Privacy Policy

Nudgy · last updated October 1, 2026

Nudgy listens to your day on your iPhone, understands what you say, and does the next thing — sets the reminder you mentioned, writes the brief you asked for, remembers the people you talk about. This page says exactly what that takes, where each piece goes, and how to delete it. Nudgy is made by HMU, INC.

What stays on your iPhone

• Recordings. Audio is recorded, encrypted on the phone with a key in your Keychain, and turned into text on the phone. It is never uploaded — unless you turn on Cloud transcription (Settings → Voice & listening), in which case short clips — or, while you dictate or Deep Listen, the live audio — are transcribed by a speech model on Cloudflare's servers (where Nudgy's server runs), Deepgram or OpenAI, and are not stored by us or kept by them.
• Your voiceprint — the numbers that tell your voice from others — is sealed on the phone and never leaves it.
• Photos. Nudgy looks at when and where your photos were taken, on the phone, to connect moments. Photos are never uploaded.
• Contacts. Names from your contacts help recognize names you say. They stay on the phone.
• Screen Time. Which apps you pick is kept by Apple's Screen Time; Nudgy never learns them.
• Camera. Voice setup can use the front camera's depth sensor on this iPhone to measure how far away you're holding it. No image or face data is recorded, stored or sent, and it isn't used for anything else. It's optional; without it a loudness meter guides you.

What goes to Nudgy's server

The server runs on Cloudflare. It receives and keeps:

• The text of stretches of conversation (with "Only me" on, just your own words), and when they happened. Words another voice said reach the server only after you've agreed to the recording notice below; until then they're left out. When the words sound like a show, a song or a video playing nearby rather than people there, Nudgy doesn't learn from them: they make no notes or topic cards and stay out of My Mind (something you ask for over them still counts); they're kept like any other stretch's words;
• The place where a stretch happened (a place name and coordinates), when location is on — only while you're using the app;
• Your name, a one-way hash of your Apple (or Google) sign-in id and of the email it verified — so either sign-in finds the same account — your settings, and the push-notification token for your device;
• Your email address as your sign-in shared it (with Apple's "Hide My Email", the relay address), encrypted, so HMU, INC. can see who uses Nudgy and reach you about it. Only Nudgy's owner can read it; it's deleted with your account;
• What Nudgy made for you: reminders, notes, answers, research briefs (as private pages at unguessable links), and the long-term picture in My Mind (facts, people, topics, your daily patterns). A reminder to call someone keeps only the name as you said it ("Call Mom"); the number is found in Contacts on your iPhone and never sent. If you connect Apple Notes, your iPhone adds each note to Apple Notes itself, through a shortcut on your phone; Nudgy's server never reads or writes your Apple Notes. My Mind never keeps one-time codes, passwords or sign-in links it hears;
• A decision log (what it decided and why, what each step cost), kept 30 days.
• Which of its cards you open, any 👍 / 👎 you give them, whether you dismissed, undid or said yes to one, and when the app opens and closes — so HMU, INC. can see whether Nudgy is actually useful. These are counted, never read for words; they're never used for ads or shared, and they're deleted with the card or your account;
• Your conversations with Nudgy (what you ask in Ask or through Siri, and its answers), so a follow-up question makes sense — kept for the same time as transcripts;
• For leave-by and sharing your ETA, one location point: the latest your phone sent, replaced each time — never a history of where you've been.
• For a reminder "when I get home" or "when I leave the gym", the place's name with the reminder, from what you said. Your iPhone finds that place and watches for it itself: where it is, where you are, and the moment the reminder goes off stay on your iPhone (its log notes the time and the place's name, never coordinates, and only reaches us if you send it yourself with Settings → Send the ledger). Nudgy's server only hears what you do with the card (Done, or In 1 hour), as with any reminder.
• Your feedback: a 👍 or 👎 on a card, what you write when something was off, and your answer when Nudgy now and then asks how it's doing. What you write is encrypted with your account's key, read only by the Nudgy team to make Nudgy better, and deleted with your account;
• Crash reports, while "keep crash reports" is on (Settings): Apple's own report of a crash or freeze — which part of Nudgy's code was running, the app version, iOS version and iPhone model. Never your words or audio. Kept 30 days, only to fix what broke. If Nudgy crashes before you've signed in, the same report is sent with a random number the app makes for itself instead of your account, so it's tied to no one — also kept 30 days;
• Invites. Who invited you, if someone did (only their first name is ever shown to you), the invite links you have to give (encrypted, shown only to you), and the first name of whoever came in with each. Someone opening your invite link sees only your first name. If you joined with a friend's invite, Nudgy asks you once whether to link your Nudgys; a link shares nothing until one of you says yes to a request (see Linked Nudgys), and your answer is kept so it isn't asked again.

The waitlist, invite links and the website

If you join the waitlist on nudgy.run, Nudgy keeps your email address, encrypted, so someone can send you an invite — nothing else about you. Only Nudgy's owner can read it. It's deleted 90 days after you're sent an invite, after 12 months on the list, or whenever you ask: write to matthew.parkk0@gmail.com from that address.

If a friend sends you an invite link and you type your email address on it, Nudgy sends that address to Apple, which emails you the TestFlight invite (Apple's privacy policy covers it from there). Nudgy doesn't keep the address. It keeps the first name you typed, if you gave one, which your friend sees, and a one-way fingerprint of the address, so that if you sign in to Nudgy with the same email your account is connected to your friend's invite. The fingerprint is erased when you sign in, or after 30 days. To be taken off TestFlight, write to matthew.parkk0@gmail.com from that address.

The website counts its visits with PostHog and Cloudflare Web Analytics, without cookies and without following you to other sites. The app itself sends no analytics to anyone.

AI providers

To understand what you said and act on it, the text above is sent to an AI provider: OpenAI. If you pick a model in Settings → Answers from, your questions, research briefs and reply drafts go to that model's provider instead — OpenAI or Google (Gemini). They are used through their business APIs, which do not use this data to train their models by default; Nudgy also asks OpenAI not to store its answers (store: false) and opts out of Deepgram's model-improvement program on every request. Research briefs may search the public web through the same provider. Quick steps — transcribing and tidying dictation — may run on open models hosted by Cloudflare, where Nudgy's server runs. Cloud transcription, if you turn it on, sends audio clips to a speech model on Cloudflare, Deepgram or OpenAI for transcription.

Nothing goes to any of these providers until you say yes in the app ("can i send your words to ai?" in the first run, or Settings → Brain). The server keeps that answer and checks it before every call it makes, including the ones it makes on its own, like reading new mail; turn it off and nothing more is sent.

Connections you choose

• Google (through Composio): if you connect it, Nudgy reads the headers and short previews of recent mail to find what needs you, can draft replies, and adds events to your calendar — but nothing is sent or added without your tap. It also reads your coming week's calendar, and finds Drive files and contacts when you ask about them. Turn "Use email details" off and no mail is read at all. Disconnecting revokes the grant and deletes what was read.
• Outlook (through Composio), if you connect it, is read the same way as Google: the senders, subjects and short previews of recent mail, and your coming week's calendar. Microsoft is asked for reading mail, drafting and sending replies, and reading your calendar — nothing else. A reply is drafted only when you ask and sent only when you tap Send; Nudgy never moves or deletes your mail and never changes your calendar. Disconnecting revokes the grant and deletes what was read.
• Other apps you connect in Settings (GitHub, Notion, Linear, Granola, Spotify, LinkedIn) go through Composio the same way. Nudgy reads a little from each — your open issues and pull requests, recently edited page titles, meeting titles and notes, the artists you play — to answer your questions and keep My Mind up to date; Granola meeting notes are kept beside that part of My Day. Anything it would make in an app (an issue, a page, a doc) waits for your yes, and each app's page in Settings lets you switch its actions off. Disconnecting revokes the grant and deletes what was kept from it. You can connect more than one account of an app (several Google accounts, say): each is read the same way, one is your primary (where drafts and calendar holds go), and removing one revokes only its sign-in and deletes only what was read from it.
• Instagram, YouTube and Facebook, if you connect them: Nudgy asks each only for read-only access, and reads your account's numbers — followers or subscribers, reach and views — and how each of your posts, Reels and videos did (views, likes, and how many comments, shares and saves), so you can ask how something's doing. It never reads your messages and never posts, comments or changes anything there. It keeps those numbers day by day, and each of your posts with its counts and the first words of its caption (encrypted with your account's key), so it can show trends and tell you when a post takes off — for 13 months. Disconnecting revokes the grant and deletes what was kept from that app.
• Coding sessions: when you say yes to building something, the repository you picked is worked on either on your own Mac or in a private, temporary Cloudflare container that can reach only GitHub, OpenAI and the public package registries. The code and your request go to the coding agent's AI provider (OpenAI). The work lands as a draft pull request on its own branch; nothing is merged. Your GitHub access is added by Nudgy's server outside the container and never stored in it.
• Weather: when you ask about the weather, and for the sky behind Home (clear, cloudy or raining where you are, checked about every 30 minutes while Nudgy is open), your approximate location — the last point your phone sent, rounded to about a kilometer — is sent to Open-Meteo to get the weather. Nothing else about you is sent with it, and the sky never sends a new location of its own.
• iMessage (through Photon): if you text Nudgy, those texts pass through Photon to reach it.
• Travel times: for "leave now" cards and ETAs, your current location and where you're headed are sent to Apple Maps (Apple's Maps Server API). Trip plans look up the place and its forecast with Open-Meteo, and search the web for ways to get there — nothing is ever booked.
• Sharing your ETA: only when you say yes. The person gets a link that shows your ETA (or, if you chose it, where you are now) until you arrive, the time you set, or you stop it — then the link ends and your last point is deleted.
• Linked Nudgys: when you and someone else link your Nudgys, you choose what their Nudgy may get from yours — free/busy times, your ETA, messages — and each can ask you every time. Nothing else crosses: not what Nudgy hears, not your memory, mail or places. Everything that crosses is in the link's log.
• Background on people: when you ask about someone in public life, Nudgy searches the web and public sources (like GitHub and paper indexes) and keeps a brief with its sources. It never looks up home addresses, phone numbers, family or private life, and stops at public, professional information for private individuals.
• Work Nudgy does in steps (a brief, a trip, an errand you hand it): what you asked, its working notes, what it found and the result, and a log of each step — all encrypted with your account's key. The step log is deleted 30 days after the work ends; the result stays with its card until you delete the card or your account, and work that never made a card is deleted after 90 days. Anything it would send, book, buy or share waits for your yes.

Other people, and recording laws

Nudgy hears what's around you, including people who haven't agreed to be recorded. In many places — California, Florida, Illinois, Washington, Pennsylvania, Massachusetts, Maryland and other all-party-consent states, and many countries — recording a private conversation needs everyone's agreement. Before Nudgy keeps anything another voice says, you agree to this notice: you'll let people know Nudgy is listening and get their OK where the law asks for it, and pause it (the mic at the top of Home) when you can't. "Only me" keeps just your own voice. Nudgy never uses anyone's words to train AI models, and never sells or shares them.

Helping make Nudgy better (only if you turn it on)

Help make Nudgy better (Settings → Privacy & your data) is off unless you turn it on, and Nudgy works the same either way. It's for people 18 and over. When it's on, Nudgy keeps a short example from some of the cards you react to (👍, 👎, dismissing, undoing, saying yes, ticking a reminder done) and a few lines that made no card: the line the card came from, up to three lines from the 30 seconds before it, what the card said, and what you did with it. Other people's lines are included only if you've agreed to the recording notice above.

• Names and places come out first. Before anyone reads an example, people's names and places are replaced with labels like [Person 1] and [Place 1], and emails, phone numbers, links, street addresses and long numbers are removed. This happens on Cloudflare, using a model Cloudflare hosts. Companies and products stay, because they're what a card is about.
• Who reads them. The Nudgy team and the AI tools we use to build Nudgy read the de-identified examples, to check whether a card was right and to turn good ones into test cases. Before we change how Nudgy decides what to show you, we replay those test cases through the same AI provider that answers you (OpenAI, with store: false) to make sure the change is better, not worse.
• What they're never used for: training AI models, ads, or anything outside making Nudgy better. They're never sold or shared.
• How they're kept. Examples are encrypted with a key that belongs to your account alone. De-identified test cases may be copied to the computer Nudgy is built on. They are never published, and a copy is removed once its example is deleted.
• How long. Twelve months at most. Turning it off deletes your examples at once; so do forgetting the card or conversation they came from, and deleting your account.

Voiceprints

To tell your voice from others, the phone makes a voiceprint — numbers that describe how a voice sounds. Laws such as Illinois's Biometric Information Privacy Act, Texas's and Washington's treat these as biometric data, so Nudgy asks for your written OK first, in the app. Your voiceprint and any voices you name stay sealed on your iPhone and are never uploaded. Telling voices apart on the server (Cloud transcription with speakers, Deep Listen's live transcript) happens only after that OK; the speech service keeps nothing. Nudgy destroys voiceprints when you delete them in Voice & listening, delete your account, or three years after you last used the app — whichever comes first. They're never sold, leased, traded or shared.

Keeping it safe

• Recordings are encrypted on the phone; everything between the phone and the server travels over HTTPS, and the server's data is encrypted at rest by Cloudflare. On top of that, the words themselves — what was heard, what a card says, what you asked Nudgy — are encrypted on the server with a key made for your account alone, so no one else's account, and no copy of the database, can read them.
• Keys for AI providers, GitHub and the other services live only on the server, never in the app; the services you connect hold their own sign-ins (through Composio), and disconnecting revokes them.
• Mail, web pages, meeting notes and code are treated as information, never as instructions, so text written to trick an AI can't make Nudgy send, pay, merge or delete anything.
• If we learn of a breach that affects your data, we'll tell you and the authorities as the law requires.

What Nudgy never does

• No ads, no tracking across apps or websites, no selling or sharing data for marketing.
• No third-party analytics in the app (the website counts its visits, as above).
• Nothing is sent, paid, submitted or deleted on your behalf without your confirmation.

Every service above handles your data only to provide Nudgy to you (and, if you turn on Help make Nudgy better, to test it as described above), under protections at least as strong as these.

How long it's kept

Transcripts — the words of each stretch — are kept for 90 days and then cleared (Settings → Privacy lets you choose a shorter or longer window); what Nudgy made from them — notes, cards, briefs, My Mind — is kept until you delete it or your account. When you take a fact or a person out of My Mind, Nudgy keeps a short note of it so it isn't learned again from the same talks; that note is in your export and goes with your account. The decision log is deleted after 30 days. A record of each agreement you give or withdraw — the Nudgy agreement with the name you signed it with, the recording notice, the voiceprint release, your age group, Help make Nudgy better — and when, is kept as long as your account, so there's proof of what you agreed to; it's in your export and deleted with your account. Your mailbox isn't copied: the headers and previews it reads are judged and dropped, and only the cards it made for you (the sender, subject and a short preview) are kept. Opening a card reads that email from Gmail again and keeps it for at most a minute.

Getting a copy

Settings → Export saves everything the server keeps for you — conversations, cards, My Mind, your settings — as one file, to Google Drive, Files or wherever you choose.

Seeing and forgetting

Settings → My data shows what the server keeps, which apps are connected, who can see what, and a log of what was read from your apps and shared lately. You can forget a single fact, person (with any brief about them), card or stretch of conversation, and pause learning so My Mind stops updating.

Deleting your data

Settings → Delete my account deletes everything on the server — every conversation, note, brief, connection and log line — revokes Sign in with Apple, and erases the recordings and transcripts on your iPhone. It can't be undone. Pausing the microphone (the mic at the top of Home) stops listening at any time.

Children

Nudgy isn't for children under 13 and doesn't knowingly collect their data. If you're 13 to 17, you need a parent's or guardian's permission to use it, and the app asks. If you believe a child under 13 is using Nudgy, write to us and we'll delete the account.

Your rights

Wherever you live, you can see, export, correct and delete what Nudgy keeps about you (Settings → Export and Delete my account, or write to us), and withdraw any agreement in Settings. Nudgy doesn't sell or share personal information, or use it for targeted advertising. California residents have these rights under the CCPA/CPRA, and people in the EU/UK under the GDPR; we answer requests within the time those laws allow.

Changes and contact

If this policy changes, the date above changes and the app says so. Questions or requests: matthew.parkk0@gmail.com.