. That card's question, answer and hint, the name of the deck it is in, and the questions you type in that panel. Nothing else: not your other cards, not your review history, not your email address or your account id.
- Generating cards from a file. The text extracted from the file you chose, up to a size limit, plus the optional note you type about what to focus on. Images in the file are not sent and are not read. Nimbus does not run character recognition, which is why a scanned PDF is refused rather than processed.
What is kept
The conversation in the card panel lives in the app's memory while the panel is open and is gone when you close it. It is not written to your disk, not synced, and not stored on the server. The uploaded file is read in memory on the server, turned into text, and discarded within the same request: it is never written to disk and there is no field for it in the database. Neither the questions you ask nor the answers you get are logged.
The only thing that persists is the daily counter in the table above, which is two integers and a date.
What to keep in mind
A language model can be confidently wrong. The app says so next to both features, and the generated cards are shown for you to read and edit before anything is added to a deck, because a wrong card that gets memorised is worse than no card. Check anything that matters against your own source.
Do not paste material into a card and then ask about it if you are not willing for that text to leave your machine. The rest of Nimbus works entirely offline and these two features are the only ones that do not.
Cram plans stay on one machine
A cram plan is excluded from sync on purpose. A half-finished plan for one exam on one laptop means nothing on another machine, so it is never uploaded.
Age
You must be at least 16 to create a Nimbus account. The app itself has no age requirement, because without an account it collects nothing.
Sign-up asks you to confirm your age rather than asking for a date of birth, because a date of birth is more personal data than the question needs. If you believe an account has been created by a child below that age, write to the contact address and it will be deleted along with its contents.
Share links
You can create a link to one of your decks. It is the only way anything of yours becomes readable by someone who is not signed into your account, and it never happens unless you press the button.
| Anyone holding the link can see | They cannot see |
|---|---|
| The deck's name, its description, its tags, and every card in it as text. | Your name, your email address, or anything identifying you. The share page deliberately does not name the person who shared it. |
| How many cards the deck has. | Your review history, your intervals, or how well you know any of it. Cards arrive new for whoever opens the link. |
| Nothing else. One deck, not your account. | Any of your other decks, even ones you have published. |
A link is unlisted, not secret. It appears in no listing and no search, and the code is long and random rather than guessable, but anyone it is forwarded to can open it. Treat it the way you would treat a link to an unlisted video: fine for people you chose, not a password.
You can turn a link off at any time, and doing so needs no subscription even if the one you used to create it has lapsed. The link stops resolving immediately. Copies people already took are their own decks and stay with them, which is the same as any file you have sent somebody.
Nimbus does not record who opened a link, when, or from where. There is no view counter and no access log tied to a share code; the only thing stored is the code itself and the date you made it.
Getting your data, or getting rid of it
Export
Settings, then "Export everything", writes a single JSON file containing every deck, card, review and session Nimbus holds for you. It needs no account, no request and no waiting, and it imports back into any Nimbus install.
Deletion
Settings, then "Delete my account", permanently removes your account and everything attached to it from the server. You are asked to type your password to confirm. The deletion is immediate and cannot be undone, and it cascades to every deck, card, review and session belonging to that account. Your local copy is left alone unless you also choose to erase it.
If you cannot reach the app, write to the contact address from the email address on the account and ask for deletion. You will get a reply within 30 days.
Your other rights
If you are in the UK, the EU, or anywhere with comparable law, you have the right to access your data, correct it, have it deleted, object to its processing, and receive it in a portable format. Export and Delete cover the first, third and fifth of those without you having to ask anyone. For the rest, write to the contact address. You also have the right to complain to your national data protection authority.
Where the data sits, and for how long
If you run the sync server yourself, which is the supported configuration today, your data sits wherever you run it and nobody else can reach it. The server binds to localhost by default and has to be deliberately exposed.
Account data is kept until you delete the account. There is no scheduled purge beyond that, and there are no backups retained separately from the database file.
Other people's servers
The website can load a webfont from Google and an icon font from unpkg, and it asks before contacting either. Stripe handles payment, and is only ever contacted when you deliberately start a purchase or open your billing settings. Groq runs the model behind the two AI features, and is only ever contacted when you ask a question about a card or generate cards from a file. The app checks for updates against the Nimbus download host. That is the complete list; the full inventory is in docs/THIRD-PARTY.md and on the cookies and storage page.
There is no analytics provider, no advertising network, no data broker and no crash reporter anywhere in this project, on either product.
Changes
If this policy changes in a way that affects what is collected or who can see it, the version number and date at the top change with it, and the previous versions stay in the repository's history where anyone can diff them.
Nimbus · hello@getnimbus.org · Back to the site