Privacy policy

Nidox is a family organiser for iOS, Android and the web. These clients connect to the same Firebase project. Android store distribution and Google Play purchases are still in preparation. This notice also covers the public Nidox website.

Who is responsible

Christian Casariego, operating Nidox. Postal address: [business address to be completed]. Contact: contact@nidox.app. The legal provider and any applicable registration details must be confirmed before this draft becomes the published notice.

What we process and why

• Account: Firebase user ID, identity-provider identifiers, and the name/email supplied by Apple or Google, to sign you in and restore your existing family. Apple may supply a relay address. We do not receive your Apple or Google password.
• Family: members, roles, names, colours, optional ages/birthdays and uploaded avatars, plus calendars, chores, lists, contacts, meals, recipes, school timetables, trips, bookings, budgets and notes that you choose to keep. We use these to provide the shared organiser and enforce permissions.
• AI: submitted requests, extracted document text, requested timetable images, relevant family context, private conversation history and AI suggestions. Usage counters and cost records enforce the family’s allowance and protect the service against abuse.
• Operations: device/push tokens, integrity checks, IP addresses and technical request/error information necessary for security, reliable delivery, hosting and support. No advertising identifiers or cross-site advertising trackers are added by Nidox.
• Subscriptions: verified store product, transaction/purchase references, dates and status to unlock Pro. Payment-card details stay with the store. Google Play purchase tokens are server-only; they are not shared with family members.

If GDPR applies, processing needed for your account and purchased service relies on contract performance; proportionate security, operation and support rely on legitimate interests. Optional location sharing and optional AI submission are initiated by you; consent is used where legally required. You can stop these optional activities. Withdrawing consent does not affect earlier lawful processing. Do not put third-party information or sensitive health/religious data into the app or AI unless you have the necessary authority and legal basis. We do not make decisions with legal or similarly significant effects solely through AI.

Who can see family content

Signed-in family members have role-based access. A family profile without its own account does not by itself provide a login. AI conversation threads are private to their account owner. Follow Me has a separate selected audience.

Connections and stored cloud data are encrypted. Nidox does not provide end-to-end encryption. Authorised service administrators and infrastructure providers can technically access stored content when operating the service. Family permissions do not prevent that administrative access. Information you share can be copied or photographed by recipients.

Shared recipe catalogue

Generic recipes generated in the recipe studio or assistant are stored in a catalogue available to signed-in Nidox users. It contains the dish, ingredients, instructions, cuisine, dietary/allergen labels, estimated per-serving nutrition and any reusable AI-generated meal image. Catalogue records do not contain your account or family ID, names, allergy profile or original request. Describe food rather than personal details; personal/contact details are rejected where detected. Your saved recipes, meal schedule, portions and shopping lists remain in your private family space. New generation uses the existing AI allowance; browsing the catalogue does not require an AI request. An image may be unavailable even when the recipe succeeds. Nutrition and allergen labels are generated estimates, not a verified food database or an allergy-safety guarantee: check actual ingredients and packaging. Generic catalogue recipes can remain after an account is deleted because they have no account ownership link. Private generation-retry records expire after one day; deletion is asynchronous.

Follow Me

You start a session yourself, grant location permission, choose the recipients and a limited duration, and may choose a destination. Other members, including an owner, cannot start it on your behalf. The server shares sampled GPS points only with the authorised selected audience. It is not a record of every footstep and is not an emergency or safety service.

On iOS, permitted background location and Apple Maps support the journey and arrival estimate. On Android, a visible foreground location service continues a session started while the app is open; device battery restrictions may interrupt it. On the web, tracking depends on the page remaining active. A destination is optional. Android currently shows the route without an in-app calculated ETA; opening another navigation app is your explicit action.

Selected phones can receive iOS Live Activities or Android progress notifications. The push payload contains session identifiers, the sharer’s display name, a destination label, timestamps and any available progress/ETA. It contains no precise route coordinates. Push services still process the notification data. Consider what is visible on your Lock Screen.

Route access is denied once the server processes Stop or the timer expires. Stopping removes the active route; a five-minute cleanup job removes expired routes, retrying failures. Session metadata is scheduled for deletion 24 hours after route cleanup. On Android, sampled route coordinates are sent without a persistent offline write queue; recipient route points are held in memory and cleared when the route view is stopped, locked or no longer authorised. Session and destination metadata can remain in the ordinary local cache. Backups and copies made by recipients are separate. We do not send Follow Me routes to OpenAI.

Device features, maps and destination images

Supported letter/photo/PDF imports are read locally: Apple text recognition on iOS, bundled ML Kit on Android and local browser OCR/PDF reading on the web. Android’s document camera and invitation QR recognition operate locally; camera permission is requested when you use them. Invitation codes are checked with Firebase before a confirmed join, but scanner frames are not uploaded. Only text you submit goes to AI, except the timetable image fallback: when local recognition does not produce usable lessons, you may explicitly submit a resized timetable image to the existing AI processing, including OpenAI. It is not uploaded automatically. Supported native speech recognition runs on-device; unavailable Android devices have no automatic cloud-recognition fallback. Optional browser dictation starts only when you activate the microphone. The browser may send audio to its own speech-recognition provider; Nidox does not guarantee local browser recognition. The transcript remains editable, and is sent to Nidox AI only when you submit it. Shared avatars are uploaded to Firebase Storage.

Holiday photos selected on iOS or Android remain local. Android can retain private photo references and available capture dates/EXIF locations for the selected account, family and trip. The original photo remains with its media provider. You may choose photos yourself without granting full-library access. The separate, optional Find photos action asks for photo/selected-photo access and, where required, original photo-location access. It searches locally for trip dates within 150 km of the destination. If destination coordinates are absent, the destination name is sent to Android’s system geocoder. These photo files and EXIF locations are not uploaded to Nidox or OpenAI. Displaying their optional map requests tiles for the viewed area, as described below. You can remove the trip associations or revoke access in Android settings.

Personal reminders are opt-in and planned on your device. Once the device accepts a reminder, Nidox saves its title, short description, subject identifier and scheduled time in a private history for your signed-in account, visible in the notification inbox on your other devices. Device permissions and lead-time choices remain local. Entries become visible when their scheduled time passes; this history records a planned reminder and does not prove that the operating system displayed it. Cancelled future reminders are removed by the device that scheduled them; past entries can remain as history. No extra push is sent from this history. Offline scheduling can still work; history synchronisation catches up when the app reconnects. Signing out or changing account/family cancels that device’s active reminders. App lock hides notification details.

Copying Nidox plans to a device calendar is optional. Android requires read and write calendar permissions so you can choose a writable calendar and Nidox can maintain its own copies. Nidox reads calendar metadata and its tagged copies; it does not upload unrelated device calendar events to Firebase. Automatic copying starts with newly added or marked plans after you enable it. Existing linked copies may be updated or removed to reflect your Nidox changes. Disabling new copying leaves existing copies linked; changing the selected calendar leaves old copies in their previous calendar. Your calendar account/provider may synchronize those copies under its own policy.

Connected calendars are a separate opt-in feature. When available, you can connect Google Calendar or Outlook through their authorization screens, or iCloud using an app-specific password. We retrieve calendar names and the events in calendars you explicitly select, including titles, notes, locations and dates. Selected imports are private to your account by default. Choosing family sharing makes that calendar’s imported events visible to your family. Two-way sync sends the event changes you confirm in Nidox back to that selected provider calendar; read-only import does not change the provider’s events. Recurring imports are shown within the supported rolling window and edited one occurrence at a time. Meeting invitations that could notify other people must be edited in the original provider app.

Calendar refresh tokens and iCloud app-specific passwords are encrypted with a server-held key, stored separately from readable event records, and used only by the backend to synchronize your selected calendars. This is not end-to-end encryption. Neither credentials nor private imported events are sent automatically to the AI assistant. Deliberately family-shared events can be part of family calendar context used when you invoke the assistant. Disconnecting stops synchronization, removes Nidox’s active imported copies and deletes stored credentials; it does not delete the original provider events. Copies already cached or seen by a family member cannot be recalled. Revoke the app authorization or app-specific password with the provider as well to withdraw that provider grant. Google, Microsoft and Apple process calendar requests under their own policies, potentially outside Switzerland/EEA. Account deletion also disconnects your calendars; Firebase recovery retention applies to deleted copies and encrypted credentials.

Android system-assistant access starts disabled and is optional per account. On supported devices, authorised system callers may read today’s agenda or a member’s outstanding chores in your selected family after current sign-in, app-lock and server-permission checks. Information returned to the system assistant is also subject to that assistant’s provider policy. Shopping-item and chore-completion actions open a review in Nidox and require your confirmation; they do not write automatically. Route points and private AI conversation history are not exposed through these actions.

iOS maps and directions involve Apple. Web and Android maps request OpenStreetMap tiles, exposing IP address and the viewed map area to the tile provider. Public destination thumbnails come from Wikimedia: Web and Android image requests use a curated public place key rather than a private address. On Android, the explicit Find address action sends the address you enter to the system geocoding service; Nidox does not include your current GPS location in that request. Displaying a thumbnail contacts Wikimedia and exposes IP/device request information; source, author and licence are shown. A private or unknown place uses a decorative fallback. Opening external maps, calendars or sharing apps passes the content you choose to that app, under its own policy.

When a recipe has no saved or generated photo, the web app can show a representative photo from Wikimedia Commons. Nidox selects it locally using a bounded set of public dish keys; family recipe text, ingredient lists and allergy profiles are not sent to Wikimedia. Viewing the photo sends your IP address and technical request information to Wikimedia. Source, author and licence are shown. These are example photos, and the pictured dish’s exact ingredients may differ from the saved recipe.

Optional external assistants (MCP)

When the controlled pilot is available to your account, you may connect a compatible external assistant through Nidox’s Model Context Protocol (MCP) service. You sign in with your existing account, choose one family and approve explicit permissions. A connection does not increase your family role. Read permissions and permissions to prepare changes are separate. Changes proposed through the service require your authenticated review and approval in Nidox before they are saved.

Approved tools may return minimal family context, family-shared calendar events, chores, shopping lists, meal plans and recipes. Private imported calendars, private assistant conversations, contacts, documents, Follow Me locations, provider credentials, invitations, billing and account deletion are not exposed by this first tool set. Information returned to an external assistant leaves Nidox and is processed under that provider’s own terms, privacy policy, retention and international-processing arrangements. Nidox does not control copies the provider already received. Ordinary MCP reads and prepared actions do not require a new call to Nidox’s AI model.

We store the connection’s account/family/client binding, selected permissions, creation/last-use/revocation information, scoped credential records and prepared-action records to authorize and secure the connection and complete approved actions. Request limits and minimal operational audit information protect against abuse; tokens and full private content must not be placed in operational logs. You can inspect and revoke a connection in Settings → Connected apps. Revocation stops future access but cannot erase data already received by a provider. Account deletion and loss of family membership also stop authorized access. Closing a browser tab is not a revocation. Pilot availability and supported clients are described in the developer guide.

Providers and international processing

• Google/Firebase: the family Firestore database, Cloud Storage and functions are configured in Zürich, Switzerland. The signed-in web app runs on Firebase App Hosting in the Netherlands; website/CDN delivery can involve global infrastructure. Firebase Authentication processes data in the United States. FCM, App Check, hosting and operational services may process technical data internationally. Firebase privacy information.
• Apple and Google: identity, app integrity, push and store purchases use their platform services and may involve international processing.
• OpenAI: optional AI inputs and required context are processed through the API, which may involve the United States. API inputs are not used to train models by default. Default abuse-monitoring retention may be up to 30 days, with stated legal/security exceptions. Nidox does not claim Zero Data Retention or EU-only AI processing. OpenAI API data controls.
• OpenStreetMap and Wikimedia: public tiles/images as explained above; their infrastructure may be outside Switzerland/EEA. External links may introduce additional providers.

International processing must use applicable safeguards where required, such as recognised adequacy arrangements or contractual protections. Contact us for information about the arrangements applicable to your data. A Zürich database does not mean all processing stays in Switzerland.

Children and household information

Adults should create only necessary profiles for their children and obtain any legally required parental authorisation before a child uses an account or location sharing. A family invitation is an access mechanism; it does not verify a child’s age or parental consent. Nidox currently does not perform formal age/guardian verification. Contact us if an account or profile was created without appropriate authority. Do not use Follow Me for covert monitoring.

Retention, deletion and your rights

Family content is kept until it is removed or the family is deleted; there is currently no automatic inactivity deletion. Account deletion removes your authentication account, private threads, membership and device registrations. If no other signed-in member remains, the family and its files are deleted. Otherwise shared content remains for the continuing family. Deleting an account does not cancel an Apple/Google subscription; cancel it in the store separately.

Firestore recovery keeps daily backups for 14 days, weekly backups for 98 days, and point-in-time history for up to seven days. Storage keeps noncurrent file versions for up to 30 days or until there are 10 newer versions, whichever happens first; deleted versions then remain recoverable through seven-day soft deletion. These recovery copies can contain data already removed from the active app. Firestore and Storage data-access audit logs are stored in Zürich for 30 days; Google-managed administrative/security logs have separate retention. Subscription and anti-abuse records have separate operational or legally required retention and are not a permanent family archive. Their business-record retention schedule remains a release-review item for this draft.

Ordinary family data uses a persistent private Firestore cache on Android, so previously loaded records and accepted offline edits may survive an app restart. Local acceptance is not final server confirmation; an edit can be rejected when permissions or server rules are checked. Signing out or changing the Firebase account logically clears that Firestore cache and unconfirmed writes; it is not a guarantee of forensic erasure. Android app data is excluded from cloud backup and device transfer. App lock hides the app, notifications and widgets but does not add end-to-end encryption. Widgets retain only account-bound names and selected plan/chore/meal summaries, never routes, AI conversations or tokens; details are hidden when the app locks or the account/family binding is invalid. Device/browser caches, local photos and calendar copies are controlled separately; sign out and clear local app data on a shared device, and manage exported copies with their calendar provider.

Use Settings → Account → Delete account, or our account deletion page. You may request access, correction, deletion and, where applicable, restriction, portability or objection by emailing us. We verify ownership without requesting passwords or sign-in tokens. You can complain to the Swiss FDPIC or the competent European supervisory authority. Required notices, optional permissions and provider changes will be communicated through the app or this page.

Website and contact

The public website has no Nidox analytics or advertising SDK. Necessary hosting requests can be logged. Theme/language preferences and the signed-in app’s authentication, integrity and offline state may use browser storage. Contacting support sends the details you choose through your email provider; please omit passwords, tokens and unnecessary family documents.