NimbuScope privacy policy

Last updated: 1 November 2026

NimbuScope is an iPhone app that tells you, for a place and a day, whether the sunlight gets through at sunrise or sunset, taking the mountains and the forecast clouds into account. This policy explains which personal data we process, in the app and on the nimbuscope.com website and its waitlist, why, for how long, and what your rights are.

An account is optional: without one, all of NimbuScope works, subscription included.

Data controller

Bulb Mode SRL Semplificata, Via Ancona 15, 60035 Jesi (AN), Italy, VAT IT02730980428.

Contact: info@bulbmode.com

What data we process

Without an account. No personal data reaches us. Your phone's location, the places you look at and your preferences stay on the phone.

Account, if you sign up:

• your email address;
• your name, if you type it or if Apple or Google give it to us when you sign in;
• how you sign in (Apple, Google, or email with a 6-digit code) and an account identifier;
• the app language (Italian or English), so we write to you in your language.

If you sign in with Apple you can hide your email: in that case we receive an address forwarded by Apple, not yours.

Profile. A photo you choose from your library (scaled down to a 512 × 512 pixel square), or one of the app's painted skies, or your initials. The photo is kept in a private store that only your account can read.

Your content. The places you save (name, area, coordinates, elevation, date) and the app preferences (units, map style and theme, place names, rain on the map, what to open at launch). They come back on every iPhone where you sign in with the same account.

Email lists. Everyone who signs up joins the "NimbuScope users" list, with email, name, sign-in method, language, sign-up date and account identifier. Whoever turns on the "News and guides" consent also joins the consent list (see below).

Consents. When you turn the consent on or off, or unsubscribe from the link in a news email, we record what happened, when, the version of the text you saw and the app version. The record does not contain your email but a fingerprint: a code derived from the email one way only, from which the email cannot be rebuilt. It is pseudonymous, not anonymous data: anyone who already knows an address can compute its fingerprint and find it in the record, which is why only we can read it. It lets us prove a consent if someone disputes it: whoever complains gives us their address, we compute its fingerprint and find its history.

Subscription. The subscription is bought and managed with your Apple ID: payment data is handled by Apple only. The app reads the subscription status from your Apple ID; today we do not store it on our servers. If you buy while signed in, Apple receives your NimbuScope account identifier with the purchase.

Location. Your phone's location is used to work out light and times on the phone and is not sent to us. To give the point a name, its coordinates go through Apple's map service. The coordinates of the places you save, instead, are kept in your account: if you save the spot where you are, they are your phone's precise location at that moment.

Technical data. IP addresses and request times stay in our providers' logs, for security. To draw the map and work out the light, the app downloads public data from these services, which see the phone's IP address and the area requested, never account data: Cloudflare (clouds), OpenFreeMap (map), Amazon Web Services (terrain), Esri (satellite imagery, only with the Satellite style) and Apple (place search, which also sees the text you type, and the name of the point).

The emails we send you

Service emails, to everyone who signs up: the sign-in code, the PDF guide to using NimbuScope (once, after you sign up) and emails about your account, security, subscription and changes to the terms. They contain no offers and have no unsubscribe link: they arrive as long as you have the account.

"News and guides", only with your consent. It is a switch that starts off, in the "Your profile" step and in Account › Email; you don't need it to get the guide. The text you see next to it (version 2026-10-24.2):

Stay up to date on the new features we release, guides and tips. No spam, we promise! Optional: the guide arrives anyway. Turn it off any time.

Turn it off whenever you like, in Account › Email or from the link at the bottom of every news email: the app and the lists catch up on their own.

Sign in with Apple. If you turn off Apple's email forwarding, Apple tells us and we note it in your profile: our emails no longer reach you until you turn it back on. If you delete your Apple ID, Apple tells us and we delete the account. If you stop using Sign in with Apple for NimbuScope, the account stays and the app signs you out: you can sign in again or delete it from the app.

The NimbuScope waitlist

On nimbuscope.com you can leave your email to hear when NimbuScope is ready.

• What we collect: your email address and the language of your browser (Italian or English), so that we write to you in your language. To protect the list from abuse, for 24 hours our server also keeps a fingerprint of your IP address and of your email: a one-way code, not the address itself.
• Why: to send you the email that confirms your address, then emails about the beta and the launch of NimbuScope. Nothing else, and no advertising.
• Confirmation: you join the list only after you open the link in the confirmation email (double opt-in). If you don't confirm it, we don't write to you again.
• Where: in the Brevo account of NimbuScope (Sendinblue SAS, France, data in the EU), not in the account that sends Francesco Gola's newsletters. The request goes through our server on Supabase in Frankfurt (EU), which does not keep your email.
• How to leave: from the link at the bottom of every email we send you, or by writing to info@bulbmode.com. You leave the list at once.

The website. nimbuscope.com uses no cookies and no analytics, and serves its fonts itself. It is hosted on GitHub Pages: to deliver the pages, GitHub receives your IP address and may keep it in its logs, for security.

Why, and on what legal basis

• Creating and keeping your account, syncing places, profile and preferences: performance of a contract (Art. 6(1)(b) GDPR).
• Sending you the guide to using NimbuScope and service emails: performance of a contract and legitimate interest (Art. 6(1)(b) and (f)).
• Sending you "News and guides": only with your consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code), which you can withdraw at any time with no effect on how you use the app.
• The waitlist: only with your consent, given when you confirm your email (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code), which you can withdraw at any time.
• Keeping the consent record and protecting the service and the waitlist from abuse: legitimate interest (Art. 6(1)(f)).

Who receives the data

Our providers, who process it on our behalf as processors, under an agreement pursuant to Art. 28 GDPR:

• Supabase Inc.: sign-in, account, profile, photo, places, preferences and consent record, on servers in Frankfurt (EU);
• Sendinblue SAS (Brevo), France: the email lists, kept in two Brevo accounts (Bulb Mode's and a second account that sends the newsletters), and sending the emails, the sign-in code included;
• Francesco Gola, who sends emails to our users on our behalf from the second Brevo account (processor);
• Cloudflare Inc.: only the cloud data the app downloads; it sees the IP address, no account data;
• GitHub Inc.: the hosting of nimbuscope.com; it sees the IP address of whoever visits the site.

Apple and Google, when you use them to sign in, process your data as independent controllers under their own privacy policies. So do the services the app downloads the map and terrain from or searches places with, which receive the phone's IP address and the area requested: OpenFreeMap (map), Amazon Web Services (terrain), Esri (satellite imagery) and Apple (place search and the name of the point: also the text you search for and the coordinates of the point). We do not sell data and we do not use it for advertising or to track you across other apps.

Transfers outside the EU

Account data is kept in Frankfurt. Supabase, Cloudflare and GitHub are US companies: any transfers take place under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Amazon Web Services, Esri and Apple are US companies too: terrain, satellite imagery and place search requests may reach servers in the United States, under the terms of their own privacy policies.

How long we keep it

• Account, profile, places and preferences: as long as you have the account. If you delete it from the app (Account › Delete account) they go away at once, and from the backups within 30 days. If you are also subscribed to other lists of ours, with a separate consent, or had unsubscribed, your email stays only there, with name, language and the identifier of the deleted account, to respect that choice; the rest of NimbuScope goes away.
• Email consent: until you withdraw it.
• Waitlist: until you leave it, and at the latest six months after the launch of the app, when we close the list. The fingerprints of IP address and email that protect it from abuse: 24 hours.
• Consent record: 10 years, with the fingerprint of the email and not the email, so that we can prove a consent if it is disputed. If the consent was on, deleting the account also leaves a line in it.
• Technical logs: as long as our providers keep them, usually a few days.

Your rights

You have the right of access, rectification, erasure (also from Account › Delete account), restriction, portability, objection and withdrawal of consent (Arts. 15-22 GDPR). Write to us at info@bulbmode.com. You can also lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Children

NimbuScope is not meant for anyone under 14.

Changes

If we change this policy in a significant way, we will tell you in the app or by email.