Privacy

Last updated October 24, 2026

Nest (at house.ybloc.us, also published under the name “yblocapp”) is a small, private app for planning a house together: rooms, budgets, ideas, shopping, dates and the people you work with. It is run by one family for itself and the people it invites. It has no ads, sells nothing and shares nothing for marketing.

What Nest stores

• Your account: your email address, the name you choose, and how you sign in. With a password, only a one-way hash is kept, never the password. With Google, Nest receives only your name, email address, profile picture link and Google account ID.
• What you and your housemates add: rooms, furniture, prices and budgets, ideas and tasks, key dates, deliveries, care tasks, the punch list (with photos), inspiration pins, the shopping list, comments, contacts you save (names, phone numbers, email addresses and websites of the people you work with), receipts (with their photos or PDFs) and papers — harmless documents such as manuals, warranties, inspection reports, plans and quotes, plus a file-free card per insurance policy (insurer, dates, agent). Papers is not for policies, signed contracts, IDs or anything with account numbers, birth dates or signatures.
• Emails you send to Nest’s addresses (for example receipts or a shopping list): Nest checks the email really came from you, files what it contains in your house (the receipt and its attachment, the list, photos you sent for a room’s board — kept privately until you add or dismiss them — or a short excerpt for the Inbox) and keeps a fingerprint of the message so it is filed only once. The rest of the email is not kept. Papers are not taken by email: one sent is refused and nothing of it is kept.
• On your device: Nest keeps you signed in and saves a copy of your house in the browser so the punch list works without a signal. It uses no advertising or tracking cookies and no analytics.

Who can see it

• Everything in a house is visible only to that house’s members. The database enforces this, not just the app.
• Nest refuses to keep Social Security numbers, payment card numbers, bank routing numbers, PINs and entry codes, and passwords in anything you type (and removes them from emails it files). A policy is kept only as a card, never as a file.
• Receipt and paper files are stored privately and encrypted at rest by our database provider (AES-256), and travel only over encrypted connections. A member can make a link to one file; a receipt’s link expires after 7 days, a paper’s after 24 hours, and replacing or deleting the file ends it sooner.
• Starred papers can also be kept in the browser’s storage on a member’s device so they open without a signal — each device chooses (on by default on phones, off on computers). That copy is protected by the device’s own lock and encryption, not by Nest; signing out, turning the setting off, unstarring or leaving the house removes it.
• Each member can make a private calendar link. It carries dates and titles, never prices, quotes, phone numbers or email addresses, and can be turned off at any time.
• The person who runs Nest can reach the database to keep it working and to make backups, and looks at your content only to fix a problem you report or when the law requires it.

Services Nest uses

• Supabase stores the data and handles sign-in. Cloudflare serves the website and receives Nest’s email. Google handles “Continue with Google” if you choose it.
• The “Ask Nest” assistant (when a house has it on) sends your question and a summary of the house’s rooms, ideas, items and dates to an AI model run by Cloudflare. If you tap “Ask Nest what this is” on an email in the Inbox, that email’s subject and text go too. Phone numbers and email addresses are left out, even ones typed into notes. The model only proposes changes; any link, phone number, email address or account number it writes that you didn’t type yourself is removed, and nothing changes until you tap “Do it”.
• Barcode scanning on the shopping list looks up just the barcode number on Open Food Facts, a public product database.

Google sign-in

If you sign in with Google, Nest asks Google only for your name, email address, profile picture and account ID (the basic “openid, email, profile” permissions), and uses them only to sign you in and to show your name to your housemates. Nest does not read your Gmail, contacts, calendar or files, does not share Google data with anyone, does not use it for advertising and does not use it to train AI models. Nest’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How long it is kept

• Your house’s content stays until a member deletes it. Deleting removes it from the house right away, and deleting a receipt or a paper deletes its stored file too.
• A nightly backup of the database (without passwords or sign-in sessions) is kept privately and encrypted, so the house can be restored after a mistake; only the owner holds the key.
• Some deletions and membership changes are recorded in a house history that members can read, so everyone can see what changed.

Your choices

• You can edit or delete anything you added, leave a house, and turn off your calendar link from inside Nest.
• To delete your account and everything only you can see, or to get a copy of your data, email privacy@ybloc.app. Receipts and papers can also be exported (as a ZIP) from their pages at any time.
• If you signed in with Google, you can also remove Nest’s access at myaccount.google.com/connections.

Security

Connections are encrypted (HTTPS). Access rules in the database decide what each person can read or change, and they are tested automatically on every update. No system is perfectly secure; if something goes wrong that affects your data, the people affected will be told.

Children

Nest is not meant for children under 13 and does not knowingly collect their information.

Changes

If this page changes, the date at the top changes too. Anything that changes how your data is used will be told to members first.

Contact

Questions or requests: privacy@ybloc.app.