Your data, clearly explained.

01Who we are

Nestje is registered with the Dutch Chamber of Commerce (KvK) under number 76766683.

Registered address: Elstarstraat 117, 1036 LH Amsterdam, the Netherlands.
Email: support@nestje.app

Nestje is the data controller for the data described in this policy. We have not appointed a Data Protection Officer; for an organisation of our size this is not required. Any privacy question can be sent to the email address above.

02Your account

Automatic guest account: The first time you open the app, Nestje creates an anonymous account for you with Supabase Authentication. No personal data is involved: it is a random user ID tied to that installation of the app. It makes sure your projects are backed up and that you can collaborate without registering first.

Signing in with Apple, Google or email: If you sign in later, your guest account is linked to the sign-in method you choose. You keep the same user ID and all your projects.

What we store: your user ID, your email address (if you sign in with email, or if Apple or Google provides it; with Apple this may be a relay address from Apple) and a display name if you enter one or if the sign-in service provides it. Passwords are managed in encrypted form by Supabase Authentication; Nestje cannot see your password.

Account emails: Confirmation emails and password reset emails are sent from noreply@send.nestje.app through the email service Resend.

03Projects and backups

On your device: Your projects are stored on your iPhone, in UserDefaults and in a secured shared app container (so the Safari share extension can access them).

Backup on our server: Nestje also keeps a backup of each project in our database (project_backups), linked to your account. This also happens when you use the app as a guest. It lets you get your projects back on a new phone or after signing in. The backup contains the project name, rooms, products, product links, image URLs, prices and budgets. Only you can access your own backups.

Deleted projects: If you delete a project, its backup is marked as deleted and no longer shown to you. The content is kept so we can help if you deleted a project by mistake. It is permanently erased when you delete your account. If you want a single backup erased sooner, email us.

04Planning together (shared projects)

If you share a project through an invite link (https://nestje.app/join/<projectcode>), the project is stored in our database (projects) and changes are synced instantly with the participants. We store:

• The project content: project name, rooms, products, product links, image URLs, prices and budgets.
• Who takes part (project_members): user ID, role (owner or participant), display name and the time of joining.

All participants see the same content and each other's display names. On Free you share with one other person; with Plus Yearly or Creator with up to five people. Someone who receives an invite does not need to register: a guest account is created automatically.

05Safari share extension

When you send a product link to Nestje using the share button in Safari, the link is placed in the shared container (SharedStore) on your device. It is processed the next time you open the app.

06Viewing and publishing collections

Viewing: Collections on the home screen are loaded from our database. If you add a product from a collection to your project, it becomes a normal part of your project. Favourite collections are kept only on your device.

Publishing (Creator): With a Creator subscription you can publish a project as a public collection. Data is stored in collections, collection_items and creators:

• Visible to everyone: the name you publish under (curator_name), title, subtitle, cover photo, the link to your social media (curator_link) and the products (name, price, shop and product link).
• Only for the server: your account ID (owner_id).
• Only for the administrator: your contact address (contact_email).
• Visible with the link: the collection's unique share code.

Good to know when publishing:

• Reviewed by a person: every submission, including the link to your social media, is reviewed by hand in our admin system before it appears on other users' home screens.
• Edits by the administrator: the administrator may edit texts, photos or links, before or after the collection goes live.
• The share code works straight away: a submitted collection can already be viewed through its link before approval. Anyone who forwards the link shares the submission immediately.

07Cover photos, photo library and camera

Cover photos: Photos you upload for a collection are stored in a public storage folder and get a public address. Anyone with that address can view the photo, even if the collection has not been approved yet. If you delete your account, your cover photos are erased automatically.

Photo library: You choose a photo through Apple's system picker. Nestje only receives the photo you select yourself, not your whole photo library.

Camera: The camera is used only to scan product QR codes. This happens entirely on your device; camera images are not stored or sent.

08Reports about collections

You can report a public collection for inappropriate content (stored in collection_reports, with one of four fixed reasons). After five reports a collection is taken offline automatically until it has been reviewed.

A report is recorded with your account ID, so that everyone can report a collection only once. The creator of the collection does not see who reported it. We use reports only for moderation, never for marketing or profiling.

09Fetching product pages

When you paste a product link into the app, your own device fetches that page directly from the shop to read the name, price and image. The shop sees this as a normal visit from your IP address. Nestje only keeps the fetched name, price and image URL in your project; the page itself is not sent anywhere else.

Our server function scrape is used only by the creator portal on the website, not by the app.

10Outgoing links and affiliate parameters

Product links are stored as they were entered, including any affiliate or referral parameters added by the maker of a collection. When you open a link to a shop, you leave Nestje and that shop's terms and privacy policy apply. The shop may see that you came from Nestje, and in some cases Nestje may receive a commission on purchases made through such a link.

11Analytics (only with your consent)

Nestje uses Firebase Analytics by Google to improve the app. Analytics is off by default: the first time you start the app we explicitly ask for consent, and nothing is measured until you agree.

You can turn it off at any time in the app's Settings. Doing so also erases analytics data already collected on your device and at Firebase.

What we measure (actions only): project created, room added, product added, option chosen, project shared or left, participant removed, subscription screen shown, subscription started, basket opened, bulk order started, and survey shown or completed. We also record whether you have a subscription.

What we never measure: names, email addresses, project names, product names or product links.

12Feedback surveys

If you complete a voluntary survey in the app, your answers are stored in survey_responses, together with the app version, the app language, your device's country code, the time and your user ID. If you delete your account, that link is removed and only the answers remain, without any way to trace them back to you.

13Subscriptions

Subscriptions (Plus Monthly, Plus Yearly and Creator) run through Apple StoreKit and the App Store. Payment details are processed only by Apple; Nestje never sees them. Nestje only learns from Apple whether you have an active subscription and which one.

When you buy, the app passes your user ID to Apple, and our server asks Apple which subscription is running and until when. We record that with your account (store_subscriptions), so the website also knows whether you are a Creator. Apple lets us know when your subscription renews, is cancelled or is refunded.

14The website nestje.app

The website uses no cookies, no trackers and no analytics, and loads no fonts or scripts from other parties. We only remember the language you choose, in your own browser's storage; it is not sent to us. The website runs on Firebase Hosting by Google, which, like any web server, processes technical data such as your IP address to deliver the pages.

The form on the support page does not send anything itself: it opens your own mail app. If you email us, we keep your message and email address to help you, in our mailbox at Hostnet.

15What we don't do

To be clear, Nestje:

• shows no advertising;
• does no tracking across other apps or websites (no IDFA, no cross-site tracking);
• does not sell data or share it with third parties for marketing;
• does not request your location;
• does not ask for access to your contacts, and to your photos only for the single photo you choose;
• does not store camera images.

16Processors and transfers outside the EU

We use these service providers to run Nestje:

• Supabase Inc.: accounts, projects, backups, shared projects, collections, surveys and storage of cover photos. The database runs in a data centre in Ireland (eu-west-1), within the EU.
• Google (Firebase): Firebase Analytics (only with your consent) and Firebase Hosting for the website. Analytics data may be processed by Google LLC in the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Resend: sending account emails (confirmation and password reset). Your email address is passed on for this. Resend is based in the United States; transfers take place under Standard Contractual Clauses.
• Hostnet: email sent to support@nestje.app.
• Apple: App Store, subscriptions (StoreKit) and Sign in with Apple.
• Google: Sign in with Google, if you choose it.

17Legal bases for processing

We process personal data only on these legal bases under the GDPR (Article 6):

• Performance of a contract (Art. 6(1)(b)): your account, storing and restoring projects, collaboration, the share extension, publishing collections, subscriptions and account emails.
• Consent (Art. 6(1)(a)): analytics and completing surveys. You can withdraw your consent at any time.
• Legitimate interest (Art. 6(1)(f)): reviewing submitted collections, handling reports and keeping the service secure.

18Retention and deleting your account

How long we keep data: Data on your device stays there until you delete the project or the app. We keep your account, backups and shared projects for as long as your account exists. If you leave a shared project, you are removed as a participant.

Deleting your account: You can do this in two ways:

• in the app through Settings → Delete account, which takes effect immediately; or
• by emailing support@nestje.app, in which case we delete your account within 30 days.

This erases: your account, your backups, the shared projects you own (for the other participants too), your participation in other projects, your creator profile with contact address, and your cover photos. Projects on your own device remain until you delete the app.

Published collections: A collection you had published goes offline immediately and is no longer linked to your account. We then review it by hand and either delete it or keep it offline. If you want the collection, including the name you published under and your social link, removed immediately, email us. Products that others had already copied from your collection into their own projects stay in their projects; that is their own data.

19Your rights

Under the General Data Protection Regulation (GDPR) you have these rights:

• Access: ask which data we process about you.
• Rectification: have incorrect or incomplete data corrected.
• Erasure: have your data deleted.
• Restriction and objection: object to processing or have it restricted.
• Data portability: receive a copy of the data you gave us, in a common format.
• Withdrawing consent: for analytics and surveys, at any time.

Email support@nestje.app with your request. We respond within one month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or with the supervisory authority in your own country.

20Changes and contact

If the app changes in a way that affects this policy, we update it and change the date at the top.

Questions? Email support@nestje.app or visit the support page.