Privacy Policy

Effective date: October 19, 2026

1 Who we are

Nestlist is an iPhone app that helps parents in the United States plan baby essentials. It is operated by AIEASY LLC ("we", "us"). This policy covers the Nestlist app, the Nestlist servers the app talks to, and this website.

Nestlist is for adults. Babies and children do not have accounts.

2 Data that stays on your iPhone

Nestlist works without an account. The following is saved on your iPhone and is not sent to us:

• Your onboarding answers, such as your first name and role, your baby's due date, birth or arrival month, number of babies and sex, your ZIP code, your budget, and your feeding, fabric, sleep, space, travel and cultural preferences. Feeding and cultural answers are optional.
• Your plan, Closet (what you own), purchases, target prices and budget.
• Photos you take or add for Closet items, receipts and drafts. Nestlist reads barcodes, receipts and photo colors on your iPhone. These photos are not uploaded.
• Drafts of reviews, product reports and support messages, until you choose to send them.
• Your choice about "Send me tips and updates". This choice is saved only on your iPhone. We do not send marketing email today.
• Reminders, which use local notifications on your iPhone.

Some of this data leaves your iPhone only through a feature you choose, as described in section 3. Your iPhone may also include app data in its own backups, such as iCloud Backup, under your Apple settings.

You can delete this data at any time in Account → Privacy & data → Delete local data, or by deleting the app.

3 What we collect and why

Accounts and sign-in

An account is optional. You need one for Family sync, an online Registry, caregiver invitations, product reviews and reports, and server exports.

• Sign in with Apple. We keep the stable identifier Apple gives us for your account. If Apple gives us a refresh token, we store it encrypted. We use it only to revoke Nestlist's access at Apple when your account is deleted.
• Sign in with Google. Nestlist asks Google only for the openid scope. We keep the stable Google account identifier only. We do not store your email address, name or profile photo. We do not store Google access or refresh tokens.
• Account records. We create a random account ID, session records, the date you signed in, and records of the consents you give in the app, such as consent to Family sync.

We use this information to sign you in, keep your account secure, and give you access to your household.

Email sign-in is not available yet. If we add it, we will update this policy first.

Family sync

Family sync lets adults in your household share selected Plan and Closet records. It is off until you give consent for each type of record, and you choose which records to send.

• Plan records include the item title, category, timing, quantity, priority and target date.
• Closet records include the item name, category, type, color family, size, quantity, and whether it is owned, received, outgrown or passed along.

Family sync never sends photos, notes, your family profile answers, purchases, target prices or budget. We encrypt the contents of these records on our servers. You can withdraw consent in the app. Withdrawing stops future sync for you. Records already shared stay available to other adults in the household until they are deleted.

Registry and guest links

If you create an online Registry, we store its items: title, category, quantity, size, color, alternatives, a note for guests, a private note for you, a store link, an estimated price, and whether the item is visible to guests.

You can share a guest link. Anyone with the link can see the items you make visible, how many are still available, your note for guests, sizes, colors, store links and estimated prices. Guests do not see your private notes, your household or child details, or other guests' details. Guest links expire, and you can revoke them.

If you are a guest, you may give us:

• your name, or choose to stay anonymous;
• an email address for a reminder about your reservation;
• a note about your purchase and a delivery choice.

We use this to record your reservation or purchase and to show it to the Registry owner, for example for thank-you notes. Guest details are not linked to any Nestlist account. Reminder emails are not being sent yet. To change or remove what you entered as a guest, contact the Registry owner or us.

Caregiver invitations

A household owner can invite another adult with a one-time code. We store only a fingerprint of the code, never the code itself. We do not ask for or store the invitee's email address. Other adults in a household see shared records and roles. They do not see your Apple or Google identity.

The Assistant

The Assistant answers questions about your plan. You can use it without an account. When you send a message, the app sends to our server:

• your message and any photos you attach (the app resizes each photo first);
• the earlier messages in the same chat;
• a short summary of your plan: items you still need and how many, what you have, your budget total and amount spent, your baby's due, birth or arrival month, number of babies, and your fabric, plan style, feeding and climate preferences.

The summary does not include your name, your account, your ZIP code or your location. Our server passes the request to Anthropic, which provides the AI model, and returns the answer. We do not keep your chat on our servers. Anthropic processes the request as our service provider under its commercial terms: it does not use it to train its models, and it deletes it within 30 days unless it must keep it longer to enforce its usage policies or to comply with the law. The chat stays in the app until you close it. Do not include information in a message or photo that you don't want to share.

Product search, product guide and recall checks

• Product search. When you search or browse products, the app sends your search terms and filters to our server to find matching products.
• Product guide. When you ask a question about a specific product, we send your question and our stored facts about that product to OpenAI to write a short answer that cites its sources. We ask OpenAI not to store these requests.
• Recall checks. To check for recalls, our server may send a product name to the U.S. Consumer Product Safety Commission's public recall service. We also use public recall data from the National Highway Traffic Safety Administration. We do not send your personal information to these agencies.

Product reviews and reports

If you are signed in, you can send a product review or a report that product details are wrong. We store your rating and text, the product, and your answers about size, how long you used it and how you got it. Each submission is linked to your account and starts as private. Our team reviews submissions. An approved review may later be shown in Nestlist without your name or account. Photos you attach to a draft stay on your iPhone and are not uploaded.

Support

When you email us, we receive your email address and what you write. We use it to help you. The in-app support form saves a draft on your iPhone and does not send anything yet.

Exports

You can export a copy of your data in Account → Privacy & data → Download my data. An export from your iPhone is created on your iPhone. A server export is created when you ask for it and sent only to your app. The file stays on your iPhone until you choose where to share it.

Email we send

Our servers can send transactional email, such as one-time codes and reminders. Most of these emails are not turned on yet. Our email does not contain tracking pixels, and we turn off open and click tracking. After an email is sent, fails or expires (at most 30 days), we erase the address and the message and keep only delivery metadata.

Technical logs and security

When the app talks to our servers, we record technical logs: the time, the type of request, the result and how long it took. To limit abuse, we use your IP address for rate limiting. Logs keep only part of it (the first three blocks of an IPv4 address, or the first 48 bits of an IPv6 address). Logs do not contain request contents, search terms, passwords or tokens. We use logs to run, secure and fix the service.

Subscriptions

Every current feature is free, and Nestlist Plus cannot be purchased today. If we offer a subscription in the future, Apple will process the payment. We will receive information about your subscription status from Apple, not your payment card details. We will update this policy before subscriptions launch.

This website

This website has no cookies, analytics or trackers. Our website host, Cloudflare, processes your IP address and basic request details to deliver and protect the site.

4 What we don't do

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising (targeted ads).
• We do not show ads, and the app contains no advertising, analytics or tracking software from other companies.
• We do not track you across other companies' apps or websites, so the app never asks for tracking permission.
• We do not use your reviews, reports or plan to train AI models.
• We have no affiliate or sponsored relationship with any retailer or brand today. If we add one, links that may earn a commission will be labeled before you open them, and we will update this policy.

5 Service providers

We use these companies to run Nestlist. They process data only to provide their service to us.

We may also disclose information if the law requires it, to protect the safety of any person, to prevent fraud or abuse, or as part of a merger, sale or transfer of our business. A new owner would have to honor this policy.

6 Children's privacy

Nestlist is for adults 18 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Babies and children do not have accounts.

Parents can enter information about their baby, such as a due date or birth month, number of babies, sex, and clothing sizes. This information is saved on the parent's iPhone. It leaves the iPhone only when the parent uses a feature that sends it, such as the Assistant (due, birth or arrival month and number of babies), Family sync (item sizes) or a Registry. We do not ask for a baby's name.

If you believe a child under 13 has given us personal information, contact us at hello@aieasy.chat. We will delete it.

7 How long we keep data

• On your iPhone: until you delete it in the app or delete the app.
• Your account and household data: until you delete your account. Erasure happens 30 days after your request. See Delete your account.
• After deletion: we keep a record that your request was handled: a random ID, dates and counts, without your name, email, or Apple or Google identity. We keep a one-way fingerprint of your Apple or Google identifier for 90 days so we can tell you the deletion status. We keep the deletion record itself for 24 months, as California rules require for records of privacy requests.
• Shared household data: if another adult can edit your household, the household and its shared records stay with them after you leave or delete your account.
• Guest gift details: kept with the Registry, and erased when the Registry is erased.
• Assistant chats: not stored on our servers.
• Email content: erased after the email is sent, fails or expires (at most 30 days).
• Technical logs: up to 30 days.
• Backups: deleted data can remain in encrypted backups until they expire, within up to 6 months (daily backups for 14 days, monthly snapshots for 6 months). If we restore a backup, we delete accounts again that were already deleted.
• Support email: as long as needed to help you, and as the law requires.

8 Security

We use encryption in transit (HTTPS) for every connection between the app and our servers. We encrypt Family sync records and Apple refresh tokens on our servers. We store only fingerprints of guest links, invitation codes and sign-in tokens. Access to production data is limited to staff who need it. No system is perfectly secure, so we cannot guarantee security. If a breach affects your personal information, we will notify you as the law requires.

9 Your choices and rights

Every Nestlist user can:

• Use Nestlist without an account.
• Access and export your data in Account → Privacy & data → Download my data.
• Correct your data by editing it in the app, or by contacting us.
• Delete local data in the app, and delete your account in Account → Privacy & data → Delete my account.
• Withdraw consent for Family sync in the app.
• Remove Nestlist's access to your Apple or Google account in your Apple ID or Google Account settings.

We will not treat you differently for using these rights.

10 California residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives California residents these rights:

• to know what personal information we collect, use and disclose, and to get a copy;
• to delete personal information;
• to correct inaccurate personal information;
• to opt out of the sale or sharing of personal information (we do not sell or share it);
• to limit the use of sensitive personal information (we use it only to provide the service you ask for);
• not to be discriminated against for using these rights.

Categories we collected in the last 12 months:

We collect this information from you, from guests you invite, and from Apple and Google when you sign in. We disclose it only to the service providers in section 5. We do not sell or share personal information, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16. We keep each category for the periods in section 7.

Shine the Light. We do not share personal information with third parties for their own direct marketing.

We do not track you, so a Global Privacy Control signal does not change anything we do. We treat it as a valid opt-out request.

How to make a request. Use the export and delete tools in the app, or email hello@aieasy.chat. We verify requests through your Apple or Google sign-in in the app, because we do not store your name or email. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to verify your identity. We respond within 45 days, and we will tell you if we need more time.

11 Residents of other states

Residents of several other states, including Florida, Virginia, Colorado, Connecticut, Utah, Texas and Oregon, have similar rights under their state privacy laws. These can include the rights to access, correct, delete and get a copy of personal information, and to opt out of targeted advertising, sale and profiling. We offer the same rights to every user in the United States, whatever state you live in. Use the tools in the app or email hello@aieasy.chat.

If we deny your request, you can appeal by replying to our decision with the subject line "Appeal". We will answer your appeal within the time your state's law requires. If you disagree with our answer, you can contact your state attorney general.

12 Changes to this policy

We may update this policy. We will change the effective date at the top. If a change is significant, we will tell you in the app before it takes effect. If a change affects how we use data we already have, we will ask for your consent where the law requires it.

13 Contact us

AIEASY LLC
6735 Conroy Rd, Ste 309, Orlando, FL 32835, USA
Privacy questions and requests: hello@aieasy.chat
Other help: Support