Privacy Policy

1. Data controller

The data controller is Eren Cansev, the individual developer and publisher of the App. For any privacy question or request: mee.cansev@gmail.com

2. Data we collect

Account data. Signing in with Apple or Google is required. Sign-in is handled by Google Firebase Authentication. We store your email address (Apple's relay address if you choose "Hide My Email"), the user ID (uid) assigned to you, and your name/display name if you share it. We never see your password.

Content you upload and create. PDFs, slide images and notebook photos you upload; notes, flashcards and quizzes generated from them; questions you ask and answers you receive in the course chat; your study progress (spaced-repetition history, card ratings) and the exam dates you enter.

Subscription data. If you buy Premium, purchase information (product, purchase and renewal dates, subscription status) reaches us through Apple and RevenueCat. Payment and card details are processed only by Apple and never reach us.

Notification data. If you allow notifications, your device's push token and notification preferences are stored. Study reminders are scheduled locally on your device.

Technical data. Our service providers' servers may process technical connection data such as IP addresses in short-lived logs to deliver requests and prevent abuse. The App contains no advertising, analytics or tracking SDKs.

Please note: do not upload documents containing identifiable health data of patients or other people. Nimbus is not designed to process such data.

3. Purposes and legal bases

• Creating your account, identifying you and syncing your data across devices — performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• Generating notes, flashcards, quizzes and answers from your content and storing your study progress — performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• Verifying your subscription and applying plan limits — performance of a contract and legal obligations (KVKK art. 5/2-c, ç; GDPR art. 6(1)(b), (c)).
• Sending notifications such as "your note is ready" and study reminders — the notification permission you grant on your device, which you can withdraw at any time in iOS Settings.
• Keeping the service secure and detecting abuse and errors — legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
• Answering support requests — performance of a contract and legitimate interests.

We do not use your data for advertising, profiling, or automated decision-making within the meaning of GDPR art. 22.

4. AI processing

To generate notes, flashcards, quizzes and chat answers, the content you upload and the questions you ask are sent to Google's Gemini models through Google Cloud Vertex AI. Google acts as our data processor for this.

Under the Google Cloud terms of service, Vertex AI does not use customer data to train AI models. We do not use your content to train any model either.

Generated content may be inaccurate or incomplete and is not medical advice. See the Terms of Use.

5. File conversion

PowerPoint (PPTX), Keynote and Word files are converted to PDF on our own Google Cloud Run server so they can be processed. Temporary files are deleted from the server once conversion finishes.

6. Shared note cache

If the same PDF has already been processed with the same settings, a previously generated note may be reused to reduce cost and waiting time. This cache is keyed by a hash computed from the file's contents and contains no user identity: we do not record whose file a cached note was generated from.

For that reason, anonymous cached copies are not linked to your account and may not be deleted when you delete your account. Write to us if you would like a cache entry removed.

7. Where data is stored and service providers

Your account and content data are stored in Google Firebase (Cloud Firestore and Cloud Storage) in the europe-west1 (Belgium) region. The following providers process data only on our behalf and to provide the service:

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Run, Vertex AI) — sign-in, storage, server processing, file conversion and AI. Privacy · Google Cloud privacy
• Apple — Sign in with Apple, in-app purchases and push notifications (APNs). Privacy
• Google Sign-In — if you sign in with your Google account. Privacy
• RevenueCat — subscription management. RevenueCat receives only your anonymous app user ID (Firebase uid) and purchase information. Privacy
• Expo (650 Industries) — the push token and notification content, to relay push notifications to Apple. Privacy

Some of these providers (e.g. RevenueCat, Expo, Firebase Authentication) may process data outside Europe, including in the United States. Such transfers rely on safeguards offered by the providers, such as standard contractual clauses, in line with KVKK art. 9 and GDPR Chapter V.

We do not sell or rent your data or share it with anyone for advertising. Unless legally required, we do not disclose your data to anyone other than the providers above.

8. Retention and account deletion

We keep your data for as long as your account exists.

You can delete your account at any time in the App under Settings → Delete account (Ayarlar → Hesabı sil). This immediately and permanently deletes your account, all your courses, notes, flashcards, quizzes, chats, study history and every file you uploaded from our servers. If you cannot access the App, you can also request deletion by writing to mee.cansev@gmail.com from the email address linked to your account.

Exceptions: Apple and RevenueCat may keep purchase records under their own policies for tax and accounting obligations; anonymous cache entries described in section 6 are not linked to your account and may not be deleted.

9. Security

Data travels between your device and our servers over encrypted (TLS) connections and is stored encrypted on Google's infrastructure. Database and file access is restricted by security rules so that each user can access only their own data. No system is 100% secure; if a data breach occurs we will notify you and the relevant authorities within the legal deadlines.

10. Your rights

Under KVKK art. 11 and the GDPR you have the right to:

• learn whether your personal data is processed and access it,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties, in Türkiye or abroad, to whom data is transferred,
• have incomplete or inaccurate data corrected,
• have your data erased,
• restrict processing and object to processing based on legitimate interests,
• receive your data in a structured, commonly used format (data portability),
• withdraw any permission you have given (e.g. notifications) at any time,
• object to an outcome against you arising solely from automated analysis,
• claim compensation for damage caused by unlawful processing.

Send requests to mee.cansev@gmail.com from the email address linked to your account. We respond free of charge within 30 days at the latest. We may ask for additional information to verify your identity.

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, in the EU/EEA, with the data protection authority of your country.

11. Children

Nimbus is intended for medical students and is not directed at children under 13. We do not knowingly collect data from children under 13. If your country sets a higher age for digital services and you are below it, you should use the App only with the consent of a parent or guardian. If you believe a child has given us data, contact us and we will delete it.

12. Changes

We may update this policy from time to time. The current version is always on this page and the "Last updated" date above will change. We will also announce material changes in the App.

13. Contact

Eren Cansev — mee.cansev@gmail.com