Privacy policy

Version 1, [date of review]. For NestCore, NestFit and StudySnap.

This page says what we collect, why, how long we keep it, who can see it, and how to get it or delete it. It is written from our data inventory, item by item. If anything here is unclear, ask: [contact email].

Who we are

NestCore, NestFit and StudySnap are made and run by [full name], [town, country] ("we", "us"). For personal accounts we are the controller of your data. For school accounts, the school is the controller and we act for it (see "School accounts" below).

Personal accounts are for people aged 13 and over

When you create an account we ask your month and year of birth. The app checks you are 13 or over and then forgets the date: we only store that the check was passed. If you are under 13, you can use StudySnap only through a class your school has set up.

What we collect, and why

Your account. In NestCore and NestFit: your email address and a password, which is stored only as a scrambled hash we cannot read. We use them to sign you in and to send confirmation and password reset emails. We also store that you passed the age check and when you accepted these terms.

What you put into the apps. Your workouts, exercises, sets and notes; your meals and targets; your habits, plans, notes, goals, calendar events and money tracking; and the answers you give when setting up NestFit. We store them so the apps work and so they are the same on all your devices.

Health related data. NestFit asks for your age, height, body weight and sex (used for the calorie estimate, and in NestCore to compare your lifts with strength standards for your age and sex; NestCore asks for age and sex itself when they are missing), and you can tell it about an injury so it leaves certain exercises out. This counts as health data. We only process it because you choose to enter it, which is your explicit consent. You can change or remove it at any time in the app, or delete your account.

The AI coach. When you ask the AI coach a question, the part of your data the question needs is sent to Groq, a company in the United States that runs the AI model, for that one answer. We do not send anything to Groq unless you ask a question. School accounts can never use the AI coach.

Scanning a barcode. When you scan or type a barcode in NestFit, only that number is sent to Open Food Facts, a free open food database run by a non profit in France, to look the food up. The camera picture stays on your phone, and the foods you scanned are remembered on your phone only.

Your calendar, if you turn it on. In NestCore you can make a private calendar link: a calendar app that has it can read your NestCore events and your training days, so keep it to yourself. Turn it off and the link stops working. You can also connect Google Calendar: Google asks you first, then NestCore reads and adds events in Google Calendar straight from your browser. That access stays on your device for the hour Google gives it and never reaches our servers. Disconnect it in NestCore, or in your Google account.

StudySnap. An account of your own needs no email. It starts with a key that stays on your device. If you set a password, we store your sign in name and the password, only as a scrambled hash, and a record for each device you sign in on. We store your name, your classes, your assignments and what is done, grades you type in, and marks and comments from a teacher who set the work. Photos of the board are read on your device and never uploaded. If you connect Google Classroom, your own browser reads your coursework and sends us only course names, titles and due dates; your Google login never reaches us. Feedback you send from the app is stored without your name or account.

On your device. A full copy of your data is kept in your browser so the app works without a connection. It stays there until you sign out, delete your account, or clear your browser.

Security. If someone enters a wrong old sync key, we keep a count, the time, the account and the network address for an hour, to stop guessing. In StudySnap, wrong passwords (the sign in name typed and the time) are kept for 15 minutes, and wrong class codes for 10. Our host keeps short request logs, including network addresses, to run the service.

Typefaces. The apps and their pages load their typefaces from Google Fonts. When a page opens, your browser asks Google for the font files, so Google receives your network address and browser details. We do not send Google anything else.

What we never do. No advertising, no tracking or analytics companies, no selling or sharing your data for marketing. No cookies except what the app needs to work, so there is no cookie banner.

Our reasons (legal bases)

• To provide the service you signed up for (contract): your account, your training, food, habits, plans, notes and money tracking.
• Your explicit consent: health related data, and each AI coach question.
• Our legitimate interest in keeping the service safe and running: the wrong key, password and class code counters, request logs, backups, and feedback sent from the app.
• A legal obligation: recording that the age check and these terms were accepted.

Who can see your data

• You.
• Nobody else using the apps. Each account can reach only its own data.
• We can, as the people running the service, and only use it to run and fix it.
• The companies that run parts of the service for us, only for that purpose: Cloudflare (hosting, storage and accounts since 24 October 2026, United States and worldwide), Netlify (the earlier hosting, storage and accounts, holding older copies until that site is closed, United States and worldwide), Open Food Facts (barcode numbers only, France), Groq (AI coach answers, United States), GitHub (backups, United States, once switched on; StudySnap's backups are encrypted first, so GitHub cannot read them), Google Fonts (typefaces, United States), and StudySnap's host (to be named here before StudySnap goes online).
• When data goes to the United States, we rely on those companies' data processing terms and the safeguards they offer for transfers.

How long we keep it

• Your account and everything in it: until you delete your account.
• Backups: a deleted account stays in our backups for up to 30 days, then it is gone.
• Data from before September 2026, kept so people could bring it back: until 31 March 2027.
• The wrong key counter: one hour.
• In StudySnap: a device you have not used for 180 days is signed out, and feedback is kept for one year.

Your rights

You can see, copy, correct and delete your data yourself:

• Copy it: Settings, Export. You get everything as a file.
• Correct it: edit it in the app.
• Delete it: Settings, Delete my account. This removes your data and your login at once, and from backups within 30 days.

You can also ask us to do any of this, to limit what we do with your data, or object to it, by writing to [contact email]. You can take back consent at any time. If you live in the EU or UK, you can complain to your data protection authority; in Belgium that is the Gegevensbeschermingsautoriteit.

School accounts (StudySnap)

A school can set up classes where students join with a class code, including students under 13. For those accounts:

• The school is responsible for the data, and we only act on its instructions, under a data agreement with the school.
• A class only opens after the school's approval is recorded and we have checked it.
• We store a nickname, a sign in name, a password (only as a hash), class membership, the work set and any the student adds, what is done, grades they type in, and marks and comments from the teacher. No email, no age and no birth date.
• School accounts see only StudySnap. No marketing, no AI features, no Google Classroom connection, and the data is used for nothing but the class.
• If a student forgets their password, the teacher can reset it. The student then chooses a new one before they can do anything else.
• A school account removed from every school class is deleted 30 days later.
• Backups are encrypted and roll over within 30 days.
• Class data is deleted at the end of the school year unless the school renews, or sooner when the school asks. The school can export everything first.
• A parent can ask, through the school, to see or delete their child's data.

Changes to this policy

If we change something important, we will say so in the app, and ask you to accept again where the law requires it.

Contact

[full name], [contact email]