Privacy Policy

Nudgy · last updated October 8, 2026

Nudgy listens to your day on your iPhone, understands what you say, and does the next thing — sets the reminder you mentioned, writes the brief you asked for, remembers the people you talk about. This page says exactly what that takes, where each piece goes, and how to delete it. Nudgy is made by HMU, INC.

What stays on your iPhone

• Recordings. Audio is recorded, encrypted on the phone with a key in your Keychain, and turned into text on the phone. It is never uploaded — unless you turn on Cloud transcription (Settings → Voice & listening), in which case short clips — or, while you dictate or Deep Listen, the live audio — are transcribed by a speech model on Cloudflare's servers (where Nudgy's server runs), Deepgram or OpenAI, and are not stored by us or kept by them. The encrypted recording stays on your iPhone so you can play a talk back, for as long as its words are kept (90 days unless you change it in Settings → Privacy), and goes when you delete the talk.
• Your voiceprint — the numbers that tell your voice from others — is sealed on the phone and never leaves it.
• Dictation, only your voice (on unless you turn it off in Settings → Voice & listening): when you stop dictating on your iPhone, the phone compares that audio, in memory, with your own voiceprint and leaves other voices' words out before Nudgy tidies or keeps anything; no one else is recognized, named or remembered. With it off, every voice the microphone hears while you dictate is typed. Dictating in Nudgy on the web, or in the Mac app's window, types every voice the microphone hears.
• Photos. Nudgy looks at when and where your photos were taken, on the phone, to connect moments. Your photo library is never uploaded or looked through: the only photos that leave your iPhone are ones you pick yourself to add to your board (see below), and Nudgy sees only those.
• Contacts. Names from your contacts help recognize names you say. They stay on the phone.
• Screen Time. Which apps you pick is kept by Apple's Screen Time; Nudgy never learns them.
• Widgets show only what's already in the app (words today, today's topic, your latest mail cards), from a copy kept on the phone. On the Lock Screen, names, subjects and topics stay hidden until you unlock; nothing new is sent anywhere for them.
• Camera. Voice setup can use the front camera's depth sensor on this iPhone to measure how far away you're holding it. No image or face data is recorded, stored or sent, and it isn't used for anything else. It's optional; without it a loudness meter guides you.
• Heart-rate samples and your gym's location, if you connect Apple Health (see below): the samples are read and summed up on the phone, and the gym you mark is watched by the phone itself.
• Answers said out loud. When you ask "Hey Nudgy, …", an answer that uses your own things (mail, messages, calendar, My Mind, an app you connected) is spoken only when your iPhone recognizes your voice or is unlocked; otherwise it says "it's on your phone" and shows the card, so someone else near your phone doesn't hear it. The voice check happens on the phone.
• The listening card's live line. While Nudgy listens, its card on the Lock Screen and in the Dynamic Island can show the last few words it heard you say, in quotes: only words matched to your voice (before your voice is set up, words it couldn't place on someone else), never anything said over music or a video playing out loud. It's shown even while your iPhone is locked, so someone holding your phone can read it. It's made on the phone from what it just heard; nothing extra is sent or kept for it.

What goes to Nudgy's server

The server runs on Cloudflare. It receives and keeps:

• The text of stretches of conversation (with "Only me" on, just your own words), and when they happened. Words another voice said reach the server only after you've agreed to the recording notice below; until then they're left out. When the words sound like a show, a song or a video playing nearby rather than people there, Nudgy doesn't learn from them: they make no notes or topic cards and stay out of My Mind (something you ask for over them still counts); they're kept like any other stretch's words;
• The place where a stretch happened (a place name and coordinates), when location is on — only while you're using the app;
• Your name, a one-way hash of your Apple (or Google) sign-in id and of the email it verified — so either sign-in finds the same account — your settings, and the push-notification token for your device, with an id the app makes for that iPhone (kept on the iPhone through a reinstall, so one phone is one install). A phone is one account's at a time: when you sign out on it, or another account signs in on it, your cards stop going to it. An install you haven't opened, and that hasn't shown a card, for 90 days is forgotten with its push tokens (opening Nudgy there sets it up again);
• Your email address as your sign-in shared it (with Apple's "Hide My Email", the relay address), encrypted, so HMU, INC. can see who uses Nudgy and reach you about it. Only you (it shows in Settings) and Nudgy's owner can read it; it's deleted with your account. Nudgy's owner can also see which apps you've connected and the account each one reads (the address or name Settings shows for it), to help when a sign-in doesn't finish, but not what Nudgy read from them;
• What Nudgy made for you: reminders, notes, answers, research briefs (as private pages at unguessable links), and the long-term picture in My Mind (facts, people, topics, your daily patterns). A reminder to call someone keeps only the name as you said it ("Call Mom"); the number is found in Contacts on your iPhone and never sent. Reminders come from what you say, from a date or deadline someone gives you in a conversation you're in ("your quiz is Tuesday"), and from something someone asks you to do that you say yes to ("can you send the slides by Friday?" "yeah"), never from someone else's own plans or from a show playing nearby; each one has Undo, and Settings → Answers turns off adding them on their own. Asking Nudgy to move or remove reminders you already have changes those ones (on your iPhone's Reminders too); removing any, changing all of them or more than three asks you first, and every change can be undone for a day. When you tick off or delete a reminder Nudgy added in Apple's Reminders, your iPhone tells Nudgy only that (done, or not wanted), so it learns what you want; your other reminders are never sent. Nudgy learns from what you turn down, for you only: the titles of cards you said no to, undid or deleted in the last 30 days (at most 15) go with what it hears to the AI that decides what to make, so it doesn't make the same thing again. If you connect Apple Notes, your iPhone adds each note to Apple Notes itself, through a shortcut on your phone; Nudgy's server never reads or writes your Apple Notes. "Send my day to Notes" puts your usual routine (as My Mind learned it), today's calendar and the reminders due today in one note, "Daily schedule"; if you set up a Shortcuts automation to do it every morning, it runs without opening Nudgy, and only while "Let Siri use what Nudgy remembers" is on. My Mind never keeps one-time codes, passwords or sign-in links it hears;
• While you're in a conversation, the cards that can wait (a reminder, a note) are held instead of buzzing you one by one, encrypted, and come as one card about two minutes after the other voices stop; the held list is deleted when that card goes (or a day later if it never could). To know when a talk has ended, and whether your iPhone is still recognizing your voice, Nudgy keeps the times it last heard you and last heard someone else, never words, replaced each time. If your iPhone hasn't recognized your voice for 20 minutes while it's listening, voices it couldn't name may be taken as yours, so your own plans and questions aren't missed; a person it named never is. Both are in your export and deleted with your account;
• A decision log (what it decided and why, what each step cost), kept 30 days.
• Which of its cards you open, any 👍 / 👎 you give them, whether you dismissed, undid or said yes to one, and when the app opens and closes — so HMU, INC. can see whether Nudgy is actually useful, and Nudgy's owner can see, person by person, on which days and how often you use it (opens, questions asked, cards, hours listening, apps connected, as counts and dates), which version of a screen you were shown when Nudgy tries two designs, and how the app is running for you over the last day (its build, whether Live Activities are on, when it was last seen, how often listening stopped and what took the microphone — music, a video, a call or Siri, never what was playing or who you talked to — how fast answers came and whether any failed, cards sent against cards shown, and crash and hang counts). These are counted, never read for words; they're never used for ads or shared, and they're deleted with the card or your account. So that a card isn't lost, Nudgy also keeps which cards it sent to your Lock Screen and what your iPhone says happened to each (shown, folded into another card, or dropped by iOS, in which case it's sent again once), as ids and times only, for 30 days, and a card's own push address for the few hours it's on screen;
• Your conversations with Nudgy (what you ask in Ask or through Siri, and its answers), so a follow-up question makes sense — kept for the same time as transcripts;
• A morning card: the first time you unlock your iPhone after 4 a.m. (or Apple Health's wake time, or a set time later in the morning), it tells Nudgy only that you're up, and Nudgy sends one card with what came in overnight. The time isn't kept apart from that day's card: the card, and the log lines and delivery records made when it was sent, are deleted after two days.
• Your contact card, if you make one (Settings → My contact card): the name, phone, email and social handles you type, encrypted. The parts you switch on are public to anyone who has the card's link or QR code (nudgy.run/c/…), until you change the link or delete the card; the parts you leave off are never shown. Nudgy counts how often the page is opened and the contact saved, never who opened it. The card is in your export and deleted with your account.
• Your board, if you say yes when you first add something (it's asked once): the photos, files (PDF or plain text), links, notes and voice notes you give Nudgy so it learns what you like. Your iPhone sends only what you pick, removes a photo's location and camera details first, and makes it smaller; a voice note is kept as its words only, never its audio. On Nudgy's server each file is encrypted with your account's key before it's stored, and is shown back only through a link that works for your account for a few minutes. A link you add is read once by Nudgy's server (public https pages only, with no cookies or sign-in) for its title and picture. To sort each thing and learn your taste for My Mind, a small copy of a photo, a file's text or a link's title goes to OpenAI (see AI providers). Nudgy never recognizes faces: it doesn't identify or name people in your photos, even when you ask, and keeps no faceprint or other face data; people in a photo are just "a person". Everything on your board is kept until you delete it; there's no silent expiry. Deleting something removes the file, what Nudgy wrote about it and what My Mind learned from it; only a note that it existed (its kind, size and dates, nothing in it) stays 30 days, for the daily limit on uploads. Turning your board off in Settings → Privacy deletes all of it, and so does deleting your account. Your export includes every file itself, not just a list.
• Shopping, if you say yes the first time (it's asked once): your sizes for each brand and kind of clothes, the measurements you type in (like chest, waist or inseam), the brands you follow, and what you've bought, with what you sent back and why, so Nudgy can tell you your size on a store's page and let you know about sales. These come from what you tell Nudgy, what you send it, and order and return emails in an inbox you connected (the brand, the item, its size, colour and price, and the date; not the rest of the email). All of it is encrypted with your account's key. On your Mac, what size am I? reads the address and title of the page in your browser only when you tap it (macOS asks you once for each browser), and never the address of an account, cart, checkout, order or sign-in page; Nudgy reads that public page once for its size chart, with no cookies or sign-in, and keeps nothing from it unless you ask it to save something; the answer (your size and why) is written by the AI providers below, Anthropic's Claude or OpenAI, with your sizes and measurements for that one answer. If you follow a brand and ask for deals, Nudgy reads that brand's sale emails you already get and may check its public sale page once a day; a deal's pictures are fetched by Nudgy's server and shown to you from there, so the store doesn't learn when you look. Nudgy never buys anything, never signs in to a store, and never shares your sizes, measurements or purchases with any brand or store. Each size, measurement, brand and purchase can be deleted on its own, "Forget my shopping" deletes all of it, and so does turning Shopping off or deleting your account. It's in your export.
• Nudgy on the web and for Mac: signing in at app.nudgy.run sets two cookies, both only for signing in — one for ten minutes while Apple or Google answers, and one that keeps you signed in for a week. They aren't used for anything else, and there's no analytics or tracking on /app (only error reports, see Crash reports). While you're signed in there, a third cookie, nudgy_app, sits on nudgy.run holding only "1" (no id, nothing about you), so opening nudgy.run takes you straight to Nudgy instead of the home page (nudgy.run/?home still shows it). It lasts as long as your sign-in, and goes when you sign out, when your sign-in runs out, or when you delete your account. Each browser or Mac you sign in on keeps a small record (which kind it is, when it signed in and was last used, and the Mac app's version) so signing out there ends it; no IP address or browser details are kept, and these records are in your export and deleted with your account. Signing in on the web or the Mac opens the account you made on your iPhone, or, if you don't have one, makes your Nudgy account from your Google sign-in (its verified email and name, kept the same way as on the iPhone; Apple's sign-in on the web shares no email, so it can't make one). Before Nudgy hears or sends anything from such an account, you agree to the same terms, confirm your age and say yes to AI, just as on the iPhone. An invited address is kept encrypted, seen only by Nudgy's owner, and deleted when it's used to sign up, when he removes the invite, or 90 days after it was sent, whichever comes first. Nudgy's owner sees who has signed in on the web or the Mac (your name and the email you signed in with), when you first signed in, when Nudgy for Mac was first downloaded from your link, whether you finished setting up, and when your Mac or browser was last used — never what was said or shown — and can take an account off the web and Mac. Nudgy for Mac listens only after you turn it on: Apple's speech recognizer on the Mac turns what it hears into text there, and only that text comes to Nudgy's server, the same way it does from your iPhone — no audio leaves the Mac. While it's listening, it also tells Nudgy's server when the Mac starts and stops playing sound (the times only, never what's playing or which app), kept one day, so a video or a song isn't taken as a conversation on any of your devices. On the web, listen here sends the tab's microphone audio, only while that tab is in front, the switch is on and someone is talking, through Nudgy's server to Deepgram for the words; the audio isn't kept by us or by them, and the words are kept like your iPhone's. Which tab is listening is kept as a random id and two times, nothing else. When more than one of your devices hears the same talk, Nudgy acts on it once: for an hour it keeps a one-way fingerprint of each line it heard live (never the words), and a talk heard twice is kept once.
• For leave-by and sharing your ETA, one location point: the latest your phone sent, replaced each time — never a history of where you've been.
• For a reminder "when I get home" or "when I leave the gym", the place's name with the reminder, from what you said. Your iPhone finds that place and watches for it itself: where it is, where you are, and the moment the reminder goes off stay on your iPhone (its log notes the time and the place's name, never coordinates, and only reaches us if you send it yourself with Settings → Send the ledger). Nudgy's server only hears what you do with the card (Done, or In 1 hour), as with any reminder. The same watch on your iPhone can also ask you to turn listening back on when you get home, to work or to the gym you marked while the mic is off; that's decided on your iPhone too, and nothing about the place is sent.
• Your feedback: a 👍 or 👎 on a card, what you write when something was off, and your answer when Nudgy now and then asks how it's doing. What you write is encrypted with your account's key, read only by the Nudgy team to make Nudgy better, and deleted with your account. If you've said yes to AI, it may also go to that AI to sum up, without your name, what's most worth fixing next;
• Crash reports, while "Send crash reports" is on (Settings): Apple's own report of a crash or freeze — which part of Nudgy's code was running, the app version, iOS version and iPhone model (on a Mac, the macOS version and Mac model; Nudgy → Send Crash Reports there). Never your words or audio. Kept 30 days, only to fix what broke. If Nudgy crashes before you've signed in, the same report is sent with a random number the app makes for itself instead of your account, so it's tied to no one — also kept 30 days. While the switch is on, a crash or error report also goes to Sentry, a crash-reporting service: where in Nudgy's code it happened, the app's version, the iOS or macOS version and the device model. When something breaks on Nudgy's server or on nudgy.run/app, Sentry gets the same kind of report, naming the route or page but never the rest of its address; /app's reports go through Nudgy's own server, so Sentry never sees your browser or your address. A report never holds your words, audio, screenshots or what's on your screen, never your name or email (at most a random-looking id Sentry can't turn back into your account), and no IP address is kept. Nothing about how you use Nudgy goes to Sentry, only what broke. Sentry keeps these reports in the United States for up to 90 days, only to fix what broke;
• Battery numbers, while "Send crash reports" is on: for each hour Nudgy listens, how much battery and processor time it used and on what (minutes and counts, never words or audio), whether it was charging, the app version, iOS version and iPhone model (on a Mac, the macOS version and Mac model), never its name. Kept 30 days, only to make Nudgy use less battery;
• Invites. Who invited you, if someone did (only their first name is ever shown to you), the invite links you have to give (encrypted, shown only to you), and the first name of whoever came in with each. Someone opening your invite link sees only your first name. If you joined with a friend's invite, Nudgy asks you once whether to link your Nudgys; a link shares nothing until one of you says yes to a request (see Linked Nudgys), and your answer is kept so it isn't asked again.

The waitlist, invite links and the website

If you join the waitlist on nudgy.run, Nudgy keeps your email address, encrypted, so someone can send you an invite — nothing else about you. Only Nudgy's owner can read it. When you join, Nudgy gives that address and your place in line to Loops for one email saying you're on the list (see Email from Nudgy below). It's deleted, here and from Loops, 90 days after you're sent an invite, after 12 months on the list, or whenever you ask: write to matthew.parkk0@gmail.com from that address.

If a friend sends you an invite link and you type your email address on it, Nudgy sends that address to Apple, which emails you the TestFlight invite (Apple's privacy policy covers it from there). Nudgy doesn't keep the address. It keeps the first name you typed, if you gave one, which your friend sees, and a one-way fingerprint of the address, so that if you sign in to Nudgy with the same email your account is connected to your friend's invite. The fingerprint is erased when you sign in, or after 30 days. To be taken off TestFlight, write to matthew.parkk0@gmail.com from that address.

Email from Nudgy is sent by Loops. When you make an account, on your iPhone, the web or a Mac, Nudgy's server gives Loops your email address (with Apple's "Hide My Email", the relay address), your first name if your sign-in shared it, and a random-looking id Loops can't turn back into your account, once, so it can send you one welcome email about your account. Joining the waitlist gives Loops your address and your place in line, for one email saying you're on the list. Nothing else goes: nothing you said, typed or saved. Every email has an unsubscribe link, and Nudgy sends no marketing email unless you say yes to it separately. Loops keeps your address only to send Nudgy's email; deleting your account deletes it from Loops too, and so does leaving the waitlist.

The website counts its visits with PostHog, Mixpanel and Cloudflare Web Analytics, without cookies and without following you to other sites: which page was opened and the steps of the waitlist and invite pages, never what you type. The app itself has no analytics inside it.

The Feedback board links on nudgy.run, in the app and on /app open Nudgy's public board on UserJot, a separate site where anyone can post ideas and vote. What you post there is public, and UserJot's own privacy policy covers it. Nudgy sends UserJot nothing about you; opening the board is like visiting any other website.

To see how Nudgy is used, Nudgy's server sends Mixpanel a short record of a few things that happen, from what it keeps anyway: that someone signed up (with Apple or Google), that a card was shown, opened or given a 👍 or 👎 (and what kind of card: a reminder, an answer…), that a check-in was answered, and that something was added to a board (and what kind). Each person is a random-looking id that Mixpanel can't turn back into your account, your name or your email, and no IP address is sent. No words — nothing you said, typed or saved, no card's title, no names or places — ever go. Mixpanel keeps these records for Nudgy only; they're never used for ads or sold.

AI providers

To understand what you said and act on it, the text above is sent to an AI provider: OpenAI or Anthropic (its Claude models). Quick answers — what you ask, and the answers Nudgy writes to what it hears — may be written by Anthropic's Claude; deciding whether what Nudgy just heard needs a card, summaries, research briefs, the hardest questions and web answers run on OpenAI, and so does a small copy of what you add to your board (a photo at low detail, a file's text, a link's title and description), only to describe and sort it and learn what you like; a PDF's text is read out of it first by a converter on Cloudflare, which doesn't keep it. The effort you pick in Settings changes which of its models answers you and how much of your set daily amount an answer uses, never who it's sent to; a very complex question gets its most capable model whatever you picked. Both are used through their business APIs, which don't use this data to train their models; Nudgy also asks OpenAI not to store its answers (store: false) and opts out of Deepgram's model-improvement program on every request. Web answers and research briefs search the public web through OpenAI. When you ask about a place — what's near you, when a café closes, the way somewhere — the place name and coordinates (to about 100 meters) of the last point your phone sent in the past six hours go with the question, so the answer looks near you first. When Nudgy hears a question and offers to answer it ("want an answer?"), it may write the answer while the offer waits, so your yes shows it at once: the question goes to the provider then, as it would on your yes, and the answer is kept encrypted and out of sight. Say no and it's deleted then; leave the offer and it's deleted within two hours; ask Nudgy to forget something meanwhile and every answer written ahead is deleted, so your yes writes a fresh one. Quick steps — transcribing and tidying dictation — may run on open models hosted by Cloudflare, where Nudgy's server runs. If OpenAI can't be reached, deciding whether what Nudgy just heard needs a card, and answering a question that doesn't need the web, run on an open model hosted by Cloudflare instead until OpenAI is back; that text isn't kept by Cloudflare or used to train anything. Everything else waits and runs on OpenAI once it's back. When Anthropic can't be reached, its steps run on OpenAI instead. Cloud transcription, if you turn it on, sends audio clips to a speech model on Cloudflare, Deepgram or OpenAI for transcription.

Nothing goes to any of these providers until you say yes in the app ("can i send your words to ai?" in the first run, or Settings → Brain). The server keeps that answer and checks it before every call it makes, including the ones it makes on its own, like reading new mail; turn it off and nothing more is sent.

Connections you choose

• Your own AI agents (Settings → Agents): if you make a token, the app you give it to (your own Claude or ChatGPT, say) can ask Nudgy what it remembers for you — search your memory, read a day, who you are and your recent cards — and nothing more: it can't change, send or delete anything. What it reads goes to that app and its AI provider, under their own terms. Each token is shown once, kept by Nudgy only as a fingerprint, and works only while AI is on; Settings → Agents shows when each was last used and by which app, and lets you delete it or make a new one (the old one stops at once). A token nobody uses for 90 days stops working by itself. A token can also sit inside the link you paste into an app, so treat that link like a password.
• Google (through Composio): if you connect it, Nudgy reads the headers and short previews of recent mail to find what needs you, and can draft replies (now and then it offers to, for an email that's waiting on you, and drafts only on your yes) — but nothing is sent without your tap. An email it picks out comes as a quiet card on your Lock Screen with the sender and subject, shown even while your iPhone is locked (unless your iPhone is set to hide Lock Screen widgets until it's unlocked). Every reminder or event goes on your own Google Calendar by itself (one with no time, or a time already past, goes in the next few minutes; no invites to anyone; its card's Undo takes it off, and Settings turns this off). It also reads your coming week's calendar (and, in Nudgy for Mac's Calendar tab, the days you open there, up to a month at a time, from each Google and Outlook calendar you connected: read while you look and not kept), and finds Drive files and contacts when you ask about them. Turn "Use email details" off and no mail is read at all. At most twice a day, when your iPhone says you're free (the first time you unlock it after getting home, or after a long quiet stretch; it tells Nudgy only that you're free, never where), Nudgy may gather the two to four emails that need you into one card, each with its choice and deadline. Answering one in your own words writes a draft you send with your own tap; "drop it" puts that email away and it isn't brought up again. An email offering you work (a sponsorship, a brand deal, a client or an introduction) may come instead as its own card, at most one a day, with the one thing to watch in it and, if you've told Nudgy your usual terms, those terms from My Mind: only ones you said or wrote yourself, never taken from an email. Disconnecting revokes the grant and deletes what was read, and what My Mind learned from it.
• Outlook (through Composio), if you connect it, is read the same way as Google: the senders, subjects and short previews of recent mail, and your coming week's calendar. Microsoft is asked for reading mail, drafting and sending replies, and reading your calendar — nothing else. A reply is drafted only when you ask or say yes to Nudgy's offer, and sent only when you tap Send; Nudgy never moves or deletes your mail and never changes your calendar. Disconnecting revokes the grant and deletes what was read, and what My Mind learned from it.
• Other apps you connect in Settings (GitHub, Notion, Linear, Granola, LinkedIn) go through Composio the same way. Nudgy reads a little from each — your open issues and pull requests, recently edited page titles, meeting titles and notes — to answer your questions and keep My Mind up to date; Granola meeting notes are kept beside that part of My Day. Anything it would make in an app (an issue, a page, a doc) waits for your yes, and each app's page in Settings lets you switch its actions off. Disconnecting revokes the grant and deletes what was kept from it, including what My Mind learned from it. You can connect more than one account of an app (several Google accounts, say): each is read the same way, one is your primary (where drafts and calendar holds go), and removing one revokes only its sign-in and deletes only what was read from it.
• Apple Music, if you connect it: your iPhone reads your library with Apple's permission and sends Nudgy only names: up to 10 artists you play most, up to 10 songs you played recently and up to 15 of your playlists' names, replaced each time (never a history). No Apple Music sign-in reaches Nudgy's server, and songs play in the Music app on your iPhone. Nudgy uses the names to answer questions about your music, find a playlist you name and keep My Mind up to date, only with your yes to AI. They're in your export; disconnecting deletes them and what My Mind learned from them.
• Spotify (through Composio, on Nudgy's own Spotify app; while Nudgy is in beta, Spotify lets only a few people connect, and everyone else's songs open in the Spotify app): if you connect it, Spotify is asked only for your profile, the artists you've played most, the songs you played recently, your playlists (private and collaborative ones too), the songs you've liked, what's playing now and on which of your devices, and starting, pausing or queueing a song. It is never asked to change your library or your playlists, so Nudgy can't like, save, follow or edit anything there. Nudgy reads these to answer questions about your music ("what's playing?"), to find a playlist you name (your own gym mix, say), and to keep My Mind up to date, and searches Spotify's catalog only when you ask it to play something. A song starts when you tap it, or, with auto-play on, by itself in two cases only: when you tell Nudgy "play …", and when you arrive at the gym and have a Spotify playlist for working out. Never while you're talking with someone, and the card's Stop pauses it (playing needs Spotify Premium). Nudgy doesn't store your listening history, your playlists or your liked songs: what stays is what My Mind writes about your music (an artist you've had on repeat, say) and the cards you asked for, all in your export and each yours to delete. Disconnecting revokes the grant and deletes what My Mind learned from Spotify.
• Instagram, YouTube and Facebook, if you connect them: Nudgy asks each only for read-only access, and reads your account's numbers — followers or subscribers, reach and views — and how each of your posts, Reels and videos did (views, likes, and how many comments, shares and saves), so you can ask how something's doing. It never reads your messages and never posts, comments or changes anything there. It keeps those numbers day by day, and each of your posts with its counts and the first words of its caption (encrypted with your account's key), so it can show trends and tell you when a post takes off — for 13 months. Disconnecting revokes the grant and deletes what was kept from that app.
• Coding sessions: when you say yes to building something, the repository you picked is worked on either on your own Mac or in a private, temporary Cloudflare container that can reach only GitHub, OpenAI and the public package registries. The code and your request go to the coding agent's AI provider (OpenAI). The work lands as a draft pull request on its own branch; nothing is merged. Your GitHub access is added by Nudgy's server outside the container and never stored in it.
• Weather: when you ask about the weather, and for the sky behind Home (clear, cloudy or raining where you are, checked about every 30 minutes while Nudgy is open), your approximate location — the last point your phone sent, rounded to about a kilometer — is sent to Open-Meteo to get the weather. Nothing else about you is sent with it, and the sky never sends a new location of its own.
• iMessage (through Photon): if you text Nudgy, those texts pass through Photon to reach it.
• Travel times: for "leave now" cards and ETAs, your current location and where you're headed are sent to Apple Maps (Apple's Maps Server API). Trip plans look up the place and its forecast with Open-Meteo, and search the web for ways to get there — nothing is ever booked.
• Sharing your ETA: only when you say yes. The person gets a link that shows your ETA (or, if you chose it, where you are now) until you arrive, the time you set, or you stop it — then the link ends and your last point is deleted.
• Linked Nudgys: when you and someone else link your Nudgys, you choose what their Nudgy may get from yours — free/busy times, your ETA, messages — and each can ask you every time. Nothing else crosses: not what Nudgy hears, not your memory, mail or places. Everything that crosses is in the link's log.
• Apple Health, if you connect it (Settings → Connections; it's asked first, never in setup): your iPhone reads your workouts and your heart rate during them, and, if you said yes on the screen that names them, your everyday numbers: steps, distance, active energy, exercise and stand time, flights climbed, sleep (time asleep and in bed, and when you fell asleep and woke), resting and walking heart rate, heart-rate variability, breathing rate, VO2 max, weight and mindful minutes. Nothing else from Health (except, if you turn on "Check in on me" below, the State of Mind you log, read on your iPhone only): never clinical records or reproductive health. The samples stay on your iPhone; Nudgy's server gets only a short summary of each workout (the kind, when, how long, average and highest heart rate) and one summary a day of those numbers, encrypted with your account's key, so My Mind can learn your routine and answer how your training, sleep or steps are going. When you're at the gym you marked, your iPhone notices it itself (the server only hears "at the gym", never where it is) and can offer your gym playlist. Workout and daily summaries are kept 13 months, are in your export, and are deleted when you turn Health off, disconnect it or delete your account. Nudgy never writes to Health, never sends health data to iCloud, never sells it or uses it for ads, and never puts it in "Help make Nudgy better". If you've said yes to AI, a summary may go to the AI that answers you, only to answer you or keep My Mind up to date.
• Check in on me (Apple Health; off unless you turn it on in Settings, with its own screen): your iPhone watches for a State of Mind you logged as unpleasant, or a heart rate well above your resting rate while you've been still. When it sees one, it tells Nudgy only which of the two and when — never the reading, your mood or a number — and Nudgy may send one quiet card asking how you're doing: at most once a day, never between 10 p.m. and 8 a.m., and never while you're talking with someone. What you answer stays on your iPhone. The card and its log lines are deleted after two days; your iPhone's own log notes only that a check-in card went or didn't, never which of the two or a reading, and stays on the phone unless you send it. It's a friendly check-in, not a medical device: it can't tell what you're feeling or notice an emergency.
• Background on people: when you ask about someone in public life, Nudgy searches the web and public sources (like GitHub and paper indexes) and keeps a brief with its sources. It never looks up home addresses, phone numbers, family or private life, and stops at public, professional information for private individuals.
• Work Nudgy does in steps (a brief, a trip, an errand you hand it): what you asked, its working notes, what it found and the result, and a log of each step — all encrypted with your account's key. The step log is deleted 30 days after the work ends; the result stays with its card until you delete the card or your account, and work that never made a card is deleted after 90 days. Anything it would send, book, buy or share waits for your yes.

Other people, and recording laws

Nudgy hears what's around you, including people who haven't agreed to be recorded. In many places — California, Florida, Illinois, Washington, Pennsylvania, Massachusetts, Maryland and other all-party-consent states, and many countries — recording a private conversation needs everyone's agreement. Before Nudgy keeps anything another voice says, you agree to this notice: you'll let people know Nudgy is listening and get their OK where the law asks for it, and pause it (the mic at the top of Home) when you can't. "Only me" keeps just your own voice. When people near you ask each other something, Nudgy may answer it quietly on your phone, for you only; it never says it out loud to them. Nudgy never uses anyone's words to train AI models, and never sells or shares them.

Helping make Nudgy better (only if you turn it on)

Help make Nudgy better is asked once: when you set Nudgy up, beside the microphone and AI questions, or, if you set it up before it was asked, the first time you open a newer version. "Not now" is never asked again. It's off unless you say yes, and Nudgy works the same either way. It's for people 18 and over, and you can turn it off anytime in Settings → Privacy & my data. When it's on, Nudgy keeps:

• a short example from some of the cards you react to (👍, 👎, dismissing, undoing, saying yes, ticking a reminder done) and a few lines that made no card: the line the card came from, up to three lines from the 30 seconds before it, what the card said, and what you did with it. Other people's lines are included only if you've agreed to the recording notice above;
• each dictation you make: what you said and what Nudgy wrote, and your 👍 or 👎 on it. Only your own words. A dictation with a code or password in it is never kept.
• how often each kind of card was right for you: the counts of your 👍, 👎, yes, done, Undo and dismiss taps per kind of card over 30 days (counts only, never what a card said), pooled with everyone else who said yes, to set how sure Nudgy must be before it makes each kind of card. Your own counts tune your own cards either way; only a yes adds them to everyone's.

• Names and places come out first. Before anyone reads an example, people's names and places are replaced with labels like [Person 1] and [Place 1], and emails, phone numbers, links, street addresses and long numbers are removed. This happens on Cloudflare, using a model Cloudflare hosts. Companies and products stay, because they're what a card is about.
• Who reads them. The Nudgy team and the AI tools we use to build Nudgy read the de-identified examples, to check whether a card was right and to turn good ones into test cases. Before we change how Nudgy decides what to show you, we replay those test cases through the same AI provider that answers you (OpenAI, with store: false) to make sure the change is better, not worse.
• What they're never used for: training AI models, ads, or anything outside making Nudgy better. They're never sold or shared.
• How they're kept. Examples are encrypted with a key that belongs to your account alone. De-identified test cases may be copied to the computer Nudgy is built on. They are never published, and a copy is removed once its example is deleted.
• How long. Twelve months at most. Turning it off deletes your examples and dictations at once; so do forgetting the card or conversation an example came from, and deleting your account.

Voiceprints

To tell your voice from others, the phone makes a voiceprint — numbers that describe how a voice sounds. Laws such as Illinois's Biometric Information Privacy Act, Texas's and Washington's treat these as biometric data, so Nudgy asks for your written OK first, in the app. Your voiceprint stays sealed on your iPhone and is never uploaded. Other people's voices are never saved as voiceprints: the phone tells them apart only for that day's conversations (Voice A, Voice B…), and a name you give one is a label for that conversation only. Voices an earlier version of Nudgy saved are deleted from the phone once. The sealed voiceprint is kept in this iPhone's Keychain, for this iPhone only: never synced to iCloud and never moved to another phone. It's tied to your account, so deleting and reinstalling Nudgy on the same iPhone and signing in again keeps it, and signing in as a different account deletes it. In Nudgy for Mac, Set Up Your Voice makes its own voiceprint the same way, after the same OK, sealed on that Mac only and never uploaded; signing out of the Mac deletes it. Telling voices apart on the server (Cloud transcription with speakers, Deep Listen's live transcript) happens only after that OK; the speech service keeps nothing. Nudgy destroys voiceprints when you delete them in My voice, sign out, delete your account, or three years after you last used the app — whichever comes first. They're never sold, leased, traded or shared.

Numbers we publish

We may publish combined numbers about how Nudgy performs — how fast it answers, how much battery it uses and what it costs per hour of listening — each from at least three people's phones. They never include names, words, places or times of day, and they never identify anyone.

Keeping it safe

• Recordings are encrypted on the phone; everything between the phone and the server travels over HTTPS, and the server's data is encrypted at rest by Cloudflare. On top of that, the words themselves — what was heard, what a card says, what you asked Nudgy — are encrypted on the server with a key made for your account alone, so no one else's account, and no copy of the database, can read them.
• Keys for AI providers, GitHub and the other services live only on the server, never in the app; the services you connect hold their own sign-ins (through Composio), and disconnecting revokes them.
• Mail, web pages, meeting notes and code are treated as information, never as instructions, so text written to trick an AI can't make Nudgy send, pay, merge or delete anything.
• If we learn of a breach that affects your data, we'll tell you and the authorities as the law requires.

What Nudgy never does

• No ads, no tracking across apps or websites, no selling or sharing data for marketing.
• No face recognition: no identifying or naming people in photos, no faceprints.
• Nothing sponsored without a label: if a brand ever pays for something Nudgy shows you, it will say so, and your data never goes to a brand without your yes for that brand.
• No analytics inside the app; the website counts its visits and the server sends Mixpanel the word-free usage records described above. Sentry gets reports of what broke, never of how you use Nudgy.
• Nothing is sent, paid, submitted or deleted on your behalf without your confirmation.

Every service above handles your data only to provide Nudgy to you (and, if you turn on Help make Nudgy better, to test it as described above), under protections at least as strong as these.

How long it's kept

Transcripts — the words of each stretch — are kept for 90 days and then cleared (Settings → Privacy lets you choose a shorter or longer window); what Nudgy made from them — notes, cards, briefs, My Mind — is kept until you delete it or your account. Once a week, Nudgy shows you that week's conversations with other people's voices in them, and for each you choose keep (the normal 90 days) or delete (their lines go; yours, and whatever Nudgy made from the talk, stay). If you don't answer, nothing is deleted and it asks again the next week. A Deep Listen keeps everyone's lines only once the recording notice is answered, and isn't in the weekly ask. In a browser, or on a Mac where you haven't set up your voice, Nudgy can't tell voices apart, so a stretch there counts as a conversation with other people, and delete removes all of its words; cards and reminders made from it stay. When you take a fact or a person out of My Mind, Nudgy keeps a short note of it so it isn't learned again from the same talks; that note is in your export and goes with your account. So does a topic you asked Nudgy to forget, which is kept encrypted, never shown to an AI, and listed in your export by the words you used. The decision log is deleted after 30 days. A record of each agreement you give or withdraw — the Nudgy agreement with the name you signed it with, the recording notice, the voiceprint release, your age group, Help make Nudgy better — and when, is kept as long as your account, so there's proof of what you agreed to; it's in your export and deleted with your account. Your mailbox isn't copied: the headers and previews it reads are judged and dropped, and only the cards it made for you (the sender, subject and a short preview) are kept. Opening a card reads that email from Gmail again and keeps it for at most a minute.

Getting a copy

Settings → Export saves everything the server keeps for you — conversations, cards, My Mind, your settings — as one file, to Google Drive, Files or wherever you choose. Your board comes as its own file too: every photo and file you added, with what Nudgy wrote about each.

Seeing, deleting and forgetting

Settings → My data shows what the server keeps, which apps are connected, who can see what, and a log of what was read from your apps and shared lately. You can pause learning so My Mind stops updating.

Delete or forget anything. You can delete any line Nudgy wrote down, any stretch, conversation or Deep Listen, any dictation it kept, and any card. You can edit or delete anything My Mind remembers; a memory you edit stays in your words. You can also ask Nudgy to forget everything about something ("forget everything about my sister's surgery"): it first shows you how much it found, and only when you say yes does it delete every line, card, memory, person and dictation about it from Nudgy's servers. To find them it looks for the words you used and the names in your own My Mind; if you've said yes to AI, one quick AI call also lists the other names and spellings it goes by. After that, Nudgy won't learn it again: the topic is kept only as a short encrypted note on your account, checked by the server's own code after the AI answers, and never sent to an AI provider. You can see and change that list in Settings → Privacy & my data; taking a topic off it doesn't bring anything back. The log of what Nudgy did says how many things it deleted, never what about. Deleted words leave Nudgy's live database at once; Cloudflare's recovery copy of the database keeps them for up to 30 days, and we only ever use it to repair damage, never to bring back something you deleted. What already went to someone you linked Nudgys with is theirs, and isn't changed.

Deleting your data

Settings → Delete my account deletes everything on the server — every conversation, note, brief, connection and log line — revokes Sign in with Apple, deletes your address from Loops, and erases the recordings and transcripts on your iPhone. It can't be undone. Pausing the microphone (the mic at the top of Home) stops listening at any time.

Children

Nudgy isn't for children under 13 and doesn't knowingly collect their data. If you're 13 to 17, you need a parent's or guardian's permission to use it, and the app asks. If you believe a child under 13 is using Nudgy, write to us and we'll delete the account.

Your rights

Wherever you live, you can see, export, correct and delete what Nudgy keeps about you (Settings → Export and Delete my account, or write to us), and withdraw any agreement in Settings. Nudgy doesn't sell or share personal information, or use it for targeted advertising. California residents have these rights under the CCPA/CPRA, and people in the EU/UK under the GDPR; we answer requests within the time those laws allow.

Changes and contact

If this policy changes, the date above changes and the app says so. Questions or requests: matthew.parkk0@gmail.com.