Privacy Policy
This policy explains how DocNimble handles data across browser tools, worker tools, accounts, billing, support, cookies, analytics and advertising.
Last updated: 15 July 2026
1. Browser-processing tools
Tools labelled client process supported files using code running in your browser. DocNimble does not receive the source file contents through the tool workflow. The browser may hold file data temporarily in memory until the tab is closed or refreshed. We may receive ordinary web-server request information such as route, time, IP address and user agent, but not the document bytes processed locally.
2. Worker-processing tools
Tools labelled worker require an upload only after the user deliberately submits a job. Inputs are stored under a random job identifier in a protected directory, made available to the authenticated shared worker through an expiring token, and scheduled for automated deletion. Outputs are accepted only after signed callback verification, allowlisted download, size checks and checksum verification. Worker tools are not represented as live until capability and end-to-end evidence exist.
3. Accounts and billing
When you register, we store your name, email, hashed password, role, status and sign-in timestamps. Passwords are hashed and are not stored in readable form. If paid billing is enabled, Razorpay processes payment details. DocNimble stores provider order and payment identifiers, amount, plan, payment status and invoice records; it does not store complete card or UPI credentials.
4. Support messages
The contact form stores the name, email, subject, message, time and a one-way hash of the source IP for abuse control. Do not send confidential document contents. Support records are retained only as long as reasonably necessary for response, security and legal obligations.
5. Cookies and consent
Essential session and CSRF cookies secure authentication and forms. Optional analytics and advertising cookies remain disabled until the user chooses them. Before advertising is activated for EEA/UK traffic, DocNimble must configure a Google-certified Consent Management Platform. The built-in preference panel is a first-party fallback and is not described as certified.
6. Google and third-party advertising
DocNimble may later use Google AdSense only after the content, indexing, traffic, trust and consent launch gate is met. Google and other third-party vendors may use cookies or similar technologies to serve and measure ads based on visits to this and other sites, subject to consent and applicable law. Manual ad units are restricted to reviewed content pages. No ad is permitted in an upload, Run, job-status or download workspace, and Google Auto Ads must remain disabled.
7. Analytics
Google Analytics may be configured after consent controls and a valid measurement identifier are in place. Analytics scripts are not loaded for users who have not granted analytics consent through the configured mechanism.
8. Security and retention
Protected directories are denied from direct HTTP access. Database queries use prepared statements. Worker callbacks use HMAC signatures, timestamps and replay protection. Automated cleanup removes expired job files, tokens, nonces and rate-limit records. No system can promise absolute security; users should avoid processing material beyond their approved risk level.
9. Your choices
You can reject optional cookies, clear browser data, avoid creating an account, use live browser tools without signing in, or request correction/deletion of eligible account and support data. Legal, fraud-prevention and accounting retention duties may limit deletion.
10. Contact
Send privacy questions to hello@docnimble.com or use the contact form.