Nimbit is a Chrome extension that suggests the next few words as you type, anywhere on the web. To do that it has to look at what you are writing, so we owe you a clear explanation of what we read, what we keep, and what we throw away.
The short version:
- We read the text around your cursor to make a suggestion, and we keep a record of each suggestion. The text near your cursor, the suggestion, and what you did with it are stored as your suggestion history, which we use to check and improve Nimbit's own models. Nothing is kept when the text looks like a password or key, or on banking, health, or government sites, and you can opt out by emailing us.
- We keep a small amount of memory so suggestions sound like you. That means a short writing-style profile, a short list of what you are working on, a handful of distilled facts, and the suggestions you accepted. Whole writing episodes are summarised and then discarded; only the summary is kept.
- We never read password, payment, or other sensitive fields, and we do not learn from banking, health, or government sites.
- We do not sell your data or show ads. We may use your writing and memory to train and improve our own suggestion models. You can opt out by emailing us.
- You are in control. Pause Nimbit on any site or everywhere, and ask us to delete everything at any time.
This policy applies to the Nimbit browser extension, the website at https://www.usenimbit.com, and the services behind them (together, the "Service"). It is operated by Nimbit ("we", "us"). If you have questions, email hello@usenimbit.com.
1. Information we collect
Account information
You sign in to Nimbit on our website. Sign-in is handled by our authentication provider, Clerk. We receive and store:
- Your email address.
- Your first and last name, if you provide them.
- A user id, and the dates you created your account and last used it.
If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not request access to your Gmail, Google Drive, or any other Google account data.
Billing information
Payments are processed by Stripe. Card numbers go directly to Stripe and never touch our servers. We share your email address and name with Stripe to create your customer record, and we store the Stripe customer id, subscription id, subscription status, your plan, and the date your free trial ends.
What you are writing (used to make suggestions)
When Nimbit decides a suggestion would be helpful, the extension sends the following to our server, which forwards it to our AI provider, OpenAI, to produce the suggestion:
- The text before your cursor in the current field (up to about 4,000 characters) and a shorter amount of text after it.
- The field's label, placeholder, and name, so the model knows what the box is for.
- The site you are on, the page title, and a key identifying the page or thread (for example a Gmail thread id or a GitHub issue number).
- Nearby text on the page, up to about 3,000 characters. In a reply, this includes the message you are replying to.
- In Google Docs, the text around your cursor comes from a plain-text copy of the document (see section 2). The same limits apply: only the text near your cursor is sent, never the whole document.
- If you asked Nimbit to rewrite a suggestion, the instruction you typed and the suggestion you rejected.
- The suggestions you recently accepted on the same page, and up to three short facts from your memory that seem relevant.
- Your local date, so suggestions can refer to "tomorrow" correctly.
Our server keeps this request together with the suggestion it produced and, once the extension reports it, what you did with the suggestion: accepted, dismissed, ignored, or asked for a rewrite. We call this your suggestion history. We use it to check whether a change to our prompts or models makes suggestions better or worse, and to train our own models (section 3). A request is not kept when the text looks like a password, key, or other credential, or when the site is one we never learn from (see the list under Memory). Our logs record only your user id, timing, and token counts, never the text itself.
Memory
Nimbit keeps a small, structured memory so suggestions sound like you. It is stored on your device and synced to your account so it works across browsers.
- Accepted suggestions. When you accept a suggestion, we keep the suggested text together with a short snippet of the text immediately before it (each up to 500 characters), tagged with the site and page it happened on. If the suggestion came from a rewrite, we also keep the instruction you typed (up to 300 characters). We keep the twenty most recent per page.
- Dismissed suggestions. When you dismiss a suggestion, we store an anonymous hash of the context so we stop interrupting you in the same spot. The dismissal itself is also noted in your suggestion history.
- Writing style, what you are working on, and facts. When you finish writing in a field, the extension sends what you wrote in that field (excluding any quoted message you were replying to) to our server. If you asked Nimbit to rewrite suggestions in that field, it also sends each instruction you typed, together with the suggestion you rejected and the one you accepted (each up to 500 characters), because what you ask for is the clearest signal of how you like to write. An AI model, run for us by DeepInfra (see section 4), summarises these into three things: a short writing-style profile (how you greet people, how you sign off, your tone and formatting habits, at most about 1,500 characters), a short list of what you are currently working on (up to twelve items, each with the date it stops mattering when there is one), and up to eight short facts (a date, a commitment, a person's name and what was agreed). We store all three, along with the site each item came from. Your memory never contains the full text you wrote or your rewrite instructions; we keep only a one-way hash of each so we do not process the same text twice. (The text near your cursor at the moment of each suggestion, and any rewrite instruction, live in your suggestion history instead.) Items on the working-on list are removed once their date has passed or after 45 days without coming up again; facts expire automatically after 90 days.
Writing is only captured from fields containing at least 120 characters of which you typed or accepted at least 80 yourself. Rewrite instructions are captured whenever you give one. Neither is ever captured from:
- Password, payment card, one-time-code, or other fields marked as sensitive by the website.
- Code editors, or any text that looks like credentials, keys, configuration, or source code.
- Sites whose address suggests banking, payments, health care, tax, or government (any
.govdomain), based on a built-in keyword list. - Any site where you have paused Nimbit.
Usage information
To understand whether suggestions are useful and to keep the service reliable, the extension reports an event for each suggestion: whether it was accepted, dismissed, ignored, or failed; how long you paused before it appeared; how long it took to arrive; how many characters were accepted; the type of field; the site; an anonymous fingerprint of the field; and the internal scores that decided whether to show it. These events do not contain the text you typed or the text of the suggestion, but each one is linked to the matching entry in your suggestion history.
We also count your requests per minute and per day, and estimate the cost of each, to enforce fair-use limits.
The extension keeps a local tally of suggestions shown and accepted for the usage chart in its popup. That tally stays in your browser and is not sent to us.
Technical information
When you use the website or the extension talks to our server, our hosting providers record standard connection information such as your IP address, browser type, and the time of the request. We use it for security and troubleshooting. The website sets the cookies needed to keep you signed in.
The website also uses PostHog, a product analytics service, so we can see which pages people visit and where they get stuck. PostHog receives the pages you view, the links and buttons you click, your browser and screen size, an approximate location worked out from your IP address, and a random identifier stored in your browser so that repeat visits can be counted. It may also record a replay of how you moved through a page; anything you type into a form is masked before it leaves your browser. This runs only on the website, never inside the extension, and we do not run advertising trackers anywhere.
Communications
If you email us, we keep the email so we can answer you and improve support.
2. How the extension works in your browser
The Chrome Web Store asks us to be specific about what an extension can do, so here it is.
- Runs on every page. Nimbit's content script runs on all sites so it can attach to whatever text field you focus. It only reads a field once you focus it and start typing, and it reads nearby page text once per field to understand the context.
- Storage. The extension stores your preferences (paused sites, whether the companion is hidden, whether you have seen the welcome bubble), your local usage tally, and a local copy of your memory in the extension's own storage. It also queues suggestion events and memory updates locally so nothing is lost if the connection drops.
- Cookies. The extension reads the sign-in cookie from our own website, and only our website, so you do not have to sign in twice.
- Active tab. When you open the popup, the extension reads the current tab's address so it can offer to pause Nimbit on that site.
- Crash reports. If the extension runs into an error, it sends a report to our server describing the error: the extension version, your browser, the address of the page it happened on, the error message and where in our code it occurred, and your user id. Never the text you typed. We forward these reports to Sentry, an error-monitoring service, so we can fix bugs. If you use "Report a problem" in the popup, your description is sent the same way, and, if you tick the box, the last few lines of the extension's own log (page addresses and timings, never text) are included. We keep problem reports on our server for up to 180 days so we can follow up.
- Google Docs. Google Docs draws documents on a canvas, so the extension cannot read the text of the page directly. While you are editing a document, the extension asks Google for a plain-text copy of that document using your existing Google sign-in, the same way Google's own File > Download works. That copy stays in your browser and is not stored. Only the pieces described in section 1 reach our server: the text near your cursor and nearby text with each suggestion, and, for the memory feature, up to about 4,000 characters of the document once you have written in it. Nimbit never reads documents you are not editing, and never reads Google Drive, Sheets, Slides, or any other Google service.
- Network. The extension talks only to our server, to our authentication provider, and, in Google Docs, to Google to fetch the document copy described above.
Signing out or switching accounts wipes the memory and queues stored locally in the extension. Uninstalling the extension removes everything it stored in your browser.
3. How we use information
- To provide the Service: generate suggestions, sync your memory across devices, keep you signed in, and run your trial or subscription.
- To personalise suggestions: the memory described above exists so suggestions match your voice and know what you are working on.
- To keep the Service working and safe: enforce fair-use limits, detect abuse, troubleshoot errors, and secure accounts.
- To improve Nimbit: we analyse suggestion events in aggregate to tune when suggestions appear and how good they are, and we may use your writing, your memory, your suggestion history, and the suggestions you accept or dismiss to train and improve our own suggestion models.
- To communicate with you: answer support requests and send account notices such as receipts or trial reminders. We will not send marketing email unless you opt in, and you can unsubscribe at any time.
- To comply with the law and enforce our Terms of Service.
Training. We may train and improve our own AI models using your content, so that suggestions get better at sounding like you and like people who write the way you do. Models trained this way are used only inside Nimbit and are never sold or shared. If you do not want your content used to train our models, email hello@usenimbit.com and we will exclude your account.
4. Who we share information with
We do not sell your personal information, and we do not share it with advertisers. We share it only with the providers we need to run the Service, each of which is bound by contract to use it only to provide their service to us:
| Provider | What they do for us | What they receive |
|---|---|---|
| OpenAI | Generates suggestions; creates the search vectors used to recall facts | The suggestion request described above; the facts distilled from your writing |
| DeepInfra | Summarises what you wrote into your writing-style profile, the list of what you are working on, and facts | The text you wrote in a field, the rewrite instructions you gave, your current style profile, and the list of what you are working on |
| Clerk | Sign-in and sessions | Email, name, sign-in method |
| Stripe | Payments and subscriptions | Email, name, payment details you enter with Stripe |
| Supabase | Hosts our database | Everything we store, described above |
| Cloud hosting providers | Run our website and server | Connection information |
| PostHog | Website analytics | The pages you visit, clicks, browser details, and approximate location, as described in section 2 |
| Sentry | Error monitoring | Error and problem reports from the website, the extension, and our server: error messages, code locations, extension or browser version, page address, and your user id, as described in section 2 |
We use OpenAI's developer API under its business terms and DeepInfra's API under its zero-data-retention terms, under which DeepInfra deletes each request once it has returned the result. We send only what is needed to produce the response.
We may also disclose information if required by law, to protect the rights and safety of our users or ourselves, or as part of a merger, acquisition, or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.
5. How long we keep information
| Information | Kept for |
|---|---|
| Suggestion history (the text around your cursor, nearby page text, the suggestion, and what you did with it) | Until you delete your account. Not kept when the text looks like a credential, on sites we never learn from, or if you have opted out of model training |
| Text you wrote in a field (writing episodes) | Not stored; summarised and discarded. A one-way hash is kept to avoid reprocessing |
| Rewrite instructions, with the suggestion you rejected and the one you accepted | Summarised into your memory and discarded there (a one-way hash is kept to avoid reprocessing). The instruction is also kept with the accepted suggestion it produced, under the accepted-suggestions rule above, and in your suggestion history |
| Facts in your memory | 90 days from creation, then deleted automatically |
| What you are working on | Until the item's date passes or 45 days after it last came up, whichever is first, or until you forget it |
| Writing-style profile, accepted suggestions, dismissal hashes | Until you forget them from your account page or delete your account |
| Account and billing records | While your account exists, then as long as needed for tax and accounting law |
| Usage events and request counts | While your account exists; we may keep aggregated statistics that no longer identify you |
| Support emails | Up to two years |
6. Your choices and rights
- Pause on a site. Hover the Nimbit companion in any field, or open the extension popup, and pause Nimbit on that site. Nothing is read or remembered there until you resume.
- Pause everywhere. Use the popup toggle or the keyboard shortcut (Alt+Shift+N by default).
- Hide the companion from its menu.
- Sign out or uninstall. Signing out wipes local memory. Uninstalling removes everything in your browser.
- See, download, or delete your data. Your account page at https://www.usenimbit.com/account shows your writing-style profile, what Nimbit thinks you are working on, and every fact it remembers, lets you forget any one of them or all of them, downloads everything we hold as a file (including your suggestion history), and deletes your account. Forgetting your memory does not remove your suggestion history; deleting your account removes both. Deleting your account cancels any subscription and erases everything at once. If you would rather email, write to hello@usenimbit.com from your account's email address and we will do it within 30 days.
- Opt out of model training. Email hello@usenimbit.com and we will exclude your account's content from training our models and stop keeping your suggestion history.
- Cancel your subscription from your account page at any time.
If you live in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict or object to our processing of, and receive a portable copy of, your personal data, and to complain to your local data protection authority. Our legal bases for processing are: performance of our contract with you (providing the Service, billing), our legitimate interests (keeping the Service secure, improving it, and training our own models, which you can object to at any time), and your consent where we ask for it. We are based in the United States and process your data there under standard contractual clauses.
If you live in California or another US state with a privacy law, you have the right to know what personal information we collect and how we use it (this policy), to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell or share personal information for advertising and do not use it for profiling that produces legal or similarly significant effects. To exercise any right, email hello@usenimbit.com. You may use an authorised agent; we will ask for proof of authorisation.
7. Security
Data travels between the extension, our server, and our providers over encrypted connections. Our database is not reachable from the browser: every request goes through our server, which verifies your signed-in session first. Access to production systems is limited to the people who run Nimbit. No system is perfectly secure, so please use a strong sign-in method and tell us at hello@usenimbit.com if you think your account has been compromised.
8. Children
Nimbit is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, email us and we will delete it.
9. Changes to this policy
We will post any changes here and update the effective date at the top. If a change materially affects how we use your information, we will also tell you by email or in the extension before it takes effect.
10. Contact
Email hello@usenimbit.com. A person will answer.