Privacy Policy

Nested List · Last updated 21 October 2026

Nested List is an outliner for notes and plans. It is operated by Sergei Vinderskykh (“we”, “us”), an individual. This policy explains what the service stores, where it is kept, who else touches it, and how to get it back or delete it.

Questions or data requests: support@nestedlist.com.

What we store

• Your content — the text of your outline, notes, and anything you type into it.
• Attachments — images and documents you add, plus small thumbnails generated from them. For a photo we also note the day and time it was taken, read from the photo itself, so you can find it by that day. Photos are kept as you added them: if your camera recorded where a photo was taken, that location stays inside the file, as it does on your phone, and goes with it when you download or export it. We never read that location, search it, or send it to AI.
• Your account — the email address you sign in with, and an identifier for each device you use, so changes made on different devices can be merged in the right order.
• Your plan and billing state — whether you are on Free, a trial, or Premium; subscription status and dates, including the date of a first successful paid invoice; and the Stripe customer and subscription identifiers needed to manage Premium. We never receive or store your full card number.
• A daily activity marker — your account identifier, the UTC date, and whether the account was Free, trial, or Premium when that day's marker was first recorded. It is recorded at most once per UTC day when you open the app. This lets us measure how often Free, trial, and Premium accounts use Nested List without recording which notes you open.
• Product usage and reliability — content-free event types such as editing, searching, importing, and sync outcomes; event times, durations, and counts. These help us measure active use, retention, and errors. They contain no note text, page identifiers, search queries, clipboard contents, or session recordings. AI usage records contain the feature, provider, model, token counts, and estimated cost.
• Emails you send from Nested List — if you send a row as an email, the row keeps when it went, to whom and its subject, as part of your outline. Separately, our server notes that an email was sent — when, how many people it went to, and Gmail's identifiers for it — but never the addresses, the subject or the text. See Gmail below.

Payment details are entered directly into checkout run by Stripe and Onelink, not into Nested List. They may ask for billing information needed to process a Premium purchase. We receive subscription status, invoice and payment amounts, refund status, and provider identifiers, but not your full card details.

Where it is stored

Nested List is local-first: a full copy of your outline lives in your own browser's storage on each device you use, and works offline. When you are signed in, it is also stored in the cloud so your devices stay in sync:

• Outline content and account records — a Supabase Postgres database hosted in Ireland (eu-west-1).
• Attachment files — Cloudflare R2 storage.

Who else processes it

These are all the third parties involved, and what each one receives. The features that send content off your device are described one by one in the next section.

Features that send content off your device

Beyond keeping your outline and attachments in sync, these features send content to Nested List's server, which runs on Supabase. All of them need you to be signed in: signed out, they send nothing.

One switch for AI. Allow sending to AI models, in Settings → General, decides whether anything of yours is sent to an AI model (OpenAI or Google Gemini). It is on by default, and it belongs to your account, not to a device: turned off on one device, it is off on all of them. While it is off, nothing is sent to either AI — our server refuses any request that would reach one — and every feature in the first list below stops. Any AI feature we add later goes through the same switch.

Turning it off also deletes from our server the search index built from your notes, and the picture descriptions and screenshot readings kept there so the same picture is not read twice. Text already added to your outline, such as a picture's description, stays. Turning it back on rebuilds the search index.

While the switch is on, these features send content to an AI model:

• Search by meaning. Sends the text of your rows and notes, attachment names and notes, and text found in your pictures and documents to OpenAI to build a meaning-based search index, kept on our server. When you search, your search words are sent too.
• Picture descriptions. Sends attachment thumbnails, and the first page of a scanned PDF, to OpenAI, which describes each one (a caption, labels, and any text in the picture) so search can find pictures by what is in them. This used to be off until you turned it on; since 14 October 2026 it is on for every account unless you turn the switch off. The description is added to your outline and stays if you turn the switch off. It is also kept on our server so the same picture is not described twice, and deleted from there when you turn the switch off, and with your account.
• Next-row suggestions. When you start a new row, or stop typing in one for a moment, the page's title, the titles of the pages it sits in and the rows around the one you are writing — about 4,000 characters at most — are sent to Google Gemini (by default) to suggest that row, with up to twelve rows from other places in your outline that look like that list: a list with the same name, rows with the same words or the same meaning (found with the search index above: the list's name, the page title and the nearby rows go to OpenAI to search it, as your own searches do, and only the rows' identifiers come back), rows that link there, share a tag or carry the page's date — about 1,500 characters more, with the titles above them. Never your notes or attachments. The rows are chosen on your device. Nothing of it is kept on our server; only the number of suggestions is counted.
• Chats into tasks (Smart paste). When a paste looks like a chat, its messages are sent the moment you paste — before you choose anything — so a task list can be ready. Up to 300 messages and 24,000 characters go, with the names of up to five rows it sits under, today's date, your language, and your display name and the part of your email address before the @, so the AI can tell which messages are yours. Google Gemini by default.
• Recognising a paste (Smart paste). A paste of three or more lines that this device could not recognise sends a sample — at most its first 40 and last 10 lines, and no more than 2,000 characters — to ask whether it is a chat. One that turns out to be a chat is then sent as above. Google Gemini by default.
• Screenshots (Smart paste). A picture you paste, drop or attach that looks like a screenshot is sent to be read into suggestions: a smaller copy of up to five pictures, when it was taken, today's date, and your name as above. A PNG or WebP counts as a screenshot; a JPEG or HEIC does unless it records a camera maker, so camera photos are never sent this way. Google Gemini by default. The reading is kept on our server so the same screenshot is not read twice, and is deleted when you turn the switch off, and with your account.
• Calendar events (Smart paste). A pasted text or chat that this device finds names a day together with a time or an event word (a dinner, a flight, a meeting) is sent to find events worth adding to your calendar: the text, up to 4,000 characters, or a chat as described above, with today's date and time, your time zone, the day your week starts, your language and your name as above. A screenshot sent as above is read for events at the same time. Google Gemini by default. Nothing reaches your calendar unless you press Add (see Google Calendar below). If you hide or ignore five calendar suggestions in a row, that device stops reading for events until you turn them back on from a row's ⋯ menu.
• Link titles and page summaries (Smart paste). After our server reads a link's page (see Link titles and Saved page copies below), the AI writes a short title for the link from the words on the page, and a one-line summary of a saved copy from the page's title and opening text. It never sees the address. Google Gemini by default. With the switch off, a link is named from its page's own title, and a new copy is kept without a summary; a copy keeps the summary it already has.

Smart paste's suggestions that are made on your device, such as removing the timestamps from a pasted chat, send nothing and work with the switch off.

What has no switch. These involve no AI, so Allow sending to AI models does not change them. Apart from Drive's own controls, they have no switch: while you are signed in, they always work.

• Link titles. When a row holds only a link — pasted, or typed and followed by Space or Enter — its address is sent to our server, which fetches the page to read its title. Pasting a block of links sends up to ten. While the switch is on, the AI then writes a title from the page, as above.
• Saved page copies. Each new web link you add to a row or note on this device, except links to posts on X, is sent to our server, which fetches the page and keeps a copy with your account: its readable text and its cover picture, plus the summary above while the switch is on. You can still read and search the page after it goes away. When you click a link, its address is sent to check that the page is still there, and an old copy is refreshed. Searching sends your search words to our server to look in your copies. Copies are deleted with your account.
• X threads. When a row holds only a link to a post on X, your browser sends our server just the post's number and its author's handle, not the link. Our server asks FxTwitter for the post and the author's thread, with VxTwitter and X's own embed services as backups. Your browser downloads the thread's pictures straight from X (pbs.twimg.com), the first ones while the suggestion is still showing, without cookies, so X sees your IP address. No AI is involved. Save X threads automatically (off by default) saves the thread without asking; it does not change what is sent. If no thread is found, the link gets a title as above.
• Google Drive files you link. When you link a Drive file, its identifier goes through our server to Google, to show the file's name, details and preview (see Google Drive below). Drive has its own controls in Settings → Data: Offer to link Drive files, Pause Drive syncing and Disconnect Google.
• Sync and attachments. Your outline and your attachment files go to our server and storage to keep your devices in sync, as described above.

Before any page is fetched, tracking parameters (such as utm_) and anything after # are removed. A link that looks private is never sent at all: an address on a local network or a bare IP address, one carrying a token, key, password or signature, a one-time link such as a password reset or a confirmation, a link to a file, or one with a non-standard port.

Which AI handles each feature is a setting on our server: Google Gemini by default for every Smart paste feature and next-row suggestions; OpenAI for search by meaning and picture descriptions. We may move any of them to the other of the two; we use no other AI service. Requests to Google go through its paid API, under whose terms Google does not use them to improve its products. Requests to OpenAI are sent with OpenAI's response storage turned off.

Google Calendar

Nested List can ask Google for two separate permissions. Each is asked for only when you use the feature that needs it, and you can grant one without the other.

• Showing today's events. If you connect a Google account in Settings → Calendar, Nested List asks for read-only access (https://www.googleapis.com/auth/calendar.readonly) so it can show today's events alongside your own time blocks on the timeline. This permission never changes anything in your calendar.
• Adding an event you choose. Only when you press Add on an event Nested List suggests from something you pasted, and only the first time for that Google account, Google asks you to let Nested List “add events to calendars you own” (https://www.googleapis.com/auth/calendar.events.owned). Nested List uses it only to add the events you choose to your main calendar (or another calendar you own that you pick), and to remove an event it added when you press Undo. It never changes, moves, or deletes an event Nested List did not create, and it never invites anyone.

• Your events are held in memory only, for as long as the page is open. They are never written to our database, never saved to your device, and never included in a backup or export. Before suggesting an event, Nested List may check whether that day already has it; that check reads the day in memory and keeps only a yes or no. An event you add goes from your browser through our server straight to Google; we do not keep a copy of it.
• You choose which calendars appear on the timeline, and can hide any of them at any time.
• The credential Google issues is stored on our server, encrypted in transit, and is readable only by the server component that talks to Google. It is never sent to your browser and no client of ours can read it.
• Pause Calendar syncing stops Calendar reads and event creation while keeping Google authorization. Drive syncing can continue. Resume uses the existing authorization unless Google has removed or expired it.

Gmail

You can send a row as an email from your own Gmail address. For that, Nested List asks Google for permission, separate from the calendar ones, and only when you use it: to send the email, and — in the same request, each on its own line you can untick — to see your contacts, so it can suggest who an email goes to.

• Sending an email you write. Only when you press Send on an email in Nested List, and only the first time for that Google account, Google asks you to let Nested List “send email on your behalf” (https://www.googleapis.com/auth/gmail.send). Nested List uses it only to send the emails you write and send yourself, to the people you put in To, Cc and Bcc, after the few seconds in which you can still press Undo. This permission cannot read, search, change or delete your mail, and Nested List never asks for one that could: Nested List never reads your mail.
• Suggesting who it goes to. With the same first Send (or later, with Allow in Settings → Email), Google asks you to let Nested List “see and download contact info automatically saved in your Other contacts” and “see and download your contacts” (https://www.googleapis.com/auth/contacts.other.readonly and https://www.googleapis.com/auth/contacts.readonly) — the people you have emailed and the ones you saved. Both are read-only. While you type in To, Cc or Bcc — or when the row names someone, like “Write to Anna” — the letters (or the name) go through our server to Google, which answers with the names and email addresses that start with them; nothing else about a contact is asked for. The answer is shown under the field and kept in that browser tab only: our server stores and logs none of it, and Nested List never changes or deletes a contact, or puts anyone in an email by itself. You can untick these boxes and still send.
• When an email is sent, its recipients' addresses, its subject and its text go from your browser through our server straight to Gmail, which sends it from your address and keeps it in your Sent folder like any email you write. Pictures and files in the email are read by our server from your account's storage, where they already are, for that one email. We do not keep a copy. So that an email never goes twice, and to limit sending to 50 emails a day per account, our server records that it was sent — when, how many people it went to, and Gmail's identifiers for it — never the addresses, the subject or the text. That record is deleted with your account.
• The row you sent it from remembers when it was sent, to whom and the subject, so it can open the email in Gmail; the To, Cc, Bcc and Subject you type are kept on the row too. They are part of your outline, synced and included in backups like the rest of it.
• What you type into an email before sending it stays in your browser until you send it or turn it back into rows. The people you have sent to from Nested List are remembered in your browser only, to suggest them next time; they are never sent to our server.
• Open it in Gmail instead needs no permission: your browser opens Gmail's own new-message window with the email filled in, and Nested List sends nothing.
• The same Google authorization serves the calendar, Drive and Gmail. Pausing Calendar or Drive syncing does not stop an email you send. Disconnect Google in Settings → Email (or Calendar, or Drive) revokes it — see Your Google authorization below.

Google Drive

When you choose to connect Drive and link an individual file, Nested List asks for https://www.googleapis.com/auth/drive.file. Google's Picker lets you choose which files to share with Nested List. We use that access to show the file's name, type, details and a preview image when Google provides one, and refresh them when you view the file. Nested List never changes your Drive files.

• Requests for linked file details and preview images pass through our server. File identifiers and metadata, such as names and types, are kept on your device; linked file information in your outline is synced with your Nested List account. Preview images are cached only in browser memory while the app is open. We do not download the original file into your Nested List attachments.
• Drive credentials are encrypted on our server. Refresh tokens stay on the server; a short-lived access token is sent to your browser so Google's Picker can show files you can choose.
• Pause Drive syncing stops Drive requests and new file linking while retaining Google authorization and existing rows, notes and cached file details. Calendar can continue independently. Resume uses existing authorization unless Google has removed or expired it.

Planned folder syncing — not available yet. When a working Sync folder feature becomes available, Nested List will ask for https://www.googleapis.com/auth/drive.metadata.readonly only when you first choose to use it. Connecting Drive for individual files or signing in will not request this extra permission.

Google grants this permission to see metadata across your Drive. Nested List will sync only the folders you select and their contents, including nested folders: file and folder names, types and hierarchy. This metadata will pass through our server; the selected folder's outline will be stored on your device and synced with your Nested List account. The permission does not let us read file contents. Folder cards will show type icons; preview images will remain available for files you select individually. Further folder selections will reuse the permission while it remains valid. If you decline it, existing individual-file and Calendar connections will remain usable.

Your Google authorization

Disconnect Google, from Calendar, Drive or Email settings, revokes Nested List's Google authorization for that Google account and clears both its Calendar and Drive connections and stored credentials. Other connected Google accounts stay connected. Linked rows, your notes and cached file details remain in your outline until you remove them; they stop refreshing. Signing in with Google again may ask for consent. You can also revoke authorization yourself at myaccount.google.com/permissions.

Pause and Resume control each service separately and retain Google authorization. A cancelled or failed connection attempt does not revoke an existing Google connection.

What we never do

• We do not sell or rent your data, to anyone, ever.
• We do not show advertising, and we do not share your data with advertisers.
• We do not run third-party analytics or set advertising cookies. Our first-party operational measurements use only the content-free events described above, never page identifiers or recordings. Browser storage holds your outline, settings, sign-in session, and a bounded queue of usage measurements for up to seven days while offline. The automatic starting-page feature also keeps a small summary on this device of which days you used the app, used Today, or quickly left an automatic Today launch. It contains no note text, page identifiers, or click history, is not sent to our servers, and is kept for up to 28 previous days plus the current day. You can choose a fixed starting page in Settings to stop this learning.
• We do not read your notes. Access to the database is limited to what is needed to operate and support the service.

Your choices

• Take your data with you. Settings → Data exports your whole outline — as a backup file, or as a folder of Markdown files.
• Turn off AI. Settings → General has one switch, Allow sending to AI models, on by default. Turning it off stops everything sent to OpenAI and Google Gemini, on every device you use: search by meaning and its index, picture and scanned-PDF descriptions, next-row suggestions, Smart paste's chats, screenshots and calendar events, and the AI's link titles and page summaries. It also deletes the search index, picture descriptions and screenshot readings kept on our server; text already in your outline stays. Link titles from the page itself, saved page copies, X threads, linked Drive files, sync and attachments involve no AI, so this switch does not change them (see above).
• Pause or disconnect Google. Google syncing can be paused separately in Settings → Calendar and Settings → Data for Drive, where Offer to link Drive files can also be turned off. Disconnect Google in either place — or in Settings → Email, for a Google account that sends your emails — removes its connections for that Google account.
• Clear this device. Settings → Data removes the local copy from the browser you are using.
• Delete everything. Settings → Account lets you delete your account yourself. Nested List first creates a final archive, then deletes your account, outline, and attachments from the live service. The private archive link works for 30 days.

Depending on where you live you may also have the right to access, correct, or object to our use of your data, and to complain to your local data protection authority. Write to the address above and we will help.

Keeping it and deleting it

We keep your content, plan state, and daily activity markers for as long as your account exists, because they are needed to provide and understand the service. When you delete your account, we remove the outline, attachments, activity markers, and account record from the live systems. Before deletion we create a final archive; its unique download link works for 30 days, after which the archive is automatically deleted. Anyone with that link can download the archive, so keep it private. Residual copies in encrypted operational backups age out on the same rolling 30-day schedule. Detailed product usage, AI attempt records, and crash reports are kept for up to 90 days. Daily usage aggregates are kept for up to 24 months. Account deletion removes linked usage records; anonymous historical totals may remain. Restricted payment and management audit records are retained where needed for billing and operating the service. Stripe and Onelink may retain transaction records under their own policies and legal obligations.

Security

Traffic is encrypted in transit. Your outline is isolated to your own account at the database level, so one account cannot read another's. We are a small operation and cannot promise perfect security, but we do not take shortcuts with credentials: the most sensitive thing we hold — your Google refresh token — is unreadable by any browser client, including your own.

Children

Nested List is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top. Material changes affecting how your data is used will be announced in the app before they take effect.

Contact

Sergei Vinderskykh — support@nestedlist.com