Privacy Policy

1. Who is responsible for your data

The data controller is Leo Rey, an individual established in Spain (“Nido”, “we”, “us”).

For any privacy question or request, contact us at [email protected].

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD).

2. Data we collect

We collect the following categories of data:

• Account data. When you sign in with Google, we receive and store your Google account identifier, name, email address and profile picture through Supabase Auth. We never receive your Google password.
• Household content. The households you create or join, their members and roles, display names, lists, items, quantities, notes, and check states, plus the invitations you create.
• Access credentials. Invitation tokens, AI (MCP) API tokens, and OAuth 2.0 authorization codes, access tokens and refresh tokens. Only SHA-256 hashes of these values are stored; the plaintext is shown once at creation and never kept.
• Technical and security data. IP address, request headers, timestamps and rate-limit counters, used to protect the Service against abuse and to enforce plan limits.
• Preferences. Your language choice, stored in a cookie.

3. How we use your data and our legal bases

We use your data to provide and operate the Service; to authenticate you and sync your household in real time; to let the AI assistants you authorize read and write your household data; to send in-app notifications (for example, when someone joins); to enforce plan and rate limits; to keep the Service secure; and to respond to your requests.

Under the GDPR, our legal bases are: performance of a contract (providing the Service you asked for); our legitimate interests (security, abuse prevention and service improvement); your consent (for example, when you connect an AI assistant, or wherever we explicitly ask); and compliance with legal obligations.

We use functional cookies only — an authentication session and your language preference. These are necessary to run the Service. We do not use advertising or cross-site tracking cookies, and we do not sell your personal data.

4. AI assistants and connected platforms

Nido is API-first. When you create an invitation link or an access token and give it to an AI assistant (for example Muse, ChatGPT, Claude, or another MCP-compatible agent), that assistant can read, and if you grant the write scope modify, the household data you selected. You can revoke tokens and grants at any time from the app.

An AI assistant and its provider are independent third parties and act as independent data controllers for the data they process. Their handling of data once they retrieve it is governed by their own privacy policies and terms, not ours. Only connect assistants you trust.

When you connect a third-party assistant or platform — for example a Meta/Muse connector — we process the data that passes through the connector only to provide that integration, within the scopes and permissions you authorize and as necessary to fulfil your request. For that data, Nido and the platform (for example Meta) act as independent data controllers, each responsible for its own processing under its own terms and privacy policy. We do not infer sensitive attributes (such as health, religion or political opinions) from your household content.

5. Who we share data with

We do not sell your personal data. We share it only with the service providers (processors) that make the Service work:

• Supabase — database, authentication and realtime.
• Vercel — application hosting and infrastructure.
• Cloudflare — MCP server hosting, DNS and network protection.
• Google — sign-in through OAuth (Google Identity).

6. International transfers

Some providers are located outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can request more information using the contact address below.

7. How long we keep data

We keep your account and household data for as long as your account exists. When you delete a household, list, item or your account, we delete or anonymize the related data, except that: hashed credentials of revoked tokens may be retained briefly for security and audit purposes; rate-limit counters are short-lived; and residual copies may remain in encrypted backups for a limited period before they are rotated out. We delete data once it is no longer needed for the purposes above. Household activity entries are kept for your plan's window (7 days on Free, 30 on Plus, 90 on Pro) and are then deleted.

When you revoke an AI assistant's access — by deleting its token or grant — we stop providing access through that connector and delete or render inaccessible the data associated with that access, except for the limited security, audit and backup copies described above.

8. Your rights

If you are in the EEA or Spain, you have the right to access, rectify, erase, restrict or object to the processing of your data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority; in Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

To exercise your rights, email us at [email protected]. We will respond within the time required by law.

9. How to delete your data

You can delete your content directly in the app: remove items and lists, or delete a household you own. Deleting a household removes its lists, items, invitations and access tokens.

To delete your account and personal data entirely, email [email protected] from the address linked to your account with the subject “Delete my account”. We will verify the request and delete your account and associated data within 30 days, except for data we must keep by law or copies in backups that are rotated out on a limited schedule.

If you connected an AI assistant, remember to revoke its tokens in the app, and to delete any data it copied to its own service using that service's controls.

10. Security

We protect data with encryption in transit (HTTPS), row-level security on every database table, hashed storage of tokens and OAuth artifacts, least-privilege access, and rate limiting. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach when the law requires it. Where a security incident affects data processed through a third-party platform connector (for example Meta/Muse), we will also notify that platform within the timeframes its terms require.

11. Children

The Service is not directed to children. You must be at least 16 years old (or the minimum digital-consent age in your country) to use it. We do not knowingly collect data from children below that age; if we learn that we have, we will delete it.

12. Changes to this Policy

We may update this Policy. When we make material changes we will post the new version here, update the “Last updated” date above, and, where required, notify you in the app or by email.

13. Contact

Questions or requests: [email protected].