Privacy Policy

NestIQ is operated by Nexhaz ("we", "us"). This policy explains what information NestIQ collects across the web app, the Android and iOS apps, and the NestIQ Vault browser extension, why we collect it, who we share it with, and the choices you have. If you have questions, contact us at mail@nexhaz.com.

Information you give us

• Account details: your name, email address, password (stored only as a secure hash by our authentication provider), and optionally a phone number, currency, and timezone.
• Household content: everything you choose to record in NestIQ, such as finances (accounts, transactions, budgets, investments, loans), calendar events, tasks, notes and journals, memories and photos, vehicles, home inventory, family and pet health records, and documents or receipts you upload.
• Vault content: passwords, secure notes, and identity documents. Vault items are encrypted on your device before they are uploaded, using a key derived from your vault password. We cannot read vault contents, and we cannot recover them if you lose your vault password.
• People you add: details about family members, household members, event guests, and emergency contacts. Please add other people's information only when you are entitled to do so.

Information collected automatically

• Product analytics: a small, fixed set of usage events (for example "task created" or "checkout started") with anonymous identifiers and counts. We do not record the text of your notes, finances, or vault items, and we do not use session recording or automatic click tracking.
• Device and technical data: push notification tokens for devices where you enable notifications, and standard server logs (IP address, browser type, timestamps) that we use for security and troubleshooting.

How we use information

• To provide NestIQ's features, including sharing with the household and organization members you invite.
• To send reminders and notifications you have turned on.
• To process payments and manage your subscription.
• To secure the service, prevent abuse, and fix problems.
• To understand, in aggregate, which features are used so we can improve them.

We do not sell your personal information, and we do not use your household content for advertising.

Service providers we share information with

We use the following providers to run NestIQ. Each receives only what it needs for its task:

• Supabase: database, authentication, file storage, and server functions (hosts your account and household content).
• Google Gemini: only when you use AI features (the Co-Pilot or receipt scanning). The text or image you submit is sent for processing.
• Google Calendar: only if you connect it. We store the access tokens encrypted and sync events between NestIQ and your Google Calendar. You can disconnect at any time.
• Razorpay: payment processing for paid plans. We do not store your card details.
• Firebase Cloud Messaging: delivery of push notifications to your devices.
• WhatsApp and Telegram: only if you message the NestIQ assistant through them. Your messages are processed to create the entries you ask for.
• PostHog: product analytics, as described above.
• Have I Been Pwned: vault password checks use a privacy-preserving range lookup. Only the first five characters of a password hash are sent, never the password.

We may also disclose information if required by law, or to protect the rights and safety of our users or the public.

Retention and deletion

We keep your information while your account is active. You can export all of your data at any time from Settings. You can delete your account and all of its data yourself from Settings → Data → Delete account (see how account deletion works). Deletion takes effect immediately. If you can't sign in, email mail@nexhaz.com from your account's email address and we will delete it within 30 days. We may keep limited records, such as payment records, where the law requires it.

Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the EU/UK GDPR, you may have the right to access, correct, delete, or export your personal information, to withdraw consent, and to raise a grievance or complaint. To exercise any of these rights, contact mail@nexhaz.com. We will respond within the time required by applicable law.

Security

We use encryption in transit, access controls enforced at the database level, and client-side encryption for the vault. No system is perfectly secure, so please use a strong, unique password and turn on two-factor authentication in Settings.

Children

NestIQ accounts are for adults. Parents and guardians may record information about their children, such as immunization or health records, and remain responsible for that information. We do not knowingly allow children to create accounts.

International transfers

Our service providers may process information outside your country. Where required, we rely on appropriate safeguards for these transfers.

Changes to this policy

If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date above shows when this policy last changed.