Privacy Policy

1. About this Policy

Asim Siddiqui (ABN 78 320 350 272), trading as Nestory, handles personal information as described in this Policy. Nestory is offered only in Australia. Where the Privacy Act 1988 (Cth), the Australian Privacy Principles or a binding privacy code applies, Nestory will comply with those requirements. Even where an exemption may apply, Nestory intends to operate to the protections stated here.

2. Personal information we collect

3. How we collect information

• Directly from adult account holders and household members when they create profiles, enter information, upload content or change settings.
• From another authorised family member who adds information about a household member.
• From connected services such as Google or Apple/CalDAV when an adult connects them.
• Through Capture/Add, including optional inbound email, Telegram or WhatsApp channels enabled by the family.
• From Google Play, which tells Nestory whether a subscription is active, in trial, cancelled or expired.
• Automatically from devices, authentication, security, diagnostics and service operation.
• From AI or software processing that derives a classification, summary, pattern, recommendation, confidence score or action from household information.

4. Why we use information

• Create and secure adult accounts, family roles and permissions.
• Provide calendars, tasks, meals, chores, rewards, reminders, Capture/Add, shared displays and other household features.
• Sync optional third-party integrations and deliver requested notifications or transactional messages.
• Provide Smart Features, including AI classification, household summaries, suggestions, answers, vision processing and permitted auto-routing.
• Support users, investigate faults, prevent misuse and maintain audit evidence.
• Administer the free trial and the monthly subscription, and reconcile subscription state with Google Play.
• Understand reliability and feature performance using appropriately minimised technical data.
• Comply with law, resolve disputes, protect users and enforce the Terms.

5. Sensitive information and household health context

Nestory may intentionally support limited household information that can be sensitive under Australian privacy law, including allergies, dietary and intolerance information, health-oriented fitness goals, moods, faith preferences and parenting context. When an adult deliberately enters such information in a clearly labelled feature, Nestory processes it for that household purpose and any closely related functions explained at collection. Additional just-in-time notice or consent is used where required.

Nestory is not designed as a repository for complete medical, therapy, school, child-protection or legal files, and is not represented as a health or professional advisory service.

6. Children and young people

Only adults aged 18 or over may hold Nestory login credentials. Children exist as supervised profiles. An authorised adult may provide child-profile information needed for household organisation, including date of birth, school and routine details, activities, allergies or dietary information, mood or status, and events connected with the child.

The Parent and Guardian Child Data Notice explains child-specific handling, visibility and choices. Nestory does not sell child information, build child advertising profiles, or allow third-party advertising networks to track children through Nestory.

7. Capture/Add privacy minimisation

Capture/Add may store the original item privately and then extract or classify information so it can be routed into Nestory. Before selected text or context is sent to external AI, Nestory applies automated privacy minimisation. Current controls include replacing known family-member names with role-like aliases, withholding internal database identifiers, and redacting certain email, phone and account-like patterns.

This process is pseudonymisation and redaction, not a guarantee of anonymity. Context needed to understand the item — such as dates, URLs, household labels, booking references or other meaningful content — may remain. Adults should avoid capturing unnecessary sensitive or third-party information.

8. Smart Features and AI

Nestory uses DeepSeek for approved text, chat and classification tasks, and Google Gemini for approved image and vision tasks. If an adult enables Smart Features, selected household context, including relevant child-profile information, may be used by those features. Nestory does not currently provide a separate child-context AI switch.

Where an external AI provider receives a family-level request identifier, Nestory uses a provider-specific pseudonymous value derived with a keyed HMAC rather than the internal family identifier.

Capture auto-routing may automatically execute certain routine household actions when enabled and when confidence, trust and action-risk rules allow it. Other actions remain for review. Nestory does not intend these systems to make decisions that determine legal rights, access to essential services or similarly significant interests.

9. Location information

If an adult chooses to provide a home address, suburb or device-derived coordinates, Nestory may store that information to provide location-dependent household features. Nestory does not use this feature as continuous background child tracking and does not intend to create a child movement history as a core function.

Where Nestory needs to send coordinates to an outside service — to turn them into a place name, or to look up the weather — the request is made by Nestory's own servers rather than by your device, and the coordinates are deliberately coarsened to roughly a one-kilometre square before they are sent. Your household's exact coordinates are not disclosed to those services, and your device does not contact them directly.

If location is unavailable or not permitted, Nestory falls back to the home location an adult saved during setup. Nestory does not estimate your location from your IP address and does not send your IP address to a location-lookup service for that purpose.

10. Who we disclose information to

• Other authorised members of the same Nestory family, according to roles, visibility settings and shared-display behaviour.
• Hosting, storage, security, email, communications and support service providers used to operate Nestory.
• Google Play, which processes the subscription purchase and provides Nestory with subscription status.
• DeepSeek and Google Gemini, for the approved AI tasks described above.
• Google, Apple/CalDAV and other integration providers, when an adult connects those services.
• Telegram, Meta/WhatsApp, or an inbound email provider, where the adult chooses to use that Capture channel.
• Professional advisers, insurers, prospective transaction counterparties or authorities, where lawful and reasonably necessary.
• Deidentified or aggregated information that no longer reasonably identifies an individual.

11. Overseas processing

Some providers may process information outside Australia. Nestory applies data minimisation, vendor review, contractual controls and security safeguards appropriate to the circumstances before approving an overseas recipient.

12. Operator access

Nestory uses a controlled operator-access model. Routine operations use minimised account, subscription, technical and diagnostic information. More detailed content access is restricted to case-based support or investigation, sensitive access requires stronger elevation, and exceptional break-glass access is reserved for security, legal or emergency operational needs. Elevated access is purpose-bound, attributable, time-limited where practicable, and audited. Curiosity browsing is prohibited.

13. Shared displays, links and external sharing

Information displayed on a household wall screen can be seen by people near the device. Share links and QR codes can expose selected content to anyone who obtains the link until it expires. Identity information is redacted from externally shared food reports by design, but dietary or allergy content may remain and should still be treated as private.

14. Security

Nestory uses measures appropriate to the service, including password hashing, secure session controls, CSRF protections, encryption of sensitive connection secrets, private object storage, least privilege, role and PIN controls, operator authentication, audit logging, rate limiting, vendor review and incident response. No internet service can guarantee absolute security.

15. Retention, deletion and export

Active household content is generally kept while the account or the relevant feature remains active. Account deletion uses a 7-day grace period before permanent deletion of active data begins. Different periods apply to security, audit, backups, provider logs and legal records, and to the subscription records Google Play keeps under its own terms.

Nestory is designed so that a verified child-profile or family deletion covers direct records and reasonably identifiable derived records, attachments and stored objects, subject to shared records, lawful holds, security evidence and backup expiry. Export is designed to cover the family information Nestory holds that is appropriate to provide, while excluding credentials, secrets, security signals and third-party confidential information.

16. Access, correction and privacy choices

Adults can manage much of their information in Settings. Parents and guardians may request correction or deletion of supervised child information, and a capable young person may raise a privacy concern. You can disconnect integrations, disable Smart Features, turn Capture auto-routing off where available, remove uploads, request an export or schedule account deletion.

Contact support@nestory.homes for access, correction, privacy complaints or other requests. Nestory may verify identity and authority before acting, particularly where a request affects information about several household members.

17. Marketing and communications

Nestory sends operational messages needed for the service, including trial, billing, security and account notices. Commercial electronic messages are sent only with an appropriate basis and include a working unsubscribe process. Nestory does not select marketing using child-profile data or child-derived behaviour.

18. Complaints, changes and contact

Privacy complaints can be sent to support@nestory.homes. Nestory will acknowledge complaints promptly and aims to provide a substantive response within 30 days. Where the Privacy Act applies, an unresolved complaint may be taken to the Office of the Australian Information Commissioner after Nestory has had a reasonable opportunity to respond.

Material changes to this Policy receive appropriate notice and a new choice where required. Contact: support@nestory.homes; support: support@nestory.homes; address: Suite 19, Level 1 191 Church Street Parramatta NSW 2150.