Nestmer中文

Privacy Policy

Effective date: October 16, 2026

1. Who We Are

Nestmer is a mobile app provided by Mook Studio. This Privacy Policy applies to Nestmer 2.0 and later for iPhone and iPad (distributed through the Apple App Store) and for Android (distributed through Google Play). Unless a platform is named, everything below applies to both.

Contact email: mclim4194@gmail.com

2. What Information We Process

Nestmer is designed to work primarily on your device. Most data is stored locally instead of being uploaded to Mook Studio servers.

We may process the following categories of information:

  1. Home storage data that you create and save, such as floors, regions, containers, item names, notes, tags, dates, and whether an item is marked as private.
  2. Reference images that you choose to add to items, including photos selected from your library or taken by you with the camera.
  3. App settings and local state, such as language, theme, onboarding state, and the local unlocked status of Pro features.
  4. If you choose to use device transfer, transfer data on the same Wi-Fi network or hotspot, including storage structure, settings, images, and temporary QR/bootstrap information, a v2 one-time master secret or v1 access token, and session metadata used to establish the connection.
  5. Purchase status information when you buy or restore local Pro or Cloud subscriptions through the Apple App Store (iOS) or Google Play Billing (Android). For Cloud subscriptions, the server stores the subscription status and the transaction identifier (Apple) or purchase token (Google Play) needed to verify it with the store.
  6. If you choose Cloud: name or display name returned by your sign-in provider (if provided), email, account UID, membership and roles, encrypted maps and photos, object sizes/hashes, versions, timestamps, usage and store subscription status. Map names, items, notes and photos are encrypted on your device; the server does not hold their decryption keys. A home's owner can see members' email addresses and roles in the member list. If you set a private passphrase, the server also stores your private key locked on your device with that passphrase; the passphrase itself is never uploaded.
  7. When you use Cloud, the server also records usage: for each home's owner, current storage, image uploads/downloads, map downloads and requests in each allowance cycle, plus pending upload reservations; for each account, the amount of photos downloaded from each owner's homes that day (one record per day, overwritten the next day) and request-rate counters. These records display usage, enforce plan limits and prevent abuse, and do not require decrypting maps or images. Allowance cycles follow your subscription and reset each month at the date and time it began; deleting content does not refund completed uploads or downloads.
  8. When "Share anonymous usage data" is on (on by default; you can turn it off in Settings): crash reports (stack trace, device model, operating system version, app version and a random installation identifier generated by Firebase). The current iOS and Android versions have no remote usage-event analytics service; feature-usage events are not uploaded. This data never includes item names, locations, notes, photos or email addresses and is not linked to your account.

3. How We Use Information

We use this information only to:

  1. Let you create, view, edit, and search your home inventory and storage structure.
  2. Let you attach reference images to items so they are easier to identify.
  3. Let you transfer your local data directly between compatible devices.
  4. Let you purchase, restore, and store the status of Pro features.
  5. Let the app remember your local preferences and function correctly.
  6. Provide your chosen cloud storage, sharing, owner approvals, subscription verification, usage display, quota enforcement and abuse prevention.
  7. Diagnose crashes and improve stability; never for advertising or cross-app tracking.

4. Permissions

Nestmer uses the following system permissions and services for the features you choose:

  1. Camera access, used only when you choose to take a photo or scan a transfer QR code.
  2. Photo/media access, used only when you choose an image from your library as an item reference image. iOS uses photo-library authorization; Android 12 and earlier may request storage read access, while newer Android versions use the system photo picker and read only the images you select.
  3. Network access, used for local-network transfer, store purchases and optional Cloud authentication, encrypted synchronization and subscription verification. On iOS, local-network transfer requires Local Network permission.
  4. In-app purchases: the App Store on iOS and Google Play Billing on Android, used to buy or restore Pro features and Cloud subscriptions.

We do not use these permissions for unrelated purposes when you have not chosen the corresponding feature.

5. How Data Is Stored and Transferred

  1. Your inventory data, app settings, and Pro status are mainly stored locally on your device.
  2. Images you add are stored in the app's private files directory. Nestmer does not separately encrypt these local image files at rest; they rely on the operating system's app isolation and device-security protections.
  3. Local features need no account. Optional Cloud uses Google, Apple or email/password accounts (available sign-in methods vary by platform) and end-to-end encrypted sharing. Authentication services process email (including Apple relay addresses), provider account identifiers and necessary authorization credentials. You may explicitly link multiple sign-in methods to the same account. After an owner chooses to create and bind a cloud home from the local home, the local map and that cloud home sync automatically while the app is in the foreground. Joined cloud homes are separate homes you can switch to. Synchronization and service access require an internet connection. Private items are uploaded only after you set or enter a private passphrase, and are encrypted with a key that belongs to your account alone: your own devices can sync and view them, while other members and the server cannot read them. Without a private passphrase, private items stay on this device. Members whose changes need owner approval cannot add private items.
  4. When you start Secure Transfer v2, inventory data and images are sent directly between devices on the same local network with end-to-end encryption instead of being uploaded to Mook Studio servers first. The app also supports transfers with legacy v1 devices after explicit confirmation that this transfer is not end-to-end encrypted; compatibility mode sends data and images as plaintext over the local network.
  5. The transfer QR contains a one-time secret that can start the session. Do not share, forward, or screenshot it. The QR scanning window lasts 3 minutes; a session lasts at most 60 minutes and closes after 5 consecutive minutes of inactivity.
  6. Default v2 local-network HTTP carries only end-to-end encrypted ciphertext. User-confirmed v1 compatibility mode carries plaintext that others on the network may read or alter. Encryption does not hide all network metadata: other devices or administrators on the network may still observe IP addresses, packet sizes, and transfer timing. Transfer only over networks you trust and between devices you control.
  7. The app automatically splits transfer content into chunks, shows progress, and retries recoverable chunk failures. Before overwriting local data on the receiving device, it verifies authentication and data integrity; insufficient storage, authentication failure, or corrupted data stops the import.
  8. Each image is limited to 50 MiB, and the total package for one transfer is limited to 1 GiB.
  9. Cloud maps, item information and photos use AES-256-GCM encryption on the device. Keys remain in OS secure storage. Private items and their photos are additionally encrypted with your account's private key using AES-256-GCM; that key is locked on your device with your private passphrase (PBKDF2-SHA256) before it is uploaded. Separate compressed cloud renditions remove EXIF/GPS metadata before upload and do not replace local originals. Cloud draft journals are encrypted; decrypted photo caches remain ordinary files in the app's private directory.
  10. Joining a cloud home downloads the complete map and thumbnails of all photos; a full-size photo is downloaded when it is shown large. Your own private photos, and the photos in an owner's My home, are downloaded in full in the background so the device stays complete if the cloud home is deleted. Members possess a copy. Removing a member revokes future server access and changes keys for future content; downloaded or independently copied data cannot be recalled. Invitation/recovery credentials contain keys and must be shared through trusted channels. A password reset cannot recover content if all credentials and device keys are lost. We also cannot recover a forgotten private passphrase: you can reset it, but private items synced earlier can no longer be read; private items already on your devices are kept and synced again.

6. Third-Party Services and Stores

Nestmer does not include advertising SDKs or third-party behavioral tracking SDKs. The app uses Google Firebase Crashlytics to collect crash reports according to the "Share anonymous usage data" switch. The current iOS and Android versions have no remote usage-event analytics service.

However, some information may be handled by third-party platforms under their own policies in these cases:

  1. The Apple App Store (iOS) and Google Play (Android), when you complete or restore an in-app purchase, for subscription verification and related billing steps. The server asks the relevant store for subscription status and, on Google Play, acknowledges new purchases.
  2. Your device operating system, when it provides camera, photo library, or local network capabilities that you choose to use.
  3. Google Firebase Authentication, Firestore, Cloud Storage, Cloud Functions and App Check provide optional Cloud accounts, encrypted storage, usage, access and device/abuse checks. Firestore/Storage are configured in US us-east1; authentication, store and network services may process necessary information elsewhere. Providers may process IP addresses, device attestations and security logs. E2EE does not conceal such metadata. See Firebase privacy and security.
  4. Google Firebase Crashlytics receives crash reports and device and system information while "Share anonymous usage data" is on, to diagnose stability problems; Google processes it under its own policies.
  5. Google Sign-In and Sign in with Apple, only when you choose that sign-in method: Google or Apple authenticates you and returns your email, an account identifier and the necessary authorization credentials to Nestmer.

How those platforms process information is governed by their own privacy policies and terms.

7. What We Do Not Do

Based on the current version of the app, Nestmer does not:

  1. Require an account for local-only use.
  2. Upload your personal local map without your choice to create, bind or use Cloud, or store Cloud maps, notes and photos in plaintext decryptable by the server.
  3. Include ad tracking or cross-app tracking, or sell your personal data. Crash data is collected only while "Share anonymous usage data" is on and never includes your inventory content.
  4. Collect precise location data, contacts, SMS messages, call logs, or calendar data.

8. Your Choices and Controls

You can, at any time:

  1. Edit or delete items, images, tags, and notes inside the app.
  2. Mark items as private and choose to exclude private items from device transfer; set, change or reset your private passphrase on the Cloud account page. Without one, private items are not uploaded.
  3. Revoke camera or photo permissions in system settings, although doing so may limit related features.
  4. Remove locally stored information by uninstalling the app or clearing app data, depending on your platform. Signing out keeps account-isolated Cloud caches and keys on this device for the same account to use after signing in again.
  5. Manage members, leave a home owned by someone else, delete cloud homes, or delete your Cloud account after reauthenticating with a linked sign-in method. Apple-linked accounts also revoke Apple authorization. Before a cloud home or account is deleted, the app first downloads the full images My home on this device is missing; if your subscription has ended and they can no longer be downloaded, you are told those photos will keep only thumbnails before anything is deleted. Account deletion removes authentication, memberships, the stored private key, and this account's Cloud caches and keys on the device; owned homes enter asynchronous deletion. Your personal local map remains separate. Uninstalling does not delete cloud data, and deleting an account does not cancel your subscription: on iOS cancel it in the App Store under Manage subscription; on Android cancel it in Google Play under Payments & subscriptions → Subscriptions. For deletion steps, what is deleted and kept, and how to request deletion without the app, see Account deletion.
  6. Turn off crash-report uploads at any time in Settings → Share anonymous usage data.

9. Data Retention

As long as you keep the app and its data on your device, local data will generally remain on your device. If you uninstall the app, clear its data, or manually delete content, that data will be removed from your device.

If you contact us by email, we may keep your contact information and message for a reasonable period needed to respond to and manage your support request.

Cloud retains the current encrypted revision during an active subscription. Unreferenced staging objects and old revision manifests become eligible for cleanup after 24 hours; pending proposals expire after 7 days. After a home's key changes, old files of private photos a member has not yet re-encrypted are kept until that member's device re-encrypts them; private photos left by removed members are cleared at the owner's next sync. Daily download records are overwritten each day and request-rate counters expire after about 35 days. Data enters deletion after 90 days without a valid subscription. Cleanup runs periodically and retries failures, so completion may be delayed. Necessary transaction, anti-reclaim bindings and minimal deletion records remain for billing and fraud prevention after account deletion; they contain no map plaintext or decryption keys. Store and cloud service security/transaction logs follow their own retention rules.

Crash reports and associated random installation identifiers are retained under Firebase's retention rules. They are not currently annotated with your Cloud account UID, email or inventory content. Turning the switch off stops new collection; data already collected expires after its retention period.

10. Children's Privacy

Nestmer is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided information to us without parental or guardian consent, please contact us at the email above.

11. Changes to This Policy

We may update this Privacy Policy if the app's features or applicable requirements change. The latest version will be indicated by the updated effective date.

12. Contact Us

If you have questions about this Privacy Policy or how Nestmer handles data, contact: mclim4194@gmail.com