Your Privacy Choices — Nestory

1. We Do Not Sell Your Personal Information

Nestory does not sell your personal information to any third party. Your family’s messages, contacts, and household data are yours — we do not sell, rent, or auction them to data brokers, advertisers, or anyone else.

Under the California Consumer Privacy Act (CCPA/CPRA), “sale” means exchanging personal information for money or other valuable consideration. We do not do this.

2. We Do Not Share Data for Cross-Context Behavioral Advertising

Nestory does not share your personal information with third parties for the purpose of targeting advertisements to you across other websites or services. We run no advertising business.

We share data only with infrastructure Sub-processors (listed in our Privacy Policy Section 8) solely for the purpose of providing the Service to you. These are service providers, not data brokers or ad networks.

3. What Data We Do Share — and Why

We share limited personal data with the following categories of service providers, solely to deliver the Service to you:

AI Processing

Message text excerpts to Anthropic PBC (Claude AI) for event extraction.

Control: Disable AI processing per-channel in Settings → [Channel]

Push Notifications

Notification content and device token to Apple APNs (iOS) or Google FCM (Android).

Control: Turn off notifications in your device Settings

Email Delivery

Name and email address to Zoho for transactional emails (receipts, alerts).

Control: Unsubscribe from non-essential emails via the link in each email

Cloud Hosting

All data stored on Hetzner Online (Germany, EU). Encrypted backups to Cloudflare R2.

Control: Delete your account to remove data from these systems

4. Sensitive Personal Information

Family messages may incidentally contain sensitive information — health details, financial information, religious mentions, or similar content. We process such data only to extract household events and apply the same 30-day retention limit as all chat messages.

We do not use sensitive personal information to infer characteristics about you, build profiles, or target you with advertising.

Under CCPA/CPRA, you have the right to limit the use of Sensitive Personal Information. Because we do not use sensitive data for secondary purposes (only for the core household-management service), no separate opt-out is required — but you may disconnect any channel at any time to stop processing entirely.

5. Your In-App Controls

Most privacy controls are available directly in the Nestory app — no need to email us first:

Disconnect a channel

Stops all further processing from that channel immediately

Settings → [Channel] → Disconnect

Delete your account

Permanently deletes all data within 30 days

Settings → Account → Delete Account

Export all your data

Download a ZIP of all your events, facts, and settings

Settings → Account → Export My Data

Manage AI processing

Enable or disable AI event extraction per channel

Settings → AI Features

Manage notifications

Choose which notification types you receive

Settings → Notifications

Manage household members

Add or remove household members at any time

Settings → Household

6. Your Rights by Jurisdiction

California (CCPA/CPRA)

California residents have the right to:

Know what personal information we collect, use, disclose, and sell (we don't sell)
Delete personal information we have collected
Correct inaccurate personal information
Opt out of sale or sharing (we don't sell or share for advertising)
Limit use of Sensitive Personal Information (see Section 4)
Non-discrimination for exercising CCPA rights
Data portability (export via Settings)

To exercise rights: support@nestory.live (subject: “CCPA Privacy Request”) or use in-app controls in Section 5.

Israel (Protection of Privacy Law, Amendment 13)

Israeli residents have the right to:

Access personal data held about them in Nestory’s database
Correct inaccurate personal data
Request deletion of personal data
Object to processing for certain purposes
Receive a response within 30 days
Lodge a complaint with the Privacy Protection Authority (gov.il/ppa)

Contact our Privacy Protection Officer: support@nestory.live (subject: “Privacy Rights — Israel”).

European Union / EEA (GDPR)

EU/EEA residents have the right to:

Access (Art. 15), correction (Art. 16), and erasure (Art. 17)
Restriction of processing (Art. 18) and data portability (Art. 20)
Object to processing based on legitimate interests (Art. 21)
Withdraw consent at any time without affecting prior processing (Art. 7)
Lodge a complaint with your national supervisory authority
Not be subject to solely automated decisions with legal effect (Art. 22) — Nestory does not make such decisions

Contact: support@nestory.live (subject: “GDPR Privacy Request”). We respond within 30 days.

7. Global Privacy Control (GPC) Signal

The Global Privacy Control (GPC) is a browser signal that tells websites you do not want your personal information sold or shared for advertising. Nestory’s website at nestory.live recognizes and honors the GPC signal.

Because we do not sell or share data for advertising, receiving a GPC signal has no material effect — we already comply with the request. No further opt-out action is required.

8. Submitting a Privacy Request

To submit any privacy rights request:

Use the in-app controls in Section 5 above (fastest method — no wait, no form)
Or email support@nestory.live with subject line identifying your request type and jurisdiction

Verification: For requests submitted by email, we will verify your identity by sending a confirmation link to your registered email address. We may ask for additional information if we cannot verify your identity.

Response time: We respond within 30 days. We may extend by an additional 30 days for complex requests, with notice.

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We will require written proof of authorization.

No discrimination: We will not discriminate against you (in pricing, service quality, or access) for exercising any privacy right.