Privacy policy

1. Who we are

Nmimes is run by Eya Ben Nessib, in Tunisia, who decides how your data is used (the “controller”).

Contact for anything in this policy: contact@nmimes.com.

2. Who Nmimes is for

Nmimes is made for pupils in 7th, 8th and 9th grade (about 12 to 15 years old) and for their parents. A child cannot create an account. A parent creates their own account first, then an account for each child.

3. What we collect

From a parent

• First name, last name and email address
• A 4-digit PIN, which we only store in scrambled (hashed) form
• If the parent signs in with Google: the Google details described in section 4

About a child, entered by the parent

• First name, a username and school grade
• An interest, if the parent picks one
• A 4-digit access code, stored only in hashed form

While a child uses Nmimes

• Learning progress: lessons, quizzes, challenge results, points, badges, streaks, topics practised and answers given
• The avatar chosen in the app (a drawing, never a photo)
• Homework and lesson photos taken with Snap, and the exercise text and explanation the AI produced from them
• Questions asked to the AI tutor
• Messages, photos and voice notes sent in study rooms (if the parent allows them; see section 10)
• Reports the child makes about a message or an AI answer

From the phone (Android and iOS app)

• A notification token, when notifications are on
• The app language
• Technical data that Google's ad software collects on its own (section 9)

On the website and the web app

• The browser keeps the signed-in session and the chosen language in its local storage, on the visitor's own device.
• To choose a starting language, the site asks Cloudflare, which serves nmimes.com, which country the visit comes from. Only the guessed language is kept.
• On the web app, the voice tutor uses the browser's own speech recognition when the browser offers it. Depending on the browser, its maker may process the audio to turn it into text (Google Chrome, for example, does this on Google's servers). Nmimes receives only the resulting text.
• The website loads its fonts from Google Fonts, which, like any web server, receives the visitor's IP address.
• The website and web app show no ads and use no analytics or tracking cookies.

We do not collect phone numbers, precise location, contacts, or the device's advertising ID.

4. Google sign-in and Google user data

We are introducing “Continue with Google” as a way for parents to create their account and sign in, as an alternative to email and PIN. It may not yet be available in every version of the app or website. Children never sign in with Google: they always use the username and access code their parent created.

When a parent chooses “Continue with Google”, Nmimes asks Google only for the basic sign-in permissions below. Nmimes does not request access to any other Google service or data, such as Gmail, Google Drive, Google Calendar, Google Contacts or YouTube, and it never sees the parent's Google password.

Storage

These details are stored by Supabase, our sign-in and database provider, in Paris (EU), in the parent's account record, together with the first and last name in the parent's profile. They are kept until the account is deleted.

Sharing

Google user data is shared only with Supabase, which provides our sign-in service under contract. It is not sent to our AI providers (Anthropic, AgentFlow on Google Cloud), to advertisers or to anyone else. It is never sold, never used for advertising, and never used to develop, improve or train AI or machine-learning models. No person at Nmimes reads it, except when needed for security, to comply with the law, or when the parent asks us for help with their account.

Revoking access

A parent can remove Nmimes' access to their Google account at any time from the Google Account permissions page: myaccount.google.com/permissions (Google Account → Security → Third-party apps and services). After that, Nmimes can no longer sign the parent in with Google; the parent can still sign in with email and PIN once a PIN is set. Revoking access does not delete the Nmimes account or its data: to do that, see section 12.

Limited Use

Nmimes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Parental consent

Only a parent can create accounts. The parent confirms their email address with a code we send to it (or signs in with Google, which confirms it), sets a PIN, and then creates each child's account with a username and access code. By doing this the parent consents, on the child's behalf, to the processing described here. The parent can see the child's progress, turn study rooms and notifications on or off, and delete the child's account at any time.

6. Why we use it

• To create and secure accounts, and to sign parents in (including with Google, section 4)
• To save progress and show points and badges
• To read a homework or lesson photo and explain it
• To answer questions in the AI tutor
• To deliver study-room messages to the other members
• To send reminders, when a parent turns notifications on
• To show the ads that keep the mobile app free (section 9)
• To keep Nmimes safe: review reports, stop abuse, fix problems

We do not sell data, and we do not use children's data to build advertising profiles.

7. Artificial intelligence

• Homework and lesson photos are sent to Anthropic (the Claude model) to read the exercise and write the explanation. We do not keep the photo afterwards, only the text of the exercise and the explanation. Under Anthropic's standard API terms, what we send is not used to train its models and is deleted within 30 days.
• Tutor questions go to AgentFlow, our own AI tutor service, which runs on Google Cloud in Paris, France (europe-west9 region). It receives the question and an account number, not the child's name, keeps the conversation for 7 days so the tutor can follow it, and does not use it to train any model.
• AI answers can be wrong. Every answer has a “Report this answer” button, and we review every report (section 10).
• Photos stored before 12 October 2026 are deleted automatically within 30 days of being taken. A parent can delete them sooner from the child's profile, and they are deleted with the account.

Google user data (section 4) is never sent to these AI services.

8. Who else receives data

These services work for us, under contract, and only receive what they need:

• Supabase: hosts our database, sign-in (including Google sign-in) and file storage, in Paris, France (EU).
• Cloudflare: serves our website and web app.
• Anthropic: reads homework and lesson photos, as described in section 7.
• Google: Google Cloud, which hosts our AI tutor service in Paris, France (EU); Google sign-in for parents who choose it (section 4); Firebase Cloud Messaging, which delivers notifications to the phone; AdMob and Google's consent tool, which show ads in the mobile app (section 9); ML Kit, the document scanner, which runs on the phone, where the picture stays until the child sends it; and Google Fonts, which serves the website's fonts.

We may also disclose data when the law requires it, or to protect someone from serious harm.

9. Advertising

The website and web app show no ads.

The Android and iOS app is free and shows ads from Google AdMob. Every ad request tells Google that the app is directed to children and that the user is under the age of consent. Ads are never personalised, only ads rated G (general audience) are allowed, and the app does not ask for permission to read the device's advertising ID. Google's ad software still collects some technical data on its own, such as the IP address, device details and how an ad was viewed or tapped, to deliver ads and prevent fraud: see policies.google.com/technologies/partner-sites.

When a child watches an ad for a reward, we pass Google a one-time random code so Google can confirm the ad was watched; it contains nothing that identifies the child. Google sign-in data is never used for ads.

10. What other children can see

• Leaderboard: other children of the same grade see a child's username and points. Not the first name, not the grade.
• Matches: the child they play against sees their first name and avatar.
• Study rooms: children who share a room code can chat and, if the parent allows it, send photos and voice notes. Everyone in the room sees what is sent. Children are reminded not to share personal information, can report any message or member, and can block a member. A parent can turn study rooms, or just photos and voice notes, off for each child. A person at Nmimes reads every report: within 24 hours when a child may be at risk, when personal information was shared, or for bullying; within 72 hours otherwise.

11. How long we keep data

• Accounts, progress and AI results: until the account is deleted.
• Google sign-in details (section 4): until the account is deleted.
• Homework photos: at most 30 days.
• AI tutor conversations: 7 days.
• Study rooms: deleted, with their messages, photos and voice notes, 48 hours after the last message.
• Reports: 90 days after they are reviewed.
• Notification tokens: until sign-out or deletion.
• Technical logs kept by our hosting provider (which can include IP addresses): 1 day.
• Backups: our current hosting plan keeps no automatic backups. Before a change to the database we may make a one-off safety copy, which we delete within 30 days.

12. Deletion and your rights

A parent can delete the whole family's account, or one child's account, in the app: Settings → Delete account, or Edit child → Delete this child's account. Deletion is immediate and removes everything listed in sections 3 and 4, including Google sign-in details. Without the app, see how to request deletion, or write to contact@nmimes.com.

A parent can also ask us for a copy of the data we hold, have it corrected, object to its use, or withdraw consent, by writing to contact@nmimes.com. We answer within 30 days. You may also complain to Tunisia's personal data protection authority, the Instance Nationale de Protection des Données Personnelles (INPDP).

To stop Nmimes from using your Google account to sign you in, see “Revoking access” in section 4.

13. Security

Data is encrypted in transit (HTTPS). PINs and access codes are stored only as hashes. Database rules make sure each family can only reach its own data, and files are private and served through short-lived links. Children's local session data is not included in phone backups.

14. Law that applies

Nmimes is offered in Tunisia and follows Tunisia's Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data. Our hosting is in the European Union (Paris).

15. Changes

If we change this policy, we update the date above and tell parents in the app before the change applies. If we ever want to ask Google for more than the permissions in section 4, we will update this policy first, and Google will ask the parent for consent again.

16. Contact

Questions about this policy or your data: contact@nmimes.com.