Privacy at Nestral

Information we handle

We receive information when you create an account, join a household, use the inbox, save records or contact support. Household members can also add information about other people.

• Account and household information, such as your email address, profile name, household name, timezone, membership, roles and invitation details.
• Text, images and PDFs submitted to the inbox, AI suggestions, your edits and approvals, and saved events, tasks, lists, notes and reminders.
• Records of actions, such as who approved an item, and technical information used for authentication, troubleshooting and abuse prevention.
• Your reply email, subject and message when you contact support. The support form uses a hashed network identifier to limit repeated requests.
• For paired household screens, the screen name, approving household member, approval and expiry times, revocation status and most recent connection. We store hashes of pairing credentials and use hashed network identifiers to limit repeated requests.
• Calendar subscription credential hashes, creating member, rotation and revocation times, and request counters. The full private link is shown when created and is not stored in the subscription table.
• Your personal morning digest choice for each household, consent time and delivery records. While an edition is queued, this includes your recipient email and a bounded snapshot of shared event and task titles and times.
• Approval safety records containing the approver, inbox and created record identifiers, timestamps, counts and hashes used to check whether records changed. These records do not duplicate the approved text or documents.
• If you connect Google Calendar or Outlook: your provider account identifier and label, selected calendar identifiers and names, your sharing choices, sync status, and imported event titles and times. Connection credentials and temporary sign-in verification data are encrypted in Supabase Vault and are not shown in the app.
• An optional household OpenAI API key, if an owner or admin supplies one. It is stored in Supabase Vault and is not displayed again in Settings.
• Kitchen Table preferences, including postcode, child ages and edition time, and the meals, celebrations and messages a parent deliberately adds for a date. These are shared household records.

Only include information you need for household organisation. Avoid unnecessary sensitive details, and check that you are entitled to share information about other people, including children. Do not send passwords or API keys to support.

How we use it

We use this information to sign you in, manage household access, organise shared records, generate suggestions you can review, provide support and maintain the security and reliability of Nestral.

When you request AI extraction, we send your submitted content and relevant household context, including timezone and member names, identifiers and roles, to OpenAI. This applies whether you use the pilot allowance or a household key. AI can make mistakes. Suggestions only become saved planning records after you approve them.

We request that OpenAI does not store responses for later retrieval. This does not remove OpenAI’s separate safety, security or legal retention. OpenAI’s API data is not used for model training by default; optional sharing settings on the OpenAI account may change this. See OpenAI’s data controls.

Sharing and service providers

Nestral is a shared household service. Other authorised household members can access shared information according to their permissions. Consider who you invite and what you save. A person who downloads or copies information may keep their own copy.

Supabase provides account authentication, database and file storage. Vercel hosts the web service. OpenAI processes AI extraction requests. Resend delivers account and support emails, and optional reminders and morning digests. Support messages also reach our support mailbox so we can respond.

Kitchen Table fetches public weather from MET Norway and event listings from Brisbane City Council on our server. Family plans, parent messages and child ages are not sent to these sources. Ages filter the public listings within Nestral. Printed copies and saved PDFs remain under your control.

Connecting Google Calendar or Microsoft Outlook authorises Nestral to read the calendars you select. We do not request permission to read your email or edit your original events. Calendar selection is off by default and sharing starts private. If you choose Shared, imported events can appear in household screens, Kitchen Table, morning emails and calendar exports. Provider private, personal or confidential events remain private. We do not import attendee lists or event descriptions.

Creating a calendar subscription lets anyone with its private link read shared event titles, times, locations and descriptions. Calendar providers may keep the link and copies of events in their systems and logs. Revoke or replace the link in calendar settings to stop future access; this cannot remove copies already taken.

Morning digest email requires your own opt in for each household. A queued digest contains up to five shared events and three open shared tasks, with a link to Kitchen Table. It excludes private items, inbox documents and parent messages. Check or turn off your choices in notification settings.

Our primary Supabase project is hosted in Sydney. Other services and provider operations may process information outside Australia. Resend states that it stores customer data in the United States. We do not promise that all Nestral information stays in Australia. Provider locations and retention can differ between services and account settings.

Cookies and device storage

The website uses cookies to keep you signed in and maintain your session. An invitation cookie remembers an invitation while you sign in or create an account and expires after one hour. The app stores session information on your device to keep you signed in.

A paired household screen uses separate cookies: a pairing cookie lasting five minutes and a screen credential lasting up to 30 days. Pairing allows the shared calendar and open tasks to be displayed without placing a personal account session on that screen. An owner or admin can revoke its access in Household screens.

These features support account access and invitations. Blocking cookies may prevent them from working. Signing out removes access from that session; it does not delete your account or household records.

How long information remains

Original inbox text and uploaded files are scheduled for removal 30 days after the first approval. If an item has not been approved, the period runs from submission. Daily cleanup removes eligible source material; failed removals are retried, so removal may happen after the scheduled date.

Removing original source material does not remove approved events, tasks, lists, notes or reminders, or the records of actions taken. These remain available for household use until separately removed. Contact support if you want to remove account or household information.

Expired pairing requests and screen abuse counters become eligible for cleanup after 24 hours. Revoked or expired screen records become eligible seven days after access ends. Scheduled cleanup processes bounded batches, so removal may occur later.

Digest recipient addresses and queued plan snapshots are cleared when delivery is accepted by the email provider or cancelled. Editions older than the two hour delivery window become eligible for cancellation. Minimal delivery metadata becomes eligible for removal after seven days. Authenticated scheduled cleanup runs even when sending is disabled, in bounded batches, so removal may happen later. Provider acceptance does not prove inbox receipt, and copies held by email providers or recipients may remain.

Disconnecting a calendar account removes its stored credentials, calendar selections and imported events from the active Nestral service. Turning off a selected calendar removes its imported events. This does not alter the provider’s originals or recall copies already emailed, exported or printed. You can also review or remove Nestral’s authorisation in your Google or Microsoft account settings. Temporary connection attempts expire after ten minutes and become eligible for scheduled cleanup.

Approval safety metadata remains with the inbox record until that record or its household is removed. The 24 hour undo window is not a deletion schedule. Calendar subscription hashes and management metadata remain until replaced or removed with the household; revocation stops future access without deleting the record.

We review closed support conversations after 90 days and remove information we no longer need. This is a review of support records, not an automatic deletion of every email copy.

Kitchen Table preferences and dated parent messages remain until edited, cleared or removed with the household. Turning off the morning edition does not delete them. Contact support to request older messages or household information be removed.

Providers may retain backups, security logs or other records under their own retention arrangements. Those copies may remain after information is removed from the active service. We may also need to retain information for an unresolved issue or a legal obligation. We do not promise immediate deletion of all provider copies.

Access, correction and deletion

You can view and edit records where your household permissions allow. You can also download your accessible household records and profile. This export excludes attachment files, AI inbox records, invitations and security settings and is not a complete backup.

For other access, correction or deletion requests, email support@nestral.ai or use the support form. We will verify your identity and the scope of the request before changing or disclosing information. Please describe what you want removed without attaching private documents.

We aim to complete verified deletion requests within 30 days. Deletion is handled manually during the pilot. Shared household records may involve other members, so we will confirm what can be removed and explain any information that must remain or any delay. Deleting an account does not necessarily remove every shared record or another person’s copy.

Questions, complaints and updates

Send privacy questions or complaints to support@nestral.ai. Explain your concern and how we can contact you. We will investigate and respond, and let you know if we need more information.

We will update this page when our handling of information changes and show the updated date above.