Privacy Policy

This page describes what Nudgie stores, why, and what we can and cannot see. It reflects what the app actually does; if the two ever disagree, the code is the bug.

What we store

Your account

• Email address: how you sign in, and where sign-in codes are sent.
• Display name and avatar emoji, shown to the people in your spaces.
• Public key, so others can encrypt messages to you.
• Status (free, busy, sleeping, thinking), quiet hours and theme choice, all set by you.
• Your block list. Only you can see it.

Your spaces

• Each space you are in: its name, kind (couple or family), who owns it, who is in it and since when.
• Each space’s button deck: emoji, label, category and animation for each button.
• Pending invite links and when they expire.
• Whether a space is backed by a subscription, and when a grace period ends.

Nudges

• Who sent it, in which space, to whom, and when it was sent, delivered and acknowledged.
• For deck nudges: the emoji, label and animation as they were when it was sent.
• For composed nudges: one encrypted copy per recipient, plus the sender’s own. We store ciphertext only.
• Scheduled send time and recipients, for scheduled nudges.

Delivery and devices

• Your per-button loudness rules, everywhere or per space.
• Push notification tokens for your devices, so notifications can reach them.
• Sign-in session records, which include the IP address and the device or browser user agent of the sign-in.

Subscriptions

If you subscribe, we store the store’s transaction identifier, the plan, its status and expiry, and which of your spaces it is backing. Apple or Google hold the payment details; we never see them.

Reports

If you report a nudge or a person, we store who reported, who or what was reported, the reason, and any note you write. Operators read these to act on them.

What we cannot see

Composed nudge text is encrypted on your device for each recipient. We hold the ciphertext and no key that opens it. A deck button label such as "On my way" is stored in plain text, because the people in that space edit the deck together. If that distinction matters to you, treat button labels as visible to us and composed text as not.

We hold the directory of members’ public keys. A compromised or compelled operator could substitute one and read messages sent to that member from then on, and the app does not offer a way to detect that. This protects stored message text from a leaked database or backup. It does not prevent us, if compelled, from handing over metadata and ciphertext.

If you enable key sync, Apple or Google hold a synced copy of your key under your account with them; we never hold it.

Who else receives your data

• Apple and Google, through the Expo push service, to deliver notifications to your devices.
• Apple and Google, to verify subscriptions and tell us when one renews, ends or is refunded.
• Our email provider, to send you sign-in codes.
• Our hosting provider, which runs the servers and the database. Backups are encrypted before they leave the server.

We do not sell your data, and we do not run advertising or third-party analytics inside the app.

Who at Nudgie can see it

Operators can reach an administration panel that reads account records, space membership, decks, schedules, delivery rules, subscription status and nudge metadata, to answer support requests and act on reports. They cannot read composed nudge text, and they cannot read the session or authentication tokens that would let them sign in as you.

Leaving a space, and deleting your account

Leaving a space, or being removed from one, ends your access to it. Nothing is deleted for the people who stay. Deleting your account removes your account record, your push tokens, delivery rules, schedules, sign-in sessions and subscription records, and your encrypted copies of composed messages. Spaces you own pass to the longest-standing member, or are deleted if there is nobody to pass them to. The account deletion page explains how to start it.

Children

Nudgie is not directed at children and we do not knowingly collect data from anyone under 13.

Changes and contact

We will update this page when what we store changes. Questions, corrections, or a data request: support@nudgie.io.

Who runs Nudgie

Nudgie is operated by [LEGAL ENTITY], [POSTAL ADDRESS].

How long we keep it

Your account and everything in it stays until you delete it, and the account deletion page says exactly what goes. After a deletion, encrypted backups still contain that data for [RETENTION PERIOD] and are then overwritten; we cannot pull one account out of a backup before that. Moderation reports outlive the account they concern, for the reason that page gives.

Governing law

This policy, and any dispute arising out of it, are governed by the laws of [JURISDICTION].