Built for the people you trust most. Including us.

Everything you send to NestBoard travels over TLS 1.3. HTTPS is terminated at our hosting provider (Railway), and we do not accept plain-HTTP traffic.

At rest, your household data lives in a managed PostgreSQL database with provider-managed storage encryption. Backups inherit the same encryption.

Passwords are never stored in plaintext. They are hashed with scrypt (per-user salt, constant-time compare on verification). Session tokens are random opaque values bound to a server-side row. Revoking a session invalidates it immediately, whether it is presented as a cookie (web) or a bearer token (our mobile apps).

Accounts use email + password with a 10-character minimum. We do not enforce arbitrary complexity rules (mixed case, symbols). Length is what matters.

Google Sign-In is available as an alternative or recovery path. Sign-in attempts are rate-limited per IP and per email. Repeated failures slow further attempts and, eventually, lock the account for a cool-down window.

Session cookies are HttpOnly and Secure in production, marked with SameSite to limit cross-site leakage. CSRF protection uses a double-submit pattern: the server issues a non-HttpOnly companion cookie that the frontend echoes back as an X-CSRF-Token header on every state-changing request.

Signup forms include a honeypot field that legitimate users never see. Submissions that fill it are silently rejected.

Every read and write in the API is scoped to a household. The auth middleware attaches the caller's household id to the request, and route handlers compare that against the resource's household id before doing anything.

Helpers like requireMember, requireEvent, and requireChore enforce this consistently. If a request asks for a resource that doesn't belong to its household, the API returns 404, not the row.

Member-level permissions (adult / teen / kid / caregiver) further restrict sensitive surfaces like medications, finances, and private calendar items.

Robin uses OpenAI and Anthropic on no-training API tiers. Your household data is not used to train their models, and we do not train any models of our own on user content.

Robin only sees what you actively hand it: messages you type, images you drop in, voice notes you send, and emails you forward to your private NestBoard inbox (hub@mynestboard.com).

Robin does not browse your inbox, read the web on your behalf, or scrape your messages. There is no background polling of any third-party account.

Robin context is retained on a rolling 30-day window for assistant memory. Older inputs are discarded automatically.

When you request deletion, your account is immediately flagged so the auth middleware refuses all new sessions for that user. The full cascade (wiping household-scoped rows from active systems) runs after a 30-day grace window in case the request was a mistake.

You can export your household data at any time as a single JSON file. The export covers the major household tables, events, chores, medications, pantry, meal plans, routines, board messages, allowance, savings goals, pets, school assignments, and more, and strips secrets like password hashes, session tokens, and Stripe identifiers before download.

Connected calendar feeds and integration tokens are revoked immediately on disconnect or deletion request, regardless of the 30-day grace period.

NestBoard runs on a small set of trusted infrastructure providers: Stripe (billing), Railway (hosting + managed Postgres), Microsoft Graph (transactional email), and OpenAI / Anthropic (Robin inference, no-training tiers).

The full list (with what each provider does and where data lives) is published at mynestboard.com/subprocessors. We notify customers 30 days before adding any new one.

If you think you've found a security issue, email security@mynestboard.com. Include enough detail for us to reproduce: a description, affected endpoint or surface, and any relevant request/response if you have it.

We acknowledge reports within 5 business days and aim to confirm or dispute the finding within 10. Please give us a reasonable window to ship a fix before publishing details. We will credit you in any post-fix announcement if you'd like.

In scope: anything on mynestboard.com, the NestBoard API (family-calendarapi-production.up.railway.app), and the official NestBoard Android app. Out of scope: denial-of-service tests, social engineering of NestBoard staff or customers, and findings that depend on physical access to a victim's device.

We don't currently run a paid bug-bounty program. We do say thank you, publicly if you want.

No advertising networks. NestBoard has no ad model and will not have one.

No data sales. Your household contents are never sold, rented, or shared with brokers.

No model training on user data. Not by us, not by our AI providers.

No tracking pixels or third-party trackers in the product. The logged-in app uses PostHog with cookies disabled, session replays off by default, and all on-screen text masked from any future replay capture. Our public marketing pages use the Meta Pixel for ad measurement (disclosed in the privacy policy). It never runs inside the app and never sees household data.

This security page (which now exists, hello).

Two-factor authentication for all accounts. The auth layer is structured to support it. The user-facing enrolment flow is the part that's not yet shipped.

A public status page so you can see incidents and uptime without having to email us.

We are not pursuing SOC 2 or ISO 27001 certification for v1. Those are real, useful frameworks. They are also a substantial spend that only buys credibility we don't need at our current scale. If that changes (for example, if we sign enterprise customers who require it) we'll say so here first.

Security reports: security@mynestboard.com.

General privacy questions: privacy@mynestboard.com. Everything else: hello@mynestboard.com.

We will update this page as our posture changes. Material changes (e.g., a new subprocessor with access to household content, a change to deletion timelines) are emailed to active account holders.

Effective date: June 11, 2026.