Built for the people you trust most. Including us.

Everything you send to NestBoard travels over TLS 1.3. HTTPS is terminated at our hosting provider (Railway), and we do not accept plain-HTTP traffic.

At rest, your household data lives in a managed PostgreSQL database with provider-managed storage encryption. Backups inherit the same encryption, and from the date we switch it on, the offsite copy we keep with Cloudflare is also locked with a key only we hold before it leaves our hands.

Passwords are never stored in plaintext. They are hashed with scrypt (per-user salt, constant-time compare on verification). Session tokens are random opaque values bound to a server-side row. Revoking a session invalidates it immediately, whether it is presented as a cookie (web) or a bearer token (our mobile apps).

The optional calendar subscription feed gets the same treatment: its secret link token is stored only as a one-way hash, with an encrypted copy kept solely so the app can show you your own link again, and regenerating the link revokes the old one immediately.

Accounts use email + password with a 10-character minimum. Length does most of the work, and we keep the rest to the few checks that actually help: a password cannot be all letters or all digits, cannot be one of the predictable long ones people pick to satisfy a length rule, and cannot contain "NestBoard". We do not demand a symbol or a capital in a particular place. Every rule is printed under the field before you type, so nothing is sprung on you in an error message. New and changed passwords are also screened against a public database of passwords known to have leaked in past breaches. That check sends only the first five characters of a hash of your password, never the password itself, so the service doing the lookup cannot tell what you chose or who asked.

Google Sign-In and Sign in with Apple are both available as an alternative or recovery path, on the website and in our apps. Sign-in attempts are rate-limited per IP and per email. Repeated failures slow further attempts and, eventually, lock the account for a cool-down window.

Session cookies are HttpOnly and Secure in production, marked with SameSite to limit cross-site leakage. CSRF protection uses a double-submit pattern: the server issues a non-HttpOnly companion cookie that the frontend echoes back as an X-CSRF-Token header on every state-changing request.

Signup forms include a honeypot field that legitimate users never see. Submissions that fill it are silently rejected.

Every read and write in the API is scoped to a household. The auth middleware attaches the caller's household id to the request, and route handlers compare that against the resource's household id before doing anything.

Helpers like requireMember, requireEvent, and requireChore enforce this consistently. If a request asks for a resource that doesn't belong to its household, the API returns 404, not the row.

Member roles (adult, caregiver, child, guest) further restrict what a session can reach, and the checks run on the server rather than in the app. Health profiles are readable by adults and caregivers and never by a child or guest account, and only an adult can edit one. Only an adult can move allowance money. Events marked adults-only are withheld from child and guest sessions. A child or guest session is shown only the medications assigned to that person, and only an adult can add, edit, or delete a medication. These are role gates, not per-person visibility settings, so we do not claim you can hide a surface from one named member.

Robin uses OpenAI, on a no-training API tier. Your household data is not used to train OpenAI's models, and we do not train any models of our own on user content.

Robin works from two sources: what you actively hand it (messages you type, images you drop in, voice notes you send, and emails you forward to your household's own private forwarding address, which you will find in Settings under Email forwarding address), and your household's own NestBoard records, such as the calendar, chores, and medications, which it reads to answer questions and updates when you ask. That access never crosses your household's boundary.

Robin does not browse your inbox, read the web on your behalf, or scrape your messages. There is no background polling of any third-party account.

From November 13, 2026, every conversation is checked, by a program first and sometimes by a person. Until then, there is no ongoing automatic check: the one person who runs NestBoard may read conversations one at a time to find Robin's mistakes. On October 26, 2026 we ran a one-time automated quality review of recent Robin conversations, processed by OpenAI, which already runs Robin. Households with Robin turned off were left out. In two households it included older conversations from before one adult turned AI off, and we deleted those results. We used the review only to improve Robin. NestBoard is run by one person, and he works inside NestBoard's own admin tools. Conversations are not emailed. It covers every household except our own internal test ones, and nothing has to go wrong first. We do it because it is how we catch Robin answering badly or getting something about your household wrong, and at our size there is no other way to know. So assume a person at NestBoard may see what you say to Robin. We do not sell those conversations, we do not use them for advertising, we do not use them to train any AI model, and we do not hand them to anyone outside NestBoard to use. Once a day from then on, an automated review run by OpenAI, under the same no-training agreement that covers Robin, reads the day's new conversations and flags answers that look wrong, such as a false "done", a wrong date or the wrong person. Before a conversation goes to that review, we replace the names you've registered in NestBoard with labels and remove common formats of email addresses and phone numbers. Anything else in the conversation, including any health details, is read by the review as it is. For each flag it writes a short note with names taken out, and those notes are deleted along with the conversation. The review only flags; it never changes anything in your household. He opens flagged conversations inside NestBoard's own admin tools, and can open any other one when he needs to. When a conversation is opened, we record that it was opened and when, but not what it said. The automated review is not recorded one conversation at a time, so we cannot promise to tell you every time yours was read. Clearing Robin's history removes the conversation from NestBoard, and deleting your account removes your messages to Robin and Robin's replies to them. If you would rather none of this happened, an adult can switch Robin off for the whole household in Settings, and then there is nothing to read.

Robin conversations are kept for 12 months, then deleted automatically by a job that runs every day. The window is deliberate: it is what lets Robin remember household context across a school year instead of asking you the same questions every few weeks. Robin chat is shared across the household, not per person.

You do not have to wait out that window. An adult in the household can wipe the whole Robin conversation at any time from Settings, then Privacy & Data, then Clear Robin's history. It takes effect immediately, it cannot be undone, and it leaves the rest of your household data alone.

The conversation is the whole of Robin's memory. Until September 2026 Robin also saved short facts it had drawn out of your chats, an allergy or a birthday or the dog's name, and kept them on a separate clock. It no longer saves them, and we hold none of them for any household, so clearing the conversation leaves nothing behind for Robin to remember.

Deleting your account removes your messages to Robin and Robin's replies to them. If yours is the last account in the household, or the only other sign-ins are children's, guests' or caregivers' and go with yours, the whole conversation goes with the household. If you would rather we cleared the history for you, email privacy@mynestboard.com from your account address and we will do it.

When you request deletion, your account is immediately flagged so the auth middleware refuses all new sessions for that user. The full cascade (wiping household-scoped rows from active systems) runs after a 30-day grace window in case the request was a mistake.

You can export your household data at any time as a single JSON file. The export covers the major household tables, events, chores, medications, pantry, meal plans, routines, board messages, allowance, savings goals, pets, school assignments, and more, and strips secrets like password hashes, session tokens, and Stripe identifiers before download.

Disconnecting a connected calendar deletes our stored token right away (if a calendar sync is running at that exact moment, we finish the job as soon as it ends, normally within the hour), and for Google we also call their revocation endpoint so the grant itself dies rather than just our copy of it. Microsoft publishes no per-application revocation endpoint, so an Outlook disconnect deletes our token and you finish the job in your Microsoft account's app permissions if you want the grant gone there too. The same teardown runs when the last account in a household requests deletion, when the last adult does and the only other sign-ins are children's, guests' or caregivers' and go with theirs, and when an adult deletes the household itself, without waiting out the 30-day grace period. Cancelling the deletion does not reconnect a calendar we already disconnected.

NestBoard runs on a small set of trusted infrastructure providers: Stripe (web billing) and RevenueCat (subscription management for the iPhone, iPad, Android and Fire tablet apps; Apple, Google and Amazon sell and bill those subscriptions as independent controllers, not as providers working for us), Railway (hosting + managed Postgres), Amazon SES (transactional email, replacing Microsoft Graph, which sends it until the switch is done), Microsoft Graph (transactional email until then), Cloudflare R2 (encrypted offsite backups, from the date we switch it on, locked with a key Cloudflare never holds), OpenAI (Robin inference, including voice dictation, no-training tier; from November 13, 2026 also a daily automated review of Robin conversations and reading photos and scanned pages emailed to a household's NestBoard address), Anthropic (Claude, which helps us answer support emails and look into problems, without a data agreement and with its training setting switched off, and our own writing and research tools, no-training tier; never Robin), Sentry (error and crash monitoring, both on our servers and in the app), Firebase Cloud Messaging and the Apple Push Notification service (push delivery to Android and to iPhone and iPad), and PostHog (product analytics and browser error monitoring, cookieless; session replay runs on our signed-out marketing, sign-in, sign-up, and password-reset request pages, and on the setup screens of every new web household, with typing and text masked throughout).

The full list (with what each provider does and where data lives) is published at mynestboard.com/subprocessors. If a new provider will receive household content, we email account holders at least 30 days before it starts. For one that sees no household content, we update that list and note the change there.

If you think you've found a security issue, email security@mynestboard.com. Include enough detail for us to reproduce: a description, affected endpoint or surface, and any relevant request/response if you have it.

We acknowledge reports within 5 business days and aim to confirm or dispute the finding within 10. Please give us a reasonable window to ship a fix before publishing details. We will credit you in any post-fix announcement if you'd like.

In scope: anything on mynestboard.com, the NestBoard API (family-calendarapi-production.up.railway.app), and the official NestBoard Android, iPhone, and iPad apps. Out of scope: denial-of-service tests, social engineering of NestBoard staff or customers, and findings that depend on physical access to a victim's device.

We don't currently run a paid bug-bounty program. We do say thank you, publicly if you want.

No advertising networks. NestBoard has no ad model and will not have one.

No data sales. Your household contents are never sold, rented, or shared with brokers.

No model training on user data. Not by us, not by our AI providers.

No advertising trackers in the product. The app uses PostHog for privacy-conscious product analytics, with cookies disabled. We record a sample of visits to our public marketing pages and to the sign-in, sign-up, and password-reset request pages, with every input and all on-screen text masked, so a recording shows layout and taps rather than content. On the sign-in and sign-up forms that means what you type, your email address and your password included, is masked and never recorded, and it stops the moment you sign in. Since September 2026 one bounded window inside the product is recorded the same way, for every new household on the web: the setup screens, where you set up your household, and the first view of your dashboard afterwards. Everything typed there is masked as well, the names and ages entered for children included, those recordings are deleted after 14 days, and the window ends when the household moves on from that first dashboard and does not start again. Nothing else inside NestBoard is ever recorded, and none of it runs in our Android, iPhone, and iPad apps. The page reached from a password-reset email is never recorded at all, because its address carries the reset link. A second product-analytics provider ran alongside it, on the marketing pages only, until September 2026; we removed it from NestBoard entirely. Our public marketing pages carry no ad-measurement tags either. We used to run the Meta Pixel and the Pinterest Tag there, and we removed both.

This security page (which now exists, hello).

Two-factor authentication for all accounts. The auth layer is structured to support it. The user-facing enrolment flow is the part that's not yet shipped.

We are not pursuing SOC 2 or ISO 27001 certification for v1. Those are real, useful frameworks. They are also a substantial spend that only buys credibility we don't need at our current scale. If that changes (for example, if we sign enterprise customers who require it) we'll say so here first.

Security reports: security@mynestboard.com.

General privacy questions: privacy@mynestboard.com. Everything else: hello@mynestboard.com.

NestBoard is operated by NestBoard LLC, a Florida limited liability company based in the USA.

We will update this page as our posture changes. Material changes (e.g., a new subprocessor with access to household content, a change to deletion timelines) are emailed to active account holders.

Effective date: September 24, 2026.