Privacy Policy

4 Pi Labs LLC, a Texas limited liability company doing business as NimbusWatch (“we”, “us”, “our”), operates the NimbusWatch service. NimbusWatch is a monitoring service that watches your website’s uptime and latency and reads your AWS account (spend, security posture and cost waste) so you get a plain-English alert when something breaks or costs too much. This policy explains what information the service handles, why, how it is protected, and the choices you have. It applies to anyone who visits the NimbusWatch website or uses the service.

Account information. When you create an account we collect your email address and a password. The password is immediately hashed with PBKDF2-HMAC-SHA-256 and never stored or readable in plain text; even we cannot look at your password. We use your email to identify your account and as the address we would reach you at about it.

Session information. When you sign in, your browser receives a session cookie (an httpOnly cookie named nw_session) holding a random token. The database stores only a hash of that token, so a stolen database cannot be used to impersonate your session. See Section 8 for more on cookies.

Monitors and check history. You tell us which website or app URLs to watch. For each check we record whether it answered, the HTTP status code, and how long it took (latency). We read and immediately discard the body of the page. We never store the contents of the pages we check.

AWS connection. To watch your AWS spend and posture you connect your AWS account with read-only credentials (a read-only cross-account role you create from a one-click template we give you, or an access key you paste in). Those credentials are encrypted at rest with AES-256-GCM and are used only to read the data you asked us to watch. See Section 3 for the read-only promise in full.

AWS data we read, and what we store. With read-only access we obtain your month-to-date spend from AWS Cost Explorer, run security-posture checks (for example: public S3 buckets, security groups open to the world, IAM users without multi-factor authentication), and run cost-waste checks (for example: idle resources and oversized instances). We store the results (spend totals, scan findings, and the estimated monthly dollar figures attached to cost-waste findings) so your dashboard can show them over time. We do not copy your AWS data wholesale; we store the findings, not your cloud.

Alerts. When an alert fires we store the alert itself (what happened, when) so your alert feed shows history. If you enable Slack alerts, you give us an incoming-webhook URL for your Slack workspace; that URL is encrypted at rest with AES-256-GCM and is used only to post the alerts you asked for to that workspace. If you turn on email alerts, they go to the email address on your account.

Payment information. Payments are handled by Stripe, our payment provider. We never see or store your full card number; we receive from Stripe only the information needed to run your subscription (billing status).

Technical information. Our hosting provider may keep standard server logs (IP address, browser, pages visited) for security and reliability, as is normal for any website hosted on cloud infrastructure. We do not use such logs to build profiles of visitors.

Messages you send us. If you email support@nimbuswatch.com, we keep the message so we can act on it — a refund, a question, a request about your data — and so we have a record of what we were told. We do not use it to build a profile of you, we do not add you to a mailing list, and we do not sell it.

NimbusWatch never makes a change in your AWS account. It never creates, changes, deletes, starts or stops anything in it: no resources, no permissions, no billing settings. Every action the IAM policy we provide grants only reads your account, with one exception: iam:GenerateCredentialReport. AWS labels that one a Write action, but it only asks IAM to compile a report about your account and changes nothing — it is the action AWS ships in its own read-only IAMReadOnlyAccess policy. You can read the policy yourself before you consent, and you can revoke access at any time by disconnecting the account in your settings or by deleting the access key or role in your AWS console.

We use the information we collect to:

• create and manage your account, keep you signed in, and authenticate you;
• run the checks and scans you asked for and show you their results;
• send you the alerts you configured, in the app, to Slack if you enabled it, or by email (Slack and email are Starter and up);
• read your AWS spend so we can compare it against the budget you set;
• apply your plan’s limits, and process billing through Stripe;
• read and act on your requests and questions;
• keep the service secure, fix bugs, and prevent abuse; and
• comply with the law.

We do not sell your personal data. We do not use it for advertising, and we do not share it with data brokers. We do not use the content of your monitors or your AWS findings for anything other than providing the service to you.

We share information only with the people and services needed to run the service:

• Stripe: processes payments. Stripe has its own privacy policy that applies to the payment data it handles.
• Slack: only if you enable Slack alerts. We post the alert messages you asked for to the workspace whose webhook you provided. We cannot read anything else in your Slack workspace.
• An email-delivery provider: sends the alert emails you switch on, to the address on your account. It handles the message and the address it is sent to, and nothing else.
• Hosting and database providers: the cloud infrastructure that stores our data and runs the service (the database that holds your account and monitoring data). These providers process data on our behalf under their own security obligations.
• HeyCatch: our web-analytics provider. It records which pages are visited and, once you sign in, which account the visit belongs to.
• Google Analytics: a second web-analytics service (a Google product). It records which pages are visited, for the same purpose and nothing else. We do not send it your account, your email address or anything about your monitors, your AWS account or your billing.
• New Relic: a browser monitoring service. It records which pages are visited, how quickly they load, the requests a page makes and the errors a page runs into, so we can see when the site is slow or broken. It is used for that purpose and nothing else, and we do not send it your account, your email address or anything about your monitors, your AWS account or your billing.
• AWS: we call AWS read APIs (Cost Explorer, security and resource-data APIs) on your behalf using the credentials you provided. AWS sees those calls as coming from your account’s identity.
• Where the law requires it: we may disclose information to courts, regulators or law enforcement when legally required, and we will tell you when we are allowed to.

If NimbusWatch is ever sold or merged, your data transfers as part of that transaction, and we will notify you before it happens.

• Traffic to and from the service is encrypted in transit (TLS).
• Passwords are hashed with PBKDF2-HMAC-SHA-256 and never stored or sent in plain text.
• Sessions are stored as hashes of random tokens, in httpOnly cookies, and expire.
• AWS credentials and Slack webhook URLs are encrypted at rest with AES-256-GCM, and are only decrypted in memory for the calls that need them.
• Access to production data is limited to the people and processes that need it to run the service.

No security is perfect. We cannot guarantee that a breach can never happen, but we follow industry-standard practices, and we would say so on this site promptly.

• Account data (email, hashed password, settings) is kept while your account is active.
• Monitor check history is kept while your account is active. Your plan sets the window the dashboard shows and reports on (1 day on Free, 30 days on Starter, and 90 days on Pro and Scale, as shown on the plans page); checks older than that window are still stored, and are not shown in it.
• AWS credentials and Slack webhook are deleted as soon as you disconnect the AWS account or remove Slack alerts in your settings, and no later than when you close your account.
• Spend totals, scan findings and alert history are kept while your account is active so your dashboard shows history.
• Messages you email us (for example to support@nimbuswatch.com) are kept while we need them to handle your request and for our records. This is separate from your account: if you close your account, a message you emailed us is still held unless you ask us to delete it.
• After you close your account we delete or anonymize your personal data within 30 days, except where the law requires us to keep records (for example, billing records held for tax purposes; note that your payment details themselves sit with Stripe, not us), except messages you emailed us, which are held as described in the bullet above, and except data in backups, which is deleted on the backup schedule.

Essential. When you sign in or create an account we set one session cookie (nw_session) that keeps you signed in. It is httpOnly, so scripts running in the page cannot read it. It lapses 30 days after you sign in, and signing out or closing your account deletes it. Your browser can be set to refuse cookies, although the dashboard then will not be able to keep you signed in.

Attribution. Two more cookies record how you arrived, so we can see which of our own links actually work. nw_referred_by is set when you follow a referral link: it holds the referral code, so the person who shared the link can be credited if you later sign up. nw_demo is set when you open the sample-findings demo page: it holds a random id that lets us tell a demo view led to a signup. Both lapse 30 days after they are set, and both are deleted when you create an account. Neither carries your name or your email address.

Web analytics. The site loads a web-analytics service, HeyCatch, which records which pages are visited so we can see which parts of the site are used. When you sign in we tell HeyCatch which account the visit belongs to, and when a subscription starts we send it an event saying so. We use this only to understand how the site and the product are used. The site also loads Google Analytics, which records which pages are visited for that same purpose, and New Relic, a browser monitoring service, which records which pages are visited, how quickly they load, the requests a page makes and the errors a page runs into, so we can see when the site is slow or broken. These services set their own cookie or browser identifier in your browser so each can tell one visit from another; that identifier is not your account, and it is not your name.

You control how much of your data we hold. In your account settings you can disconnect an AWS account, delete monitors, and remove Slack alerts at any time; each removal deletes the corresponding stored data. You can close your account entirely, which starts the deletion described in Section 7.

Depending on where you live, you may also have rights to access, correct, delete or export your personal data, and to object to or restrict certain processing. To exercise any of these, email support@nimbuswatch.com (see Section 13); we read every message sent there. When you write, write from the email address on your account, because that is how we check the request really came from you; we will not hand your data to someone pretending to be you.

The service is for adults running websites and cloud applications. It is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us their data, contact us and we will delete it.

The service runs on cloud infrastructure, which may mean your data is processed or stored in countries other than the one you live in. Where your hosting provider and database location are set, that is where the data lives; by using the service you consent to this. We apply the same protections described in Section 6 regardless of location.

If we change this Privacy Policy, the “last updated” date at the top of this page changes and the new version is posted here. If a change is material (for example, a new kind of data or a new reason for sharing), we will announce it on the NimbusWatch website before it takes effect.

Questions about this policy, your data, or the choices you have? Email support@nimbuswatch.com — we read every message sent there. To delete your account and everything in it, use Settings; it takes effect immediately.