Privacy Policy

Version 1 · Updated 29 September 2026

DRAFT FOR LEGAL REVIEW. This policy has not yet been reviewed by a lawyer and is not in force. Everything in square brackets is a placeholder that must be completed before it is published.

NestPrep helps one household run its week: school lunches planned per child, the family calendar, the grocery list, to-dos and chores, the papers you keep needing, and what a nanny or helper needs for a shift. To do that it has to hold information about you and the people you live with, including your children. This policy says what we hold, why, where it is kept, who else touches it, how long we keep it, and what you can do about it.

We wrote it to be read. Where the law needs a precise word we use it, and where a plain sentence does the job we use that instead.

1. Who we are

NestPrep is provided by [legal entity name], a company registered in South Africa with registration number [company registration number], whose registered address is [registered address]. In this policy "we", "us" and "NestPrep" mean that company.

For the purposes of the Protection of Personal Information Act, 2013 (POPIA), we are the responsible party for the personal information described here.

Our Information Officer is [Information Officer name], who can be reached at [Information Officer email address]. Our Deputy Information Officer is [Deputy Information Officer name], at [Deputy Information Officer email address]. Our Information Officer is registered with the Information Regulator under registration number [Information Regulator registration number].

2. Who this policy is about

This policy covers everybody whose information is in NestPrep:

Account holders, the adults who sign in with their own account.
Household members without an account, such as a child or grandparent whose profile an adult added.
Children using a kid device, a tablet or phone a parent has signed in as their child.
Helpers, nannies, babysitters and carers a household invites, who sign in with their own account and see only what the household allows.
People named by a household, such as an emergency contact or a person allowed to collect a child from school.
Visitors to our website, including anyone who asks us to delete an account from it.

3. What we collect, and why

We only collect what a part of the app needs to work. Most of it is information you, or another adult in your household, type or choose in the app.

Your account

Your name, your email address and, if you sign in with Google, your Google profile picture.
How you sign in: with Google, or with an email address and a password. Passwords are handled by Google's Firebase Authentication service. We never see or store your password.
A random account identifier, the households you belong to, which one you last had open, and when you created your account and last signed in.
Which version of this policy and of our Terms you accepted, and when.

We use this to sign you in, to show you your households, and to keep a record that you agreed to these terms.

Your household and its members

The household's name and time zone.
A profile for each member: a display name, a colour, a role (admin, parent, kid, helper or carer), and, if the household chooses, a birthday.
For each helper, carer and kid, what they are allowed to see and change, as the household's parents set it.
Invite codes, which are single use and expire, and which member profile an account claimed.

We use this so the people in a household see the same week, and so each person sees only what the household's parents decided they should.

Family profiles, including children's information

For each member, and most often for each child, a household may record likes, dislikes, allergies and food rules (for example nut-free), medication, school, grade and clothing and shoe sizes. Children's profiles are the heart of lunch planning: the app uses allergies and food rules to stop a lunch that would break them from being planned.

Allergies and medication are health information, which POPIA treats as special personal information. Information about a child is also specially protected. See section 5 for how we handle both.

Kid devices

A parent can sign a child's device in as that child's profile with a short code that lasts ten minutes and can be used once. A kid device has no email address, no name of its own and no password. For each kid device we store a random identifier, which household and child profile it belongs to, the label the parent typed for it (for example "Mia's tablet"), and when it was paired and by whom. A parent can sign a kid device out at any time.

Lunches, meals, groceries, to-dos and chores

Lunch box plans per child, the household's library of lunch items and the allergens each contains, favourites, the prep list, and what came home uneaten.
The weekly meal plan and the household's meal library.
The grocery list: items, who added them and who ticked them off.
To-dos, routines, who they are assigned to and when they were done.
Chores that earn stars, the rewards a parent sets, and each child's star balance and history.

The calendar

Events you and your household add: titles, times, who they are for, how they repeat, and notes.
If you connect a Google or Outlook calendar, we keep the permission those services give us to read your events (an access credential) on our servers only, never on other household members' phones, and copy the events into your household calendar. We only ask to read, never to change, your calendars. You can disconnect at any time, which deletes the credential.
If you add a calendar by pasting a calendar link, we keep that link on our servers only, because the link itself is the key to that calendar.
If you share the household calendar as a feed, we create a secret link and keep only a scrambled form (a hash) of it. Anybody with the link can read the household's events, so treat it like a key; you can reset it at any time.
A view of how the week's work was shared between the household's adults is worked out on your phone from what the app already shows you. It is not stored.

Documents and personal vaults

Households can keep documents such as a lease, insurance papers and school letters in shared folders, and each person has a private vault for identity documents, passports, birth certificates and medical aid cards.

The files themselves, and for each one its name, type, size, tags, an expiry date if you set one, and who uploaded it and when.
A view log for every vault: every time a vault document is opened, we record which document, who opened it and when, before the file can be read. The owner and the family can read that log, and nobody can edit it.
If you share a single document by link, we keep the link's settings, when it expires and how often it was opened. We store only a scrambled form of the link and of any PIN you set.
If you choose to keep a document on your phone for use without a connection, that copy is encrypted on your phone with a key held in your phone's secure storage. It is deleted when you sign out or lose access to the document. We cannot read it.

Identity documents are among the most sensitive things you can give us. The vault only opens after your phone's own screen lock (fingerprint, face or passcode), a helper or carer sees nothing in a vault unless they are granted it, and every open is logged.

Where people are (live location)

Location sharing is off unless you turn it on, and only you can turn it on for yourself. Nobody, not even a household admin, can start sharing your location. When you share, you choose a window of 15 minutes, one hour or four hours. For that time your phone sends its position, while the app is open, and the household sees it. When the window ends or you stop, the position is deleted. We do not track location in the background.

The nanny hub and home care

Child cards for carers, an emergency sheet with contacts, a house guide with photos, house rules and shift checklists.
Who may collect each child: their name, relationship, photo and a note about their identification, and the weekly school run.
Shifts: when a carer started and ended one, what they logged (meals, naps, nappies, moods, incidents and medicine given), photo updates they sent, and the summary written for the parents at the end.
Home care: cleaning jobs with photos of the spot before and after, the room, and the products and steps to use.

Photos taken in the hub and in home care are compressed and have their location and camera details removed before they are stored.

Subscriptions

Premium is bought through the Google Play Store or the Apple App Store. We never see your card or bank details; the store does. We receive from the store a purchase record (for Google Play a purchase token, for Apple a transaction identifier), which product was bought, when it renews or ends, and whether it is still active. We store that against the household it gives premium to and the account that linked it, and we check it with the store to confirm it is genuine.

Notifications

If you allow notifications, your phone gives us a push token, a random address for your device that Apple and Google use to deliver notifications. We keep it with your account so we can send your morning digest and reminders, and delete it when you sign out or delete your account.

AI features

Some features use artificial intelligence, for example reading a school letter you photograph into proposed calendar events that you then check and confirm. These features:

Run on Google's Gemini models on Vertex AI, in the European Union (the Netherlands), and are called only from our servers, never directly from your phone.
Send only what the task needs. We replace names with placeholders where we can (a child is "child-1"), and we never send allergies, medication, member identifiers or contact details. The photo or document you choose to have read is sent because it has to be; the app tells you so before you pick it, and we do not keep it afterwards.
Are not used by Google to train its models, under Google Cloud's data processing terms.
Keep a count per household of how many AI requests were made each month, with no content, so we can apply fair-use limits.

AI suggestions are proposals: nothing is added to your household until you confirm it.

Product numbers, crash reports and security checks

Product numbers. To know whether NestPrep is working we count weekly active households, lunch plans created per week and how many invites are sent. These are counted on our servers from random identifiers. We do not use an advertising or analytics SDK, we do not track you across other apps or websites, and the weekly totals contain no names or identifiers.
Crash reports. When the app crashes it sends a report to Google's Firebase Crashlytics: the technical details of the crash, your device model and operating system version, the app version, and a random member identifier so we can tell how many people a crash affects. We do not put names, email addresses or anything you typed into crash reports.
App integrity checks. We use Firebase App Check, which asks Google Play Integrity or Apple App Attest to confirm that requests come from a genuine copy of our app on a genuine device. This protects your household's data from scripts pretending to be the app.

Our website

Our website sets no cookies, uses no analytics and loads nothing from other companies. If you ask us to delete an account through the website, we keep the email address and message you send us only until we have dealt with the request.

4. Why we are allowed to use it

POPIA allows us to process personal information only when there is a lawful reason. Ours are:

To provide the service you signed up for (performance of our agreement with you): your account, your household, and everything the app does for it.
Your consent, and for children, the consent of a parent or guardian: children's information, health information such as allergies and medication, live location, connecting outside calendars, notifications, and AI features. You can withdraw consent at any time by turning the feature off, deleting the information, or deleting your account. Withdrawing does not make earlier processing unlawful.
Our legitimate interests, balanced against yours: keeping the service secure (App Check, rate limits, logs without personal details), fixing crashes, and counting the product numbers described above without identifying anybody.
Legal obligations: keeping records the law requires, such as records of purchases, and responding to lawful requests.

We do not sell personal information, and we do not use it for advertising.

5. Children's information and health information

NestPrep is used by adults to organise family life, and it holds information about children because that is what school lunches, chores and childcare are about.

Only an adult can create an account. You must be 18 or older to sign up. Children do not sign up themselves; a child uses NestPrep only on a kid device a parent has signed in, or as a profile an adult manages.
A parent or guardian consents for the child. POPIA allows a child's personal information to be processed with the consent of a competent person, meaning a parent or legal guardian. When an adult adds a child's profile or marks a profile as a child, the app asks them to confirm that they are the child's parent or guardian, or are acting with that person's authority, and that they consent. We record who confirmed it, when, and against which version of this policy.
Health information is kept for the child's safety. Allergies and food rules are used to keep unsafe food out of lunch plans and to show carers what a child must avoid. Medication is visible only to the people the household's parents allow.
A kid device holds no account details. It has no email address or password, and it sees only what the child's parents allow it to see.
A parent can view, correct or delete any of their child's information at any time, and can sign out every kid device.

6. Who can see your information

Your household. Family members (admins and parents) see the household's information. Helpers, carers and kids see only the areas the parents grant them. Your private vault is visible to you and your household's parents, and to anyone else only if you or they grant it.
People you share with. If you share a single document by link or share the calendar feed, anybody who has that link can see what it points to until it expires or you reset it.
Our service providers, who process information on our behalf and under contract. They are listed below.
Authorities, only where the law requires it and after we have checked that the request is lawful.

Our service providers are:

Google (Google Cloud and Firebase): our database, file storage, servers, sign-in, crash reports, app integrity checks and push notifications; and Vertex AI for the AI features.
Apple and Google Play: in-app purchases, subscription management, app integrity checks and push notification delivery.
Google and Microsoft, only if you connect your Google or Outlook calendar, to read your events.

Nobody at NestPrep looks at your household's content unless you ask us to help with something and give us permission, or the law requires it.

7. Where your information is kept, and transfers outside South Africa

Our database, file storage and servers run in Google Cloud's Johannesburg region (africa-south1), in South Africa.

Some processing happens outside South Africa:

AI features run in the European Union (Vertex AI in the Netherlands).
Sign-in, crash reports, app integrity checks and push notifications are run by Google, Apple and Microsoft on their global infrastructure, which may include the United States and Europe.

POPIA (section 72) allows these transfers because the recipients are bound by law or by binding agreements that give protection substantially similar to POPIA's, including the European Union's General Data Protection Regulation and Google Cloud's data processing terms, and because they are necessary to provide the service you asked for. [Legal review: confirm the section 72 basis for each processor and reference the relevant agreements.]

8. How we keep it safe

Everything is encrypted in transit and at rest by Google Cloud.
Every read and write is checked against your household's roles and grants on our servers, not only in the app, and each of those checks is tested.
Vault documents open only behind your phone's own lock, every opening is logged by the server first, and a helper sees no identity document unless granted it.
Credentials for connected calendars, purchase records and share-link secrets are held only on our servers, and links and PINs are stored scrambled.
Our logs record what happened, not who you are: no names, email addresses, tokens or content.
App Check and rate limits protect us from automated abuse.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the Information Regulator as POPIA requires, as soon as reasonably possible.

9. How long we keep it

While your account exists, we keep your account and the information in your households so the app can work.
Things you delete are removed from the live service straight away. Live location is deleted when the sharing window ends. Invite and kid pairing codes expire and are removed. Document share links stop working when they expire and are then cleared.
When you delete your account, we delete your account, your sign-in, your private vault and its files, your personal details in each household, and your push tokens. If you were the last adult in a household, the whole household and everything in it is deleted, including its files and kid devices. If other adults remain, the household continues: shared records such as events and lists stay with the household, but your personal details and vault are removed and your profile is no longer linked to you. Deletion from the live service is immediate; copies in Google's backups are overwritten within [backup retention period, for example 30 days].
A data export you download is available through a link that expires one hour after it is made, and only your own signed-in account can open it; the file is deleted from our servers within two hours, or sooner if you make a new one.
Purchase records are kept for as long as the law requires for financial records, [purchase record retention period], even after the account is deleted, without the household's content.
Weekly product numbers are totals with no identifiers and are kept.
Crash reports are kept by Crashlytics for [Crashlytics retention period, for example 90 days].

10. Your rights

Under POPIA you have the right to:

Know what we hold about you and get a copy. In the app, go to Account, then Privacy and your data, then Download my data. We prepare a file of everything held about you and give you a link to download it.
Correct it. Almost everything can be edited in the app. For anything you cannot edit, contact us.
Delete it. In the app, go to Account, then Privacy and your data, then Delete my account. If you no longer have the app, use the form at [website domain]/delete-account.
Object to processing based on our legitimate interests, and withdraw consent at any time.
Not be subject to decisions made only by automated means. NestPrep makes none: AI suggestions are only proposals until you confirm them.
Complain to the Information Regulator if you think we have handled your information wrongly. We would like the chance to put it right first, so please contact us too.

The Information Regulator (South Africa) can be reached at inforegulator.org.za, by email at POPIAComplaints@inforegulator.org.za, or at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. [Legal review: confirm the Regulator's current contact details.]

We answer requests within [response period, for example 30 days]. We may need to confirm who you are first, so that we never give your information to somebody else.

11. Changes to this policy

When we change this policy we change its version number and the date at the top. If the change matters, the app asks you to read and accept the new version before you carry on, and we will tell you what changed. Earlier versions are available on request.

12. Contact us

For anything about your privacy, write to our Information Officer at [Information Officer email address], or to [legal entity name], [postal address]. For help using the app, write to [support email address].

This policy takes effect on [effective date].