Purpose
Product analytics and browser error monitoring. Understanding which features get used, where the app gets confusing, and which errors the page hits, on both the marketing site and inside the app.
Data shared
Anonymized usage events keyed to an internal account id (never your email). It is cookieless (local storage, not a tracking cookie), any sign-in token in a page address is stripped before it is recorded, and no household content is collected. Since September 2026 those events include a record of each push notification we send (its category, such as a chore reminder or a lightning alert, the platform it went to, and whether the push service accepted it) and of taps on those notifications. That is a category label and a platform name, never the notification text, and it is captured by our own servers rather than by anything running on your device. Error reports carry the error type, message, and stack trace, with console output excluded and the message scrubbed on the device. Session replay covers our public marketing pages and the sign-in, sign-up, and password-reset request pages, the ones you see before you sign in, and a sample of the visits to them by visitors who are not signed in. Typing and all on-screen text are masked, so a recording shows the layout of the page and where someone tapped rather than what anything said. On the sign-in and sign-up forms that means what a visitor types, their email address and their password included, is masked and never recorded. It stops the moment a visitor signs in. Since September 2026 it also covers one bounded window inside the product: for a sample of new households on the web, the setup screens, where you set up your household and add the people in it, plus the first view of your dashboard afterwards. Everything typed there is masked too, including the names and ages entered for children, so those recordings carry the layout and the taps and none of the content. That window stops when the household moves on from that first dashboard and does not start again, nothing else inside NestBoard is ever recorded, and none of it runs in our Android, iPhone, and iPad apps. Setup recordings are deleted after 14 days, sooner than the rest. The page reached from a password-reset email is excluded throughout, because its address carries the reset link.
