Privacy policy

This policy describes data processing by the NimboX application for Android and Android TV. The controller of NimboX is Francisco Daniel Jimenez Fernandez. Contact me@pamsho.dev for support and privacy questions.

NimboX is an independent Xbox Cloud Gaming client. It does not create its own user accounts and is not an official Microsoft, Xbox or Google application. This policy covers the app; it does not describe processing performed independently by Microsoft, Google or websites you visit.

This page is part of pamsho.dev, which uses Vercel Analytics and may display Google AdSense advertising. These website tools are separate from the NimboX application and are not integrated into it.

Authorization takes place on Microsoft’s website, opened in your browser when you scan the QR code or follow the sign-in link. NimboX receives authorization credentials to retrieve the catalog and start a game; it does not receive your Microsoft password.

The QR code contains the verification URL and public user code. It does not contain the refresh token or the private device authorization code.

Authorization credentials: access tokens and a refresh token to keep you signed in, retrieve available games and start streaming with Microsoft/Xbox.

Game and connection data: title identifiers, the selected game, controller input, video capabilities, language and technical connection information needed to negotiate and maintain the game session. Microsoft and network services receive the IP address needed to communicate with your device.

Local preferences: favorites, resolution and bitrate settings. Game covers and names are cached to reduce requests when loading the library.

NimboX does not request microphone, camera, contacts or location access. The camera used to scan the QR code belongs to the application you choose on your phone, not to NimboX on the TV.

Microsoft/Xbox receives sign-in, catalog and game requests, along with the credentials and technical information needed to provide the service. Covers and metadata are requested from Microsoft’s catalog services and the image URLs they supply.

Streaming uses WebRTC. Google STUN servers help establish the connection and receive your IP address and technical network information. Game content is exchanged with Xbox service infrastructure and endpoints.

The app does not include a developer-operated account platform, its own analytics SDKs or its own advertising SDK. Some titles may show advertising supplied by Xbox, subject to its terms and policies.

Processing, retention and any international transfers performed by these providers depend on their own policies. Read the Microsoft Privacy Statement and Google Privacy Policy.

The refresh token is encrypted with AES-GCM using an Android Keystore key and stored in the app’s private storage. The app data is excluded from the automatic Android backup and transfer mechanisms declared by NimboX.

Authentication and catalog requests use HTTPS. No system offers absolute security: protect your device, Microsoft account and device unlock method.

Favorites and settings are stored locally. The app does not offer its own service to synchronize this data across devices.

The saved session remains until you sign out, clear NimboX data or uninstall the app. Signing out removes the locally saved token and keeps your favorites and preferences. It does not revoke all permissions associated with your Microsoft account.

Favorites and settings remain until you change them, clear app data or uninstall. Metadata cache may be reused for up to seven days; covers and other temporary files may remain until Android or the app replaces them, you clear the cache or you delete app data.

To delete all local data: Device Settings → Apps → NimboX → Storage → Clear data. Option names may vary by TV. Uninstalling NimboX also removes its private storage.

NimboX does not create a separate account that you need to delete. Clearing data or uninstalling does not delete your Microsoft account, cloud game saves or information retained by Microsoft. Manage that account’s data and permissions at account.microsoft.com.

For questions about this policy or requests to review, correct or delete information you sent directly to the developer for support, email me@pamsho.dev. State that your request concerns NimboX and describe the issue; do not send passwords, tokens or private codes.

The developer cannot delete data held only on your device or data independently controlled by Microsoft or Google. Follow the instructions above for local data; use the relevant providers’ privacy tools for their data.

Updates will be published on this page with their revision date. If a new feature materially changes data processing, the relevant information and any necessary communications will be updated.