Cookies and storage
Version 1.0, last updated 2026-10-05.
Nimbus sets no cookies at all. Not a necessary one, not an analytics one, not a third-party one. The website keeps a few small values in your browser's local storage, which stays on your machine and is never attached to a request automatically. There is no consent banner because there is nothing to ask: the page loads its font and icons from this site and makes no request to any other server. Paying is a redirect to Stripe, so no payment script ever loads here.
Cookies
None. There is no analytics product, no tag manager, no advertising pixel, no embedded video, and no social widget. There is no session cookie either: the account page signs you in with a token held in local storage rather than a cookie, for the reason given below. There is no session cookie either, because there are no accounts: this site has nothing to sign in to.
You can verify this rather than believe it. Open your browser's developer tools on any page of this site, look under Application, then Cookies, and the list is empty.
What is stored in your browser
Local storage is not a cookie. Nothing in it is attached to a request automatically, and it is readable only by this site. This is everything the site keeps. The first one never leaves your browser at all; the sign-in token is sent to the Nimbus server, by our own code, only on requests about your own account. Neither value ever leaves your browser.
| Key | What it holds | Why | How long |
|---|---|---|---|
nimbus.theme |
Light, dark, or system | So the page does not flip back to the wrong theme on your next visit | Until you clear your browser's site data |
nimbus.token.v1 |
Your sign-in token, only if you sign in on the account page | So you are not asked for your password on every visit to your account | Until you sign out, or 30 days |
The web app stores more, at its own address
Nimbus also runs as a web app at app.getnimbus.org. That is a different address from this website, so a browser keeps its storage completely separate from the table above: nothing listed here is readable by the app, and nothing listed below is readable by this site. None of it is a cookie either, and none of it is sent anywhere automatically.
| What | What it holds | Why | How long |
|---|---|---|---|
nimbus (IndexedDB) |
Your decks, cards, review history, study sessions and settings. Everything the desktop app keeps in a file, including your sign-in token if you sign in. | It is the app's storage. Without it there is nowhere for your cards to be. | Until you delete it, or your browser clears site data. A browser may do that on its own; the app says so when that is a risk. |
nimbus-app-<version> (Cache Storage) |
A copy of the app's own files: the page, its code, its stylesheets and its icon font. No study data of any kind. | So the app opens and works with no network after the first visit. | Replaced when a new version is installed; removed with site data. |
nimbus.store.v1 (local storage) |
Nothing, on any recent version. It is the key older web builds used before IndexedDB, read once and then deleted. | So an early user's decks were moved rather than lost. | Deleted on first launch after the move. |
Clearing the app's site data erases your decks on that device. If you are signed in they are also on the server and come back when you sign in again; if you are not, they are gone, which is why the app tells you so rather than waiting for you to find out. You can also export a deck to a file at any time, with no account.
Clearing site data removes all of them. The page works fine without any: the theme falls back to your operating system's setting and the font question gets asked again, and you sign in again.
The sign-in token is kept in local storage rather than in a cookie deliberately. A cookie is attached to every request your browser makes to this site automatically, which is what makes cross-site request forgery possible; a value in local storage is only ever sent when our own code chooses to send it. Signing out removes it immediately.
The third-party request question
The website makes none. Its typeface (Outfit) and its icon font (Phosphor) are files on this site, served from the same address as the page, so reading it sends your IP address to nobody but us. Earlier versions loaded both from Google Fonts and unpkg after asking; that request, the banner and the stored answer are gone.
You can check this the same way as the cookie claim: open your browser's developer tools, look at the Network tab, and every request is to this site.
Paying for Nimbus Pro
Checkout is a redirect. Pressing "Get Nimbus Pro"
or "Get Lifetime" sends your browser to a page hosted by Stripe at
checkout.stripe.com, and you come back here afterwards.
Managing or cancelling works the same way.
This matters for what the rest of this page promises. There is no Stripe script on any Nimbus page. Nothing from Stripe loads while you are reading the site, nothing from Stripe can set a cookie on this site, and Stripe learns nothing about you until the moment you deliberately start a purchase. An embedded card form would have meant loading Stripe's JavaScript on every page view, which is exactly the kind of third-party request this site avoids.
Once you are on Stripe's own page you are on Stripe's own site, and the cookies it sets there are governed by Stripe's privacy policy rather than this one.
Stripe is the seller of Nimbus Pro, which is set out in the
privacy policy, so the checkout page, the
receipt and Stripe's order management at link.com are all
Stripe's. None of them loads anything on this site, and nothing about that
arrangement puts a script or a cookie on a Nimbus page: the redirect is
still a redirect, and it still happens only when you press the button.
The desktop app
The app is not a browser page and has no cookies of any kind. Your decks are written to a file on your own disk, and every study feature works with no network at all.
Its content security policy is default-src 'none'. That means
no remote script, stylesheet, image or font can load into the interface, so
a deck you import from a file or clone from the public library cannot
phone home or pull anything in. You can read the policy at the top of
app/renderer/index.html.
This is the complete list of requests the app itself can make:
- The update check, once a day, against the Nimbus download host. It sends no account data and you can turn it off in Settings.
- Sync, only while you are signed in, and only to the server address shown in Settings. Signing out stops it.
- The two AI features, only when you press the button: a question about a card, or a file you chose to generate cards from. These go to the Nimbus server, which passes the text to the model provider. The app never contacts that provider directly. Both are described in detail in the privacy policy.
Nothing from the AI features is stored on your machine. The conversation in the card panel is held in memory while the panel is open and is discarded when you close it: it is not written to your deck file, and it is not synced.
Nimbus · hello@getnimbus.org · Back to the site