Built for the people you trust most. Including us.

Everything you send to NestBoard travels over TLS 1.3. HTTPS is terminated at our hosting provider (Railway), and we do not accept plain-HTTP traffic.

At rest, your household data lives in a managed PostgreSQL database with provider-managed storage encryption. Backups inherit the same encryption.

Passwords are never stored in plaintext. They are hashed with scrypt (per-user salt, constant-time compare on verification). Session tokens are random opaque values bound to a server-side row. Revoking a session invalidates it immediately, whether it is presented as a cookie (web) or a bearer token (our mobile apps).

The optional calendar subscription feed gets the same treatment: its secret link token is stored only as a one-way hash, with an encrypted copy kept solely so the app can show you your own link again, and regenerating the link revokes the old one immediately.

Accounts use email + password with a 10-character minimum. We do not enforce arbitrary complexity rules (mixed case, symbols). Length is what matters. New and changed passwords are also screened against a public database of passwords known to have leaked in past breaches. That check sends only the first five characters of a hash of your password, never the password itself, so the service doing the lookup cannot tell what you chose or who asked.

Google Sign-In is available as an alternative or recovery path. Sign-in attempts are rate-limited per IP and per email. Repeated failures slow further attempts and, eventually, lock the account for a cool-down window.

Session cookies are HttpOnly and Secure in production, marked with SameSite to limit cross-site leakage. CSRF protection uses a double-submit pattern: the server issues a non-HttpOnly companion cookie that the frontend echoes back as an X-CSRF-Token header on every state-changing request.

Signup forms include a honeypot field that legitimate users never see. Submissions that fill it are silently rejected.

Every read and write in the API is scoped to a household. The auth middleware attaches the caller's household id to the request, and route handlers compare that against the resource's household id before doing anything.

Helpers like requireMember, requireEvent, and requireChore enforce this consistently. If a request asks for a resource that doesn't belong to its household, the API returns 404, not the row.

Member-level permissions (adult / teen / kid / caregiver) further restrict sensitive surfaces like medications, finances, and private calendar items.

Robin uses OpenAI and Anthropic on no-training API tiers. Your household data is not used to train their models, and we do not train any models of our own on user content.

Robin works from two sources: what you actively hand it (messages you type, images you drop in, voice notes you send, and emails you forward to your private NestBoard inbox at hub@mynestboard.com), and your household's own NestBoard records, such as the calendar, chores, and medications, which it reads to answer questions and updates when you ask. That access never crosses your household's boundary.

Robin does not browse your inbox, read the web on your behalf, or scrape your messages. There is no background polling of any third-party account.

Robin conversations are kept for 12 months, then deleted automatically by a job that runs every day. The window is deliberate: it is what lets Robin remember household context across a school year instead of asking you the same questions every few weeks. Robin chat is shared across the household, not per person.

You do not have to wait out that window. An adult in the household can wipe the whole Robin conversation, plus the short facts Robin saved from it, at any time from Settings, then Privacy & Data, then Clear Robin's history. It takes effect immediately, it cannot be undone, and it leaves the rest of your household data alone. Deleting your account removes the conversation too.

Deleting your account wipes the whole conversation history along with the rest of your household data. If you would rather we cleared the history for you, email privacy@mynestboard.com from your account address and we will do it.

When you request deletion, your account is immediately flagged so the auth middleware refuses all new sessions for that user. The full cascade (wiping household-scoped rows from active systems) runs after a 30-day grace window in case the request was a mistake.

You can export your household data at any time as a single JSON file. The export covers the major household tables, events, chores, medications, pantry, meal plans, routines, board messages, allowance, savings goals, pets, school assignments, and more, and strips secrets like password hashes, session tokens, and Stripe identifiers before download.

Connected calendar feeds and integration tokens are revoked immediately on disconnect or deletion request, regardless of the 30-day grace period.

NestBoard runs on a small set of trusted infrastructure providers: Stripe (web billing), Apple In-App Purchase with RevenueCat (billing inside the iPhone and iPad app), Railway (hosting + managed Postgres), Microsoft Graph (transactional email), OpenAI / Anthropic (Robin inference, no-training tiers), Sentry (error and crash monitoring, both on our servers and in the app), Firebase Cloud Messaging and the Apple Push Notification service (push delivery to Android and to iPhone and iPad), PostHog (product analytics, cookieless with no session replays), and HeyCatch (product analytics, first-party only, no session recording).

The full list (with what each provider does and where data lives) is published at mynestboard.com/subprocessors. We notify customers 30 days before adding any new one.

If you think you've found a security issue, email security@mynestboard.com. Include enough detail for us to reproduce: a description, affected endpoint or surface, and any relevant request/response if you have it.

We acknowledge reports within 5 business days and aim to confirm or dispute the finding within 10. Please give us a reasonable window to ship a fix before publishing details. We will credit you in any post-fix announcement if you'd like.

In scope: anything on mynestboard.com, the NestBoard API (family-calendarapi-production.up.railway.app), and the official NestBoard Android, iPhone, and iPad apps. Out of scope: denial-of-service tests, social engineering of NestBoard staff or customers, and findings that depend on physical access to a victim's device.

We don't currently run a paid bug-bounty program. We do say thank you, publicly if you want.

No advertising networks. NestBoard has no ad model and will not have one.

No data sales. Your household contents are never sold, rented, or shared with brokers.

No model training on user data. Not by us, not by our AI providers.

No advertising trackers in the product. The app uses PostHog for privacy-conscious product analytics: cookies disabled, session replays off by default, and all on-screen text masked from any future replay capture. It also uses HeyCatch for product analytics: first-party only (local storage plus a first-party cookie), session recording off, and it never sees household data. Our public marketing pages carry no ad-measurement tags either. We used to run the Meta Pixel and the Pinterest Tag there, and we removed both.

This security page (which now exists, hello).

Two-factor authentication for all accounts. The auth layer is structured to support it. The user-facing enrolment flow is the part that's not yet shipped.

We are not pursuing SOC 2 or ISO 27001 certification for v1. Those are real, useful frameworks. They are also a substantial spend that only buys credibility we don't need at our current scale. If that changes (for example, if we sign enterprise customers who require it) we'll say so here first.

Security reports: security@mynestboard.com.

General privacy questions: privacy@mynestboard.com. Everything else: hello@mynestboard.com.

NestBoard is operated by NestBoard LLC, a Florida limited liability company based in the USA.

We will update this page as our posture changes. Material changes (e.g., a new subprocessor with access to household content, a change to deletion timelines) are emailed to active account holders.

Effective date: August 12, 2026.