Privacy Policy

Who we are

Nest (“we”, “the Service”) is an AI helper for families at https://nesty.cyou. Contact: hello@nesty.cyou.

What we collect

Account details — your name, email address and profile photo, from email sign-up or “Sign in with Google” (openid, email and profile).

Content you create — family memory, reminders, chats with the AI, quiz results, family membership and settings.

Usage data — daily and weekly AI usage counters and basic technical logs (for example error logs) needed to run and secure the Service.

Photos — homework or note photos are compressed in your browser and sent to the AI model for that request only. They are not stored on our servers.

Files and Nestie memory — files you upload to the family Files area or attach in chat (stored in our database, split into chunks, visible to your family for Files and only to you for chat attachments), daily briefs, and facts the AI remembers for you (Nestie memory), which you can view and delete in Settings.

Notifications — if you turn on push notifications, the push subscription for that device (an address issued by your browser), so we can send reminders and briefs.

Google user data (connected Google accounts)

Connecting a Google account is optional. If you choose to connect one in Connections, we ask Google for these permissions, and use each one only for the feature named:

• Gmail (gmail.readonly) — read recent messages so Nest can summarise them, find school notices and deadlines, and answer your questions about your mail. Nest never sends, deletes or changes email.

• Google Calendar (calendar.readonly, calendar.events) — show your events in Nest’s calendar and daily brief, and create, edit or delete an event only when you ask and confirm it.

• Google Classroom (classroom.courses.readonly, classroom.coursework.me.readonly, classroom.announcements.readonly) — show your classes, assignments, due dates and announcements.

• Google Drive (drive.readonly) — list and read files you ask Nest about. Nest never changes or deletes Drive files.

Google data is fetched when you use a feature and is used only to provide that feature to you. When you ask the AI about it, only the parts needed for your request are sent to our AI model provider to produce the reply; the reply is saved in your chat history, which you can delete. We do not otherwise copy your emails, events, coursework or files into our database.

Limited Use disclosure

Nest’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use Google user data only to provide and improve user-facing features you can see in Nest; we do not sell it; we do not use or transfer it for advertising, retargeting or interest-based ads; we do not use it to determine credit-worthiness or for lending; we do not use it to train or improve generalised AI or machine-learning models (ours or anyone else’s), and our AI provider receives it only to answer your request; and no person reads it unless you give us permission for a specific message (for example a support request), it is needed for security (such as investigating abuse), or the law requires it.

How Google tokens are stored

When you connect Google, Google gives Nest a refresh token. It is encrypted on our server (AES-256-GCM, bound to your account) and stored in your own user record, which security rules let only you read. Only Nest’s server can decrypt it. Short-lived access tokens (about one hour) are kept in your browser session.

AI processing

To answer you, your message and the context it needs (for example family memory, an attached file or the Google data you asked about) are sent to the AI model provider that serves the model in use. The default model is Agnes 3.0 Flash (Agnes AI). In AI chat you can also pick other free models, served by OrcaRouter (DeepSeek, Hunyuan, GLM models), Google Gemini API (Gemini, Gemma) or Mistral AI (Ministral, Codestral). Only the provider of the model you use receives that request.

Web search grounding — when a question needs current or factual information, a short search query (not your whole chat) may be sent to Wikipedia, Tavily or Firecrawl, and the results are passed to the AI with your question.

Providers process this data to generate the reply. We never use your data for advertising, and we do not sell it.

Service providers

We use these providers to run the Service. They process data on our behalf only to provide their service:

• Google Firebase (Authentication and Cloud Firestore) — sign-in, account and all stored content. • Vercel — website hosting and server functions. • AI model providers listed under AI processing (Agnes AI, OrcaRouter, Google Gemini API, Mistral AI). • Wikipedia, Tavily, Firecrawl — web search for grounding. • Resend — sending account emails (verification, password reset). • Web push services of your browser (for example Apple, Google, Mozilla) — delivering reminders and briefs if you turn on notifications; we store only the push subscription for your device. • Cloudflare — DNS and forwarding of email sent to our contact address.

We do not sell personal data to anyone.

Who can see your data

Family memory, reminders and the member list are visible to members of that family. AI chats, quiz results, connected accounts and agent suggestions are visible only to you.

Retention and deletion

Disconnect Google at any time in Connections: Nest revokes the token at Google and deletes it from our database immediately. You can also remove Nest’s access at myaccount.google.com/permissions.

Delete your account in Settings › Account (you confirm twice). This immediately deletes your user record and everything under it (profile, stored Google tokens, push subscriptions, Nestie memory), your public creator profile, your private AI chats, and your Firebase sign-in. If you are the only member of your family, the whole family is deleted too (family memory, reminders, files, daily briefs and invites). If other members remain, you are removed and, if you were the owner, ownership passes to another parent or member; shared family content they created stays with the family.

We keep your data only while your account is active. Server logs are kept for a short time for security. You can also email us to ask for a copy or deletion of your data; Settings › Export downloads a copy of your data at any time.

Security

Data is sent over HTTPS, access is limited by database security rules, and Google tokens are encrypted at rest.

Children

Nest is designed for families. Children under 13 may use Nest only with the consent of a parent or guardian, who should create the account or the family and manage it with them. Users under 18 should have permission from a parent or guardian before signing up. The sign-up screen asks you to confirm this.

Parents and guardians can ask us to review or delete a child’s data at any time: email us or delete the account in Settings.

Changes

If we change this policy we will update the date above, and tell you in the app for important changes.

Contact

Questions or requests: hello@nesty.cyou. This policy follows the Hong Kong Personal Data (Privacy) Ordinance.