This Privacy Policy describes how Nestli ("we", "our", or "the app"), a mobile application for tracking baby care activities, collects, uses, stores, and shares information about you when you use the app. It should be read alongside our Terms & Conditions.
We collect the following categories of information:
Nestli requests access to your device camera and photo library so that you can capture or select photos of your baby to attach to your records. Microphone access is requested only when you use the voice-log feature. These permissions are used only when you explicitly invoke the corresponding feature inside the app.
You can deny or revoke any of these permissions at any time via your device settings. Denying them will disable the relevant features but will not affect other parts of the app.
We do not sell your personal information. We do not use your data for advertising.
Text records (feeding, diaper, sleep, growth, etc.), account data, and authentication are stored on Supabase, a managed backend provider, using encrypted connections and row-level security so that only you and the family members you explicitly invite can access your baby records.
Photos are stored on Amazon Web Services (AWS S3) in the Asia Pacific (Sydney) region, in a private bucket that is not publicly readable. They are served to your device through Amazon CloudFront, a global content delivery network, using short-lived signed URLs — this lets users in different regions (including mainland China, via CloudFront edge locations in Hong Kong, Tokyo, or Singapore) load photos quickly without making the bucket public.
Photos uploaded to Nestli pass through an automated image-moderation step that screens for content that breaches our policies or applicable law. This screening is automated and best-effort: we do not warrant that it will catch every prohibited image, and we may remove a photo we subsequently determine to be in breach. Concerns about a specific photo can be reported to the contact address in section 11.
All data is encrypted in transit (HTTPS). Supabase and AWS S3 encrypt data at rest using their standard provider-managed keys.
Nestli uses the following service providers to operate the app. Limited user data is shared with each only as required for the listed purpose, and none of them sell your data.
By using the Service you agree to these sub-processors being used. The list may be updated as our infrastructure evolves; material additions will be communicated in-app.
You may invite other users (for example, a partner or caregiver) to view or edit records for a specific baby. Invited members only gain access after accepting an invite code or email invitation. You can revoke their access at any time from the app. Revoking access removes a member's ability to view future data but does not erase entries they previously created.
Nestli is designed for use by adult caregivers to record information about their own children. The app is not directed at children under 13, and we do not knowingly collect personal information directly from children. The data stored about an infant or child within Nestli is provided by the parent or legal guardian on behalf of that child.
You can:
We retain your data for as long as your account is active. When you delete your account, your personal information and uploaded photos are removed from live systems within a reasonable period. Routine backups may retain data for up to 30 days before being purged. Voice-log audio is not retained at all by Nestli — it is passed through to the transcription provider in memory and discarded.
We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. Continued use of Nestli after a change constitutes acceptance of the updated policy.
Questions about this policy or your data can be sent to:
[email protected]