Crow's Nest Privacy Policy
Effective date: 07/06/2026 Last updated: 07/06/2026
Crow's Nest is a wishlist app made for sharing with the people you trust. This policy explains what information we collect, why we collect it, and what we will never do with it. We have tried to write it in plain language, because a privacy policy you can actually read is part of taking your privacy seriously.
The short version: we make our product for you, not out of you. We do not sell your data, we do not show you ads, and we do not track you across the internet.
Crow's Nest is operated by Ethan Duval ("we," "us"). You can reach us at support@getcrowsnest.app.
1. What we collect
Account information. When you sign up we collect your email address and a password. Passwords are handled by our authentication provider and stored only in hashed form; we never see or store your plain-text password. You also choose a username, and you can optionally add a profile photo.
Your content. The lists, folders, items, notes, prices, links, and photos you add to the app. This is the point of the app, and it belongs to you.
Social information. Your connections (the people you have chosen to connect with), connection requests, lists you have shared or that were shared with you, and gift claims. Claims are handled with care: when surprise mode is on, the owner of a list cannot see which items have been claimed or by whom. This is enforced at the database level, not just hidden in the interface.
Reports and blocks. If you report content or block another user, we store that report or block so we can act on it.
Technical basics. Standard information needed to operate a service, such as timestamps on your account and content. We do not currently run analytics or advertising trackers in the app. If we add crash reporting in the future to fix bugs, it will collect technical crash data (device model, OS version, and what the app was doing when it crashed), not the contents of your lists.
What we do not collect. We do not collect your contacts, your location, your browsing history, or advertising identifiers. We do not fingerprint your device.
2. How we use your information
We use your information to do exactly what the app promises:
To operate your account and store your lists and photos. To let you connect and share with people you choose, under the permissions you choose. To keep gift surprises intact through surprise mode. To keep the platform safe through automated content checks and the report and block tools. To respond when you contact us. To meet legal obligations that apply to us.
We do not use your information for advertising. We do not sell it or rent it to anyone. We do not use your content to train AI models.
3. Photo moderation
Because Crow's Nest lets people share images with each other, every uploaded photo is automatically checked before it becomes visible to anyone other than you.
Here is how it works. When you upload a photo, it is scanned by an automated image classification service (currently Sightengine). To perform the scan, the service temporarily accesses the image through a short-lived private link. The classifier returns a content assessment, and based on that assessment the photo is approved or blocked. Blocked photos are never visible to other users. Photos that clearly violate our rules are blocked permanently. Photos in a gray zone are blocked but can be disputed by contacting us.
The classification service processes images to produce the assessment; it is a data processor acting on our instructions, and it does not get your name, email, or account details alongside the image.
If we obtain actual knowledge of content that appears to depict the sexual exploitation of a minor, we are required by law to report it to the National Center for Missing & Exploited Children (NCMEC) and to preserve related records. We comply with that law.
4. Who can see your content
Your lists and items are private by default. They become visible to another person only when you share a list with them and they accept, or when you accept a list shared with you. Photos are stored in private storage and served through expiring signed links; they are not publicly addressable on the internet.
Your username is only discoverable through search if you turn on "Let people find me," which is off by default. Search works only on exact username matches, so nobody can browse or enumerate users.
5. Our own access to your data
We want to be honest about something most policies bury: as the operator of the service, we technically have administrative access to the systems that store your content. Here is our commitment about that access. We access user content only when it is necessary to investigate a report, review flagged content, debug a specific problem you have raised with us, or comply with a legal obligation. We do not browse user content out of curiosity, and we never will. All content is encrypted in transit and at rest.
6. Third parties we rely on
We use a small number of infrastructure providers to run the service:
Supabase hosts our database, authentication, and file storage (on infrastructure located in the United States). Sightengine performs automated image moderation as described above. Frankfurter, a currency conversion service, receives only currency codes (for example "GBP to USD") when the app converts prices; it receives no personal information. If we add crash reporting (such as Sentry), this policy will be updated to reflect it.
Each provider processes data only to provide its service to us. We do not have "data partners," and no third party is permitted to use your data for its own purposes.
If a link in the app takes you to a store or another website, that site's own privacy practices apply once you are there.
7. Data retention and deletion
Your data is retained while your account is active. You can delete individual items, photos, lists, or your entire account at any time from within the app. Account deletion is immediate and removes your profile, lists, items, photos, connections, claims, and shares from our systems. Reports you filed about other users may be retained where needed for safety or legal reasons.
Routine backups may hold residual copies for a limited period before they cycle out.
8. Your rights
Depending on where you live, you may have legal rights to access, correct, delete, or export your personal data, or to object to or restrict certain processing.
For users in the European Union, United Kingdom, and similar jurisdictions: the legal bases for our processing are performance of our contract with you (running the app you signed up for), our legitimate interests in keeping the service safe and functional (content moderation, abuse prevention), and legal obligation (such as mandatory reporting described above). You also have the right to lodge a complaint with your local data protection authority. Because our infrastructure is in the United States, your data is transferred to and processed in the United States.
Most rights can be exercised directly in the app: you can view and edit your content, correct your profile, and delete your account without asking us. For anything else, email support@getcrowsnest.app and we will respond within 30 days.
9. Children
Crow's Nest is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at support@getcrowsnest.app and we will delete it. Users in jurisdictions with a higher age of digital consent must meet their local minimum age.
10. Security
We protect your data with encryption in transit and at rest, private storage with expiring access links, database-level access rules that enforce sharing permissions on every request, and automated content scanning before images become visible to others. No online service can promise perfect security, but security decisions in Crow's Nest are made at the database layer rather than only in the app interface, which means permissions hold even if a client misbehaves.
11. Future changes and monetization
Crow's Nest is currently free, with no ads and no paid tiers. If we ever introduce revenue features, our commitment is that they will not involve selling your data or showing you targeted advertising. For example, we may in the future add anonymous affiliate links, where a store pays us a commission for purchases made through links in the app. If we do, the link will carry no personal information about you, and we will disclose it clearly in the app and in this policy before it happens.
If we make material changes to this policy, we will notify you in the app before the changes take effect.
12. Contact
Questions, concerns, or requests: support@getcrowsnest.app
Ethan Duval Address available on request