Privacy policy

This is a translation of the French version, which is the only one that legally prevails.

Nestido is used to record where children sleep when their parents live apart. That is private family information, and it concerns minors: it deserves to be handled seriously, and described plainly. This document sets out everything the service knows about you.

Who is responsible

Data processed by Nestido is processed under the responsibility of Eric Mollenthiel, sole trader, SIREN 795 225 226, 103 avenue Lacassagne, 69003 Lyon, France. For any question about this policy or your data: team@nestido.com.

What data is processed

Your account: your e-mail address, your password (stored only as a hash, never in clear text, and unreadable even to the publisher), the language you chose, the account creation date, and whether your address has been verified.

The fact that you came: the date of your last visit and the number of days on which you came, kept on your account. Nothing else: no page viewed, no time of day, no journey. This is what makes it possible to know whether Nestido is of use to anyone, under the publisher's legitimate interest. Nothing is stored on your device, and no outside service is called.

How your sign-up arrived: two indications about the sign-up form itself, kept on your account: whether a hidden field of the form, which no person sees, was filled in, and whether the form was sent in under three seconds. They serve to tell a sign-up placed by an automated program from one placed by a parent, so that the publisher's figures do not count machines as people, under its legitimate interest. They have never refused or slowed down a sign-up, and they will not do so: your account is created and served the same way in every case. Neither your IP address, nor your browser, nor your device, nor the network you use is recorded.

Which link you arrived by: one word kept on your account, taken from a short list written by the publisher (the name of a directory, the Google Play store, the Android app, or “other”), and “unknown” when the link says nothing, which is the most common case. It is used to know which channels people arrive by, under the publisher's legitimate interest. It is set once, when the account is created, and never changed afterwards. Neither the address of the page you came from, nor the pages you view, nor the time, nor your IP address are recorded.

Your family: the name you give it, its time zone, its country and school holiday area if you declare them, and the first name, role and colour of each member, including those without an account.

Your children: first name, colour, and date of birth if you choose to enter it, which remains optional. Nestido asks for no surname, no school, no address, no photo and no health data.

The schedule: the places you create and their nature (a parent's home, school, relatives, a holiday), the nights spent at each, the handovers recorded, their confirmation or dispute by the other parent, the declared custody rhythm and its exceptions. This is the core of the service: without it there is no schedule.

Evening reminders, if you enable them: the technical address your browser provides to reach your device, the keys that encrypt the notification, and the date of the last reminder sent. That address identifies your device only in order to speak to it, and disappears as soon as you turn reminders off.

The evening reminder by email, if you ask for it: the date of your request. It goes to your account's address, once that address is confirmed, and only the evening before a handover; it gives the children's first names, the place and the time. It stops with one click from the email itself or from the “Today” screen.

The schedule in your calendar, if you ask for it: a secret address, the date of your request and the last day your calendar read it. Your calendar (Google, Apple, Microsoft or another) reads there the children's first names, the names of the places as you named them and the handover times, over one past month and three months ahead; no address, no notes, no statistics. Anyone you share that calendar with sees them too. The “Cut this link” button on the “Today” screen stops everything at once.

Server logs: IP address, date, page requested and browser, as on any website. They serve security and fault diagnosis, and nothing else.

Why, and on what legal basis

Providing the service (keeping your account, your family and its schedule, computing the forecast and statistics, allowing the other parent to be invited): performance of our contract, under Article 6(1)(b) GDPR. This data is not optional: without it there is nothing to display.

Sending you necessary messages (address verification, forgotten password, an invitation you choose to send): performance of the contract. Nestido sends no newsletter and no marketing message.

Evening reminders on your phone: your consent, given by enabling notifications, and withdrawable at any time from the same screen with no effect on anything else.

The evening reminder by email: your consent, given by asking for it, and withdrawable at any time with one click from the email or from the “Today” screen.

The schedule in your calendar: your consent, given by asking for it, and withdrawable at any time with “Cut this link” on the “Today” screen.

Keeping the service running and safe (logs, backups, blocking mass login attempts): the publisher's legitimate interest in a service that works and is not attacked.

Children's data

Information about your children is entered by you, and by you alone. By recording it, you declare that you hold parental authority, or that you act with the agreement of whoever does. Nestido is not aimed at minors: no account is intended for them, and no child logs into the application.

The service is designed to ask for as little as possible: a first name and a colour are enough to run a schedule. A date of birth only serves to display an age, and nothing requires you to enter one.

What the other parent sees

This is the most important question in a shared application, and it deserves a clear answer. Members of the same family see the same schedule: places, nights, handovers, statistics, and the first name of whoever recorded what. That is the very purpose of the service.

Your e-mail address, password and language, however, remain yours: they appear on no screen of the other parent. A family is watertight: no account can read the schedule of a family it does not belong to, even holding a link.

An invitation attaches an account to an existing member. Until it is accepted, the invited person sees nothing; once accepted, they see the family's entire history, including what was recorded before they arrived. An invitation can be cancelled as long as it has not been used.

What Nestido does not do

• No data is sold, rented, exchanged or transferred to a third party.
• No advertising, no profiling, no automated decision-making.
• No analytics tracker, no social network button, no third-party script. Nestido's pages call no external server.
• Your family's content is not used to train any artificial intelligence model: no assistant reads it (see "Who else has access").
• The installed application stores no data on your device: its cache holds only the "offline" screen and style files. A lost phone does not reveal where your children sleep.

Cookies

Nestido uses strictly necessary cookies only, which is why it needs no consent, and why it spares you a banner:

• a session cookie, keeping you logged in during your visit;
• a re-login cookie, if you stay signed in between visits, valid thirty days;
• an authorisation cookie for real time, letting your screen update when the other parent records something.

Your light or dark theme choice is kept by your browser alone, and never sent to the server.

For how long

Your account and your family's schedule

As long as the account exists. You can delete it at any time, and deletion is immediate.

The family itself

It disappears with the last account belonging to it. As long as another parent has an account, the family and its history remain theirs: your departure cannot erase their memory, but your account is indeed deleted.

Security backups

Fourteen days. Deleted data may therefore survive that long in an encrypted backup, which nobody accesses outside an incident, before disappearing for good.

Server logs

One year.

Unaccepted invitations

They expire on their own and then stop working.

Who else has access

OVH SAS (Roubaix, France) hosts the server and the database, and carries the service's e-mail. The servers are located in France. Your family's schedule never leaves the European Union.

If you subscribe to Nestido+, payment is handled by Stripe (Stripe Payments Europe, Dublin, Ireland), which receives your e-mail address, your billing address, your payment method and an identifier for your family, and nothing else: no first name, no place, no schedule. Stripe may process this data in the United States, under the European Commission's standard contractual clauses. Without a subscription, Stripe receives nothing about you.

Evening reminders travel through your browser's notification service (Apple, Google or Mozilla depending on your device), which receives an encrypted message it cannot read, and only if you enabled reminders.

The publisher, as server administrator, technically has access to the database: that is unavoidable in order to maintain it. He does not read a family's content out of curiosity or for any commercial reason, and touches it only at the explicit request of the person concerned, or to fix a fault that requires it.

The publisher runs the server with the help of artificial intelligence assistants: Claude, from Anthropic (Anthropic Ireland, Dublin, Ireland), and Codex, from OpenAI (OpenAI Ireland, Dublin, Ireland), which process in the United States whatever they are given to read. They receive the service's usage figures, in which an account is designated only by a number (for example the dates of sign-up and visits, the language, where it came from), and, only when security, a fault or your own request requires it, the server logs (IP address, browser) or an account's e-mail address. They never receive your family's content: not its name, not a first name, not a place, not the schedule. They are not processors acting for the publisher: each processes this data under its own responsibility, according to its own privacy policy, and covers its transfer to the United States with the European Commission's standard contractual clauses or an adequacy decision. The setting that would let them train their models on these conversations is turned off; only a conversation flagged by Anthropic's safety checks may still be used to train those checks.

Security

Traffic is encrypted end to end by HTTPS. Passwords are stored as hashes computed by an algorithm designed to be slow to break. The identifiers that travel in web addresses are drawn at random and cannot be guessed. Every screen checks that what it displays belongs to the family of the logged-in account, and that check is tested automatically, route by route, on every code change.

In the event of a data breach likely to create a risk to your rights, the French data protection authority will be informed within 72 hours and you will be notified directly where the risk is high.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability over your data. Two of them require no procedure at all, because they live in the application:

• Access and portability: your account screen downloads, in one click, a file containing everything Nestido knows about you, in an open format readable by a machine and by you.
• Erasure: the same screen deletes your account, immediately and permanently.
• Rectification: the family, children and places screens edit everything you entered there.

For the others, or if something does not work: team@nestido.com. You will receive an answer within one month.

If that answer does not satisfy you, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or from cnil.fr, or with the supervisory authority of your own country.

Deleting your account

You can delete your Nestido account yourself, at any time, without writing to us: log in, open the My account screen, choose Delete my account, type your password, then Delete permanently. Deletion happens straight away, it is permanent, and you are logged out on the spot.

Before you confirm, the screen tells you what will go: if the other parent has an account, the family and its schedule stay with them and your first name becomes a member without an account again; if you are the only account in the family, everything goes with you. The same screen downloads your data, should you want to keep a record of it first.

If you can no longer log in, write to team@nestido.com from the e-mail address of your account: the deletion will be carried out for you, once we have checked that the request really comes from you.

Not everything requires closing your account: from the app, you can delete a recorded night, a place that has never been used, a family member, or the declared custody rhythm. A child can be deleted as long as no night has been recorded for them, which undoes an entry made by mistake; as soon as one exists, they are archived instead: they leave the screens and their history remains, so that the timeline of nights already recorded is not cut in two.

Changes

This policy may be updated, in particular if the service changes. The date at the top of the page shows the latest version. A change that genuinely affects your data would be announced to you by e-mail, not slipped quietly into a paragraph.