Privacy Policy
The short version
- Your places, errands and journeys stay on your phone. Nudgeby has no accounts and no servers that can read your data. We can't see where you go.
- Lists you share with family are end-to-end encrypted. They sync through Nudgeby's relay, which passes them on without being able to read them. Nobody's location or visits are ever shared.
- Location is only used to ring your alarm or remind you near a place you chose. Nudgeby doesn't track your route or keep a location history.
- No ads, no analytics, no selling or sharing of data.
- Crash reports are off unless you turn them on, and they never include your places, labels or search text.
1. Who we are
Nudgeby is made by Digitaldot Consultancy Pte Ltd., a company registered in Singapore, 22 Sin Ming Lane, #06-76, Singapore ("we", "us"). This policy covers the Nudgeby app for iPhone and Android and this website.
2. What stays on your phone
Nudgeby stores these only on your phone:
- destinations you set, their alert circle and any time backup alarm;
- saved places;
- errands: the places, the items on each list and when you were last reminded;
- recent journey history and a short record of alarm events, used for the in-app timeline and troubleshooting;
- your settings (units, language, quiet hours) and the choices you made about consent.
This data is held in an encrypted database (AES-256). Its key is kept in your phone's secure storage (Keychain on iPhone, Keystore on Android). The data is excluded from iCloud and Google backups and isn't copied to a new phone. It's never uploaded to us.
3. How Nudgeby uses your location
- Alert circles. When you activate a journey or have errands switched on, Nudgeby asks your phone's operating system to watch the circle around each place. The phone tells Nudgeby when you enter (or stay in) a circle, and Nudgeby then rings or reminds you. This is why Nudgeby asks for location access "Always" / "Allow all the time": alarms must work while the phone is locked and the app is closed.
- One-off position checks. When you tap to centre the map on yourself, or Nudgeby checks whether you're already inside a circle before activating, it asks for your current position once. That position is used straight away and isn't saved.
- No tracking. Nudgeby doesn't record your route, doesn't keep a log of your positions and doesn't send your location to us.
While an alarm is set, the centre and size of its circle are also kept in a small file on your phone. This lets the alarm survive a restart. The file is removed when the journey ends.
4. Services that receive data when you use a feature
Some features need a map, place-search or messaging provider. Map and search requests go directly from your phone to the provider, not through us.
| Feature | Provider | What is sent |
|---|---|---|
| Map, place search and place names on iPhone | Apple (Apple Maps) | The text you type into search, the area of the map you are looking at, and map positions you pick. See Apple's privacy policy. |
| Map, place search and place names on Android | Google (Maps SDK, Places API, Android Geocoder) | The text you type into search, an approximate area to show nearby results first, map positions you pick, and the map tiles needed for the screen. See Google's privacy policy. |
| Syncing shared lists (section 5) | Cloudflare, Inc. (runs our relay) | Encrypted changes it can't read, random phone and list IDs, public keys and a push token. See Cloudflare's privacy policy. |
| Wake-ups for shared lists | Google (Firebase Cloud Messaging), and Apple's push service on iPhone | Your phone's push token, a random list ID and a number. See Google's privacy policy. |
| Crash reports (only if you turn them on) | Sentry (Functional Software, Inc.), stored in the EU | Technical details of a crash or error: the error and code location, app version, phone model and operating system version. Places, labels, search text and coordinates are removed before sending. Sentry deletes reports after its retention period. |
We don't store your search text. On Android, Nudgeby may keep Google's place identifier for a saved place on your phone, as Google's terms allow. Apple's place identifiers aren't stored.
5. Sharing errand lists
You can share errands with people you choose, for example your family, so whoever passes the shop picks things up. Sharing is always your choice; errands you don't share never leave your phone.
- What the people in a list see: the list's name, its errands with their places and items, who ticked what and when, who an item is for, and the name you chose for yourself in shared lists. They never see your location or when you visit a place.
- Invites (QR code or link). An invite holds a copy of the list and your phone's public keys. The list travels in the part of the link after "#", which browsers, messengers and our website never send to any server. Anyone who has the link can see the list and ask to join, so send it only to people you trust. The owner approves each phone after comparing a 6-digit safety code.
- Syncing through Nudgeby's relay. Each change is encrypted on your phone with a key that only the phones in the list have (XChaCha20-Poly1305), then passed through our relay, which runs on Cloudflare. The relay can't read lists, places, items or names. It does see: random IDs for each phone and list, the phones' public keys, which phones are in which list, a push token to wake your phone, and the size and time of each change. Your name, when you give it to the owner with a join request, is also encrypted for the owner only.
- Wake-ups. To tell your phone that a list changed, the relay sends a push message through Google Firebase Cloud Messaging (on iPhone, through Apple's push service). It contains only the list's random ID and a number, never the change itself.
- Leaving. If you leave a list or the owner removes you, your phone keeps its own copy as private errands and stops getting changes. A removed phone can't read anything written after it was removed: the list gets a new key.
6. Data you choose to send us
- Diagnostics export. If you tap Export diagnostics in Settings, Nudgeby creates a file of the last 7 days of alarm events, permission states and app and phone versions. It contains no coordinates, place names or search text. A detailed text log is added only if you tick that option. You choose where to send it through your phone's share sheet; nothing is sent automatically.
- Emails to support. If you email us, we receive your email address and what you write. We use it only to answer you, and we delete support emails within 12 months of the last reply.
7. What we don't do
- No advertising and no advertising identifiers.
- No analytics or usage tracking.
- No selling, renting or sharing of personal data.
- No tracking across other companies' apps or websites.
- No accounts, sign-in or marketing messages. Shared lists use random phone IDs, not your email or phone number.
- No reading of shared lists: they are encrypted on your phone before they reach us.
8. Permissions Nudgeby asks for
- Location (Always / All the time): to ring alarms and errand reminders in the background (section 3).
- Notifications: to show the alarm and reminders.
- Alarms & reminders (Android): for snooze and the time backup alarm to ring on time.
- Full-screen alerts (Android) and Time-Sensitive notifications / alarms (iPhone): so the alarm shows on the lock screen with Stop and Snooze.
You can change any permission in your phone's settings. Nudgeby will then tell you which alarms may no longer work.
9. How long data is kept
- Unfinished destination drafts: 7 days.
- Finished journeys and their history: 30 days.
- Troubleshooting records on the phone: 7 to 180 days, depending on how important they are for explaining a missed alarm.
- Saved places and errands: until you delete them.
- Shared-list changes on the relay: until every phone in the list has collected them, and never longer than 7 days. Requests to join: 7 days. A phone's registration (random ID, public keys, push token): until you delete all data or leave sharing.
Delete everything at any time with Settings → Delete all data. This also leaves your shared lists and asks the relay to forget your phone. Uninstalling Nudgeby removes all of its data from the phone; anything left on the relay is unreadable and expires as described above.
10. Your choices and rights
- Turn crash reports on or off in Settings → Privacy.
- Withdraw location monitoring consent in Settings → Privacy. Active journeys end and no new ones start until you agree again.
- Because your data stays on your phone, you can view, correct and delete it in the app yourself. We hold no copy of it. We only hold what you email us and, if you turned them on, crash reports, which we can delete on request.
We follow Singapore's Personal Data Protection Act 2012 (PDPA). If you are in the European Economic Area or the UK, you also have rights under the GDPR, including to access, correct, delete or object to processing of your personal data and to complain to your data protection authority. Contact us to use any of these rights.
11. Children
Nudgeby isn't directed at children under 13, and we don't knowingly collect personal data from them.
12. International transfers
Crash reports are stored by Sentry in the European Union. Apple and Google may process map and search requests and push messages in other countries under their own policies. The relay for shared lists runs on Cloudflare's network, which may handle encrypted changes in the data centre nearest to each phone. Where personal data leaves Singapore, we rely on the providers' contractual protections.
13. Changes to this policy
If we change this policy in a way that matters, we'll update the version and date above, and the app will ask you to agree to the new version before you continue.
14. Contact
Data Protection Officer, Digitaldot Consultancy Pte Ltd.
Email: hello@digitaldot.com.sg
Address: 22 Sin Ming Lane, #06-76, Singapore