Security & Data Practices
FocalNest handles data for families with children. We take that seriously. This page covers what we do technically and operationally to protect your family's information.
Encryption
In transit
All communication between your device and our servers uses TLS 1.2+. We enforce HTTPS everywhere, with no HTTP fallback.
At rest
Your data is stored on encrypted volumes. Passwords are never stored in plain text. We use bcrypt hashing with a work factor that we update as hardware improves.
Authentication tokens
Session tokens are short-lived JWTs. Refresh tokens are rotated on each use and stored as HTTP-only cookies, so they are not accessible to JavaScript.
Infrastructure
API & database
Hosted on Fly.io in the US. Each family's data is logically isolated. You cannot access another family's records through any normal operation. We take our own database backup every hour and keep 48 hours of them, so deleted data ages out of our backups well inside the 90 days our privacy policy commits to. Our managed Postgres provider also keeps its own backups, with point-in-time restore.
CDN & edge
Static assets are served through Cloudflare Pages, which provides DDoS protection and global edge caching.
Payments
Billing is handled entirely by Stripe. We never see or store your payment card details.
Transactional email (password resets, parental consent requests) is sent via Resend under a data processing agreement. Email you forward to your family's FocalNest address is received and parsed by Postmark. We do not use email marketing services.
AI features
Some FocalNest features use a large language model, and we'd rather you read that here than find it in the privacy policy. Four things use one: drafting a project from a plain-language description, writing the small first step for a task, turning an email you forward into tasks and events, and the one-line observation about your recent momentum that can appear on your Nest.
Those requests go to Anthropic's Claude API. They contain the text you supplied, plus a summary of your household's shape — member roles and age ranges, never names. Two of the four send more than that. Parsing a forwarded email also sends your existing project titles and identifiers and the titles of up to 15 recent open tasks, so the result can be filed against something you already have. The momentum observation is written from your own recent task and routine titles. So while we never send a roster of who is in your family, titles you wrote yourself do leave with the request. Anthropic does not use API requests to train their models.
Nothing else in the product touches an LLM. Scheduling, task ranking, capacity calculations, and reminders are all ordinary deterministic code running on our own servers.
AI features are off for a child account until a parent turns them on. That is a separate decision from the consent that created the account — a parent grants it per child from the parental dashboard and can withdraw it at any time, after which every AI feature refuses that child again. And because your own text is sent as you wrote it, don't put sensitive personal, health, or financial details into an AI prompt.
We also use OpenAI to generate collectible card art, narration audio, and ambient backgrounds. That happens ahead of time, from prompts we write — no customer data is involved.
Access & Isolation
Every API request is authenticated and scoped to a family. It is not possible to read another family's data through the API. This is enforced at the database query level, not just the application layer.
Within a family, the system distinguishes between admin and member roles. Admins can manage family members and settings; members can manage their own tasks and see shared content. Children have a restricted view appropriate to their age.
Our internal team has access to production systems only through audited, MFA-protected admin tooling. We do not have routine access to your family's content.
What We Don't Do
- We do not sell your data or your children's data to anyone, ever.
- We do not run advertising. There are no ad networks, no tracking pixels, no remarketing.
- We do not use third-party analytics that profile users (no Google Analytics, no Meta Pixel).
- We do not build profiles of your children's behavior for any purpose other than showing them their own tasks.
- We do not send marketing email to children.
- We do not share data with partners, affiliates, or data brokers.
Children's Data (COPPA)
FocalNest complies with the Children's Online Privacy Protection Act (COPPA). Children under 13 cannot create accounts independently. A parent or guardian must verify and approve the account first.
Once a child account is active, the data we collect is minimal: display name, birthday (for age-appropriate features), and in-app activity (tasks completed, collectibles unlocked). We collect no email, phone number, or location data from children.
Parents can review, export, or permanently delete their child's account and all associated data at any time from the parental controls dashboard.
Read the full COPPA section in our Privacy Policy →Reporting a Security Issue
If you discover a security vulnerability in FocalNest, please report it responsibly. We ask that you do not publicly disclose the issue until we have had a chance to address it.
We do not currently offer a formal bug bounty program, but we genuinely appreciate responsible disclosure and will publicly credit researchers with their permission.
Questions about our security practices?
Email us at privacy@focalnest.com or visit our contact page. We're happy to answer specific questions.