Security at Nestled

Our Approach

We designed Nestled with a simple principle: collect only what we need, protect everything we store, and never share it with anyone. Every architectural decision, from authentication to database access, is made with your privacy and security in mind.

Authentication

Nestled uses email and password authentication powered by Supabase Auth. Passwords are transmitted over encrypted HTTPS connections and stored by our authentication provider as secure hashes, not plain text. We may also send account security emails such as verification messages. This means:

• Plain-text passwords are never stored in our application database
• Credentials only travel over encrypted HTTPS/TLS connections
• Account verification emails are handled by Supabase Auth
• Sessions are managed with secure, HTTP-only cookies that cannot be accessed by client-side scripts

Data Protection

All data stored in Nestled, including your daily cards, swipe history, couple pairing, and profile details, is protected at every layer:

• Encryption in transit: all connections use HTTPS/TLS, so data is encrypted between your device and our servers
• Encryption at rest: your data is encrypted on disk using Supabase's built-in encryption
• No plain-text secrets: API keys and service credentials are stored as environment variables, never in code

Infrastructure

Nestled is hosted on Vercel, which provides automatic HTTPS, DDoS protection, and a global edge network. Our database runs on Supabase (PostgreSQL), a trusted open-source platform with enterprise-grade security controls. Both providers maintain SOC 2 compliance and undergo regular security audits.

We enforce comprehensive security headers on every response, including Strict-Transport-Security (HSTS), Content Security Policy (CSP), X-Frame-Options, and Referrer-Policy to protect against common web attacks.

Access Control

We enforce strict access boundaries so you only ever see your own couple's data:

• Row Level Security (RLS): database policies ensure every query is scoped to your couple, enforced at the database level itself
• Middleware auth firewall: all app routes require authentication before any data is loaded or rendered
• Server-side validation: sensitive operations are verified on the server, never trusted from the client alone

What We Don't Do

• We never sell your data to third parties
• We never share your relationship data with advertisers
• We never store plain-text passwords
• We never access your data unless required for support you initiate
• We never use your content to train AI models

Responsible Disclosure

If you discover a security vulnerability, we want to hear about it. We ask that you disclose it responsibly by contacting us directly rather than posting it publicly.

Reach out at hello@nestledinlove.com with details of the issue. We take every report seriously and will respond as quickly as we can.