Privacy
Your data belongs to you.
This policy explains what we collect, why we collect it, who processes it, and the rights you have over it. The short version is below; the full policy follows.
The short version
- We collect what is needed to run your account and workspace, and nothing else.
- Your workspace content is yours. We do not sell it, and we do not use it to train AI models.
- We use no analytics, advertising, or tracking cookies.
- The only people who can see activity inside a shared workspace are its members and its administrators.
- The Chrome extension reads a page only when you explicitly ask it to scan.
- Questions? Contact [email protected].
01 Who we are
Nimbus Vault is a knowledge-management tool for security researchers. This policy explains how Nimbus Vault (“we”, “us”) processes personal data, and how you can exercise your rights. We are the data controller for the processing described here. Contact: [email protected].
02 Scope
This policy covers the Nimbus Vault website (nimbusvault.app), the workspace app (workspace.nimbusvault.app), and the Nimbus Vault Chrome extension.
03 Data we collect
- Account data — name, email address, profile image, and authentication details, processed through our authentication provider (Clerk).
- Workspace content — the programs, assets, components, playbooks, notes, and outcomes you create. This content is yours (see section 05).
- Activity records — an audit log of actions within a workspace (who did what, and when). In shared workspaces, administrators can view these records.
- Communications — emails with us, and workspace invitation emails sent through our email provider (Resend).
- Technical data — IP address and request metadata processed by our infrastructure when you use the service, plus the session cookies required to keep you signed in. Our website also loads its typefaces from Google Fonts, which receives your IP address when a page loads. If you play the walkthrough video on our website, it loads through YouTube’s privacy-enhanced embed (youtube-nocookie.com).
- Waitlist data — if you join the waitlist, your email address and the page you signed up from.
- Optional AI settings — if you use the extension’s AI analysis feature, the API key you provide is stored locally in your browser, not on our servers.
- Payment data — if you purchase a paid plan (when available), payment details are collected and processed by our payment processor; we do not store card numbers.
04 Purposes and legal bases
We process data to provide the service (contract), to keep it secure and prevent abuse (legitimate interest), to respond to support requests (legitimate interest, or consent where required), and to comply with law (legal obligation). We contact waitlist subscribers about the launch based on the consent given at signup; every such email lets you opt out.
05 What we do not do
- We do not sell your personal data or your workspace content.
- We do not use your content to train AI models.
- We do not use advertising, analytics, or tracking cookies.
- We do not use one customer’s workspace data to improve suggestions in another customer’s workspace.
06 When we can access content
Workspace content is stored in our production database and is not end-to-end encrypted. We do not view or read your content, except: (a) when you ask us to as part of support; (b) when necessary to investigate abuse or a security incident; or (c) when legally required. Where the law permits, we will tell you about legal requests. In a shared workspace, your administrators can see membership and activity records; they cannot see anything outside that workspace.
08 The Chrome extension
Permissions, in plain language:
- Cookies — connects the extension to your Nimbus session. No tracking cookies.
- Storage — keeps preferences, session state, and (if you add one) your AI API key locally on your device.
- Tabs — detects when a Nimbus tab is active so the side panel can open. Tab URLs are not transmitted.
- Scripting / activeTab — reads page structure (URL, forms, buttons, headings) only when you click “Scan for Components”. It never scans automatically.
- declarativeNetRequest — removes an unnecessary Origin header from the extension’s own login requests. It does not block or modify your browsing.
- Context menus — adds “Scan for Components” to the right-click menu.
- Site access — the extension can run on any site so that scanning works on whichever target you choose; it reads nothing until you ask it to.
- AI analysis — off by default, user-triggered only, with your own key (see section 07).
10 Retention
Account and workspace data are kept while your account is active, and deleted within 30 days of a deletion request (encrypted backup copies are purged within 90 days). Waitlist emails are kept until launch and deleted on request. Audit records are kept for the life of the workspace.
11 Security
Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure provider. Access to production systems is limited to the small team that operates the service, under access controls. No system is perfectly secure; if a breach affects you, we will notify you and the relevant authorities as required by law.
12 International transfers
Our infrastructure and providers process data primarily in the United States. Where personal data is transferred from the EEA or the UK, we rely on appropriate safeguards, such as standard contractual clauses.
13 Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete your data (subject to legal retention obligations).
- Export your data to another service.
- Object to or restrict certain processing.
- Withdraw consent at any time, where processing is based on consent.
- Complain to your local data-protection authority.
Email [email protected] to exercise any of these rights — we respond within 30 days. California residents: we do not sell or share personal information as defined by the CCPA, and we will not discriminate against you for exercising your rights.
14 Children
The service is not for anyone under 16, and we do not knowingly collect data from children under 16.
15 Changes
We will post any changes here with a new effective date, and email registered users about material changes.
16 Contact
[email protected] — including for complaints. EU/UK users may also contact their local supervisory authority.