Privacy Policy

What we collect. Your email address (account identity and sign-in codes), hashed API keys and OAuth tokens (never plaintext), per-call metering records (tool name, credits charged, latency, timestamp, status, and which version of the Nimrod app made the call), and billing state (plan, credit balance, order references from Polar). Sign-in is by emailed one-time code — we never store passwords.

What we don't collect. Web pages you read with Nimrod are fetched and processed by the Nimrod program on your computer; neither the pages nor their addresses reach our servers. The one exception is optional scraping, which is off unless you turn it on: when your AI app scrapes a page, its address goes to our servers and our scraping provider, which renders the page, and the page's content passes back through our servers to you. We don't store scraped addresses or content beyond the live request; the metering record notes only that a scrape was made and what it cost. We don't store your search queries beyond what is needed to serve the live request. No advertising trackers, no third-party analytics on this site, no sale of any data to anyone.

On your computer. Nimrod keeps its sign-in in ~/.nimrod/credentials.json, readable only by your user account, and adds an entry for itself to the settings of the AI apps you set it up for. In Claude Code it also installs skills, an agent, and hooks under ~/.claude. nimrod uninstall removes all of it.

Processors we rely on. Search queries, and the addresses of pages you choose to scrape, are passed to upstream search and scraping providers under our account (they see the query or address, not your identity). Payments are processed entirely by Polar as merchant of record — we never see card numbers. Sign-in and receipt emails are sent through our own mail provider.

Retention. Metering records are kept for billing accuracy and abuse prevention. Account deletion: email us and we remove your account, keys, and personal data, keeping only the minimal ledger entries required for tax/billing records held by the merchant of record.

Security. Credentials are stored as SHA-256 hashes; transport is TLS-only; webhook payloads are signature-verified; infrastructure lives on a single provider (EU/US hosting) with nightly encrypted backups.

Contact. admin@orchis.ai.