Legal

Privacy Policy

Effective date 1 November 2026 · Last updated 1 November 2026 · Version 2.0

This Privacy Policy explains how NudgiFi Technologies Limited (trading as NudgiFi — “NudgiFi”, “we”, “us”, “our”) handles personal information when you use the NudgiFi mobile app, our website at https://nudgifi.com, and related support services. It covers information processed on your device as well as the much smaller set of information received by our account service. Features differ by platform, device, permissions and release.

Related documents: Terms of Service · Cookie Policy · Sub-processors · Delete your account · Consumer Health Data Privacy Policy (Washington and Nevada residents)

At a glance

1. Who is responsible for your information

The data controller is NudgiFi Technologies Limited, a company registered in England and Wales under company number 16620072, with its registered office at 199 St. Saviours Road, Birmingham, West Midlands, B8 1HW, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC281299.

For users in the European Economic Area, our representative under Article 27 of the EU GDPR is NudgiFi Technologies SRLS, Via Albertini 36, 60131 Ancona, Italy, reachable at [email protected]. You may contact either us or our representative on any matter concerning this policy.

We have not appointed a statutory Data Protection Officer because we are not required to; the privacy contact above handles all data-protection matters.

This policy applies to our own services. App stores, sign-in providers, calendar accounts, operating-system services and backup destinations handle information under their own privacy notices. We explain those connections in section 9.

2. Our data-handling approach

NudgiFi provides personal goals, tasks, reminders, AI-assisted coaching and contextual insights. Its personal AI processing is designed to run on your device. Detailed task content, onboarding answers, conversations, voice and face templates, sensor history, location history, photos, chats, learned memories and the personalised model trained for you are kept in account-specific app storage on your device. They are not uploaded to the NudgiFi account service.

Our servers receive only what is needed to run your account: identity and sign-in information, selected goal categories, coaching preferences and limited progress information (section 3).

Local-first does not mean offline. Account operations, model downloads, support requests and third-party services you choose require internet connections, and exports or backups you make can leave the app’s private storage. Section 9 lists every recipient.

We do not sell personal information, use private content for targeted advertising, or upload private content to train a shared or public AI model. Any material change to these commitments requires an updated policy and, where the law requires it, your consent, before it takes effect.

3. Information used for your account

Identity and sign-in. Name or display name, email address, account identifier, verification status and account timestamps. If you use a password, we store a password hash, never the password itself. Verification and reset codes, session credentials and security records support authentication and account recovery. If you sign in with Google or Apple, we receive the identity information and authentication tokens that provider supplies; we never receive your Google or Apple password.

Preferences and progress. Selected goal categories; language, coaching style, reminder and quiet-hour preferences; opaque task references and completion status; aggregate counts, streaks and basic progress. Opaque task references do not contain task titles or notes and cannot be reversed by us to reveal them.

Support. Information you send to support, including attachments you deliberately provide, is processed to respond to you.

4. Personal information processed on your device

The following is processed only when you use the relevant feature and have granted the relevant permission. Granting a permission and switching a feature on are separate controls. The goals, tasks and reminders features work with every optional permission refused; related optional functions are simply unavailable.

4.1 Goals and personal reflections. Task titles, descriptions, notes, schedules, completion details, chats and feedback organise your plans and personalise assistance. Onboarding answers may describe routines, motivation, stress, anxiety, mood, sleep, relationships or other wellbeing matters. Associated scores and inferred traits are personal inferences, not clinical diagnoses.

4.2 Voice and conversations. Voice features may process microphone audio, recordings, transcripts, speaker labels, conversation summaries, action items and voice embeddings. Live conversation sessions can retain audio recordings for playback and speaker processing. Speaker samples and voice-ID enrolment recordings are retained when those features are used (see section 5, Biometric features).

4.3 Short sound samples. When contextual audio is enabled, the app can sample a few seconds of nearby sound while preparing context or nudges. These clips are processed in memory and are not saved as recordings. Derived information — a sound category, a noise estimate and a confidence value — may become part of local context or history. This is separate from live conversation recording and voice enrolment, which do save audio.

4.4 Images and people. Camera, selected-image, supported-glasses and social-memory features may process images, scene descriptions, face crops, face embeddings, people labels and encounter details. Social-memory images and face templates are retained on your device only; we never receive them. Camera permission does not mean every visual feature is running.

4.5 Mood snapshots (emotion recognition). On supported Android devices, if you switch on the separate Mood snapshots feature, the app may capture a brief front-camera image after a phone interaction, estimate your mood from it in memory, discard the image and keep only the mood estimate and confidence value. This is an emotion-recognition function within the meaning of the EU Artificial Intelligence Act. It is off by default, is indicated on screen while active, is available only for your own personal use, and must not be used in a workplace or educational setting (see Terms, section 6). Mood estimates can be wrong and are never used to make decisions about you.

4.6 Location and movement. With permission, the app can process approximate or precise location, places you name, journeys, movement and inactivity, step or activity information, and accelerometer, gyroscope, compass, proximity, ambient-light and related sensor readings. Background access lets supported features continue when the app is not visible. From these signals the app may infer places, routines and behavioural episodes — for example “commuting”, “at the gym” or “a long period of inactivity” — to time nudges appropriately.

4.7 Device use and context. Depending on your choices, the app may process app-usage and screen-session information, device and operating-system capabilities, battery and charging state, and connectivity and accessory state. Usage access reveals patterns of device use, never the content of messages or of other apps.

4.8 Calendar and health. Calendar access provides event titles, times, locations and availability so reminders avoid unsuitable moments. If you add a task to a calendar, its details are written to that calendar and synced by its provider. On supported Apple devices, optional Health access can read authorised steps, workouts and sleep information. Health-derived information stays on your device, is never shared with any third party, and is never used for advertising, data brokerage, marketing or any purpose unrelated to the feature you enabled.

4.9 Learning, personalisation and sensitive inferences. The app derives preferences, constraints, commitments, habits, mood or wellbeing estimates and confidence values. A confidence value is an estimate, not a guarantee. The app also trains and updates a small personalised model on your device, using only your own data, for you alone; that model never leaves your device except inside a backup you create, and is not combined with any other user’s data. Some inputs and inferences may be health information, biometric data or other sensitive information under applicable law even though they remain on your device; we apply the safeguards in sections 5 and 7 to them.

5. Biometric features

Two optional features create biometric templates — mathematical representations that can distinguish one person from another:

Before either feature is enabled we ask for your separate, explicit consent with a plain-language explanation; granting the operating-system camera or microphone permission is not that consent. Templates are used only to distinguish or recognise speakers and people inside the feature. They are not an identity document and are never used as an authentication or security credential. Biometric matching can be wrong.

Retention and destruction. Templates are deleted when you remove the person or enrolment, disable the feature, delete the account’s data from the installation, or uninstall the app, and in any case no later than three years after the feature was last used, whichever comes first. NudgiFi never receives, stores or has access to biometric templates. If you record or save another person, you are responsible for having their permission (Terms, section 6).

6. Permissions and your control

The app explains each access request and then uses the operating-system permission dialog or directs you to the relevant settings page. You can refuse access, withdraw it in device settings, or change feature settings at any time. A permission review may appear when you set up a new installation even if your account already exists. Turning off access stops new collection through that permission; it does not automatically delete information already saved — use the in-app delete controls for that.

• Microphone and speech support voice input, conversations and audio context. You can stop recording and disable audio capture in the app.

• Camera supports visual features and, where available, the separately controlled Mood snapshots feature. Social memory can retain images and face templates; mood snapshots are discarded after analysis.

• Location supports places and journeys. Background location is a separate choice. Approximate access reduces accuracy. Device location services must be enabled.

• Motion, activity, sensors and Health support movement and wellbeing context. Some basic hardware readings do not require a separate permission dialog.

• App usage / Screen Time identifies usage patterns and requires platform authorisation.

• Notifications, exact alarms and overlay support reminder delivery and nudges shown over other apps. Battery and background settings affect whether Android keeps coaching or sensors running.

• Android accessibility service (optional) is used solely for the disclosed service-recovery function that restarts coaching after the app is closed. A separate in-app explanation and system authorisation apply. It does not read screen content and is never used for advertising or to collect credentials.

• Bluetooth connects supported accessories. Calendar supports scheduling. Files access is used for models, selected imports, exports and backups; broad file access, where offered, is optional and is never used to upload unrelated files.

Permission does not guarantee uninterrupted background operation; the operating system can pause or stop collection. NudgiFi is not an emergency-monitoring service.

7. Why we process information and on what legal basis

Where consent is the basis you can withdraw it at any time in the app or in device settings; withdrawal does not affect earlier lawful processing but may stop the feature working. We never treat an operating-system permission as a substitute for a separate consent or notice the law requires. Where we rely on legitimate interests we have balanced them against your interests; contact [email protected] for details.

We have carried out a data protection impact assessment covering the biometric, emotion-recognition and background-monitoring features.

8. AI personalisation and automated processing

On-device models and rules analyse the information available to them to produce nudges, summaries, transcriptions, context estimates, mood estimates and learned memories. These outputs may be incomplete, inaccurate or inappropriate. They are never used to make decisions with legal or similarly significant effects about you — such as eligibility for employment, credit, insurance, housing or healthcare — and we do not use NudgiFi’s estimates for solely automated decision-making of that kind. You decide whether to act on a suggestion and can correct or remove saved information in the app.

We do not send private conversations, images, health answers or sensor histories to the NudgiFi backend or to any cloud AI service. Three narrow exceptions involve ordinary technical data only:

• Model downloads. Downloading an AI model discloses ordinary connection information (IP address, requested file) to the model host listed on our Sub-processors page.

• Google ML Kit. Some on-device vision and language functions use Google’s ML Kit libraries. Google states that ML Kit may contact its servers for updates and sends metrics about the performance and utilisation of the ML Kit APIs to Google. These metrics are technical; they do not contain your images, audio or text. See https://developers.google.com/ml-kit/terms.

• Platform speech and translation. Optional speech-to-text or translation features use the device’s own services; the app requests on-device processing where supported. Availability and handling depend on your device and its provider.

Any future optional cloud AI processing would be introduced only with a clear notice and, where applicable, your consent before any private content is sent. Echo, the AI guide on our website, is separate from the app and is described in section 10.

9. Who may receive information

9.1 Service providers (processors). We use a small number of providers to run the account service, website and support. They may process account, connection, security or support information strictly for the service they provide and under contract. They never receive the on-device content described in sections 4 and 5. The current list, with locations and purposes, is maintained at https://nudgifi.com/subprocessors and currently comprises Cloudflare (website hosting, account service and database), Google (Google Cloud services, Google Sign-In, Play services and push notifications, ML Kit metrics), Apple (Sign in with Apple, push notifications, App Store), Hostinger (domain and email hosting), the model hosts for AI model downloads, and, for the website only, Anthropic and ElevenLabs (Echo, the website guide) and Web3Forms (website forms).

9.2 Services you choose. Google or Apple process sign-in under their own terms. Your calendar provider receives entries you add. Operating-system and accessory services process what those features need. An export, share action, backup folder or cloud-storage destination you choose transfers content to that destination; review the recipient’s practices first.

9.3 Legal and business disclosures. We may disclose information we hold where reasonably necessary to comply with a legal obligation or valid legal request; to protect rights, safety and service security; or to address fraud or abuse. If the business is reorganised, financed, sold or transferred, relevant information may be disclosed subject to safeguards and notice. None of this gives us or anyone else remote access to content stored only on your device.

9.4 What we do not do. We do not sell personal information or share it for cross-context behavioural advertising. We do not provide private audio, health information or biometric templates to advertisers or data brokers. We do not use your content to train a general-purpose model for other users.

10. Website and connection information

When you visit our website, Cloudflare’s hosting and security systems process your IP address, browser and device information, requested pages, timestamps, error information and security logs to deliver and protect the site. Our website uses strictly necessary cookies only; see the Cookie Policy.

Echo, the website guide. If you type a message to Echo, the AI guide on our website, your message, the recent conversation, the page you are on and your approximate country (as reported by Cloudflare) are sent through our Cloudflare service to Anthropic, which generates Echo’s reply. If you switch Echo’s voice on, the text of her replies is sent to ElevenLabs to produce audio; if ElevenLabs is unavailable, your browser’s own text-to-speech voice reads the reply instead, and in some browsers, such as Chrome, that voice is provided online by the browser maker. If you use Echo’s microphone button, your browser’s own speech-recognition service converts your speech to text; in some browsers, such as Chrome, the browser provider processes that audio on its servers. Our service does not store Echo conversations. Echo is not part of the NudgiFi app; please do not share personal information with it.

Forms. When you submit the contact or waitlist form, the details you enter (such as your name, email address, message and preferred platform) are delivered to us by email through Web3Forms, which states that it does not keep submissions and deletes its server logs every two months. We use them only to reply to you or to send waitlist updates.

Demo videos. The product page shows demo videos hosted on Google Drive. A video loads only when you press play; until then your browser does not connect to Google. When you play one, Google receives your IP address and browser information and may read or set its own cookies under Google’s privacy policy.

11. International processing

We operate from the United Kingdom and Italy. Information received by our servers and providers is processed in the United Kingdom, the European Economic Area and the United States (where our hosting and sign-in providers operate). Information retained only on your device is not transferred internationally by us; your own cloud backups or connected accounts may involve transfers under their providers’ rules.

Where a transfer requires safeguards we rely on an adequacy decision (including the UK–EU adequacy arrangements and the EU–US and UK–US Data Privacy Framework for certified providers) or on standard contractual clauses / the UK International Data Transfer Addendum, with additional measures where needed. Contact [email protected] for details of the safeguard applying to a particular transfer.

12. Storage, security and retention

The app separates private local data by account. Application-owned databases and application-created backup archives are encrypted by the app. Saved audio recordings and some other media rely on the operating system’s file-based encryption and app sandbox, which protect them while your device is locked. Protect your device, credentials and backup recovery key. No method of storage or transmission is completely secure. If a personal-data breach occurs we will notify the relevant regulator within 72 hours and notify you where the law requires it.

Retention rules

• Account identity, preferences and basic progress: while the account is active or until you request deletion.

• Session and verification credentials: for their configured lifetime or until revoked; related security records follow the 12-month security-log period.

• Account-service and website security logs: 12 months.

• Support correspondence and attachments: 24 months after the ticket closes.

• Deleted server records in restricted disaster-recovery backups: up to 35 days, after which they expire under the backup schedule. If a backup is restored, deletion instructions are re-applied.

• Detailed local content (goals, notes, chats, transcripts, recordings, voice samples, social memories, derived context, personalised model): on your device until you remove it, the feature’s disclosed clean-up rules apply, or you delete the account’s data from that installation. Biometric templates: section 5.

• Short ambient-audio clips and mood-snapshot images: never retained; derived records follow the local-data rule above.

• Records kept for a specific legal obligation or dispute: limited to what is necessary for the applicable period; we explain any such exception when responding to a request.

App backups and exports stored where you choose are separate copies under your control. Scheduled backups may include recorded audio, voice profiles and other selected categories. Deleting a record in the app does not erase an earlier exported copy.

13. Deleting your account and local content

In the app: Profile → Privacy and account → Delete account, then confirm. The account service deletes your account and associated records, and the app removes that account’s private data from the installation. If local clean-up is interrupted, reopen the app to finish.

Without the app: go to https://nudgifi.com/delete-account or email [email protected] from the address on the account. We may verify that you control the account using proportionate information. We complete requests within one month, and normally within 10 working days, and confirm completion and any lawful retention exception.

Uninstalling the app does not delete your server account. Deleting the server account cannot erase exports, calendar entries, cloud-storage copies or private files on an offline device; remove those through their own controls and clear app data on other devices. We do not keep a recoverable copy of local-only content; losing your device, local files or recovery key can make that content unavailable.

14. Your privacy rights

Depending on the law that applies to you, you may request access, a copy or portable version, correction, deletion, restriction, information about disclosures, withdrawal of consent, or objection to certain processing, and you may have rights concerning sensitive information and automated decisions. We will not discriminate or retaliate against you for exercising a right.

Use the in-app review, export, forget, delete and permission controls, or contact [email protected]. An account export does not include data stored only on your device; use the local export or backup controls for that content, which we cannot supply because we do not hold it. We may request proportionate verification and, where applicable, evidence that an authorised agent may act for you. We respond within the legal deadline (normally one month) and explain any lawful refusal, limitation or extension. Appeals go to the same address.

United Kingdom, EEA and Switzerland. Your rights include access, rectification, erasure, restriction, portability, withdrawal of consent and objection. You may complain to the Information Commissioner’s Office (https://ico.org.uk) in the UK, the Garante per la protezione dei dati personali (https://www.gpdp.it) in Italy, or your own supervisory authority. Our EU representative is identified in section 1.

United States. Where state privacy or consumer-health laws apply, you may have rights to know, access, correct, delete, obtain a copy, appeal, and opt out of sale, targeted advertising or profiling. California residents may limit specified uses of sensitive personal information. The categories, sources, purposes and recipients are described in sections 3–10. We do not sell or share personal information for cross-context behavioural advertising and we honour Global Privacy Control signals. Residents of Washington and Nevada should also read our separate Consumer Health Data Privacy Policy at https://nudgifi.com/consumer-health-privacy. Residents of Illinois, Texas and Washington have specific biometric rights; section 5 states our biometric practices and retention schedule.

India and other regions. Where applicable and in force, rights may include access to processing information, correction and erasure, grievance redressal and withdrawal of consent; our grievance contact is [email protected]. Users in Canada, Australia, New Zealand, Brazil and elsewhere may have equivalent local rights. Mandatory local rights prevail over anything inconsistent in this policy.

15. Children and age

NudgiFi is for people aged 16 or over. We do not offer the service to anyone under 16 and do not knowingly collect information from them. If you believe a child under 16 has created an account, contact [email protected] and we will investigate and delete the information where required. A store age rating does not replace this rule.

16. Changes to this policy

We may update this policy as the service, our practices or the law changes. We publish each new version with an updated date and version number, keep earlier versions available, and give additional notice in the app or by email where a change materially affects you or the law requires it. Where a new purpose or a new use of sensitive data requires consent, an updated policy alone does not replace obtaining that consent.

17. Contact and complaints

Privacy requests and concerns: [email protected]. Support: [email protected]. Post: NudgiFi Technologies Limited, 199 St. Saviours Road, Birmingham, B8 1HW, United Kingdom. We acknowledge complaints within 5 working days and aim to resolve them within 30 days. You may also complain to the ICO, the Garante or your own regulator, or seek any remedy available under applicable law.