Security

Encryption

All traffic between your device and Nestino runs over an encrypted connection (TLS). We do not accept unencrypted connections.

We store passwords exclusively as a hash. We do not keep them in a form from which the original password could be recovered — which is why we can never tell you your password, only let you set a new one. Sign-in cookies are set so that they travel only over the encrypted connection.

Hosting

The servers that hold user data are operated by Hetzner Online GmbH in Germany. Processing therefore takes place within the European Union — for hosting we transfer no personal data to third countries.

We deliberately do not list the specific technical components and their versions here. Such an inventory would make an attacker’s job easier and tells the reader nothing.

Authentication

Signing in rests on short-lived tokens. An access token is valid for 15 minutes and is renewed by a single-use refresh token valid for 30 days — each refresh token can be used only once.

We rate-limit repeated failed sign-in attempts.

Child accounts sign in with a family code, a name within the family, and a password. They have no email address attached — a child therefore does not need their own email for Nestino.

Dependencies

We keep an eye on the libraries Nestino is built on and handle security advisories by hand.

We draw the advisories from public vulnerability databases. Every finding opens a separate change proposal, which we review by hand. No update deploys itself.

Responsible disclosure

If you find a security flaw, write to us privately at hello@nestino.cz — please before you publish the finding.

We take no legal action against research conducted in good faith.

We aim to respond to a report within 30 days.

References

The processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and by Act No. 110/2019 Coll., on personal data processing. Our handling of data is described in detail in Privacy.