Privacy
NurtureNet holds notes about the people you care about keeping in touch with. That is unusually personal, so this page is specific rather than reassuring.
What we store about you
Your email address, because it is how you sign in — there is no password. Your email preferences, the day of the week you want each note, and your time zone, which decides what “this week” means for you. If you connect Google Calendar (on the web), we store OAuth tokens so we can add a time you compose; we do not read your existing events. Disconnecting drops the tokens.
What we store about the people you add
Whatever you type: their name, and optionally an email address, phone number, company, job title and free-form notes. Alongside that, how you have classified the relationship, how important it is to you, and a record of each interaction you log — when it happened, the channel, what kind of touch it was, and any note you wrote.
These people did not sign up. You are recording information about them, and we hold it because you asked us to. Two things follow from that. Write what you would be comfortable with them reading. And if one of them ever asks what you hold about them, you can answer precisely — the export includes every contact and every interaction, in full, including the ones you have moved to Trash.
What we record automatically
A change log of who edited which contact and when, so a surprising change can be traced. A record of which emails we sent you and whether they were delivered, so you are not sent the same note twice. Nothing else.
What we do not do
- No analytics, no tracking pixels, no advertising identifiers, no session recording.
- No cookies beyond the one that keeps you signed in. There is no consent banner because there is nothing to consent to.
- We do not sell your data, or the data of anyone in your network, to anybody.
- We do not read your contacts or notes to train anything, and we do not use them to build a profile of you.
- We do not import your phone or email contacts. Every person is added by hand.
- We do not read your existing calendar, and we do not create contacts from calendar attendees. A time you set with someone is written to your calendar only.
Who else processes it
We use a small number of services to run NurtureNet. They process data on our instructions and for no other purpose.
- Supabase — the database and sign-in, hosted in the United States (US East). This is where your contacts and notes live.
- Resend — sends your sign-in links and the weekly emails you have turned on. It sees your email address and the contents of those emails, which can include the names of people who need attention.
- Vercel — serves this website and the app.
- Apple and Google — when you install the mobile app, and if you buy a subscription through their stores. We never receive your card details. If you connect Google Calendar on the web, Google also processes the event you asked us to add.
How long it is kept
Removing a contact moves them to Trash, where they stay until you empty it — that is reversible on purpose, because deletion by accident is easy. Emptying the Trash erases them permanently and immediately.
Deleting your account erases your contacts, everything you logged about them, your notes, your email preferences, your remembered calendar choices, your Getting-started dismiss and your sign-in, straight away. There is no grace period and no recovery.
Getting your data
Export downloads your contacts, every interaction you have logged, your email preferences and your app preferences (remembered calendars and whether you dismissed Getting started), as a single JSON file, from Account in the app. Contacts you have moved to Trash are included — they are still data we hold. Delete account is on the same screen. Neither requires you to email us or wait for us to act, which is deliberate: a right you have to ask permission to use is a weak one.
Security
Every request is scoped to your account by row-level security in the database, so one account cannot read another’s data even if the application has a bug. Traffic is encrypted in transit. Sign-in is a one-time code with no password to leak or reuse.
No system is perfect. If you find something wrong, please tell us at nurturenet@protonmail.com and we will take it seriously.
Children
NurtureNet is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this page changes in a way that affects what we do with your data, we will say so rather than quietly updating the date at the top.
Contact
Questions, requests, or anything that reads wrong here: nurturenet@protonmail.com.