Legal
Privacy Policy
NestFund Pty Ltd · Last updated: 17 June 2026
1. About this policy
NestFund Pty Ltd operates NestFund, a personal finance and net-worth tracking app available at my.nestfund.app. This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have over it.
We handle your information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Questions? Email us at privacy@nestfund.app.
2. Who this policy covers
This policy applies to anyone who visits nestfund.app or creates an account on my.nestfund.app.
Minimum age: NestFund is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us and we will delete it promptly.
3. What information we collect
Information you give us directly
Account details
- First name and last name
- Email address
- Password — stored only as a secure hash; we never see your actual password
Financial information
- Monthly income amount and income type (fixed or variable)
- Assets: names, current values, and the institution they're held with
- Liabilities: names, outstanding balances, interest rates, and minimum monthly payments
- Expenses: descriptions, amounts, dates, and categories
- Income entries: amounts by month, source (e.g. salary, freelance), and optional notes
- Savings goals: names, target amounts, current progress, and deadlines
- Budgets: category spending limits
- Recurring subscriptions you track (e.g. service name, cost, billing cycle)
- Custom category names and colours you create
Preferences
- Currency, app theme (dark/light/system), dismissed notification flags
Information we collect automatically
When you use NestFund, the following is collected automatically by us and our infrastructure providers:
- IP address
- Browser type and version, device type, operating system
- Pages and features accessed, and timestamps
- Session tokens (used to keep you securely logged in)
This data is used for security and fraud prevention — not to profile your behaviour or serve advertising.
If you sign in with Google
If you choose "Sign in with Google", Google shares only your name and email address with us. We do not receive access to your Google contacts, Gmail, Drive, or any other Google data.
4. Why we collect your information
We only collect information that is reasonably necessary to provide and improve NestFund:
| Information | Purpose |
|---|---|
| Name and email | Create your account, identify you, send security emails |
| Password hash | Authenticate you securely |
| Financial data | Calculate net worth, track budgets and goals — this is the core service |
| Income and expense data | Power the financial insights and dashboard |
| IP address and device info | Detect unauthorised access, prevent fraud |
| Session tokens | Keep you logged in between visits |
| Billing status | Manage your subscription tier |
We do not use your financial data for advertising, and we do not sell your personal information.
5. How we use your information
We use your information to:
- Provide the NestFund service — your financial dashboard, net-worth tracking, budget tools, and goal tracking
- Authenticate your identity and keep your account secure
- Send transactional emails: account verification, password resets, and security alerts
- Process your subscription payment if you upgrade to a paid plan
- Improve and maintain the app (using aggregated, de-identified technical data)
- Meet our legal obligations
We do not send marketing emails. The only emails we send are necessary for the operation of your account.
7. Overseas storage and disclosure
NestFund is an Australian company, but all of our service providers are based in the United States. This means your personal information is stored and processed overseas.
Under Australian Privacy Principle 8, we are required to tell you this: when your information is disclosed to an overseas recipient, we may not be able to enforce the APPs against them, and the Office of the Australian Information Commissioner (OAIC) may not be able to investigate a complaint about their conduct. We have taken reasonable steps to select providers with established privacy programmes and data processing agreements in place, but this limitation is important to understand.
By creating a NestFund account, you acknowledge that your personal information will be processed in the United States by the providers listed in section 6.
8. How long we keep your information
While your account is active: We keep your personal and financial information for as long as your account exists.
When you delete your account: Your account and all associated data are permanently deleted immediately. This action is irreversible.
Backup copies: Our database provider (Supabase) maintains automated daily backups. After account deletion, residual copies may persist in backups for up to 1 day before being permanently overwritten.
Server access logs: Vercel access logs (IP address, request data) are retained for up to 1 hour and then permanently deleted automatically.
Stripe billing records: If you held a paid subscription, Stripe independently retains payment records for their own legal and compliance purposes. We do not control Stripe's retention schedule.
9. How we protect your information
We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access or disclosure:
Encryption in transit: All data is transmitted over HTTPS/TLS
Encryption at rest: Your data is encrypted at rest within Supabase's infrastructure
Row-level security: Our database is configured so that every user can only ever query their own records — no query can return another user's data
HTTP-only session cookies: Session tokens are stored in HTTP-only cookies that cannot be read by browser scripts
Content Security Policy: The app blocks connections to any domain not explicitly approved — only Supabase is permitted
Password standards: Minimum 10 characters including uppercase and a number
Access controls: Access to the production database is restricted to authorised NestFund personnel
No security system is perfect. If you believe your account has been compromised, contact us immediately at privacy@nestfund.app.
10. Your rights
Access your data
You can download a copy of all your NestFund data at any time from Settings → Export Data (JSON format). To request data in a different format, email privacy@nestfund.app.
Correct your data
You can update your name, income, and all financial data directly inside the app. For anything you can't edit yourself, contact us.
Delete your data
You can permanently delete your account and all data from Settings → Delete Account. Deletion is immediate and cannot be reversed.
Make a complaint
If you believe we have breached the Australian Privacy Principles and we have not resolved your concern, you can lodge a complaint with the OAIC:
- Website: oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
We ask that you contact us at privacy@nestfund.app first so we have a chance to resolve your concern directly. We will respond within 30 days.
If you are in the EU or UK
You may have additional rights under the GDPR or UK GDPR, including the right to data portability and the right to restrict processing. Contact us at privacy@nestfund.app to exercise these rights.
12. Changes to this policy
If we make material changes to this policy, we will:
- Display a notice inside the NestFund app the next time you log in
- Update the "Last updated" date at the top of this page
Continuing to use NestFund after a policy update takes effect means you accept the revised policy. If you disagree with the changes, you should delete your account before they take effect.
13. Contact us
NestFund Pty Ltd
privacy@nestfund.app
We aim to respond to all privacy enquiries within 30 days.