Built for the people you trust most. Including us.

Everything you send to NestBoard travels over TLS 1.3. HTTPS is terminated at our hosting provider (Railway), and we do not accept plain-HTTP traffic.

At rest, your household data lives in a managed PostgreSQL database with provider-managed storage encryption. Backups inherit the same encryption.

Passwords are never stored in plaintext. They are hashed with scrypt (per-user salt, constant-time compare on verification). Session tokens are random opaque values bound to a server-side row. Revoking a session invalidates it immediately, whether it is presented as a cookie (web) or a bearer token (our mobile apps).

The optional calendar subscription feed gets the same treatment: its secret link token is stored only as a one-way hash, with an encrypted copy kept solely so the app can show you your own link again, and regenerating the link revokes the old one immediately.

Accounts use email + password with a 10-character minimum. Length does most of the work, and we keep the rest to the few checks that actually help: a password cannot be all letters or all digits, cannot be one of the predictable long ones people pick to satisfy a length rule, and cannot contain "NestBoard". We do not demand a symbol or a capital in a particular place. Every rule is printed under the field before you type, so nothing is sprung on you in an error message. New and changed passwords are also screened against a public database of passwords known to have leaked in past breaches. That check sends only the first five characters of a hash of your password, never the password itself, so the service doing the lookup cannot tell what you chose or who asked.

Google Sign-In is available as an alternative or recovery path. Sign-in attempts are rate-limited per IP and per email. Repeated failures slow further attempts and, eventually, lock the account for a cool-down window.

Session cookies are HttpOnly and Secure in production, marked with SameSite to limit cross-site leakage. CSRF protection uses a double-submit pattern: the server issues a non-HttpOnly companion cookie that the frontend echoes back as an X-CSRF-Token header on every state-changing request.

Signup forms include a honeypot field that legitimate users never see. Submissions that fill it are silently rejected.

Every read and write in the API is scoped to a household. The auth middleware attaches the caller's household id to the request, and route handlers compare that against the resource's household id before doing anything.

Helpers like requireMember, requireEvent, and requireChore enforce this consistently. If a request asks for a resource that doesn't belong to its household, the API returns 404, not the row.

Member roles (adult, caregiver, child, guest) further restrict what a session can reach, and the checks run on the server rather than in the app. Health profiles are readable by adults and caregivers and never by a child or guest account, and only an adult can edit one. Only an adult can move allowance money. Events marked adults-only are withheld from child and guest sessions. These are role gates, not per-person visibility settings, so we do not claim you can hide a surface from one named member.

Robin uses OpenAI and Anthropic on no-training API tiers. Your household data is not used to train their models, and we do not train any models of our own on user content.

Robin works from two sources: what you actively hand it (messages you type, images you drop in, voice notes you send, and emails you forward to your household's own private forwarding address, which you will find in Settings under Email forwarding address), and your household's own NestBoard records, such as the calendar, chores, and medications, which it reads to answer questions and updates when you ask. That access never crosses your household's boundary.

Robin does not browse your inbox, read the web on your behalf, or scrape your messages. There is no background polling of any third-party account.

Robin conversations are kept for 12 months, then deleted automatically by a job that runs every day. The window is deliberate: it is what lets Robin remember household context across a school year instead of asking you the same questions every few weeks. Robin chat is shared across the household, not per person.

You do not have to wait out that window. An adult in the household can wipe the whole Robin conversation, plus the short facts Robin saved from it, at any time from Settings, then Privacy & Data, then Clear Robin's history. It takes effect immediately, it cannot be undone, and it leaves the rest of your household data alone. Deleting your account removes the conversation too.

Deleting your account wipes the whole conversation history along with the rest of your household data. If you would rather we cleared the history for you, email privacy@mynestboard.com from your account address and we will do it.

When you request deletion, your account is immediately flagged so the auth middleware refuses all new sessions for that user. The full cascade (wiping household-scoped rows from active systems) runs after a 30-day grace window in case the request was a mistake.

You can export your household data at any time as a single JSON file. The export covers the major household tables, events, chores, medications, pantry, meal plans, routines, board messages, allowance, savings goals, pets, school assignments, and more, and strips secrets like password hashes, session tokens, and Stripe identifiers before download.

Disconnecting a connected calendar deletes our stored token immediately, and for Google we also call their revocation endpoint so the grant itself dies rather than just our copy of it. Microsoft publishes no per-application revocation endpoint, so an Outlook disconnect deletes our token and you finish the job in your Microsoft account's app permissions if you want the grant gone there too. The same teardown runs when the last account in a household requests deletion, without waiting for the 30-day grace period.

NestBoard runs on a small set of trusted infrastructure providers: Stripe (web billing), Apple In-App Purchase with RevenueCat (billing inside the iPhone and iPad app), Railway (hosting + managed Postgres), Microsoft Graph (transactional email), OpenAI / Anthropic (Robin inference, no-training tiers), Sentry (error and crash monitoring, both on our servers and in the app), Firebase Cloud Messaging and the Apple Push Notification service (push delivery to Android and to iPhone and iPad), PostHog (product analytics and browser error monitoring, cookieless; session replay runs on our signed-out marketing, sign-in, sign-up, and password-reset request pages, and on the setup screens of a sample of new web households, with typing and text masked throughout), and HeyCatch (product analytics, first-party only, no session recording).

The full list (with what each provider does and where data lives) is published at mynestboard.com/subprocessors. We notify customers 30 days before adding any new one.

If you think you've found a security issue, email security@mynestboard.com. Include enough detail for us to reproduce: a description, affected endpoint or surface, and any relevant request/response if you have it.

We acknowledge reports within 5 business days and aim to confirm or dispute the finding within 10. Please give us a reasonable window to ship a fix before publishing details. We will credit you in any post-fix announcement if you'd like.

In scope: anything on mynestboard.com, the NestBoard API (family-calendarapi-production.up.railway.app), and the official NestBoard Android, iPhone, and iPad apps. Out of scope: denial-of-service tests, social engineering of NestBoard staff or customers, and findings that depend on physical access to a victim's device.

We don't currently run a paid bug-bounty program. We do say thank you, publicly if you want.

No advertising networks. NestBoard has no ad model and will not have one.

No data sales. Your household contents are never sold, rented, or shared with brokers.

No model training on user data. Not by us, not by our AI providers.

No advertising trackers in the product. The app uses PostHog for privacy-conscious product analytics, with cookies disabled. We record a sample of visits to our public marketing pages and to the sign-in, sign-up, and password-reset request pages, with every input and all on-screen text masked, so a recording shows layout and taps rather than content. On the sign-in and sign-up forms that means what you type, your email address and your password included, is masked and never recorded, and it stops the moment you sign in. Since September 2026 one bounded window inside the product is recorded the same way, for a sample of new households on the web: the setup screens, where you set up your household, and the first view of your dashboard afterwards. Everything typed there is masked as well, the names and ages entered for children included, those recordings are deleted after 14 days, and the window ends when the household moves on from that first dashboard and does not start again. Nothing else inside NestBoard is ever recorded, and none of it runs in our Android, iPhone, and iPad apps. The page reached from a password-reset email is never recorded at all, because its address carries the reset link. It also uses HeyCatch for product analytics: first-party only (local storage plus a first-party cookie), session recording off, and it never sees household data. Our public marketing pages carry no ad-measurement tags either. We used to run the Meta Pixel and the Pinterest Tag there, and we removed both.

This security page (which now exists, hello).

Two-factor authentication for all accounts. The auth layer is structured to support it. The user-facing enrolment flow is the part that's not yet shipped.

We are not pursuing SOC 2 or ISO 27001 certification for v1. Those are real, useful frameworks. They are also a substantial spend that only buys credibility we don't need at our current scale. If that changes (for example, if we sign enterprise customers who require it) we'll say so here first.

Security reports: security@mynestboard.com.

General privacy questions: privacy@mynestboard.com. Everything else: hello@mynestboard.com.

NestBoard is operated by NestBoard LLC, a Florida limited liability company based in the USA.

We will update this page as our posture changes. Material changes (e.g., a new subprocessor with access to household content, a change to deletion timelines) are emailed to active account holders.

Effective date: August 12, 2026.