Skip to main content
NestBoard
Start free
Subprocessors

The full list, no hedging.

Our Privacy Policy promises to publish every third party that processes household data on NestBoard's behalf. This is that list, kept current, with the actual data each one sees and where they sit.

EFFECTIVE DATE: SEPTEMBER 24, 2026 · LAST REVIEWED: OCTOBER 27, 2026 · SUBPROCESSORS: 35

We update this list when it changes. If a new subprocessor will receive household content, we email account holders at least 30 days before it starts. For vendors that see no household content, we update the list and note the change here. If we remove one, we will note the change here.

Until September 24, 2026 this page promised that email for every new subprocessor, whatever it saw, and in practice we did not manage it. Every entry added before then was published on the day it shipped or the day a sweep found it, not 30 days ahead. Rather than leave you to take our word for it, every change to this list is dated at the bottom of the page, including the ones where the notice was owed and not given.

Some subprocessors are engaged only when you opt in (for example, we don't talk to Google Calendar unless you connect a Google Calendar). Those are flagged below.

The app stores are not on this list for the subscriptions they sell. If you subscribe inside our iPhone or iPad app, Apple sells and bills it, if you subscribe inside our Android app from Google Play, Google does, and if you subscribe inside our Fire tablet app, Amazon does. Each of them is an independent controller of the purchase it handles, the same way Stripe is for a subscription sold through Link, and decides for itself how to use your payment details and purchase history under its own privacy policy. For those purchases they do not work for us. We receive only a confirmation that the subscription is active, through RevenueCat, which is listed below.

Prepared but not active: our public marketing page has a Trustpilot reviews widget built in and switched off. While it is off, nothing loads from Trustpilot and no visitor data reaches them. If we ever switch it on, Trustpilot will be added to this list first, with the same notice as any other addition.

Railway

Railway Corp.
railway.com/legal/privacy
Purpose
Application hosting and managed Postgres. The NestBoard API container and primary database run on Railway. This is where everything in your household physically lives at rest.
Data shared
All household data: accounts, members, events, chores, comments, medications, lists, notes, attachments, push tokens, and connected-calendar tokens. Server logs and request metadata.
Location
United States (US-West / US-East regions).

Google Cloud Storage

Google LLC
cloud.google.com/terms/cloud-privacy-notice
Purpose
Offsite backup storage. Once a day we take a compressed backup of the entire NestBoard database and store a copy with a cloud provider separate from our main host, so a failure at the host cannot take your household data with it.
Data shared
A complete encrypted-at-rest copy of the production database, which means everything in your household. This copy is never read in the ordinary course of business. It exists to restore the service after a disaster and is deleted on the backup rotation schedule.
Location
United States.

Cloudflare R2

Cloudflare, Inc.
cloudflare.com/privacypolicy
Purpose
Encrypted offsite backup storage, listed October 25, 2026. Once we switch it on, the same daily backup job takes a copy of the NestBoard database, locks it with a key before it leaves the job, and stores the locked file in a private Cloudflare R2 bucket. We are adding it next to the Google Cloud Storage copy above. Once a restore test from the Cloudflare copy passes, we plan to stop the Google copy and take that entry off this list, and the change log below will say the day we do.
Data shared
Only a locked (encrypted) file. It is encrypted on the GitHub machine, before upload, to a public key. The matching private key is held only by us, and neither Cloudflare nor GitHub ever has it, so Cloudflare cannot read what it stores. It holds the whole database once unlocked, which is why we say so here. We keep the newest 30 daily copies and delete older ones, so a copy is deleted about 30 days after it is made, and Cloudflare keeps no recoverable version afterwards. If a nightly run fails, nothing is deleted until runs resume, so a copy can stay a little longer.
Location
Cloudflare chooses where the data sits and does not promise any one country. We created the bucket from the United States, so it most likely sits in North America. Cloudflare is a US company.

GitHub Actions

GitHub, Inc. (Microsoft Corporation)
docs.github.com privacy statement
Purpose
Automation that runs the daily offsite backups described above. The backup job runs on a GitHub-hosted machine, which reads the database and sends it to backup storage (Google Cloud Storage and Cloudflare R2).
Data shared
The database backup passes through the job while it runs. Nothing is retained on the machine after the job finishes.
Location
United States.

Stripe

Stripe, LLC
stripe.com/privacy
Purpose
Subscription billing, payment processing, and tax handling. Stripe stores your card on its servers, so we never see the full number. For a subscription sold through Link, Stripe's checkout service, which is how a subscription started on our website is sold, Stripe has a second role. Its affiliate Sold through Link, LLC is the merchant of record, and Stripe is an independent controller of the billing details it collects at that checkout, using them under its own privacy policy at link.com/privacy rather than only on our instructions.
Data shared
Billing email, name, country, card token, subscription status, charge history. Card numbers, CVC, and full payment instruments stay with Stripe. For a subscription sold through Link, Stripe also holds your Link account and the order, and shares the order with us: your contact details, billing address, payment information without the full card number, and what was bought.
Location
United States (with regional processing in the EU and UK for customers there).

RevenueCat

RevenueCat, Inc.
revenuecat.com/privacy
Purpose
In-app purchase and subscription management for the iPhone, iPad, Android and Fire tablet apps. RevenueCat validates Apple In-App Purchase, Google Play Billing and Amazon In-App Purchasing purchases and tells NestBoard when an in-app subscription starts, renews, or lapses, so we can keep the household's access in sync. During a free trial it also supplies the store's own price for the plan, which the app shows so the price is the one the store will charge.
Data shared
An opaque app user id (your NestBoard account id), the purchased product, and subscription status and expiry. No name, email, household contents, or card number is sent. Payment details stay with Apple, Google or Amazon. During a free trial the only thing sent is the app user id, and the store's prices come back.
Location
United States.
When
Only engaged in the iPhone, iPad, Android and Fire tablet apps.

Amazon SES (email delivery)

Amazon Web Services, Inc.
aws.amazon.com/privacy
Purpose
Transactional and broadcast email delivery, listed October 25, 2026. Amazon SES is replacing Microsoft Graph, listed below, as the service that sends our email: verification, password resets, invites, billing receipts, opt-in task reminder emails, the daily briefing, the weekly update, replies to your messages and founder updates. Until we switch, Microsoft Graph sends it; after, Amazon SES does. We do not turn on SES open or click tracking, and nothing in our email is an invisible tracking image.
Data shared
Recipient email address, sender (hub@mynestboard.com or dillon@mynestboard.com), subject, message body, and any inline content (e.g. invite link, household name). Amazon also tells us when a message bounces or is marked as spam, with the address it happened to.
Location
United States. Our SES account is in the AWS US East (Ohio) region.

Microsoft Graph email

Microsoft Corporation
privacy.microsoft.com
Purpose
Transactional and broadcast email delivery, until we finish moving it to Amazon SES (listed above). Until the switch, every email NestBoard sends (verification, password resets, invites, billing receipts, opt-in task reminder emails, the daily briefing, the weekly update, founder updates) is dispatched via Microsoft Graph, and after it only our own company mailbox stays with Microsoft until we close that account. We will date the removal in the change log below.
Data shared
Recipient email address, sender (hub@mynestboard.com), subject, message body, and any inline content (e.g. invite link, household name).
Location
United States. Our Microsoft 365 tenant is registered in the North America region, so the mailbox that sends your mail sits in the United States.

Cloudflare Email Routing

Cloudflare, Inc.
cloudflare.com/privacypolicy
Purpose
Inbound email delivery only. Cloudflare is the mail exchanger for mynestboard.com, so a message you send to one of our addresses (a reply to an email from us, a forward to your household's NestBoard address, or a note to hello@, privacy@, or support@) passes through Cloudflare Email Routing on its way to the mailbox we read or, for mail to a household address or hub@, to our own server through a Cloudflare Email Worker that runs inside Cloudflare's network. It is the postal sorting step, nothing more. Cloudflare is not a proxy or CDN in front of the NestBoard app or our marketing pages: that traffic goes straight to our host, so Cloudflare never sees your browsing, your session, or anything inside your household. The one exception is the bot check on our sign-up and password-reset pages, once we switch it on, which has its own entry below as Cloudflare Turnstile.
Data shared
Only what an email you send us contains while it is in transit: the sender and recipient addresses, the subject, the message body, and any attachment. Nothing is read out of your household to send to Cloudflare, and the emails NestBoard sends to you do not go through it.
Location
Cloudflare global network, with delivery into our United States mailbox.

Cloudflare Turnstile

Cloudflare, Inc.
cloudflare.com/turnstile-privacy-policy
Purpose
A bot check on the sign-up and password-reset pages of our website, listed October 27, 2026, before we switch it on. It stops automated programs from creating fake accounts and from sending password-reset emails to people who never asked for one. Once it is on, it runs in the background while one of those two pages is open, and only asks you to click if it cannot tell on its own. It does not run on any other page, once you are signed in, or inside our iPhone, iPad, Android and Fire tablet apps. It is not a proxy in front of our site: the pages themselves still come straight from our host.
Data shared
From your browser, while one of those two pages is open: your IP address, your browser's user agent, the technical fingerprint of its secure connection, and which of our pages asked for the check. When you submit the form, our server sends Cloudflare the one-time result of the check and your IP address to confirm it. Never your email address, your password, or anything inside your household. Cloudflare uses these signals to tell people from bots for us and, as a controller in its own right, to improve its bot detection. It says it does not use them to identify, profile or target anyone.
Location
Cloudflare global network. Cloudflare is a US company.

Microsoft Outlook Calendar sync

Microsoft Corporation
privacy.microsoft.com
Purpose
Read-only calendar sync: importing events from your Outlook / Microsoft 365 calendar into NestBoard, when you connect it.
Data shared
Calendar event titles, times, locations, descriptions, and attendees on the calendars you authorize. We do not read mail, contacts, or files.
Location
United States and European Union.
When
Only engaged if you connect an Outlook / Microsoft 365 calendar in Settings.

Google Sign-In and Calendar sync

Google LLC
policies.google.com/privacy
Purpose
Google Sign-In (account creation and login); calendar sync (importing your Google Calendar events) when you connect it; and, only if a household adult switches it on, copying your NestBoard events out into a calendar NestBoard creates inside your Google account.
Data shared
Sign-In: your Google account email, name, profile picture, and a verified ID token. Calendar sync in (only when you connect it): event titles, times, locations, descriptions, and attendees on the calendars you authorize. Showing NestBoard events in Google Calendar (off unless a household adult turns it on): the titles, times, locations, descriptions, and participant names of the NestBoard events we copy into the calendar we create in your account. That permission covers only calendars this app creates, so we cannot read, change, or delete the calendars you made yourself. If a household adult also turns on showing chores in the calendar copies (off by default), the chore titles, due dates and times, whether each is done, and the first name of the assigned family member, which can be a child, are copied into that calendar as well, in the Google account the household's calendar copy is connected to. We never request mail, contacts, drive, or other scopes.
Location
United States and global Google infrastructure.

Calendar feeds you add yourself (iCal / ICS / webcal)

mynestboard.com/privacy
Purpose
Read-only calendar import: when you paste an external calendar link (an .ics or webcal:// URL) into Settings, Calendar Sync, NestBoard's server periodically fetches that link and imports its events onto your family calendar.
Data shared
NestBoard's server sends a request to whatever host you choose, so that host can see the request and our server's IP address. We do not send it any of your household data. The events the feed returns are stored on your family calendar. The host is the operator of the URL you provide (for example Apple iCloud, a school portal, or a sports-league app), which you choose, not a NestBoard-contracted subprocessor.
Location
Wherever the calendar you subscribe to is hosted (you choose the URL).
When
Only engaged for feed URLs you add yourself in Settings, Calendar Sync.

Apple Sign-In

Apple Inc.
apple.com/legal/privacy
Purpose
Sign in with Apple (account creation and login) when you choose to use it.
Data shared
Your Apple account identifier, the name you share on first sign-in, and your email address or an Apple private-relay address that forwards to your real inbox. We never request any other Apple data.
Location
United States and global Apple infrastructure.
When
Only engaged if you choose Sign in with Apple.

Firebase Cloud Messaging

Google LLC
firebase.google.com/support/privacy
Purpose
Delivery of push notifications to the Android app (reminders, comments, chore nudges, founder pings).
Data shared
FCM device token, notification title and body, and a small payload (e.g. household id, event id) used to deep-link into the app.
Location
United States and global Google infrastructure.
When
Only engaged on the Android app and only after you accept the system notification permission.

Apple Push Notification service

Apple Inc.
apple.com/legal/privacy
Purpose
Delivery of push notifications to the iPhone and iPad app (dose reminders, chore nudges, comments, lightning alerts). We send these straight to Apple rather than through Firebase, so no Google service is involved in iOS push.
Data shared
The APNs device token for each device you enable, the notification title and body, and a small payload (e.g. household id, event id) used to deep-link into the app.
Location
United States and global Apple infrastructure.
When
Only engaged on the iPhone and iPad app and only after you accept the system notification permission.

Browser push services

mynestboard.com/privacy
Purpose
Delivery of push notifications when you enable them in a web browser rather than in our app. Web push is routed through whichever push service your browser vendor operates (for example Google for Chrome, Mozilla for Firefox, Apple for Safari). Which one is used is determined by the browser you chose, not by us.
Data shared
The browser push subscription endpoint and the notification payload, which is encrypted so the push service cannot read its contents.
Location
Determined by your browser vendor.
When
Only engaged if you turn on notifications in a web browser and accept the browser permission prompt.

Pwned Passwords (Have I Been Pwned)

haveibeenpwned.com/Privacy
Purpose
Breached-password screening. When you set or change a password, we check it against a public database of passwords known to have leaked in past breaches, so we can stop you reusing one that attackers already have.
Data shared
Your password is never sent. We hash it on our server and send only the first five characters of that hash, which match many millions of different passwords, then do the actual comparison ourselves against the list that comes back. The service cannot tell what your password is, who you are, or that the check came from your account.
Location
Cloudflare global network.
When
Only engaged when you create a password or change an existing one.

OpenAI

OpenAI OpCo, LLC
openai.com/policies/privacy-policy
Purpose
Every AI model Robin uses runs here: Robin AI inference (the default model is gpt-4o-mini), content moderation on Robin inputs, and voice-dictation transcription (Whisper). Robin's tool-calling layer runs against the OpenAI Chat Completions API. Dictation goes to Whisper every time you tap the microphone in our Android, iPhone, and iPad apps, and in a web browser that has no speech recognition of its own. Also powers meal plan suggestions, automatic pantry item categorization, and structuring recipes imported from a PDF. From November 13, 2026, also runs a once-a-day automated review of Robin conversations that flags answers that look wrong, and reads photos and scanned pages attached to emails sent to a household's NestBoard address. On October 26, 2026 it also ran a one-time automated quality review of recent Robin conversations, described in the change log below.
Data shared
The text, screenshots, and forwarded-email contents you give Robin, plus the household context Robin needs to answer (e.g. a list of upcoming events). From November 13, 2026, for the daily review, each day's new Robin conversations: what the household typed and what Robin answered. Before it is sent, the names you've registered in NestBoard are replaced by labels and common formats of email addresses and phone numbers are removed. Everything else in the conversation, including any health details you typed, is sent as it is. It returns short notes about mistakes, which we store with names and contact details taken out. From November 13, 2026, for emailed photos and scanned pages, the image itself, which can show a person, a child included; we do not keep it once it has been read. When dictation uses Whisper, the short audio clip from a voice dictation is sent to OpenAI for transcription and not retained. API usage runs under an enterprise/no-training agreement, so prompts, completions, and audio are not used to train OpenAI models. For meal and pantry features we also send pantry item names and quantities and any meal request you type, and, when you ask for meal ideas, write a recipe or check who a dinner works for, the food preferences you set for family members (a diet, foods someone won't eat), under their first names, and, when you import a recipe from a PDF, the text extracted from that PDF. The same no-training agreement applies. Every one of these requests is made from our servers. Your browser and our apps never talk to OpenAI directly, and a voice clip goes to our own server first and is forwarded from there.
Location
United States.

Anthropic

Anthropic, PBC
anthropic.com/legal/privacy
Purpose
Anthropic Claude models do two jobs, neither of them Robin. First, Claude helps us answer support emails and look into problems that customers report or that our error reports catch. Second, Claude powers our own writing and research tools: drafting blog posts and checking them against our help center before they go live, drafting the public changelog and other marketing copy, and checking how AI assistants describe NestBoard when someone asks them about family organizer apps. Robin never calls Anthropic. The writing and research tools use the Anthropic Messages API; support and troubleshooting use a Claude subscription.
Data shared
For support and troubleshooting: the email a customer sent us and, when a problem needs it, the household records it involves, limited to what the job needs and never a child's records unless the parent who wrote to us asks us to. This runs under Anthropic's standard consumer terms, not a data processing agreement, with the setting that lets Anthropic train its models on our conversations switched off. For the writing and research tools: topic notes, drafts, and passages from our own help center for the blog, short descriptions of our own code changes for the changelog, and general questions about family organizer apps for the visibility check. None of that is read out of your household. One more path exists in our code: a quick-add parser that turns one typed line into a calendar event would send that line to Claude, but no screen in NestBoard or in our apps uses it today. The writing and research tools run under a no-training data agreement.
Location
United States.

Sentry

Functional Software, Inc. (dba Sentry)
sentry.io/privacy
Purpose
Error and crash monitoring, in two places. On our servers, when the API throws, Sentry receives the stack trace so we can fix it before it hits another household. In the NestBoard app (web, Android, and iPhone/iPad), Sentry also reports crashes and unhandled errors directly from your device so we can see failures that never reach our servers, such as an app that crashes on launch. Our servers also send Sentry a small sample of performance timings, so we can see which requests are slow. Our public marketing pages have no crash reporting at all.
Data shared
From our servers: error stack traces, request paths, HTTP status codes, user id (opaque), household id (opaque), and IP address. We scrub email addresses, names, household contents, and message bodies from those payloads before they leave the server. From your device: the crash or error stack trace, the app version, the screen or page address where it happened, and basic device and operating-system information, plus your IP address. Reports sent from your device do not pass through our servers first, so the server-side scrubbing above does not apply to them. The app sends Sentry no performance traces, and we do not use Sentry session replay anywhere. Our servers do send about one request in ten as a performance trace: which part of our service handled the request, how long it and the steps inside it took (such as a database lookup or a call to OpenAI), and the status code it ended with. Those traces go through the same server-side scrubbing, which also removes IP addresses, the user id, and the part of a web address after the question mark. The SDK is configured not to attach personal information by default. No household content is sent.
Location
United States.

Open-Meteo

OpenMeteo GmbH (Switzerland)
open-meteo.com/en/terms
Purpose
Weather forecasts and geocoding for the home dashboard weather card and Robin’s "what’s the weather?" answers.
Data shared
Only a place name or latitude/longitude that you (or Robin acting on your request) ask about. No account identifier, email, or household data is sent.
Location
European Union (Switzerland / Germany).

Zippopotam

The Zippopotam.us project (its site names no company or operator)
zippopotam.us (it publishes no privacy policy or terms)
Purpose
Postcode lookup. When a household in Canada, the United Kingdom, Australia or New Zealand enters a postcode as its weather location, our server asks Zippopotam which place that postcode belongs to, and uses the answer to fetch the forecast for the weather card.
Data shared
Only the postcode text and its country code (CA, GB, AU or NZ), sent from our server. No account identifier, household identifier, email, name, cookie or household contents are sent, and the request does not come from your device. It is used only for postcodes in those four countries. United States ZIP codes and place names do not use it.
Location
Not published. Zippopotam does not say where it is hosted, and its answers reach us through Cloudflare’s network. Its site says its data comes from geonames.org.
When
Only engaged when a household in one of those four countries enters a postcode as its weather location.

Google Pollen API

Google LLC
policies.google.com/privacy
Purpose
The pollen reading on the dashboard air-quality card. Once a day, for each household that has set a home location, we ask Google for that location's pollen forecast. The air quality and UV readings on the same card come from Open-Meteo, not from Google.
Data shared
Only the latitude and longitude of the home location you set. No account identifier, email, member name, or household content is sent, and nothing identifies which household asked. A household that has not set a home location is never looked up.
Location
United States.
When
Only engaged when a household sets a home location.

Open Food Facts

Open Food Facts (non-profit association, France)
openfoodfacts.org/terms-of-use
Purpose
Product lookup for the pantry barcode scanner. When you scan a grocery barcode, the product's barcode number is sent to the Open Food Facts public database to retrieve its name, brand, and category.
Data shared
Only the scanned product barcode (UPC or EAN). No account identifier, email, name, or household contents are sent. Because the lookup runs from your device, your device IP address reaches Open Food Facts.
Location
European Union (France).
When
Only engaged when you scan a barcode in the pantry.

Jina AI

Jina AI GmbH (Elastic N.V.)
jina.ai/legal
Purpose
Reader fallback for recipe import. When a recipe site blocks our direct fetch, the recipe URL you pasted is sent to Jina AI's reader (r.jina.ai) to retrieve the page's readable text, which is then parsed into a recipe.
Data shared
Only the public recipe URL you chose to import. No account info or household data.
Location
United States.
When
Only engaged when you import a recipe from a URL and the site blocks our direct fetch.

Blitzortung.org

Blitzortung.org (community lightning detection network)
blitzortung.org
Purpose
Real-time lightning strike data for the storm / lightning alert feature. NestBoard streams strike events and filters them down to your area so we can warn you when lightning is close.
Data shared
Nothing about you or your household. Our server connects to the public strike feed and sends only a fixed message that starts the stream, then filters the strikes down to your area itself. No location, account identifier, email, name, or household contents are sent.
Location
European Union (community-operated detection network).

OpenStreetMap Nominatim

OpenStreetMap Foundation
wiki.osmfoundation.org privacy policy
Purpose
Address lookup. When you type a place into a location box, such as the home location or an event address, we ask the OpenStreetMap search service to turn what you typed into a suggestion list and coordinates.
Data shared
The text you type into a location field, and, because the lookup runs from your device, your device IP address. No account identifier, email, or household contents are sent.
Location
European Union (OpenStreetMap Foundation infrastructure).
When
Only engaged while you are typing in a location field.

Amazon Alexa

Amazon.com, Inc.
amazon.com privacy notice
Purpose
Voice control. If your household connects NestBoard to Alexa, Amazon's Echo devices and speech services process what you say to the NestBoard skill, turn it into a structured request (the command plus the words you filled in, like an item name or an event name and date), and send that request to our server. Amazon also delivers NestBoard's spoken reply back to your Echo.
Data shared
What Amazon sends us: the recognized command and its details (for example "add milk", an event name and date, or a chore name), opaque Amazon account and speaker identifiers, and, during pairing, the code exchange. What Amazon holds on its side: your voice recordings and their transcripts, under your Amazon account and Amazon's own privacy controls. We never receive audio. What we send Amazon: the text NestBoard speaks back, which can include household data you asked for out loud, like today's events or what's for dinner.
Location
United States and global Amazon infrastructure.
When
Only engaged if a household adult connects NestBoard to Alexa.

Geoapify

Geoapify GmbH
geoapify.com/privacy-policy
Purpose
Address autocomplete. When you type a place into a location box, such as the home location or an event address, Geoapify turns what you typed into a suggestion list with coordinates. It has real United States residential address coverage, which is why it sits in front of the OpenStreetMap lookup listed below (used as the fallback when Geoapify is not configured).
Data shared
The text you type into a location field, and, because the lookup runs from your device, your device IP address. No account identifier, email, or household contents are sent.
Location
European Union (Germany).
When
Only engaged while you are typing in a location field.

Google Fonts

Google LLC
policies.google.com/privacy
Purpose
Typeface delivery. Our default look loads its fonts from Google Fonts every time NestBoard starts, on the web and in our Android, iPhone, and iPad apps, and our public marketing pages load theirs from Google too. Four of the optional looks load one more font each when you pick them.
Data shared
Your device IP address and browser user-agent reach Google when the font file is fetched, which is unavoidable for any file a browser downloads from another host. No account identifier, email, or household contents are sent.
Location
United States and global Google infrastructure.
When
Engaged on every device, because the default look uses it.

Google Play Integrity

Google LLC
policies.google.com/privacy
Purpose
Abuse prevention on Android. At signup the Android app can ask Google to confirm that it is a genuine, unmodified copy of NestBoard running on a genuine device, which helps us tell real families from automated signup abuse.
Data shared
A signed verdict from Google about the app and device. We record the verdict. We do not receive an advertising identifier, and the Android app explicitly removes the advertising-ID permission.
Location
United States and global Google infrastructure.
When
Only engaged in the Android app.

App install attribution (Apple Search Ads and Google Play)

Apple Inc. and Google LLC
apple.com/legal/privacy
Purpose
Working out which advert or listing an app install came from, so we know where to spend a small marketing budget. On iPhone and iPad this uses Apple's AdServices attribution. On Android it uses the Google Play install referrer.
Data shared
On iOS, an Apple-issued attribution token that we exchange with Apple for a campaign-level report. On Android, the referrer string Google Play recorded for the install. This is campaign information, not a profile of you. We do not use the iOS advertising identifier and do not ask for tracking permission, and the Android app removes the advertising-ID permission entirely.
Location
United States and global Apple / Google infrastructure.
When
Only engaged once, when the app is first installed and opened.

PostHog

PostHog, Inc.
posthog.com/privacy
Purpose
Product analytics and browser error monitoring. Understanding which features get used, where the app gets confusing, and which errors the page hits, on both the marketing site and inside the app.
Data shared
Usage events keyed to an internal account id (never your email), and the IP address of the device, from which PostHog estimates a rough location (town or city). It is cookieless (local storage, not a tracking cookie), any sign-in token in a page address is stripped before it is recorded, and no household content is collected. Since September 2026 those events include a record of each push notification we send (its category, such as a chore reminder or a lightning alert, the platform it went to, and whether the push service accepted it) and of taps on those notifications. That is a category label and a platform name, never the notification text, and it is captured by our own servers rather than by anything running on your device. Error reports carry the error type, message, and stack trace, with console output excluded and the message scrubbed on the device. Session replay covers our public marketing pages and the sign-in, sign-up, and password-reset request pages, the ones you see before you sign in, and a sample of the visits to them by visitors who are not signed in. Typing and all on-screen text are masked, so a recording shows the layout of the page and where someone tapped rather than what anything said. On the sign-in and sign-up forms that means what a visitor types, their email address and their password included, is masked and never recorded. It stops the moment a visitor signs in. Since September 2026 it also covers one bounded window inside the product: for every new household on the web, the setup screens, where you set up your household and add the people in it, plus the first view of your dashboard afterwards. Everything typed there is masked too, including the names and ages entered for children, so those recordings carry the layout and the taps and none of the content. That window stops when the household moves on from that first dashboard and does not start again, nothing else inside NestBoard is ever recorded, and none of it runs in our Android, iPhone, and iPad apps. Setup recordings are deleted after 14 days, sooner than the rest. The page reached from a password-reset email is excluded throughout, because its address carries the reset link.
Location
United States.

Prighter

Prighter EU Rep GmbH (Vienna, Austria) and Prighter Ltd (United Kingdom)
prighter.com/legal
Purpose
Our representative in the UK and the EU under Article 27 of each GDPR, appointed September 21, 2026. NestBoard LLC has no office in the UK or the EU, so a reader or a regulator there is entitled to a contact who is local to them. Prighter run that contact point for us: the portal at app.prighter.com/portal/nestboard, and the postal addresses in section 8 of our privacy policy. They are a mailbox and a case file, not part of the product.
Data shared
Only what you put in a request you send them: your name, your email address, whatever you tell them about your account, and our correspondence with you about it. They have no access to NestBoard, no account with us, and no route into your household. Nothing is read out of your household to send to Prighter, and if you come straight to us at privacy@mynestboard.com instead, they never see it at all.
Location
Austria and the United Kingdom.
When
Only engaged if you choose to contact them rather than contacting us directly.

Every change to this list

Newest first. Nothing is removed from this log, including the times we added a company without giving the notice promised above.

  1. October 27, 2026
    Cloudflare Turnstile
    Added, before it is switched on. Cloudflare Turnstile is a bot check on our sign-up and password-reset pages. While one of those pages is open it receives your IP address and technical details about your browser, and no household content, so no 30 days' notice was owed. Cloudflare was already on this list for email and backups. We will date the day it is switched on here.
  2. October 26, 2026
    Zippopotam
    Added. Zippopotam turns a Canadian, UK, Australian or New Zealand postcode into a place for the weather card. It receives only the postcode and its country code from our server, with nothing that identifies you or your household, so no 30 days' notice was owed. It publishes no privacy policy or terms, which is why this entry links only to its site.
  3. October 25, 2026
    Amazon SES
    Added. Amazon SES is becoming the service that sends our email, replacing Microsoft Graph, and our email carries household content such as reminders and briefings. The 30 days' notice promised above was not given first: we are listing it and starting now, and we are emailing every account holder about it anyway. Microsoft Graph's entry stays until the switch is done.
  4. October 25, 2026
    Cloudflare R2
    Added. Cloudflare R2 stores a second offsite copy of our database backup, encrypted before it leaves us with a key Cloudflare never holds, so it sees no household content. Because of that, no 30 days' notice was owed for it, and we are including it in the same email to account holders. The Google Cloud Storage copy keeps running until a restore test from Cloudflare's copy passes, and we will date its removal here.
  5. October 25, 2026
    OpenAI
    No company was added or removed; OpenAI now also receives family members' food preferences, including children's, for Robin's meal suggestions and recipe labels.
  6. October 25, 2026
    RevenueCat
    No company was added or removed; RevenueCat's entry now says that during a free trial the apps also use it to look up and show the store's price for the plan. It receives the same opaque app user id and returns the store's prices. No name, email or household contents.
  7. November 13, 2026
    OpenAI
    No company was added or removed. OpenAI now also runs a daily automated review of Robin conversations and reads photos and scanned pages emailed to a household's NestBoard address. We emailed every account holder about this on October 13, 2026.
  8. October 26, 2026
    OpenAI
    No company was added or removed. On October 26, 2026 we ran a one-time automated quality review of recent Robin conversations, processed by OpenAI, which already runs Robin. Households with Robin turned off were left out. In two households it included older conversations from before one adult turned AI off; we deleted those results. The review was used only to improve Robin.
  9. October 18, 2026
    Langfuse
    Deleted. We deleted our Langfuse project on October 18, 2026. That deleted the short summaries of Robin turns it still held, the ones we sent it from September 21 to September 29, 2026 and described in the two entries below. They were counts, timings, and labels, never the words of anyone's conversation. Nothing has gone to Langfuse since September 29.
  10. October 19, 2026
    Apple In-App Purchase, Google Play Billing
    Removed from the list, and no company was added. Apple and Google sell and bill a subscription bought inside our apps, and each is an independent controller of that purchase, the same way Stripe is for a subscription sold through Link. For those purchases they do not process anything for us, so their billing does not belong on a list of subprocessors, and a line above the list now says so. Nothing changed in what they or RevenueCat receive, and RevenueCat's entry stays. The September 29, 2026 entry below that added Google Play Billing stays as written.
  11. October 13, 2026
    Anthropic
    No company was added or removed. Anthropic's Claude now also helps us with support emails and troubleshooting, which means it can see household content; that use has no data agreement, and its training setting is off. We emailed every account holder about this on October 13, 2026.
  12. September 29, 2026
    Langfuse
    Removed. From September 21, 2026 until this change, our servers sent Langfuse a short summary of each Robin turn, made of counts, timings, and labels and never the words of anyone's conversation, so we could see whether Robin was working. We now keep those numbers in our own database instead. The code that sent them has been deleted, so nothing reaches Langfuse anymore, and its entry is off the list above.
  13. September 29, 2026
    Google Fonts
    Corrected, and no company was added or removed. The entry said Google Fonts was only used by looks that load a font we do not ship ourselves. In fact our default look loads its fonts from Google on every device, and four optional looks load more. The entry now says so.
  14. September 29, 2026
    Stripe, OpenAI, Open-Meteo, Jina AI
    Corrected, and no company was added or removed. The company names on four entries were out of date. Stripe's entry now says Stripe, LLC, where it said Stripe, Inc. OpenAI's now says OpenAI OpCo, LLC, where it said OpenAI, L.L.C. Open-Meteo's now names OpenMeteo GmbH, the company that runs it. Jina AI's now notes that Jina AI GmbH is part of Elastic. The services, and what each one receives, are the same.
  15. September 29, 2026
    Google Play Billing, RevenueCat
    Added Google Play Billing, and RevenueCat's entry now covers the Android app. Google Play Billing handles a subscription bought inside our Android app from Google Play, the way Apple handles one bought in the iPhone and iPad app. Neither receives household content. For a Google Play subscription RevenueCat gets the same things it already gets for an Apple one: an opaque account id, the plan, and its status and end date.
  16. September 29, 2026
    PostHog
    Corrected, and no company was added or removed. The entry called the events PostHog receives anonymized. They are keyed to an internal account id, and they carry the IP address of the device, from which PostHog estimates a rough location. The entry now says so.
  17. September 29, 2026
    Blitzortung.org
    Corrected, and no company was added or removed. The entry said Blitzortung receives your approximate home location. It never has: our server takes the public strike feed and does the filtering itself. The entry now says Blitzortung gets nothing about you or your household.
  18. September 25, 2026
    Langfuse
    Added. Langfuse has received a summary of each Robin turn since September 21, 2026, and it was missing from this list until today, when our own review of it found the gap. No notice was given: on the day it started this page still promised 30 days' email before any new subprocessor, and it was not listed on the day either. For its first few hours, before the daily household code was in place, each summary carried the last six characters of the household's internal id instead.
  19. September 25, 2026
    Sentry
    Corrected, and no company was added or removed. The entry said Sentry performance tracing was turned off. That was true of the app on your device and never true of our servers, which send Sentry about one request in ten as a performance trace. The entry now says so, and says what those traces carry.
  20. September 25, 2026
    Anthropic, OpenAI
    Corrected, and no company was added or removed. The Anthropic entry said it handled some of Robin's work. It does not: every AI model Robin uses runs at OpenAI, and Anthropic is used for our own writing and research tools, as its entry now says. The OpenAI entry said voice dictation reached OpenAI only from iPhone and iPad. It also does from our Android app, and from a web browser that has no speech recognition of its own.
  21. September 24, 2026
    This page
    Changed, and no company was added or removed. The promise at the top of this page now says what we actually do. A new subprocessor that will receive household content still means an email to account holders at least 30 days before it starts. One that sees no household content is added to the list and dated here on the day, rather than emailed about.
  22. September 22, 2026
    Stripe
    Changed, and no company was added. The entry now describes Stripe's second role for a subscription sold through Link, Stripe's checkout service, which is how new subscriptions on our website are sold. For those sales Stripe is the merchant of record and decides for itself how it uses the billing details it collects, under its own privacy policy. Subscriptions bought on our website before that stay as they were, with Stripe processing payments for us.
  23. September 21, 2026
    HeyCatch
    Removed. Later the same day as the cancellation below, the code that sent to them was deleted: their script no longer loads on our marketing pages, our servers no longer send them anything, and their entry is off the list above. Two lines rather than one because they are two different events. The day we stopped paying and the day we stopped sending were not the same day, and only the second one changes what happens to your data.
  24. September 21, 2026
    Prighter
    Added. Our representative in the UK and the EU under Article 27, appointed and listed on the same day. They receive privacy requests from readers there. This did not get the 30 days' notice promised above.
  25. September 21, 2026
    Microsoft Graph email
    Corrected, no change to who processes anything. The location said our Microsoft 365 tenant spanned the United States and the European Union. It does not. The tenant is registered in North America, so the mailbox that sends your mail is in the United States. The Cloudflare Email Routing entry had copied the same wording and was corrected with it.
  26. September 21, 2026
    HeyCatch
    Our subscription was cancelled on this date, and the entry stays. Cancelling the invoice did not stop the data: their script still loads on our public marketing pages and our servers still send them milestone events. It comes off this list on the day that code is removed, and that day gets its own line here.
  27. September 8, 2026
    Cloudflare Email Routing
    Added. Already live as the mail exchanger for our domain, and found undisclosed by a sweep. No notice was given.
  28. September 8, 2026
    Discord
    Removed. The feedback webhook that sent us a chat notification was deleted from the product outright, so nothing reaches them at all.
  29. September 3, 2026
    Google Pollen API
    Added. Already live behind the dashboard air-quality card, and found undisclosed by a sweep. No notice was given.
  30. August 24, 2026
    Amazon Alexa, Geoapify
    Added. Both shipped with version 1.0.149, listed the day they shipped. No notice was given.
  31. August 12, 2026
    Nine entries from a disclosure sweep
    Added: Google Cloud Storage, GitHub Actions, the Apple Push Notification service, browser push services, Pwned Passwords, OpenStreetMap Nominatim, Google Fonts, Google Play Integrity, and app install attribution. All were already live and none had been listed. No notice was given. The Meta Pixel and the Pinterest Tag were removed from the product entirely on the same day.
  32. August 10, 2026
    HeyCatch
    Added, on the day it shipped with the product. No notice was given.
  33. June 11, 2026
    This page
    Published with the launch list.

Questions about a specific subprocessor?

Email privacy@mynestboard.com. We answer within one business day.

Start your household See features