Nestsy Legal Policies, Zero-Telemetry Scope, Key Management & Cryptographic Security Documentation (https://www.getnestsy.com/legal)

1. Zero-Telemetry Scope & Server Log Specification (Exact Data Boundary)

  • What is NEVER collected or transmitted to Nestsy Cloud: Etsy login passwords, browser session cookies, localStorage/IndexedDB tokens, proxy IP/port/username/password credentials, browsing history, store URLs inside isolated profiles, and crash dumps. The Nestsy Tauri desktop binary contains zero third-party crash reporters or telemetry SDKs (no Sentry, no Crashpad, no Mixpanel, no Google Analytics inside the desktop runtime).
  • What IS sent to Nestsy Cloud (Minimal SaaS Licensing Only): (1) Account authentication email (Supabase Auth JWT), (2) Subscription tier & daily quota counter (atomic integer decrement via PostgreSQL SECURITY DEFINER RPC), and (3) One-way SHA-256 hashed hardware claim identifier (device_claims) to prevent multi-account freemium abuse. Server logs retain zero store session payloads.

2. Cryptographic Key Management, Salt Generation, Hardware Binding & Recovery Specification

  • Key Derivation Function (KDF): Standard WebCrypto / Rust-backed PBKDF2-HMAC-SHA256 with 100,000 iterations.
  • Salt & IV Generation: Each encryption operation generates a fresh cryptographically secure 128-bit (16-byte) random Salt and a unique 96-bit (12-byte) Initialization Vector (IV) via OS CSPRNG (crypto.getRandomValues).
  • Authenticated Encryption Cipher: AES-256-GCM with a 128-bit Authentication Tag (v1:base64(salt):base64(iv):base64(ciphertext+tag)), guaranteeing both confidentiality and tamper-proof integrity on disk.
  • Hardware-Bound Key Material: The master derivation secret is bound locally to the host OS hardware UUID (Windows Registry HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid or macOS IOKit IOPlatformUUID) retrieved via Tauri v2 Rust IPC commands, plus an OS-protected local master secret fallback.
  • Backup, Migration & Recovery Mechanism: If a seller switches computers or reinstalls their OS, profiles and cookies are recovered via Nestsy's built-in Local Cookie & Session Vault Export/Import (supporting portable JSON/Netscape export encrypted or user-controlled on local disk) without ever routing through Nestsy servers.

3. Cryptographic Implementation Documentation, OWASP Security Audit & Open Verification Protocol

  • Tauri v2 Rust Capability Sandbox: Built on Tauri v2 (Rust backend + OS WebView2/WebKit) instead of bloated Node.js Electron, restricting filesystem and child-process execution strictly to declared IPC capability allowlists.
  • OWASP XSS & Command Injection Hardening: All UI inputs are validated via strict Zod schemas and sanitized with DOMPurify. All Python/Camoufox subprocess invocations pass parameters strictly as OS argument arrays (never shell string interpolation), eliminating command injection vectors.
  • Open Network & Storage Verification Protocol (Verify-Yourself): Because Nestsy offers a permanent $0 Forever Free tier, any security researcher or seller can inspect the local storage format (v1:salt:iv:ciphertext) and verify via Wireshark, Proxyman, or Windows Resource Monitor that 0 bytes of Etsy cookies or proxy credentials ever leave the local machine toward Nestsy servers.

4. Terms of Service (tab=terms), Refund Policy (tab=refund) & KVKK/GDPR Compliance (tab=gdpr)

  • Tab 1 — Terms of Service (https://www.getnestsy.com/legal?tab=terms): Pro ($39.99/mo annual or $49.99/mo monthly) and Agency ($119.99/mo annual or $149.99/mo monthly) plans have zero lock-in contracts and support instant 1-click self-serve cancellation inside the dashboard.
  • Tab 2 — Privacy Policy (https://www.getnestsy.com/legal?tab=privacy): Strict local-first data residency and zero third-party data sharing.
  • Tab 3 — Try-Before-You-Buy & Refund Policy (https://www.getnestsy.com/legal?tab=refund): Permanent $0 Forever Free plan (no credit card required) allows complete hardware and workflow verification prior to paid license activation.
  • Tab 4 — KVKK & EU GDPR Compliance (https://www.getnestsy.com/legal?tab=gdpr): Full compliance with Turkish KVKK No. 6698 and EU GDPR Articles 15–17 (Right to Access, Portability, and Instant Erasure).