Privacy Policy

Last updated: July 28, 2026

DocNest ("the app") is a document and receipt organizer for iPhone. This policy explains what the app collects, why, and what control you have over it. It is written to match what the app actually does — if you find a discrepancy, the app's behavior is the bug, not this document.

Who we are

DocNest is operated by Tibb Shimabukuro.
Contact: it@diversesg.com

What DocNest collects

DocNest collects only what it needs to store and organize your documents:

Data	Why it's collected
Email address	Identifies your account so you can sign in and recover your password.
Password	Stored only as a salted hash by our authentication provider. Nobody at DocNest can read it.
Document images	The photos you scan or import are stored so your documents are available across sessions.
Extracted document data	Text recognized from your documents, plus the vendor, date, totals, tax, tags, notes, folders, expense reports and gift-card records you create.
Timestamps	When each record was created and last updated, so lists can be sorted.

What DocNest does not collect

No advertising identifiers, and no tracking across other apps or websites.
No third-party analytics, crash-reporting, or advertising SDKs.
No location data.
No contacts, calendars, health, or financial account credentials.
No access to your photo library beyond the specific images you pick. Importing uses Apple's system photo picker, which hands the app only your chosen image and never grants access to the rest of your library.

How your data is processed

Text recognition happens entirely on your device. DocNest uses Apple's on-device Vision framework to read your documents. Document images are never sent to any text-recognition, machine-learning, or AI service.

Storage. Your account, document records, and document images are stored in a Supabase project (Supabase Inc., hosted on Amazon Web Services) operated on our behalf. Every record is protected by row-level security rules that restrict it to the account that created it, except for documents you deliberately place in a shared ledger — see “Shared ledgers” below. Data is encrypted in transit with TLS and encrypted at rest by the hosting provider.

Supabase is our only third-party processor, and it acts solely as a data processor under our instructions. It does not use your data for its own purposes.

Shared ledgers

DocNest lets you create a shared ledger: a separate feed that you and people you invite can both scan into. This is the only circumstance in which another person can see your documents, and it never happens by accident.

Your private documents are never shared. A document belongs either to your private feed or to one shared ledger, and it is filed at the moment you save it. Nothing already in your private feed is exposed by creating or joining a ledger.
Membership is invite-only. A ledger owner generates an invite code that expires; someone can only join by entering that code. There is no public directory of ledgers, and nobody can add themselves to one.
What other members can see. Every member of a ledger can see, edit and re-file every document placed in that ledger — including its image, recognized text, vendor, amounts and tags — and can see the email addresses of the other members. Assume anything you put in a shared ledger is visible to everyone in it.
What they cannot see. Members cannot see your private documents, your folders, your gift cards, or any other ledger you belong to.
Leaving. You can leave a ledger at any time, which immediately ends your access to it. Documents you contributed remain in the ledger for the other members, because they belong to the shared space rather than to you personally. If you want a contributed document removed, delete it before you leave, or ask the ledger owner to remove it.
Deletion. A ledger owner can delete the whole ledger, which permanently deletes every document in it for every member.

How your data is used

Your data is used only to operate the app: to sign you in, store and display your documents, run your searches, build your expense reports, track gift-card balances, and share documents with the members of any ledger you choose to join.

We do not sell your data, share it with advertisers or data brokers, or use it to train machine-learning models.

Data retention and deletion

Your data is retained for as long as your account exists.

You can delete your account at any time from inside the app: open your profile, then tap Delete account. This permanently and irreversibly deletes your account together with every document, image, folder, expense report and gift card in it. There is no recovery period and no archived copy — once the deletion completes, the data is gone.

If you would rather have your account deleted for you, email it@diversesg.com from the address on the account and we will action it within 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. The in-app delete covers deletion; for anything else, contact it@diversesg.com.

Children

DocNest is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

Security

Access to your data requires your account credentials. Row-level security is enforced at the database layer, so one account's queries cannot reach another account's rows. Document images are served through short-lived signed URLs rather than public links.

No system is perfectly secure, and we cannot guarantee absolute security. Use a strong, unique password.

International transfers

Your data is stored on infrastructure that may be located outside your country of residence, including the United States. By using DocNest you consent to this transfer.

Changes to this policy

If this policy changes materially, the "Last updated" date will change and the new version will be posted at this URL before the change takes effect.

Contact

Questions about this policy or your data: it@diversesg.com