Last updated 19 October 2026 · applies to the free beta
The short version. Your CRM lives on your own device. It is only copied to our server if you sign in, and only so you can use it on more than one device. We do not sell anything, we do not run advertising or third-party analytics, and you can take everything with you or delete it at any time from Settings.
If you never sign in: nothing. The app runs entirely in your browser and stores your modules and records there. No account exists and we have no way to identify you.
If you sign in with Google, we receive and store your email address, your name, and your profile picture URL. We use these to identify your workspace, to show who you are in the app, and to name you to colleagues if you join a team. We do not receive your Google password and we ask for no access to any other Google service.
Your CRM contents — the modules, fields and records you create — are stored on our server so they can sync between your devices and, if you are on a team, be shared with that team.
Operational records: we keep a log of sign-ins and syncs, used to see whether the service is working and how much of it is being used. These expire automatically after 90 days.
Problem reports: if you use Report a problem, we store what you wrote plus your app version, the screen you were on, your browser, your sync status, how many modules and records you have, and up to ten recent error messages from your browser's console. The app tells you this before you send. Reports are deleted automatically after 90 days.
The service runs on Render (hosting) and MongoDB Atlas (database). Both hold the data on our behalf in order to run the service. Sign-in is provided by Google. The daily backup is stored on GitHub, in a private repository we control. That backup is encrypted (AES-256) before it is stored, with the passphrase held separately, so being able to download the file is not the same as being able to read it.
If a problem report is sent, we receive a notification through Telegram containing your email address and what you wrote — so Telegram holds that much, and nothing else. The diagnostic details and any error messages stay in our database and are not forwarded anywhere.
If your team switches on the daily digest, your workspace sends a short message to a destination your workspace owner chooses — a team chat, usually. It carries the workspace name, module names and counts only: never a record, a name or a value. That destination is your team's choice rather than ours, so it is not on our list below; the owner who set it up knows where it points.
Sending reminders by email. A workspace owner may connect their own email account with Resend or Postmark. When they do, and when somebody on that team sends an overdue reminder, the customer's email address and the text of that reminder go to whichever of those two services the owner chose. That is their account and their contract with that provider, not ours — we hold the key only so the reminder can be sent, we never show it back to anybody, and it is removed from our nightly backup. Nothing is sent automatically. If no provider is connected, reminders are written into the sender's own email program instead and never reach us or anybody else at all.
Two services help us keep the site up — an uptime checker and a scheduled-job monitor. Neither receives any of your data: one asks whether the site answers, the other is told only that a job ran.
If you email us at the address at the foot of this page, that message and your address pass through ImprovMX, who forward mail for our domain, and are then held in the mailbox they forward it to — in the ordinary way email works. That is a route you choose rather than something the app does, and nothing in the app sends anything there.
That is the complete list of what the app sends anywhere. There is no advertising network, no analytics product, and nobody buys anything from us.
A workspace belongs to an organisation, not to a person. Everyone on a team can see and edit everything in that team's workspace, and records show who added them. If you bring your own records into a team when you join, the app says so first and asks. Leaving a team, or being removed from one, gives you a fresh empty workspace and removes the team's data from your device the next time it connects.
Data is held in Frankfurt, Germany — the application on Render and the database on MongoDB Atlas, both in that region. For anyone in the UK, that is a transfer to a country the UK recognises as providing adequate protection, so no additional transfer safeguards are needed.
We keep your workspace for as long as your account exists. Deleted records leave a marker for up to 180 days so the deletion can reach your other devices; the contents are removed immediately. Activity logs and problem reports expire after 90 days.
Daily backups are held separately, and are the one place deleted data persists for a short while after you remove it — a backup taken before a deletion still contains it until that backup is discarded. They are encrypted and are kept only to recover from a failure — never used for anything else.
This is a free beta, and backups are limited. The database tier we are on provides no point-in-time recovery. We take a daily export, so the worst case is losing up to a day. Please keep your own JSON backup of anything you would be upset to lose.
Everything travels over HTTPS. Sessions are httpOnly cookies. We never see or store a password. Each account's data on a shared computer is kept in a separate local store, so one person's work cannot be read or uploaded by the next person to sign in.
If this page changes in a way that affects you, we will say so in the app rather than quietly editing the date.
Questions about this page, anything you want corrected or deleted, or anything above that you cannot do yourself: contact@nimbleclerk.com. You do not need an account to use it — if you asked for access and never got it, or your account is already gone, that address still reaches us.
If you are signed in and something is broken, Report a problem in the app is the better route for that one thing: it attaches the version and the recent errors, which an email cannot, and we only ever see your address and what you wrote.