Nimbus Radar — Privacy Policy

Last updated 8 September 2026

Nimbus Radar shows you live weather radar and what it is about to do next. This page explains exactly what the app keeps on your device, what it sends to the server, and who else can see it. It is written to be specific rather than comprehensive-sounding — if something isn't listed here, Nimbus doesn't do it.

The short version

• There is no account and no sign-in.
• There is no analytics, advertising, or tracking of any kind. The app contains no third-party code at all.
• Your precise location never leaves your device. Weather is requested for a rounded position about 5 km across.
• Coordinates are not written to the server's logs.
• If you turn on notifications, a rounded home point and a notification token are stored so alerts can reach you while the app is closed.

What stays on your device

Your exact location. Nimbus asks for precise location so the blue dot sits where you actually are, and that fix is used on the device only. Before asking the server for weather, the app rounds your position to a fixed grid roughly 5 km across, so what leaves your phone describes a general area rather than an address. Nothing is lost by this: the radar covers a 700 km square drawn at about 2 km per pixel, so the picture is identical either way.

The camera, in the Sky view. Nimbus can place storms and lightning on the real horizon through the camera. Those frames are processed live on the device and are never recorded, stored, or transmitted. The app has no ability to save or upload them.

Also on the device only: your last known position and its place name, so the map opens where you are instead of a default city; the distance and time of the most recent nearby lightning strike, which is how the strike read-out can still say "26 minutes ago" after the strike has aged out of the live feed; your layer choices and other settings; and a cached copy of the last radar received, so the app shows something useful on a weak connection. Deleting the app erases all of it.

What is sent to the server

Nimbus talks to one server, run by Limit Cycle, which assembles the radar and map layers. Each request carries:

• A rounded position — the ~5 km grid point described above, which is how the server knows which part of the country to send.
• Your device's IP address, unavoidably, as with any app that makes a network request. It is used to rate-limit abusive traffic.
• An app-attestation identifier and a per-request signature, from Apple's App Attest service. This proves the request came from a real, unmodified copy of Nimbus rather than from something impersonating it. It identifies an installation, not a person.

If — and only if — you turn on notifications, the app additionally registers:

• An Apple push notification token, which identifies your installation so alerts can be delivered to it.
• The point you want watched, rounded to about a kilometre. This is the only location Nimbus stores rather than uses and forgets, so it is the one rounded hardest — and again nothing is lost, because the radar it is checked against is drawn at 2 km per pixel.
• Which alert types you have switched on, so the ones you turned off are never computed.

That registration is stored, keyed to the push token, so the server can check your point against live radar every couple of minutes while the app is closed.

What is never sent

• Your precise location.
• Your name, email address, phone number, or contacts.
• Any camera image.
• Any advertising identifier. Nimbus does not ask for tracking permission, because it does not track you — in the App Store's sense or any other.
• Any usage or behavioural analytics. There is none to send.
• Your payment details. Nimbus Pro is sold through Apple's In-App Purchase system, so Apple handles the transaction and the app only ever sees a signed receipt confirming that a subscription is active.

What the logs contain

The server runs on Google Cloud Run. Each request writes a log line recording the IP address, the time, which endpoint was asked for, and whether it worked. Coordinates are not written to these logs — the app sends only the rounded grid position, and the server strips it from the log line before writing, so no location is retained there at all. Logs exist for debugging and abuse prevention, are kept for 30 days, and are then deleted automatically. They are not combined with notification records and are not shared.

One deliberate exception: when a device registers for notifications, the server records the watched point rounded to about a kilometre, because that point is the setting being saved and it has to be possible to confirm the right one was stored.

Who else is involved

Nimbus relies on outside services, and only for the functions described:

• Apple — push notifications are delivered through Apple's servers, which is the only route any iOS app has; purchases are handled entirely by the App Store; and App Attest verifies that requests come from the genuine app.
• Apple Weather — the forecast in the daily morning notification. The request is made by the server, not by your phone, so Apple sees the server asking rather than your device.
• Google Cloud — hosts the server and stores the notification registrations and the logs described above.

Nimbus's weather itself comes from public sources that the server fetches on its own behalf: NOAA and the National Weather Service for radar, storm warnings, satellite and lightning data and tide gauges, and OpenStreetMap contributors via OpenMapTiles for the map. No information about you travels to any of them. Credits are shown in the app under Sources.

No data is sold, and none is shared for advertising. There are no advertising or data-broker relationships of any kind.

How long it is kept, and how to remove it

Notification registrations are kept for as long as notifications remain enabled. Switching them off in the app tells the server to stop watching your point and deletes the stored registration. Turning off "travelling updates" stops background location updates while keeping alerts.

Deleting the app erases everything held on the device. If notifications were on, switch them off first so the server-side record goes too — or email the address below and it will be removed.

Depending on where you live you may have rights to access, correct, delete, or port your personal information, and to object to or restrict its processing. Because Nimbus holds so little, and nothing tied to your identity, the practical answer to almost any such request is the notification registration described above. Email the address below and it will be handled within the period the applicable law requires.

Where it works

Nimbus's radar coverage is the United States only, and the server is operated in the United States, so the information described here is processed there.

Children

Nimbus is not directed at children and does not knowingly collect information from them. There is no account, no user-generated content, and no messaging in the app.

Changes

If this policy changes, the date at the top of this page changes with it.

Contact

Nimbus Radar is made by Limit Cycle LLC, an independent software studio. Questions, or requests to delete your data: admin@limitcycle.net.