Privacy policy
Bimbask Nexus is built to work on your device first. This policy explains plainly what data it uses, what leaves the device (only when you use certain features) and what we keep in the cloud.
النصوص القانونية مكتوبة بالإسبانية والإنجليزية والبرتغالية. تُعرض هنا النسخة الإنجليزية.
Summary
- Your requests, history, notes and learned preferences are kept on your device, in encrypted storage.
- Your voice is not stored, and Nexus does not upload audio.
- Some features read data on your device, always with your permission and only if you turn them on: notifications, e-mail, contacts, the app list and devices on your local network.
- Other features send minimal data to third parties, only when you use them: web lookups, your mail provider and sign-in.
- The cloud is optional: a minimal account profile and, only if you turn on backup, an end-to-end encrypted vault that Bimbask cannot read. It is stored in the United States.
- We do not sell your data, show ads, use an advertising identifier or use your content to train models.
Who we are
Bimbask Inc. (“Bimbask”, “we”) publishes Bimbask Nexus and this website. For any privacy question, write to hola@bimbask.com.
What stays on your device
Nexus keeps the following on your phone and nowhere else, unless you turn on the optional backup:
- The requests you make and the assistant's replies (history).
- Notes and memory you ask it to keep.
- Preferences it learns from how you use it. You can see them in the app and erase one or all of them.
- Your per-app permission settings, your reminders and a log of the actions it performed.
This data is stored in an encrypted file (AES-256-GCM). The key is held in the Android Keystore or the iOS Keychain and is not exported. The file is excluded from iCloud and Android Auto Backup. Today your requests are interpreted on the phone by a rules engine; we are integrating AI models that run on the device.
What Nexus reads on your device, with your permission
Each of these features is off until you turn it on and, where needed, grant the system permission. You can withdraw it at any time.
- Notifications of the apps you allow (Android): enabled app by app in the system's notification access. They are processed in memory and are not stored or sent anywhere.
- E-mail accounts you connect (Gmail, Outlook, IMAP): enabled per account. Nexus keeps summaries in an encrypted cache on your device for 30 minutes. Bimbask does not receive your e-mail.
- Contacts: read at the moment you name someone and not stored in Nexus's history, which keeps only an opaque reference. A number or address goes only to the dialer, messaging or mail app that you confirm.
- Installed or supported apps list: used to know which apps Nexus can open. It is kept in an encrypted cache on your device. If you accept diagnostics, at most the category of an app (for example “maps”) is reported, never the list.
- Microphone: audio is processed by your system's speech recognition (on the device when available). Nexus does not store or upload it.
- Smart-home devices on your local network: Nexus looks for and controls them only when you ask. It keeps the list and their states in an encrypted cache on your device.
Voice and audio
When you use voice, the audio is transcribed by your operating system's speech recognition. Nexus does not store the audio and does not upload it. Depending on your device and language, your operating system may process speech on its own servers; that is governed by the policy of your device's manufacturer. Text always works without voice.
What is sent to third parties, only when you use those features
These calls go straight from your phone and do not pass through Bimbask servers:
- Web lookups: a minimal query, without personal data such as phone numbers, e-mails or card numbers, to services such as Open-Meteo (weather), Wikipedia and Nager.Date (holidays) and, if enabled, a search engine. You choose whether Nexus always looks things up, asks first or never does.
- Mail providers: if you connect an account, the app calls the Google (Gmail) or Microsoft (Graph) APIs, or your IMAP server, directly with your credentials.
- Smart-home vendor services: today Nexus controls compatible devices on your local network or with your own server (for example Home Assistant). If you connect a manufacturer's service, your commands go to that service and are governed by its policy.
- Other services you connect, such as Spotify: used with your authorization and under their own policy.
- Firebase Authentication (Google): to sign in with Google, with Apple (iOS) or by SMS.
Other apps
Nexus can open the apps you allow and prepare actions in them (for example, a message, a route or an event). You choose, per app, what it may do, and it asks for your confirmation before sending, calling, buying or deleting. What you ask it to send (a text, a destination) goes to that app when you confirm, and those apps process your data under their own privacy policies.
What we keep in the cloud, and where
We use Google Firebase. The storage location is the United States (Firestore multi-region nam5), and the backup, once available, is also stored there.
- Account and minimal profile: user id, sign-in provider, e-mail or phone number, language, platform, your consent choices and whether backup is on. You can use Nexus without an account.
- Optional backup: off by default and only starts if you turn it on. Your data is end-to-end encrypted on your device with a key derived from a 12-word phrase that only you know, and only the encrypted result is uploaded. Bimbask cannot read it. For each backup we only see the date, the number of items and the size. If you lose your phrase, we cannot recover it.
Sign-in
Where the app asks you to sign in (for example, to use backup), you can use Google or SMS on Android and iOS, and Apple on iOS only, through Firebase Authentication. The provider shares with us basic account identifiers, such as your e-mail address or phone number, which we use only to identify your account.
Optional diagnostics
Nexus can send usage events and crash reports (Google Analytics for Firebase and Crashlytics) so we can fix problems. They never include the content of your requests, messages or notes, and Nexus does not use an advertising identifier. Crash reports include the error type, the device model and the system version. You can turn this on or off at any time in the app.
The initial value of your consent will follow the law of your region. In the European Economic Area and the United Kingdom, diagnostics stay off until you accept them.
AI model files
Nexus may download AI model files to your device. The download does not include your data. Each model keeps its own license.
This website
This website does not use cookies, analytics or advertising trackers, and its fonts are served from our own domain. Your language and theme choice is stored only in your browser. Our hosting provider (Google Firebase Hosting) may log standard technical data, such as your IP address, when you load a page. If you write to us by email, we use your message only to answer you and to coordinate early access.
Retention
- Account and profile: until you delete your account.
- Backup: until you turn it off or delete your account.
- Diagnostics: according to Google Firebase's retention settings.
- We are still defining periods for inactive accounts.
Your rights and controls
- See and erase what Nexus learned about you.
- Change or revoke the permissions of each app and each feature, and turn diagnostics off.
- Delete your local data, your backup and your account from within the app, or by uninstalling the app (local data).
- Access your data, export it or ask us to delete it by writing to hola@bimbask.com.
International users
If you use Nexus outside the United States, your account, profile, encrypted backup and diagnostics are processed in the United States. We are designing our practices with laws such as the GDPR (European Union and United Kingdom), the LGPD (Brazil) and the CCPA (California) in mind. Depending on where you live, you may have rights of access, correction, deletion, portability and objection, and to withdraw your consent; to exercise them, write to hola@bimbask.com. This document is a draft: the legal bases and the international transfer mechanisms still need legal review.
Children
Bimbask Nexus is not directed to children under 13, and we do not knowingly collect their data.
Changes to this policy
If we change this policy in a meaningful way, we will update the date above and, when appropriate, tell you in the app before the change applies.
Contact
Bimbask Inc. · hola@bimbask.com