Privacy policy

Last updated 10 October 2026

Nimbus is a group chat with an AI assistant built in. This policy explains what we collect, why, who helps us run Nimbus, and the choices you have. We've tried to write it plainly.

Who we are. Nimbus is run by Muhammad Ans Bin Najeeb (a sole trader, trading as Nimbus), 2 Rigby Street, Salford, M7 4BJ. We're the “controller” of your personal data under UK data protection law. Questions or requests: ans.najeeb1@gmail.com.

What we collect

Your account: your name, email address and password. Your password is stored only as a scrambled hash we can't reverse.
What you post: messages, reactions, photos, PDFs, polls, quiz answers, task lists, reminders, docs, library files and pages you publish. Everyone in a group can see what's posted in that group.
What you ask Nimbus: your questions and Nimbus's answers, plus the context Nimbus needs to answer — recent messages in the group, its memory of the group, and relevant parts of the group's library and docs.
The group's memory: short notes Nimbus keeps about a group (for example “the group is planning a trip to Barcelona”), which anyone in the group can see and delete. Nimbus is instructed not to store sensitive information such as health details.
Usage: how much of your daily allowance you've used, and your chosen model.
Payments: if you subscribe, our payment provider Stripe handles your card details — we never see or store them. We keep your plan and Stripe's reference numbers for your customer record and subscription.
Notifications: if you turn them on, the technical address your browser gives us for sending them, and your notification setting.
Technical data: our hosting provider records basic information such as IP addresses and the time of requests, to keep Nimbus running and secure.

Why we use it

Purpose	Legal basis
Running your account, your groups and Nimbus's features	Contract — it's how we provide the service you signed up for
Taking payments and managing subscriptions	Contract, and legal obligations (for example tax records)
Sending password-reset and essential account emails	Contract
Push notifications	Consent — you turn them on, and can turn them off at any time
Keeping Nimbus secure, preventing abuse and handling reports	Legitimate interests in a safe service

We don't sell your data, and we don't use it for advertising.

Who helps us run Nimbus

These companies process data on our behalf, only to provide their part of the service:

Provider	What they do
Anthropic	Provides the AI models behind Nimbus (Breeze, Gale and Tempest are powered by Claude). When you ask Nimbus something, the question and the context needed to answer it are sent to Anthropic. Under Anthropic's commercial terms (at the time of writing), they don't use this content to train their models.
Netlify	Hosts Nimbus and stores its data, including accounts, messages and files.
Stripe	Processes payments and manages subscriptions.
Resend	Sends emails such as password resets.
Browser notification services	Google, Apple, Mozilla or Microsoft, depending on your browser, deliver push notifications if you turn them on.
Your browser's speech service	If you use the 🎤 button, your browser turns your speech into text. Some browsers (for example Chrome) do this on their maker's servers, such as Google's; others do it on your device. Nimbus only receives the finished text. Reading answers aloud happens on your device.
Websites you share	When you ask Nimbus about a link, Anthropic fetches that page to read it. The website sees a normal request from Anthropic, not from you.
GitHub	Only if you connect your GitHub account: we keep an access key (stored encrypted) so Nimbus can create repositories you ask for, and send that project's files to GitHub when you export. Disconnect any time in your account window.
jsDelivr	Supplies the open-source readers used to read PDF and Word files in your browser when you add them to a library. They see a normal web request from your browser, not the file.

Some of these providers are based in, or use services in, the United States. Where data leaves the UK, we rely on recognised safeguards such as the UK International Data Transfer Agreement or addendum, or a UK adequacy decision.

Published pages

If you publish a page that Nimbus built, anyone with its link can see it. Published pages are hidden from search engines, and anyone in the group can take them down.

The Community

If you choose to share a page to the Nimbus Community, its title, description, cover, your name and the page itself become visible to everyone using Nimbus, who can like it and make their own copy to change (“remix”). Before a post goes up, Nimbus's AI checks its text, cover and page against the Community rules. You can remove your post at any time, and it's removed automatically if the page is taken down or you delete your account. Remixes other people already made stay in their spaces.

Pictures

If you add a profile picture, or a group picture for a space you run, we store a small square copy. It's shown to the people in your spaces, and it's served from a long, random web address that can't be guessed. Removing it, or deleting your account, deletes it.

Calendar links

Each space can have a private calendar link that shows its reminders and scheduled tasks in your own calendar app. Anyone who has the link can see those reminders, so keep it private. The space's owner or admins can reset it at any time, which stops the old link working.

Keeping Nimbus safe

To stop abuse — such as bots creating accounts in bulk or guessing passwords — we keep a one-way fingerprint of the internet connection used for sign-ups and failed sign-ins, for up to a day. We can't turn it back into your IP address, and we don't use it for anything else. Our legal basis is our legitimate interest in keeping Nimbus and its users secure.

How long we keep it

Your account and content are kept until you delete them or your account.
Docs keep their last 20 versions so changes can be undone.
When you delete your account, we erase your messages, photos and files, remove your name from things that stay with a group, cancel any subscription and delete your account records. A few records may persist for a short time in our providers' systems before they're removed, and we keep payment records where the law requires it.

Your rights

Under UK data protection law you can:

Get a copy of your data — use Account → Download my data, or email us.
Delete your account and data — use Account → Delete account.
Correct inaccurate data, object to or restrict some uses, and move your data to another service.
Withdraw consent to notifications at any time, in your account settings.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children

Nimbus isn't for children under 13. If you're under 18, you need a parent or guardian's permission to buy a subscription.

Security

We use encryption in transit (HTTPS), hashed passwords, and access controls so only members can see a group. Pages people publish run in a browser sandbox, so they can't access anyone's allowance account. No system is perfectly secure, so please use a strong, unique password.

Changes

If we make important changes to this policy, we'll tell you in the app or by email before they take effect.