Privacy policy

Nestra helps you plan meals, manage pantry items and shopping lists, and save and import recipes. This notice describes processing in the Android app, web app and our website. The app's privacy choices supplement this notice; they do not replace it.

We process data to provide requested features and perform our contract under Article 6(1)(b) GDPR, on the basis of voluntary consent under point (a), and to secure the service, prevent abuse and handle enquiries under point (f). Legally required retention is based on point (c). Our legitimate interests are a reliable, secure service and the establishment or defence of legitimate claims. You may withdraw consent for future processing.

The operator named above is responsible for Nestra's processing. You can contact this address with privacy enquiries, deletion requests, corrections or complaints. Never send us your password or sign-in codes.

For a synchronised account we process your email address, internal account ID, display name and the profile information you choose. When you sign in with Google, Supabase receives the sign-in and profile information you authorise. Passwords and sessions are managed through Supabase Auth; Nestra does not need your Google password.

App data may include ingredients, quantities, expiry and purchase dates, storage areas such as fridge or pantry, item prices, shopping lists, notes, recipes, cookbooks, meal plans, reviews and settings. These records are stored for your chosen features and synchronised when you use an account. Search terms are processed to perform your search. Necessary access and error data include IP address, time, requested function, response status, and app and device information.

You may voluntarily provide dietary preferences, avoided ingredients, allergies and intolerances. Allergy and intolerance information is processed only after separate explicit consent; it is not needed for the app's general features. It is synchronised with your profile and used for recipe exclusions, warnings and suggestions. Without consent, those details are not stored. Revoking consent removes them from your profile, planner settings and local app data. A minimal consent record remains in the account/installation audit.

People aged 16 or older can consent themselves. For ages 13–15, Nestra also requests confirmation through a one-time link sent to the provided parent/guardian email address. The address is sent to Resend for delivery and is not stored in Nestra's database; the link contains no allergy details. This verifies access to the email inbox, not the recipient's legal guardianship. This feature is unavailable under age 13. The legal adequacy of this flow must be reviewed by a qualified adviser before public launch.

Allergy and dietary information is not sent to general usage analytics or used as general learning signals. Nestra does not provide medical advice or guarantee that food is allergen-free. Check ingredients and product labels yourself when you have an allergy.

Household profiles also let you voluntarily save weight, height, age, gender and activity level. You explicitly confirm their storage in the form before entering them. They are optional and do not currently change calorie targets. Only the account that creates the profile can view or edit these body details; other group members and administrators do not receive them. You can remove individual details in the household profile or revoke health consent to delete body details associated with your account from the device and server. Enter another person’s details only when you are authorised to manage them.

When you use a group or explicitly share content, authorised people can access the relevant lists, pantry items, plans, recipes and notes. Your display name, avatar and necessary membership information may be shown to other group members. The activity feed records changes with the acting account, time and change data needed for conflict handling and undo. Joining a group does not by itself make your private area public.

Reviews and shared content may be visible to their intended audience. Reports, blocks and moderation decisions are processed for community safety. Do not enter confidential information about other people without permission. Invitations use an email address you enter or an invitation link you share; Nestra does not read your address book.

Profiles for people without an account contain a name, an optional photo, a portion factor and favorite and avoided ingredients. Assigning a profile to a group shares these details with authorised members for planning together. Body details are excluded. Removing a person deletes their profile contents from the server.

The camera and selected images are used only for scan or image features that you start. Android text recognition, document capture and barcode recognition run on your device using Google ML Kit. The current flow does not automatically upload receipt images to our servers or an AI model. Confirmed items, quantities, purchase date, price and, where applicable, the relevant item text are synchronised as normal inventory data.

Separately from optional Nestra analytics, Google ML Kit may transmit technical SDK data such as device model, operating system, app version, installation identifier, timings, SDK events and error codes. Image contents and complete recognition results are not sent to Google as ML Kit telemetry. Downloading scanner modules or offline product packages requires an internet connection. Nestra does not request GPS permission; an item's storage area is not a geographic location.

Profile, recipe, product or background images that you save may be synchronised as part of that content and shown to its recipients if you share it. Imported image or video URLs may refer to external providers. Local files are processed only when you select them; these features do not require access to your entire photo library, contacts or microphone recordings.

For offline features, sign-in sessions, settings, consent and pending synchronisation, Nestra uses local app or browser storage such as IndexedDB and localStorage. A random installation ID associates your privacy choices with your installation. Remove local app data from shared devices when you no longer want it kept there. Consent is separated by installation and account.

When you start an import, the recipe URL is sent to Nestra's backend to fetch publicly available content. For YouTube, the video ID may be sent to Google through the YouTube Data API. A native fallback may contact the source website directly from your device; that website receives ordinary connection data. Confirmed import data is saved as your recipe. The current import flow does not send private recipes or receipt images to an external generative AI service.

External preview images may be fetched from their provider when displayed. When you choose to open an external video, link or embedded player, the provider's own information also applies, for example Google/YouTube, Meta/Instagram or TikTok. These providers may process connection data and their own identifiers. Such requests are separate from optional Nestra usage analytics.

Android purchases are handled or verified through Google Play and RevenueCat. This involves your Nestra account ID, product and transaction identifiers, purchase receipts, times, subscription status, price/currency information and technical SDK data. Processing enables access, restoration, abuse prevention and purchase analytics. Nestra does not receive complete card or bank-account details through this flow.

You can use an account without making a purchase. General analytics choices do not disable necessary purchase and entitlement verification. Google Play's own rules also apply to store payments and their retention. Deleting your Nestra account does not cancel a store subscription; cancel it separately in the store.

Under Profile → Privacy & Data you can separately choose usage analytics, recommendation improvement, receipt learning, product-catalog contributions, price contributions and recipe-import improvement. These purposes are off by default. A consent record stores purpose version, time, account and installation context. General analytics support is prepared for PostHog, but it is not configured in the currently published Android build. Enabling it requires your separate consent; automatic input capture and session recording are disabled in the app code.

Contributing receipt images is a separate purpose. The current flow has no connected upload for it; saving a choice alone does not send images. A future image upload requires its own explanation at the relevant moment. Voluntary improvement contributions are not used for advertising or selling personal data.

Receipt learning uses only explicitly confirmed, rejected or corrected item lines with retailer, language, quantity, unit, catalog mapping and recogniser version. Complete receipts, payment and loyalty information are excluded. A global mapping requires matching votes from multiple people. Product-catalog contributions contain product name, barcode, brand, package size and mapping, not private stock, storage areas, expiry, notes or images.

Price contributions contain confirmed product prices, quantities, units, purchase date, currency, retailer and country, but no GPS coordinates or branch address. Recommendation and import improvement use controlled actions, IDs, source and version information instead of private recipe text or images. These contributions may initially remain associated with your account and are not automatically anonymous.

Supabase provides authentication and the app database. The configured database region is EU West (Ireland). Railway runs the backend in EU West (Amsterdam). Cloudflare delivers our website, web app, images and downloadable catalog files and processes connection and security data for this. RevenueCat supports purchase verification and entitlements. Google provides Play payments, Google sign-in, the YouTube API and technical ML Kit services. Resend processes waitlist email addresses and, for the separate consent flow for ages 13–15, the provided parent/guardian address to deliver a confirmation link. PostHog is prepared as an optional analytics service but is not configured in the current Android build.

Providers receive the data needed for their particular service. Disclosure to other group members or public publication follows your sharing choices. Transfers may also be necessary to comply with legal obligations or address abuse. The linked provider notices explain their respective processing.

• Supabase
• Railway
• Cloudflare
• RevenueCat
• Resend
• Google / ML Kit
• PostHog

An EU hosting region does not mean that every support access, network node or subprocessor is exclusively in the European Economic Area. Several providers are US companies or process data internationally. External recipe sources and platforms you open may also process data outside the EEA.

Transfers for which we are responsible must meet Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses. Contact us for information about the recipients and safeguards applicable to your particular processing. We do not claim that processing takes place exclusively in Europe.

Account and saved app data remain available for your chosen features until the content or account is deleted. Group changes and conflict records support a traceable history and undo; account deletion also removes the related personal activity and restoration records.

Controlled learning signals have expiry periods depending on type: candidate displays 30 days, outcome and quantity signals 365 days, and explicit corrections 730 days. Expired signals are removed during server cleanup. You can request earlier removal through contribution deletion or by contacting us. Support data is needed for handling your enquiry and resolving legitimate claims. Waitlist data remains until removal from the list.

Security logs and backups follow the applicable operational deletion and overwrite cycles. Legally required purchase and accounting records, and data handled by independently responsible stores, may remain longer. On request we explain any necessary continued retention and its reason; deleting an account is not a promise that every external store receipt is immediately erased.

You can switch off optional purposes under Profile → Privacy & Data. This prevents future voluntary contributions but does not automatically remove existing data. Delete contribution data removes associated optional learning and catalog contributions. Private data needed for your app features remains.

Under Profile → Account → Delete account you can delete your account and associated private app data. Without the app or a sign-in, email [email protected] from your account email address. We check account ownership before removing data and do not disclose other users' account information. The following page explains the process and possible exceptions.

Production connections to our app, authentication and purchase services use HTTPS/TLS. Account-scoped access checks and database permissions restrict access to private data. Shared records are intended only for authorised accounts. Sign-in credentials, access tokens and server keys must not be included in public error reports.

You grant camera and file permissions for your chosen features and can revoke them in Android. Nestra uses no advertising SDKs, address-book access or GPS tracking. We do not claim end-to-end encryption of synchronised app data or independent security certification.

Nestra is intended for people aged 13 and over, not children under 13. Processing that relies on consent is also subject to your country's legal age thresholds. In Germany, the required permission from a parent or guardian must be considered for users under 16. The age group selected in an app store does not replace that permission.

If you are below the applicable threshold, do not enable voluntary contributions or enter health information without the necessary permission. Contact us about questions or information entered by mistake. The general app features do not require your full date of birth.

Where the legal conditions apply, you may request access, rectification, erasure, restriction, portability and objection, and withdraw consent. Email [email protected] for a copy of your personal data or help exercising these rights. We may ask for proportionate proof of account ownership to protect your account.

You may also complain to a data protection authority, particularly where you normally live or work or where an alleged infringement occurred. The Data Protection Commissioner for Lower Saxony is particularly relevant for the operator based in Lower Saxony, Germany.

When you join our website's waitlist, we process your email address and list status at Resend to inform you about access to Nestra. This is based on your consent. The entry does not create an app account and is separate from optional in-app contributions. Request removal at any time by emailing [email protected].

For support or privacy enquiries, we process the sender address, message and attachments you voluntarily provide to handle the request. Send only necessary information and redact sensitive details on receipt attachments. Joining the waitlist is not general advertising consent.