Draft for review. Items in [brackets] need the operator's details, and the whole policy needs legal review before Nestday is offered to the public.
Effective date: [DATE]. Operated by [OPERATOR NAME AND ADDRESS] ("we").
This policy describes what Nestday stores, why, who can see it and the choices you have. It reflects how the software works today; see Help › Privacy and your data for a shorter summary.
What we collect
Your account. When you sign in with Google we receive your name, email address and Google account identifier. We use them to sign you in, show your name to your household and match invitations sent to your email.
What your household adds. Events, chores and routines, stars and rewards, lists, meal plans, recipes, pantry items, notes, photos you upload for displays, household settings, the people you add (including children's profiles, which have a name and colour and no account), and records of who completed or changed things.
Connected calendars. If someone in your household adds a calendar link or connects Google Calendar, we store that calendar's events in your household. The calendar link and the Google sign-in token are kept only on our servers (the token encrypted) and are never shown to other members or included in exports.
Wall displays. For each paired display: its name, settings and when it was last online. Pairing requests are stored only as one-way hashes and expire after 10 minutes. To limit abuse, we keep short-lived counters keyed by a one-way hash of the requesting network address.
Technical information. Our hosting provider processes standard request information (such as IP address and browser type) to deliver the service. If the operator turns on error reporting, technical details about errors are sent to the error-reporting service. [CONFIRM WHETHER ERROR REPORTING IS ENABLED.]
We don't use advertising or analytics cookies. See Cookies and local storage.
How we use it
To provide Nestday to you and your household: syncing calendars, showing the right information to the right people, keeping the service secure and fixing problems. We never use household data for advertising, never sell it, and don't send it to AI services.
Who can see it
- Your household. Members see household data according to their role. Children and wall displays never see the details of private events; they see "Busy". Adult-only notes are hidden from children and displays.
- Wall displays see only what an owner or admin allows for shared screens.
- Service providers that run Nestday for us: Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage and Hosting), Open-Meteo (your browser sends your household's weather location to get a forecast), Google Calendar (only if you connect it), the websites that host calendar links your household adds (our servers download those calendars), and an error-reporting service if enabled. [LIST ANY OTHER PROCESSORS.]
- People with administrative access to the Nestday project at [OPERATOR NAME] can technically access stored data. [DESCRIBE INTERNAL ACCESS POLICY.]
- Legal requests: [DESCRIBE WHEN DATA MAY BE DISCLOSED.]
Where it's stored
Data is stored with Google Cloud. Database location: [FIRESTORE LOCATION]. Server functions run in the United States (us-central1). [ADD INTERNATIONAL TRANSFER WORDING IF NEEDED.]
How long we keep it
A formal retention period hasn't been decided. Until it is, nothing is deleted automatically: deleted items stay recoverable until an adult deletes them permanently, and accounts and households remain until they're deleted. Pairing requests and abuse counters stop being used within an hour; they're deleted automatically once the database's expiry cleanup is configured. [CONFIRM TTL POLICIES ARE ENABLED.] Backups: [DESCRIBE BACKUP RETENTION, OR "none are configured"].
Your choices
- Export: owners and admins can download a household's data as a file from Settings › Privacy & data.
- Delete: delete items, remove yourself from a household, delete your account (Settings › My account) or, as an owner, delete the whole household. Deleting a household removes its data for everyone.
- Disconnect calendars at any time; the stored link or token is deleted.
- Other requests (access, correction, objection): contact us through the Contact page. [ADD THE RIGHTS AND RESPONSE TIMES THAT APPLY IN YOUR JURISDICTION.]
Children
Children can have a profile created by an adult in their household. A child profile has no email or password. A child can also be invited with their own Google account, in which case they get the child role. [LEGAL REVIEW: COPPA, GDPR-K AND LOCAL RULES FOR CHILDREN'S DATA; MINIMUM AGE FOR ACCOUNTS.]
Security
Access is checked by our servers on every request; calendar tokens are encrypted; display PINs are stored only as one-way hashes. No system is perfectly secure; tell us about any problem through the Contact page.
Changes
We'll update the effective date when this policy changes and tell households about significant changes in the app. [CONFIRM NOTICE PROCESS.]