Privacy Policy

The data controller is the provider named in our Legal Notice (Impressum).

Depending on how you use Nestory, we process: • Account: email address, display name, sign-in provider (Apple, Google, or email) • Content: photos, videos, captions, and reactions you upload • Invites & guests: invite tokens and coarse device/browser information for the guest album link • Technical: IP address, device/OS, app version, crash and error reports • Analytics (web only, after consent): usage events via Mixpanel — no photo bytes or captions in analytics

We process personal data on the following legal bases (Art. 6 GDPR): • Providing the service (storing and showing photos to invitees): contract (Art. 6(1)(b)) • Account, authentication, security, error monitoring: legitimate interest (Art. 6(1)(f)) • Web product analytics (cookie banner): consent (Art. 6(1)(a)) • Legal obligations: Art. 6(1)(c) We do not sell data or train AI models on your photos.

We use the following categories of technical service providers, with EU/Frankfurt hosting where applicable:

• Cloud infrastructure & database (EU/Frankfurt)
• Web hosting (EU)
• Transactional email
• Error monitoring (EU)
• Product analytics (EU, web only after cookie consent)

A full list of processors by name is available on request by email: privacy@getnestory.app (or feedback@getnestory.app).

The limited license to display uploaded media to invitees of a nest is in the Terms of Use.

We only load Mixpanel (product analytics) in your browser after you accept the cookie banner on this site. Declining means Mixpanel never loads. We store your decision in a first-party cookie (nestory_consent) — no third-party tracking while declined.

Under the GDPR you have rights including access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). You may withdraw consent (e.g. for web analytics) at any time without affecting the lawfulness of processing before withdrawal. How to exercise your rights: • Email privacy@getnestory.app • Delete account: in the app under Your nest → Account → Delete account (two confirmations) • Export data: in the app under Your nest → Contact → Request to export data You may lodge a complaint with a supervisory authority, e.g. the German Federal Commissioner for Data Protection. We will respond to your request within 30 days.

We keep account data while your account is active. When you delete your account, personal data is removed; backup copies may persist briefly before being overwritten.

We use technical and organizational measures to protect your data. Processing is primarily in the EU (Frankfurt). No system is 100% secure — only transmit sensitive data on networks you trust.

Nestory is intended for parents and guardians. Accounts are for people aged 18+. Photos of children are uploaded by family members; you are responsible for having the necessary consent.

Processing is primarily in the EU. If a sub-processor outside the EU is used, this happens only with appropriate safeguards (e.g. standard contractual clauses) where required.

We may update this privacy policy. The date at the top shows the last revision. Material changes will be communicated appropriately.

Email privacy@getnestory.app (or feedback@getnestory.app). We will respond to your request within 30 days.