Privacy Policy

Effective date: 22 October 2026 · Applies to nimbuscorp.tech

How Nimbus processes information when you explore public GitHub repositories, use optional integrations, or submit feedback.

1. Who operates this service

Nimbus is a public codebase-analysis web application operated by the Nimbus website operator. For privacy questions or requests, use our feedback/contact form. Please do not submit credentials or sensitive source code in this form.

2. Information processed

Repository analysis: Public GitHub repository names, file trees, selected source files, dependency manifests and publicly available metadata are processed when you request analysis.
Repository popularity: We record repository identifier, aggregate visit count, last-visited date, GitHub statistics and trending information in Azure Cosmos DB to operate Nimbus Trends. These records are not intended to identify individual visitors.
Optional GitHub connection: With your authorization, Nimbus obtains an OAuth token to access the GitHub API. The OAuth token is held in the browser application's memory during the session and is not intentionally saved to Cosmos DB. Optional GitHub security alert retrieval may require additional access permissions.
AI features: If you configure an AI provider and use AI analysis or chat, relevant prompts, repository context and responses are processed by your selected provider, subject to that provider's policies. BYOK configuration may be kept in browser session storage or local storage if you select persistent storage. Older versions of Nimbus may have saved keys in local storage.
Local scanner imports: Semgrep SARIF files selected for import are parsed in your browser; Nimbus does not intentionally upload the SARIF file to its backend.
Feedback and operational logs: Feedback submitted through the linked Microsoft form is processed by that service. Hosting, security and network logs may include IP addresses, timestamps, request paths and browser information.

3. Why we process data

We process data to provide requested repository analysis, display security information, maintain the service, prevent abuse, troubleshoot failures, and calculate aggregate repository popularity. Depending on circumstances and applicable law, relevant legal bases may include providing a service you request, legitimate interests in operating a secure public service, and consent for optional integrations or storage choices.

4. Providers and transfers

Nimbus uses GitHub APIs, Google OSV.dev, Microsoft Azure App Service and Azure Cosmos DB. Optional functionality may involve OpenAI, OpenRouter, Anthropic, Azure OpenAI, GitHub Models or third-party scanner websites you choose to open. Visiting an external provider does not itself authorize Nimbus to share your GitHub token with that provider. These organizations may process information under their own terms and privacy policies, including in other jurisdictions.

5. Storage and retention

Aggregate repository visit records persist in Cosmos DB while required for the Trends functionality or until removed through operational maintenance. Browser session storage normally persists for a tab session; local storage remains until cleared or replaced. OAuth tokens held only in application memory are cleared from that memory when the page session ends or you disconnect; revoking GitHub authorization must be done through GitHub. Log and backup retention depends on the deployed hosting configuration. We do not promise a fixed retention period where one has not been implemented.

6. Security

We employ safeguards such as HTTPS, rate limiting, application input checks and data-minimization controls. No online service can guarantee absolute security. Do not provide private repository credentials, secrets or confidential information when using public analysis.

7. Your choices and rights

Use Nimbus without GitHub sign-in for public-repository exploration; disconnect GitHub at any time and revoke the authorization in GitHub settings. You can clear locally stored settings through browser controls. Where applicable, you may request access, correction, deletion, restriction or objection relating to personal data, or raise a concern with a relevant supervisory authority. Send requests through the contact form; identity verification may be required.

8. Changes

We may update this notice to reflect changes in services, providers or legal requirements. The effective date above indicates the latest published version.