Yours, only. Forever.

NestBoard is a calmly designed shared calendar for households. We are paid for by subscriptions, not advertising, and we never sell your personal data.

We don't train AI models on your data. We don't read what isn't shared with us. We don't allow third-party trackers in our product surfaces.

You can export your household's data at any time, and you can delete your account and household with a single request.

Account data: your name, email, the household name you create, and billing details. On the web, billing is handled by Stripe (we never see your card number). If you subscribe inside our iPhone or iPad app, the purchase is handled by Apple In-App Purchase, and we use RevenueCat to confirm and manage that subscription (we never see your card number there either). If you subscribe inside our Android app, the purchase is handled by Google Play Billing, and if you subscribe inside our Fire tablet app, it is handled by Amazon In-App Purchasing. In each case we use RevenueCat to confirm and manage that subscription (we never see your card number there either). In those apps we also use RevenueCat before you subscribe, including during your free trial, to look up the price the store charges in your country so we can show it to you. For that it receives the same opaque app user id (your NestBoard account id) and returns the prices the store sets, and it never receives your name, your email, or anything in your household. Apple, Google and Amazon sell and bill those subscriptions, and each is an independent controller of the purchase it handles, deciding for itself how to use your payment details and purchase history under its own privacy policy. They do not process that purchase for us.

Subscriptions sold through Link: a subscription you start on our website is sold through Link, the checkout service run by Stripe, and for that sale Stripe is not only a provider working for us. Stripe's affiliate Sold through Link, LLC is the merchant of record, and Stripe and NestBoard LLC are each independent controllers of the personal data collected at that checkout. Stripe collects your name, email, billing address, payment details, and the order itself, and decides for itself how it uses them to take the payment, work out any tax and pay it to the tax authority, send your receipts, and answer payment and refund questions, under its own privacy policy at link.com/privacy. A subscription sold through Link needs a Link account. Stripe shares the order with us, including your contact details, billing address, and payment information (never your full card number), so we can run your household's plan, and what we do with it from there is covered by this policy. You can ask Stripe to delete what it holds for those orders by deleting your Link account, which also cancels a subscription sold through it. A subscription you bought on our website before we moved checkout to Link stays as it was, with Stripe processing it for us.

Sign-in options: you can create an account with an email and password, or with Google or Apple. When you use Sign in with Google or Sign in with Apple, we store the account identifier the provider gives us along with your name and email (for Apple this may be an Apple private-relay address) so we can sign you back in.

Household contents: events, chores, medications, pantry items, alerts, and routines you and your household members add, and any sound you upload for event chimes or lightning alerts. This is yours, and it lives in your household. When you scan a grocery barcode to add a pantry item, the barcode number is sent to the Open Food Facts public database to look up the product. Only the barcode is sent.

Meals and recipes: the recipes and meal plans you save, and any food preferences you set for family members, such as a diet like vegetarian or foods someone won't eat. We store family members' food preferences, including children's, to plan meals, and share them with our AI provider only as needed for Robin's meal suggestions and the labels on recipes and planned dinners. In a household, adults and caregivers, including on a shared kiosk, can see food preferences; only an adult signed in on their own device can change them; children and guests are only told whether one exists.

Recipe import: when you import a recipe from a URL, we fetch that page directly to read its recipe data. If the site blocks our direct fetch, we send the recipe URL you pasted to Jina AI's reader (r.jina.ai) to retrieve the page's readable text, which is then turned into a recipe. Only the public recipe URL is shared with Jina AI, never your account or household data.

Health and emergency details: if you choose to fill them in, we store medical profile details for household members (including allergies, conditions, blood type, and insurance provider, policy, and group identifiers) and emergency contact information you enter (a contact name, relationship, phone, email, and address). These are optional. Health profiles are for the grown-ups: only adults and caregivers can read a card, only an adult can edit one, and a child or guest account never sees the section at all. That protection is a role, not a per-person picker, so there is no way to hide one person's card from another adult in the same household. Emergency contacts stay visible to everyone in the household, because that is the part a child may need in a hurry. Medications are narrower: a child or guest account sees only the medications assigned to them, and can log those doses, while adding, editing, or deleting a medication is for household adults. If you ask Robin to delete a medication, we keep a copy of it, without its dose history, for 30 days so you can undo it, then delete it.

Comments and member groups: notes you leave on events (e.g. "running 10 minutes late") and the optional groupings you assign to family members are stored alongside the household. Comment authorship is recorded so the family can see who said what. The author name is preserved even if the member is later renamed or removed.

Connected calendar data: when you connect Google, Outlook, iCloud, or an ICS feed, we read events as you authorize. We do not read mail, contacts, or files.

Showing NestBoard events in Google Calendar: this is off unless a household adult turns it on in Settings under Calendar Sync. When you do, you grant NestBoard permission to create one calendar of its own inside your Google account, named NestBoard, and we copy your NestBoard events into it so they appear on your phone and laptop within seconds. The permission we ask for covers only calendars this app creates. It gives us no access to calendars you made yourself, so we cannot read, change, or delete anything in them, and we never add guests to a copy or send invitations on your behalf. Each copy carries a private marker identifying it as ours, and we act only on events carrying that marker. Google receives the event details you chose to copy and handles them under its own privacy policy. We do not sell this data, use it for advertising, or use it to train models. Turning the setting off deletes the NestBoard calendar from your Google account along with the copies inside it, and disconnecting Google entirely removes it as well. There is one case we cannot clean up for you: if you remove the NestBoard permission on the Google permissions page before turning the setting off here, we no longer have permission to touch that calendar, so it stays in your account until you delete it yourself. NestBoard tells you when that has happened and what to remove.

Showing chores in your calendar copies: this is a second switch, off unless a household adult turns it on in Settings under Calendar Sync. When it is on, your chores appear as calendar entries on your private calendar subscription link and, if the household copies its calendar into Google, in the NestBoard calendar inside the Google account that copy is connected to. Each entry carries the title of the chore, its due date and time, whether it is done, and the first name of the person it is assigned to, which can be a child. We do not send chore descriptions, points, money, photos, or last names. Google handles what we copy under its own privacy policy, and we do not sell it, use it for advertising, or use it to train models. Anyone who holds your subscription link, or who can see that Google calendar, can see these entries, so treat the link like a house key and use Reset link if it gets out. Turning the switch off removes the chore entries from the Google copy within a few minutes and from the link straight away.

Alexa: if a household adult enables the NestBoard skill and links it, we store a hashed copy of the link token Amazon uses to reach your household (we cannot read the token back, only recognize it), which household it maps to, and, when someone introduces themselves on an Echo by saying "I'm ..." with their name, an opaque speaker identifier Amazon assigns to that voice so chores finished by voice credit the right family member. That identifier is a random Amazon code, not a recording; we never receive or store audio. What Amazon receives from us is the spoken response to each request, for example today's agenda or a confirmation that milk was added to the list, and Amazon handles it under its own privacy policy. We also keep a record of each voice request for 30 days, then delete it automatically: what was asked (the command and details such as the item or event name), which family member it was if the voice was recognized, and what NestBoard answered. A person at NestBoard may read these in our admin tools to check that voice requests worked. Opening one is recorded (that it was opened and when, not what it said). The daily automated review described in section 2 covers Robin conversations, not voice requests. You can disconnect at any time in Settings under Alexa: every link and speaker mapping for the household is deleted immediately, and voice requests stop reaching NestBoard from that moment.

Calendar subscription feed: you can optionally turn on a feed URL that lets another calendar app (Google Calendar, Apple Calendar, Outlook) subscribe to your household calendar. That URL contains a secret token, so treat it like a password: anyone who has the URL can read your household calendar, except events marked adults-only, which are never included in the feed. You can regenerate the URL at any time, which revokes the old link instantly.

Home location: if you set a home location (latitude/longitude or ZIP), we store it to power the weather widget (forecasts and the air quality and UV readings come from Open-Meteo), to fetch the pollen reading on the same card (that one comes from Google, which receives the location and nothing else, and we ask it once a day per location), and to filter real-time lightning alerts down to your area (strike data streams from Blitzortung.org, and we do that filtering on our own servers, so Blitzortung gets nothing about you or your household). Only the location itself is shared with Open-Meteo and Google, never your name, email, or household contents. If your household is in Canada, the United Kingdom, Australia or New Zealand and you enter a postcode, our server also sends that postcode and its country code to Zippopotam, a postcode lookup service, to find the place it belongs to. That is all it receives: nothing about you or your household, and no cookie.

Robin inputs: text you paste, screenshots and documents you attach, voice notes you send, and emails you forward to your private NestBoard inbox. To answer questions and take actions for you, Robin can also read your household's own NestBoard records, things like the calendar, chores, lists, and medications, and update them when you ask. That access stays inside your household's boundary: Robin never reads another household's data, and it never reaches outside NestBoard for yours.

Photos and scanned pages emailed to your household: your household has its own NestBoard email address, and when an email sent to it carries a photo or a scanned page, such as a picture of a school flyer, we send the image to OpenAI to read the dates and details on it, the same way we read the email's text, under the same no-training agreement. Anyone who has the address can send to it, and nobody looks at an image before it is read, so a picture can show a person, a child included. We do not keep the image once it has been read. What we read out of it is handled like the email's text (section 4).

Permission before AI: AI features ask for your permission in the app, and you can turn them off for yourself any time in Settings, under Privacy & Data, AI features.

Reading Robin conversations: from November 13, 2026, every conversation is checked, by a program first and sometimes by a person. Until then, there is no ongoing automatic check: the one person who runs NestBoard may read conversations one at a time to find Robin's mistakes. On October 26, 2026 we ran a one-time automated quality review of recent Robin conversations, processed by OpenAI, which already runs Robin. Households with Robin turned off were left out. In two households it included older conversations from before one adult turned AI off; we deleted those results. The review was used only to improve Robin. Once a day from then on, an automated review run by OpenAI, under the same no-training agreement that covers Robin, reads the day's new conversations, what your household typed and what Robin answered, and flags answers that look wrong, such as a false "done", a wrong date or the wrong person. Before a conversation goes to that review, we replace the names you've registered in NestBoard with labels and remove common formats of email addresses and phone numbers. Anything else in the conversation, including any health details, is read by the review as it is. For each flag it writes a short note with names taken out, and we use those notes to fix Robin. Those notes are deleted along with the conversation. The review only flags; it never changes anything in your household. NestBoard is run by one person, and he opens flagged conversations inside NestBoard's own admin tools, and can open any other one when he needs to. Conversations are not emailed. This covers every household except our own internal test ones, and nothing has to go wrong first for it to happen. We do it because it is how we catch Robin answering badly, getting something about your household wrong, or quietly failing at what you asked for, and for a company this small there is no other way to know. So the honest thing to tell you is to assume a person at NestBoard may see what you say to Robin. What we do not do with those conversations: we do not sell them, we do not use them for advertising, we do not use them to train any AI model, and we do not hand them to anyone outside NestBoard to use. When a conversation is opened in our admin tools, we record that it was opened and when, but not what it said. The automated review is not recorded one conversation at a time, so we cannot promise to tell you every time yours was read. Clearing Robin's history deletes the conversation from NestBoard. If you would rather none of this happened, Robin can be switched off for the whole household in Settings, and then there is nothing to read.

Feedback you send us: the feedback button inside NestBoard sends us what you wrote, the page you were on, your household name, and the email address on your account so we can write back. If you attach a screenshot, that comes too. This only happens when you press send. Your note is stored in our own admin dashboard and emailed to our own inbox, and that is the whole of it. No third party is notified, and nothing else from your household goes with it.

Why you are leaving, if you tell us: when a plan billed by the App Store, Google Play or Amazon is set to end, Subscription & Billing asks once, optionally, why. If you answer, we store which of four answers you picked (too expensive, not using it enough, missing something you need, or switching to something else), or that you skipped, with the date, against your household. There is no box to type in. Only we see it. It also reaches us in an alert email to our own inbox, sent through Microsoft 365, the email service on our subprocessors list, and we do not share it with anyone else. The stored answer is deleted with your household. When a plan bought on our website is set to end, Stripe's cancel page may also ask why. If you pick an answer there, Stripe tells us which one, and it reaches us in the same alert email. We never read anything you type in Stripe's comment box, and we keep the answer only in that email.

Help from Claude with support: Claude, an AI model made by Anthropic, helps us answer the emails you send us and look into problems, whether you report them or our error reports catch them. It sees the message you sent and, when a problem needs it, the records in your household that the problem involves, and we give it only what the job needs. It does not look at a child's records unless the parent who wrote to us asks us to (our Children's Privacy page says the same). Unlike our other AI providers, this use is not covered by a data agreement with Anthropic: it runs under Anthropic's standard terms, with the setting that would let Anthropic train its models on these conversations switched off. Claude never runs Robin and never reads Robin conversations.

Product diagnostics: crash and error reports, processed through Sentry. These come from two places. When something breaks on our servers, we scrub names, email addresses, and household contents out of the report before it leaves the server, though it may include your IP address. When the app itself crashes or hits an error on your device, the report goes from your device straight to Sentry so we can see failures that never reach our servers, such as an app that will not start. Those device reports include the error, the app version, the screen you were on, basic device and operating-system information, and your IP address, and because they do not pass through our servers first, the server-side scrubbing does not apply to them. We keep the collection narrow instead: the app sends Sentry no performance traces, we do not use Sentry session replay, and the app is configured not to attach personal information by default. Our servers do send Sentry about one request in ten as a performance trace, which records which part of our service handled the request, how long it and the steps inside it took, and the status code it ended with. Those traces go through the same server-side scrubbing, which also removes IP addresses from them. We do not send content from your household, and the report is scrubbed before it leaves to catch anything that slips through. Sentry itself does not run on our public marketing pages; errors there are recorded by PostHog, described next.

Product analytics: we use PostHog to understand which features get used and where the app gets confusing, on both the marketing site and inside the app. It uses local storage rather than a tracking cookie, session replay runs on our public marketing pages, on the sign-in, sign-up, and password-reset request pages, and, for every new household on the web, on the setup screens (the next two paragraphs explain both), it identifies you only by an internal account id and your household's internal id (never your email or anyone's name), and for the household it records only how many members it has, how many people have a login, and its plan status, any sign-in token in a page address is stripped before it is recorded, and no household content is collected. PostHog also receives the IP address your device connects from and uses it to estimate a rough location, about the town or city, which we use to see where NestBoard is used. If you are in the UK, the EEA, or Switzerland, none of it runs until you say yes, and we ask with a banner the first time you visit. The section below on the UK and Europe has the detail. If you skip the step that asks you to invite someone, we may ask you one optional question, "Who else would use this board?", once. You pick from a short list (your partner, your kids, a co-parent in another home, roommates, or just you for now), there is no box to type in, and your answer goes to PostHog with the rest of our product analytics. We only ask if product analytics is on for you.

Session replay on our signed-out pages: since September 2026 PostHog records a sample of visits to our public pages, the ones you see before you sign in, so we can see where those pages confuse people. Since September 2, 2026 it also covers the three pages in front of the app, for the same reason: sign in, sign up, and the page where you ask for a password reset. Typing is masked and so is every piece of text on the page, so a recording shows the layout and where someone tapped rather than what anything said. On those forms that means what you type, your email address and your password included, is masked and never recorded. It stops the moment you sign in, and it never runs in our Android, iPhone, and iPad apps. The page you reach from a password-reset email is never recorded at all, because its address carries your reset link.

Session replay on the setup screens: since September 2026 there is one place inside NestBoard where the same kind of recording can run, and we would rather set it out in full than bury it. When you create a household on the web, your setup screens are recorded: the steps where you name your household, add the people in it and pick what you want to see, plus the first view of your dashboard afterwards. We are doing it to see where new households get stuck during setup. Until then we could not see that part of NestBoard at all, so every change we made to it was a guess. Everything typed is masked, without exception, and that includes the names and ages you enter for your children. So is every word on the screen. A recording shows the layout, which step you were on, what you tapped and where you stopped, and none of what you or the app wrote. It stops when you move on from that first dashboard and does not start again, nothing else inside NestBoard is ever recorded, and it never runs in our Android, iPhone, and iPad apps. These recordings are kept for 14 days and then deleted, which is shorter than we keep anything else of this kind. If you are in the UK, the EEA, or Switzerland, none of it happens unless you said yes to the banner.

Where setup stops: our own server keeps one small record for each household of how far it got through the setup screens that follow creating a household. It holds which of those screens were reached and when, the last one seen, which setup path was chosen, whether setup was skipped, and which version of the website or app it ran on. It holds nothing anyone typed and no household content. We use it only to see where new families stop during setup, so we can fix those screens. It follows the same rule as the rest of our product analytics: if you are in the UK, the EEA, or Switzerland, no record is kept unless you have said yes to analytics. It is kept for as long as your household account exists and is deleted with it.

Browser errors: PostHog also records errors the page itself hits, on the marketing site and inside the app, so we can find and fix breakage we would otherwise never hear about. A report contains the error type, the error message, and the stack trace showing which of our code files and line numbers were involved. It does not include anything your browser printed to its console, and the message is scrubbed on your device before it is sent, stripping email addresses, the names of members in your household, and any sign-in token, exactly as page addresses already are. When the failure came back from one of our own servers, the message text is dropped entirely and only the error code is kept, because a server message can quote something you typed. No calendar entries, chore names, lists, notes, or messages are sent.

When you connect a Google, Outlook or iCloud calendar, we copy each event's title, times, location and description into your household. Some calendar providers also send the guest list with each event; we do not store it. An event can still name other people, or show something like a medical appointment, in its title or description. We do not ask for health, religious or other sensitive details and we do not deliberately collect them, whether they arrive in an imported event, a note, a message or an email you forward. We keep them only as part of what your household chose to put in, and the scrubbing described above keeps them out of crash reports.

Keeping you signed in: on the web, a single strictly-necessary session cookie keeps you signed in. In our Android and iPhone apps, that same sign-in is kept by a session token stored privately in the app's own local storage on your device and sent with each request. It is never shared with third parties and is cleared when you sign out. On Android 9 and newer, NestBoard also asks Android to keep a sign-in key for the app, so that when you move to a new phone by restoring your Google backup or transferring from your old phone, NestBoard can sign you back in without your password. The private part of that key stays in Android's own credential storage and your Google backup, where it is end-to-end encrypted. We keep only the public part, which cannot sign anyone in by itself, and the key stops working when you sign out of the phone it came from or remove that phone in Settings. Inside NestBoard there are no advertising or cross-site tracking cookies, ever. There is no analytics cookie either: the product analytics described above use local storage rather than a cookie. Until September 2026 a second analytics provider did set a first-party cookie on our public marketing pages. We removed that provider from NestBoard, and if you still have that cookie, your browser drops it the next time you load one of our pages. Each time you sign in we also keep a note of the network you signed in from and the browser or app you used. The network is a shortened form of your IP address that points to your internet provider's area, not to your exact connection. We use it only to notice when a sign-in turns up somewhere unexpected, and it is deleted when you sign out or after 30 days at most.

Push notifications: once you allow notifications on your device, NestBoard sends push notifications for things like dose reminders, chore nudges, and lightning alerts. If a household goes quiet for a few days we may send one gentle reminder push to help you pick back up. To deliver any of these we store a device push identifier (a token issued by Apple, Google, or your browser's push service) for each device you enable. These tokens carry no household content, are used only to route notifications to your device, and are removed when you turn notifications off or sign out.

Counting notifications: since September 2026 we also keep a tally of the notifications we send and whether they get opened. For each push we record what kind it was (a chore reminder, a dose reminder, a lightning alert, and so on), which platform it went to, whether the push service accepted it, and, if you tap it, that it was tapped. That is a category label, never the text of the notification, it is keyed to the same internal account id as the rest of our product analytics, and it goes to PostHog. We use it to learn whether the reminders you switched on actually help your household come back, and for nothing else. The send count and the tap on a web browser notification are recorded by our own servers as the message goes out or the tap comes in, and they store nothing on your device. A tap inside our Android, iPhone, and iPad apps is reported through the app itself, so if you have analytics switched off there it is not reported at all.

Account and onboarding emails: beyond the verification emails above, we may send a small number of onboarding and re-engagement emails in your first days, for example a short welcome note and, if your household goes quiet, one reminder that your calendar is waiting. These come from NestBoard, never contain third-party ads, and you can reply to reach us or ask us to stop.

Task reminder emails: you can optionally have NestBoard email you a separate reminder for each chore or event at its reminder time. This is off by default and strictly opt-in, per person, and only adults in a household can turn it on. Each reminder email contains the task or event title and its timing, and goes only to your own verified account address, never to anyone else. You can turn it off at any time in Settings, under Notifications and Sounds.

Email click tracking: two of the emails we send, our weekly update email and the daily morning briefing, carry links that pass through our own server on the way to where they are going. When you click one of those links, we record that the link was clicked, which link it was, when it happened, and which email address it was sent to. We use this to learn whether our updates are worth sending, and to stop mailing people who never engage with them. Clicking is an action you chose to take, and following the link stores nothing on your device. This measurement is entirely first-party: it runs on our own servers, no ad network or outside tracking service is involved, and it never touches your household content. A clicked briefing link is only ever used as a count; it never decides whether you keep getting them. Until September 2026 these emails also carried a tiny invisible image that reported back when a message had been opened. We removed it, and we no longer measure email opens at all. Everyday account emails such as verification, password reset, and task reminder messages carry none of this.

This works the same way wherever you live. There is no invisible image in any email we send, to anybody, so email opens are not recorded for any household. Until September 2026 we left that image out only for households in the UK, the EEA, and Switzerland; now it is gone for everyone. The links in the weekly update and the daily briefing still route through our server so we know a link was clicked, which records an action you chose to take and stores nothing on your device.

Where your app install came from: the first time you open our Android, iPhone, or iPad app after signing in, the app sends us what the app store recorded about how the install arrived, and we keep one row of it for your household. On Android that is the Google Play install referrer, the string Google Play records alongside an install saying whether it came from a search, a listing, or a link carrying campaign tags. We split that string into the parts we use, such as its source and medium, and do not keep the string itself. On iPhone and iPad it is a token Apple issues, which we hand back to Apple and get a campaign-level report in return. We keep it so we can tell whether money spent on advertising actually brings households in, and inside our own admin pages we look at it next to whether a household went on to subscribe. We keep the row for 24 months from when we record it and then delete it. Here is what is actually in it, because the honest version is smaller than that makes it sound: every row we hold records an install with no advert attached to it, and there is not one advert, keyword, or ad click identifier recorded against any household. We do not use the advertising identifier on your device, we never ask for tracking permission, and our Android app removes the advertising-ID permission outright. The app does note on your device that it has already sent this, so it only happens once. The row holds no household content and is not joined to anything you do inside NestBoard.

Where you came from: when you create a household, we keep one small note of how you reached us. It holds the website you came from (the site name only, never the full address), any campaign tags in the link you followed, the first NestBoard page you landed on, and whether you signed up on the web or in the Android, iPhone or Amazon app. It holds nothing you typed and no household content, it is not joined to what you do inside NestBoard, and we use it only to see which channels bring families in. If you are in the UK, the EEA or Switzerland, we keep this note only if you have said yes to analytics. It is deleted with your household.

Cookies on our marketing site: our public pages (the pages you see before you sign in) carry no advertising or cross-site tracking tags at all. We used to run the Meta Pixel and the Pinterest Tag there. We removed both, along with the data they sent to Meta and Pinterest. The only measurement on those pages is the same PostHog product analytics described above, which stays on our own site and carries no household content. A second analytics provider ran there until September 2026 and was removed.

We don't train models on your data, yours or anyone else's in NestBoard.

We don't sell, rent, or share your data with advertisers, data brokers, or any third party for marketing.

We don't run advertising in NestBoard. There is no ad model and there will not be one.

We don't read your inbox, browse the web on your behalf, or scrape your messages. Robin works from what you hand it and from your household's own NestBoard records, nothing outside them.

Google user data specifically: NestBoard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at https://developers.google.com/terms/api-services-user-data-policy.

In plain terms: the calendar data we read from Google, and the events we copy into the NestBoard calendar we create inside your Google account, are used only to provide and improve the calendar features you chose to turn on. We do not transfer that data to anyone else except where it is needed to provide those features, where the law requires it, or in a merger or acquisition where these same commitments carry over. We never use it for advertising, and we never sell it. No person at NestBoard reads it, unless you ask us to look at something to fix a problem you reported, we need to for security, or the law compels it.

Active household: as long as you and your household members use NestBoard.

Unverified signups: if you create an account but never confirm your email address, we send up to two verification reminder emails, and then we automatically delete the unverified account (and the empty household created with it) 30 days after signup. We do not delete it while someone else in the household still signs in. Every reminder includes a link to remove the account right away if you did not sign up. If other people still sign in to the household and none of them is an adult (for example, when only a child signs in), the link does not remove the account, because that would leave them on their own. Instead, the page it opens lets you stop our emails to that address and explains how to get the account deleted.

Account deletion: your data is held for 30 days so you can change your mind, and signing back in during that window cancels the deletion. Some things do not wait for the 30 days, and cancelling does not bring them back. If you are the last adult who signs in to the household, invites nobody has accepted yet are cancelled when you ask, and once you sign back in you can send new ones. If nobody at all is left signing in after you, connected Google and Outlook calendars are disconnected when you ask (see Connected calendar tokens below), and once you sign back in you can connect them again. On day 30 the live data is removed. Backup copies take longer to disappear, and there are two kinds of them on two different clocks. Our host takes a snapshot of the database once a day and keeps each snapshot for six days, so a copy of your data can survive up to six days past the deletion there. Separately, once a day we copy the whole database to storage with a different cloud provider, so that a failure at the host cannot take your data with it. Those offsite copies are deleted 30 days after they are made. That storage then keeps a recoverable version for a short period afterwards, so a copy is fully gone about 38 days after it was taken. From the date we switch it on, we also keep a second offsite copy with Cloudflare, locked with a key only we hold before it leaves our hands. We keep the newest 30 daily copies and delete older ones, so a copy is deleted about 30 days after it is made, with no recoverable version afterwards; if a nightly run fails, nothing is deleted until runs resume. The older copies that piled up before we set that limit in September 2026 have been cleared out with it. Until a copy reaches the end of its own window, your data still exists inside it. We do not go back into a backup to use your data for anything.

Household deletion: an adult in the household can delete the household itself, not just their own account, from Settings, then Privacy and Data, then Delete this household. Children, guests and caregivers cannot. It works on the same clock: everyone is signed out immediately and every adult or caregiver who signs in to the household is emailed, the household is kept for 30 days, any adult signing back in during that window cancels it for everyone, and on day 30 the household and every record in it is permanently deleted. Invites nobody has accepted yet are cancelled and connected Google and Outlook calendars are disconnected as soon as the deletion is asked for (see Connected calendar tokens below), and cancelling does not bring them back. There is one exception and it is named below: feedback you sent us about the product is kept, with you taken out of it.

Connected calendar tokens: when you disconnect a calendar, when the last account in a household is deleted, when the last adult's account is deleted and the only other sign-ins are children's, guests' or caregivers' and go with it, and when an adult deletes the household itself, we delete our copy of the token right away, and the events synced in from that calendar are removed from NestBoard. In the rare case that a calendar sync is running at that exact moment, we finish the job as soon as it ends, normally within the hour, and the token stays on our servers only until then. For Google we also call their revocation endpoint, so the permission you granted stops working on Google's side too, not just on ours. Microsoft publishes no equivalent endpoint for an app to revoke its own Outlook access, so for Outlook we delete our copy and you can remove NestBoard yourself in your Microsoft account's app permissions. None of this waits for the 30-day window, and cancelling a deletion does not reconnect a calendar we already disconnected.

Robin conversations: kept for 12 months, then deleted automatically by a job that runs every day. We keep them that long deliberately. It is what lets Robin remember your household across a school year, so you are not re-explaining who has practice on Tuesdays every few weeks. Robin's chat belongs to the household, so everyone in your household sees the same conversation.

Getting rid of Robin's history: an adult in your household can clear it whenever they like, from Settings, then Privacy & Data, then Clear Robin's history. That deletes the household's entire Robin conversation right away, and it cannot be undone. Because Robin's chat is shared, it clears for every member, not just the one who pressed the button. Nothing else is touched: your calendar, chores, lists, and the rest of your NestBoard stay exactly as they are.

When Robin cancels a calendar event, deletes a chore or deletes a medication, NestBoard keeps a small record of it (its title and how it looked) for 30 days so an adult can put it back. For a medication the record is the medication itself, without its dose history. Clearing Robin's history does not remove it. It is deleted with your household, and a medication's record is removed when that family member is removed.

Deleting your account (Settings, then Privacy & Data, then Delete my account) removes your messages to Robin and Robin's replies to them. If yours is the last account in the household, or the only other sign-ins are children's, guests' or caregivers' and go with yours, the whole conversation goes with the household. If you would rather we did it for you, email privacy@mynestboard.com from your account's email address and we will wipe it.

The conversation is all Robin remembers. Until September 2026 Robin also kept a short list of facts it had picked out of your chats, things like an allergy, a birthday, or the dog's name, on a clock of their own. It stopped doing that, and we hold none of them for any household now. So clearing Robin's history or deleting your account leaves Robin with nothing else to remember. Either way, the records you entered yourself are untouched, such as allergies saved on a medical profile or foods on your meal exclusions list.

Crash and error logs: automatically purged after 90 days.

Emails sent to us: when you email something into your household, or write to one of our addresses, we log the message so we can tell what arrived and what happened to it. After 90 days a job that runs every day erases the text of the message, and along with it the events, chores and notes we read out of that text. The sender, the subject, the date and what we did with it stay, because that is what we would need if you later asked whether your email ever reached us. From November 13, 2026, a photo or scanned page attached to one of those emails is not kept once it has been read; what we read out of it follows the same 90 days.

Records of email between us: the log line itself, the one that survives the 90 days above, is deleted after 12 months, and so is our record of the notes we sent you one to one. We no longer record whether an email was opened, and the open counts we collected before September 2026 age out on the same clock. It is the same 12 months as the audit trail below, deliberately, because it is the same kind of record: what was sent, to whom, and what came back.

Feedback you send us: if you delete your account or your household, we keep what you told us about the product and take you out of it. The message is separated from your account and your household, any screenshot you attached is deleted outright, and the text is stripped of email addresses, phone numbers and the names of everyone in your household before we keep it. We do this because a bug you reported is still worth fixing after you have gone, and because the alternative is losing the report. We will not claim more than that, so here is the limit: something a person wrote in their own words can never be guaranteed to be untraceable to them, which is why we call what is left de-identified rather than anonymous. We do not use it to contact you and we do not link it back to you.

Weather for your area: the forecast for your saved location is cached for ten minutes so your dashboard is not fetching it again all day. A cached forecast is deleted within a day of going stale, and the coordinates stored with it go at the same time, so a location nobody has looked at for a day is no longer held at all.

Check-ins, chore history and leaderboard scores: household content, kept for as long as the household is, and removed with it. There is no separate clock on these.

Where your app install came from: the one row described in section 2 is kept for 24 months from when we record it, which is the first time the app is opened after signing in, and is then deleted automatically. If the household is deleted before then, the row is deleted with it.

Setup progress: the one record per household described in section 2, under where setup stops, is kept for as long as the household account exists and is deleted with it. There is no separate clock on it.

Billing records: we keep our own books for seven years, because tax and accounting rules require it. Those books are our bank deposits, the payouts we receive from Apple, Google and Stripe, and our expenses, and they are kept in our accounting software and at our bank. Beyond that we keep no seven-year record of our own of each customer's payments. The seller of your subscription keeps that record, as the merchant of record and under its own privacy policy: Apple for a subscription bought in our iPhone or iPad app, Google for one bought in our Android app, and Stripe for one sold through Link on our website. For a website subscription bought before we moved checkout to Link, Stripe holds the payment records in our Stripe account on our behalf.

Audit trail: security and administrative audit records are retained for 12 months.

Anything you add to a household is visible to that household's members, by design.

Sensitive surfaces are held back by role rather than by picking members one at a time. Health profiles, the cards holding allergies, conditions, blood type, and insurance numbers, can be read by adults and caregivers and never by a child or guest account, and only an adult can edit one. A calendar item marked adults-only is hidden from child and guest accounts and is left out of the calendar subscription feed. It is included in the Google Calendar copy if an adult turns that on, because that calendar sits in the adult's own Google account. Money moves in or out of an allowance wallet only when an adult moves it.

Medications follow the same role rule: a child or guest account sees only the medications assigned to them, so they can still log their own dose, and only household adults can add, edit, or delete one. Everything else stays shared, emergency contacts included, because a child needs to be able to call one. We would rather tell you that plainly than imply a per-person privacy control we do not offer.

Member groups (e.g. "Kids", "Grandparents") are visible to everyone in the household. They exist to make filtering and addressing easier, not to hide people from each other.

Removing a member from a household revokes their access immediately.

We use a small set of trusted providers: Stripe (web billing) and RevenueCat (subscription management for the iPhone, iPad, Android and Fire tablet apps), Railway (hosting), Google Cloud Storage and Cloudflare R2, with GitHub Actions (the daily offsite backups of our database; the copy we send to Cloudflare is encrypted before it leaves us, with a key Cloudflare never holds), Amazon Web Services (Amazon SES, which sends our email), Microsoft (the same email via Microsoft Graph until the move to Amazon SES is finished, and our own company mailbox until we close that account), Cloudflare (inbound email routing, the mail exchanger for our domain and the Email Worker that passes mail to our server, plus R2 storage for the encrypted backups, and, from the day we switch it on, Turnstile, a bot check on our sign-up and password-reset pages that receives your IP address and technical details about your browser while one of those pages is open, never your email, password or household; never a proxy in front of the app), OpenAI (Robin AI inference, including voice dictation, the daily automated review of Robin conversations and reading photos and scanned pages emailed to your household's address, both from November 13, 2026, and meal and pantry suggestions, with a no-training data agreement), Anthropic (Claude, which helps us answer support emails and look into problems, without a data agreement and with its training setting switched off, and our own writing and research tools, such as drafting our blog, under a no-training data agreement; never Robin), Sentry (error and crash monitoring, on our servers and in the app), PostHog (product analytics), Google Firebase Cloud Messaging and the Apple Push Notification service (delivering push notifications to Android and to iPhone and iPad respectively), Pwned Passwords (checking new passwords against known breaches, without ever sending us your password to them), Open-Meteo (weather, air quality, and UV), Zippopotam (turning a Canadian, UK, Australian or New Zealand postcode into a place for the weather card, from the postcode and country code alone), Google (the pollen reading on the same card), Open Food Facts (pantry barcode lookup), Jina AI (reader fallback for recipe import from a URL), Blitzortung.org (real-time lightning alerts), and Prighter (our representative in the UK and the EU, who receive privacy requests and correspondence from readers there on our behalf). There is one more, and it is the only advertising-adjacent thing we do: Apple and Google also tell us which advert or store listing an app install came from, which section 2 describes in full and which has its own entry on the full list we publish. Beyond that there is no advertising network anywhere in NestBoard, no ad tags on our marketing pages, and nobody here is selling an audience.

Stripe has a second role for a subscription sold through Link. There it is the merchant of record and an independent controller of what it collects at checkout, as section 2 explains, rather than only a provider acting for us. It stays on this list because it also processes payments for us, including the web subscriptions bought before we moved checkout to Link.

Apple, Google and Amazon are not on this list for the subscriptions bought in our apps. They sell and bill those, and each is an independent controller of the purchase it handles, as section 2 explains. For those purchases they do not work for us, and what we learn about a purchase reaches us through RevenueCat, which is listed above.

We publish the full list (with the exact data each one sees and where it sits) at mynestboard.com/subprocessors and update it when it changes. If a new subprocessor will receive household content, we email account holders at least 30 days before it starts. For one that sees no household content, we update the list and note the change there.

Export: download all your household data as JSON and ICS at any time.

Correction: edit your own profile anytime, or ask us to correct anything else.

Deletion: delete your account in Settings, or email privacy@mynestboard.com.

Portability: ICS export works with any other calendar, and JSON export documents the full schema.

EU/UK/CA residents have additional rights under GDPR, UK GDPR, and PIPEDA. Contact us to exercise them, and see the next section for how.

If you are in the United States: wherever you live, you have the rights above. You can see, export, correct and delete your data, and we answer a request within one month, the same as we do for readers in the UK and Europe. We do not sell your personal information, and we do not share it for targeted advertising. The only advertising-related record we keep is the one row per household described in section 2, which tells us which of our own adverts or store listings an app install came from.

This section applies if you are in the United Kingdom, the European Economic Area, or Switzerland. NestBoard LLC is the data controller for the personal information described in this policy. Where we act on your instructions inside your own household, we still hold controller responsibility for the service as a whole, so you can bring any request straight to us.

Why we are allowed to process your data (lawful basis). Running your household calendar, chores, lists, medications, and everything else you put into NestBoard: performance of our contract with you, because it is the service you signed up for. Billing, fraud prevention, and keeping records of what we sold: contract, and our legal obligations for tax and accounting. Sending verification, password reset, security alerts, and reminders you switched on: contract. Keeping the service secure, preventing abuse, fixing crashes, and running the audit trail: our legitimate interests in operating a safe and working product, balanced against your interests and limited by the scrubbing described in section 2. Product analytics, including the setup-progress record described in section 2: your consent, asked for separately, and withdrawable at any time without losing anything. Knowing that a link in our weekly update or daily briefing was clicked: our legitimate interests in knowing whether the emails you are subscribed to are worth sending, which stores nothing on your device. Counting the notifications we sent you and whether they were opened, which stores nothing on your device and carries only a category label: our legitimate interests in knowing whether the reminders you switched on are working. Onboarding and re-engagement emails: legitimate interests, with a one-click way to stop them in every message. From November 13, 2026, the automated daily check of Robin's answers described in section 2: our legitimate interests in catching and fixing Robin's mistakes before they cause a family harm, limited to finding mistakes, with names you've registered replaced before the check and nothing kept but short notes about mistakes. Working out which advert or store listing an app install came from, which is the one row per household described in section 2: our legitimate interests in knowing whether money we spend on advertising brings households in, rather than guessing. It carries no advertising identifier and no profile of you, it is not joined to what you do inside NestBoard, and you can ask us to delete it the same way you can ask about anything else here. Health details, which are special category data under Article 9: your explicit consent, given by choosing to type them in. From November 13, 2026, if you type health details to Robin, the automated daily check of Robin's answers reads them too, for that second purpose of finding Robin's mistakes, under the same consent. It is told to keep health details out of its notes, and you can stop it by clearing Robin's history or switching Robin off. They are shown back to the adults and caregivers in your own household, and there is one further use worth spelling out. If your household switches on the National Leaderboard, which is off until somebody turns it on, the number of medication doses marked as taken in the last four weeks is one of the ingredients in the score we publish for your household. That number is never published, and neither is a medication name, a member, or a date. A visitor to the leaderboard sees a rank, the team name your household invented, the city and state your household chose to show, a score, and an identifier that is not your real household id. Switching the leaderboard back off takes your household out of it.

Cookies and similar storage. In the UK, the EEA, and Switzerland we store nothing on your device that is not strictly necessary until you have said yes. Non-essential storage means our product analytics, and it is off by default for you. Strictly necessary storage keeps working either way, because without it the service cannot function: the session cookie or app token that keeps you signed in, your theme and layout preferences, the offline cache, and the record of the choice you made on the consent banner. You can change your answer at any time in Settings, under Privacy and Data. Saying no is one tap, exactly like saying yes, and nothing about NestBoard works differently afterwards.

How long we keep things. The retention periods in section 4 apply to you in full: household content for as long as the household is active, a deletion request holding your data for 30 days (some things go at the request, such as invites nobody has accepted yet and connected Google and Outlook calendars, as section 4 sets out) and then removing the live data, with our host's daily database snapshots aging out six days after that and the daily offsite copy deleted after 30 days and fully gone about 38 days after it was taken, unverified signups deleted automatically after 30 days, but not while someone else in the household still signs in, Robin conversations for 12 months, crash and error logs for 90 days, the text of emails sent to us for 90 days, along with whatever we read out of that text, with the sender, subject and date kept after that, the record of email between us for 12 months, a cached weather forecast for your area deleted within a day of going stale along with the coordinates stored with it, check-ins, chore history and leaderboard scores kept for as long as the household is and removed with it, the record of where an app install came from kept for 24 months and then deleted, or removed with the household if that comes first, and security and administrative audit records for 12 months. Our own books (our bank deposits, the payouts we receive, and our expenses) are kept for seven years because tax and accounting rules require it. For a subscription sold through Link, Stripe keeps its own record of the sale as merchant of record, under its own privacy policy, and Apple and Google do the same for a subscription bought in our apps. Nothing is kept indefinitely by default. One thing is deliberately kept past a deletion rather than removed by it: feedback you sent us about the product, which we hold in de-identified form, as section 4 sets out. We do not call that anonymous, and we treat it as personal data for as long as there is any argument that it still is.

Where your data is. Our servers are in the United States, and several of the providers listed at mynestboard.com/subprocessors are US companies. So when you use NestBoard your personal data is transferred out of the UK and the EEA. For most of our providers, we rely on the European Commission Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK transfers and the Swiss addendum where Swiss law applies, in each contract that needs them. Where a provider is certified under the EU-US Data Privacy Framework and its UK extension, we rely on that instead. Four routes are covered by neither, and we would rather name them than let those sentences claim them. Apple and Mozilla are not certified under the Data Privacy Framework and have no transfer contract with us, so no contract or certification covers what they receive. The Apple Push Notification service receives the push token for your iPhone or iPad and the text of each notification we send it, and that text can name a family member or, in a dose reminder, a medicine. Safari web push, run by Apple, and Firefox web push, run by Mozilla, receive only the delivery address for your browser and a message encrypted end to end, which they cannot read. Apple's advertising attribution service receives the install token described in section 2. We keep the volume of data crossing the border as small as we can: the scrubbing described in section 2 runs before anything leaves our servers or your device, and no provider on that list receives your calendar entries, chore names, notes, or messages except the ones you can see are for exactly that purpose.

Your rights. You can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or object to how we use it, ask us to hand it to another provider in a portable format, and withdraw any consent you have given. Several of these you can do yourself and immediately: export from Settings under Privacy and Data, delete your account from the same place, delete the whole household from there if you are an adult in it, and turn analytics off there too. For anything else, email privacy@mynestboard.com from your account address. We answer within one month, and if a request is genuinely complicated we will tell you before that month is up rather than after. We do not charge for any of this.

Automated decisions. We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you for advertising. Robin acts only on what you ask it to do, inside your own household.

Complaints. If you think we have got something wrong, tell us first at privacy@mynestboard.com, because we would rather fix it than argue about it. You also have the right to complain to a regulator without going through us. In the UK that is the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). In the EEA it is the supervisory authority in the country where you live or work, and the European Data Protection Board publishes the list at edpb.europa.eu. In Switzerland it is the Federal Data Protection and Information Commissioner.

Our representative in the UK and the EU. NestBoard LLC is based in the United States and has no office in the UK or the EU, so Article 27 of the UK GDPR and of the EU GDPR each require us to name a representative you and your regulator can contact locally. We have appointed Prighter. For the European Economic Area our representative is Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria. For the United Kingdom our representative is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom. The quickest way to reach them, and to exercise any of the rights above, is the page they run for us at app.prighter.com/portal/nestboard. You can also write to either of them about anything in this policy, and you can always come straight to us instead at privacy@mynestboard.com. Naming a representative does not change any of your rights, does not change how long we take, and does not change where you can complain.

Kid-mode seats are designed for use by minors under parental supervision. They cannot sign up independently and have no public profile, no messaging, and no AI access by default.

A child's profile is created and controlled by an adult in the household. How we take your consent depends on where you add the child. During first-time setup, adding a child under 13 brings up a box you have to tick before you can carry on. It says that you are that child's parent or legal guardian and that you consent on their behalf, and setup does not continue until you tick it. We record that you ticked it and the date. We will not dress that up as more than it is: it is your word, recorded and dated, and it is not one of the formal verification methods the COPPA rule lists. Adding a child of 13 or over raises nothing, and adding a child anywhere else in NestBoard asks the same question in the same words. On the Family page afterwards, marking a child as under 13 turns that confirmation into a checkbox the profile will not save without. We do not independently verify the relationship, and we do not work out a child's age by ourselves. Parents can review a kid-mode seat, and delete it, at any time. Our Children's Privacy page at mynestboard.com/childrens-privacy sets out exactly what we hold about a child and exactly how each consent is asked for.

Data is encrypted in transit (TLS 1.3) and at rest.

Accounts are protected by strong password rules (including a check against known breached passwords), automatic lockout after repeated failed sign-in attempts, and an email alert when a new device signs in. You can also sign in with Google or Apple, which add their own protections.

Our security overview and vulnerability disclosure policy are published at mynestboard.com/security.

The service is provided by NestBoard LLC, a Florida limited liability company based in the USA. NestBoard LLC is the data controller responsible for your personal information under applicable privacy laws.

Most changes to this policy take effect when we publish them, and once a month we email every account holder with a confirmed email address a summary of what changed and the date each change took effect. If a change takes away a protection this policy gives you, or starts sharing household content with a company that does not get it today, we email every account holder with a confirmed email address at least 30 days before that change takes effect.

Privacy questions: privacy@mynestboard.com. General questions and bug reports: hello@mynestboard.com. A real person answers within a day.

Effective date: October 30, 2026. Last updated: October 27, 2026.

The daily quality review of Robin conversations and the reading of photos and scanned pages, both described in section 2, start on November 13, 2026. A one-time version of the quality review ran on October 26, 2026; section 2 says what it covered and what we deleted.