Privacy Policy
- Nimbu has no servers and no user accounts. Your financial data is stored on your phone.
- Nimbu reads SMS only after you turn on Auto-capture, and processes messages on your phone.
- We don't collect, receive, sell or share your data. There are no ads, analytics or trackers.
- Backups go only where you send them (a file or your own Google Drive), encrypted with your password.
1. Who we are
Nimbu is a personal expense-tracking app developed by KeshavBits (“we”, “us”). If you have any question about this policy, email nimbu@keshavbits.tech.
2. Data Nimbu handles, and where it stays
Everything you create or capture in Nimbu is saved in the app's private storage on your phone. We do not run any servers, so none of it is sent to us.
| Data | Why | Where it's stored |
|---|---|---|
| Transactions, accounts, categories, tags, budgets, recurring items, investments and lending records | The core features of the app | On your phone |
| SMS messages Nimbu checks (sender, text, time) | Detecting transactions, showing the original SMS behind a transaction and avoiding duplicates | On your phone |
| Receipts (images or PDFs) and a profile photo, if you add them | Attaching proof to a transaction; personalising the app | On your phone |
| Your name, if you enter it | Greeting you in the app | On your phone |
| App-lock PIN (salted and hashed), backup password and settings | Security and preferences | On your phone, with secrets protected by Android Keystore |
3. SMS messages
Auto-capture is off by default. Nimbu asks for the SMS permission only when you turn it on in the app, and you can turn it off, or revoke the permission in Android settings, at any time.
- When Auto-capture is on, Nimbu checks new incoming SMS on your phone to find transaction alerts from banks and card issuers, and records the amount, account, merchant and date as a transaction.
- If you choose Sync SMS, Nimbu scans your inbox for bank messages in the period you pick and shows you a preview. Nothing is saved until you confirm.
- Nimbu keeps a copy of the messages it checks in its on-device database. You can delete old captured messages at any time in Settings → Advanced → Privacy.
- SMS content is never sent to us or to any third party. It leaves your phone only inside a backup that you create (see section 5).
4. Internet use
Nimbu works offline. It connects to the internet only for these features:
- Mutual fund prices: downloads the public daily NAV file from AMFI (Association of Mutual Funds in India). No personal data is sent.
- Crypto prices and search: requests prices from CoinGecko for the coins you hold, and sends the search text you type when you look up a coin. No personal or financial data is sent.
- Google Drive backup, only if you connect it (see section 5).
These services receive your device's IP address as part of any internet request and handle it under their own privacy policies.
5. Backups
- Local backup: you can save a backup file to a location you choose on your phone.
- Google Drive backup: if you connect Google Drive, Nimbu uploads backups to a “Nimbu Backups” folder in your own Drive. Nimbu uses the
drive.filepermission, which only lets it see files it created, not the rest of your Drive. It also reads your Google account email address so it can show which account was last backed up to. Automatic backups run only if you turn them on. - Every backup is encrypted with AES-256-GCM using a key derived from a backup password that you set. We never receive this password. If you lose it, the backup cannot be recovered.
You can revoke Nimbu's access to Google Drive at any time from your Google Account's third-party connections page.
6. Other permissions
- Notifications: to tell you about captured transactions, loan reminders and backup status. Each type can be switched off in the app or in Android settings.
- Run at startup: so background tasks you enabled (SMS catch-up, due bills and SIPs, reminders, automatic backups) keep working after your phone restarts.
- Biometrics (optional): fingerprint or face unlock is handled by Android. Nimbu never has access to your biometric data.
- Voice entry (optional): uses your phone's built-in speech recognition service, which may process audio under its provider's own policy (for example Google). Nimbu only receives the recognised text.
- Photos and files: Nimbu opens only the image or document you pick through the Android file picker.
7. Sharing and selling
We do not sell, rent, trade or share your data with anyone. Nimbu contains no advertising SDKs, analytics or crash-reporting services, and no trackers.
8. Keeping and deleting your data
Your data stays on your phone until you delete it. You can:
- Delete individual transactions, accounts, categories and other records in the app.
- Delete old captured messages in Settings → Advanced → Privacy.
- Remove all app data by uninstalling Nimbu, or with Android Settings → Apps → Nimbu → Storage → Clear storage.
- Delete Drive backups from the “Nimbu Backups” folder in your Google Drive, and delete any backup files you saved.
Because we hold no copy of your data, we can't access, recover, or delete it on your behalf.
9. Security
Nimbu stores data in the app's private storage, which other apps can't read. Secrets such as your backup password are protected with Android Keystore, backups are encrypted, and you can lock the app with a PIN or biometrics. No method of storage is perfectly secure, so please keep your phone's own screen lock enabled.
10. Children
Nimbu is not directed at children under 13, and we do not knowingly collect data from anyone. Since all data stays on the device, we don't collect data from children either.
11. Changes to this policy
If Nimbu's data practices change, we'll update this page and change the effective date above. Significant changes will also be mentioned in the app's release notes on Google Play.
12. Contact
Questions or requests: nimbu@keshavbits.tech