benudge Privacy Policy

Last updated: 2026-10-20

This Privacy Policy explains how benudge collects, uses, protects and shares personal data when you use our mobile app, our web app at benudge.io/app, our website benudge.io and related services (the "Service"). benudge is operated by [Company name] Pte. Ltd., a company incorporated in Singapore (UEN [pending]), registered office [registered office address], Singapore ("we", "us", "our"). We are the organisation responsible for your personal data under Singapore's Personal Data Protection Act 2012 (the "PDPA"). If you do not agree with this policy, please do not use the Service.

benudge is a shared household organizer for two or more people. Some of what you put into benudge is meant to be shared with your household; some of it is private to you. This policy says which is which.

1. Who we are and how to reach our Data Protection Officer

Our DPO is responsible for making sure we meet the PDPA, answers access and correction requests, and is the first person to contact with a complaint. The DPO's business contact information is registered with ACRA on BizFile+ as the PDPA requires. [counsel: confirm the DPO designation wording once the officer is appointed]

2. What we collect, and why (notification of purpose)

We collect only what the Service needs. Each row says what it is for and whether your household can see it.

We do not collect: contacts, browsing history, advertising identifiers, biometric data, precise continuous location, financial account details, heart rate, or anything from your health data other than the daily sleep total and, only for a workout goal you add, daily steps and exercise minutes (iPhone, with permission).

3. Consent: what you agree to by using benudge, what needs a separate yes, and how to withdraw

Deemed consent by contract. When you create an account, you are asking us to provide the Service; the account, household, calendar, chore, list, note, life-admin, device and subscription data in §2 is collected because the Service cannot work without it. The PDPA calls this deemed consent, and we rely on it for those categories only.

Express consent (off until you say yes). Each of the following is a separate, optional yes, asked in the app at the moment it matters, and each can be switched off again:

• Apple Health (sleep; and separately steps and exercise minutes for a workout goal).
• The microphone and speech recognition, the camera, location, and notifications (each through your phone's own permission prompt).
• Rhythm learning for your work, personal and health areas. Household chores are learned by default, because timing household reminders is the core of the Service. [counsel: confirm that household rhythm learning may rest on deemed consent by contract, or whether it needs its own express opt-in]
• Product and marketing email (marketing_opt_in, off by default).
• Sharing a specific goal, interest, preference or photo with your household.

Withdrawing consent. You can withdraw any express consent in the app or in your phone's settings at any time, and we stop the related processing within a reasonable time. Withdrawing has consequences we will tell you about when you do it: without Apple Health, Energy uses the sleep you enter by hand; without notifications, reminders appear only when you open the app; without rhythm learning, timing falls back to your quiet hours and the household defaults. Withdrawing the consent the Service itself depends on means deleting your account (§7).

4. How we use your information

• Provide the Service: calendar, chores, lists, notes, reminders, life admin, verified chores, Daily Debrief, Energy, Joy & Rewards, rhythms, add-ons, the web app.
• Produce AI results (captures, verdicts, summaries, suggestions) using Anthropic Claude under a zero-data-retention agreement. Our AI providers do not train on your data.
• Keep the Service reliable and secure, detect abuse, and meet legal obligations.
• Send operational messages (security, billing, account) and, if you opt in, product emails.

We do not sell your personal data, do not share it for cross-context behavioural advertising, and do not use it for advertising of any kind.

5. We do not track you

benudge does not track you across other companies' apps or websites. We do not request App Tracking Transparency permission because we do nothing that requires it. The app contains no Meta, TikTok or other advertising SDKs. Our website has no analytics, advertising pixels or tracking cookies. Install attribution (AppsFlyer) uses store-provided, privacy-preserving signals and our own links, not cross-app identifiers.

6. Your partner and your household

benudge separates three kinds of data:

1. Household data: calendar, chores, lists, notes, messages, home life-admin items, points, verdicts, ❤. Every adult member of the household can see these. On the Family tier, kids see what a parent assigns to them. A tablet you set up as a wall display shows household data only, never anyone's private items.
2. Private-by-default data: your Daily Debrief transcripts and summaries, your Energy score and its inputs, your health daily totals, your interests and goals, your preferences, your rhythm profile, your work, personal and health life-admin items, the private memory benudge keeps about you, your captures before you approve them, your devices and notification settings, your location events. Your partner cannot see these, and we build the database so that each person's private rows are separated from everyone else's, including other members of the same household. You may choose to share a specific goal, interest or preference.
3. Shared-by-choice data: a goal, interest or preference you share, a together reward, a photo you choose to show. A shared preference shows your partner the preset value only (for example "Groceries: delivered"), never the free-text note behind it.

What benudge remembers. Settings → What benudge remembers lists every durable fact benudge has kept from your captures, Debriefs and preference answers, each with a share toggle and a forget button. How you like to work shows what was learned about your rhythm, per area, with edit and reset.

Removing a member from a household removes their access to household data; it does not give anyone access to that member's private data.

7. Access, correction, export and deletion (your rights)

You can, at any time:

• Access and export your personal data: Profile → Account → Export produces a zip of JSON files (GET /users/me/export) covering your private data (Debrief, Energy, health totals, goals, preferences, memory, rhythm profile, devices and notification log) and the household data you can see. Or write to the DPO. We answer access requests as soon as reasonably possible and within 30 days; if we need longer we tell you within those 30 days when you will have it. We do not charge for access or correction. [counsel: confirm that no fee is charged for any access request]
• Correct your information in the app (profile, preferences, learned rhythms, every item you created), or ask the DPO to correct it. Where we have passed the data to a processor in the last year we send them the correction too.
• Delete your account: Profile → Account → Delete account, or at benudge.io/delete-account. Deletion removes your account within 30 days and destroys your personal encryption key, which makes your encrypted private data (Debrief, health values, captures, memory, preference notes, rhythm notes) unreadable immediately (crypto-shred). Notes and household messages are encrypted under a key shared by the household, so they stay readable to the remaining members and are not shredded when one member leaves. Household data you created (chores, events, lists) stays with the household unless you remove it first; your name on it is replaced with "a former member". Your records at our processors (analytics, attribution, subscriptions) are deleted at the same time.
• Opt out of product emails (link in every email) and of optional analytics (Settings → Privacy).
• Withdraw permissions: Apple Health, location, microphone, camera and notifications can each be turned off in your phone or browser settings; the related feature stops, everything else keeps working (§3).
• Complain: to our DPO first (dpo@benudge.io); if you are not satisfied, to the Personal Data Protection Commission of Singapore (pdpc.gov.sg).

8. Health data (Apple Health / HealthKit)

If you choose to connect Apple Health on iPhone, benudge reads sleep analysis as a daily total only (last night's sleep) to compute your Energy score. If you add a workout goal or task, benudge asks separately whether it may "count your steps and exercise minutes toward this goal"; only if you allow it does it read step count and exercise minutes, as daily totals, to track that goal. benudge does not read heart rate or any other Health data type. benudge:

• uses sleep only to compute your Energy score and explain it to you in plain words, and uses steps and exercise minutes only to show progress on your own workout goal; steps and exercise minutes never feed Energy;
• never uses Health data for advertising, marketing, or any purpose other than providing the Energy feature and progress on your own workout goals;
• never shares Health data with your partner, your household, or any third party for their own purposes; it is never used in points, the leaderboard, analytics values, or any comparison between people;
• never sells Health data, never uses it to make eligibility decisions, and never discloses it to data brokers, insurers, employers or advertisers;
• sends only daily totals off the phone (never raw samples), encrypts the values per user, keeps them for 365 days on a rolling basis, and destroys the keys when you delete your account. The coarse hour-of-day window in which you usually sleep (used only to avoid nudging you then) is stored unencrypted by design;
• does not write anything to Apple Health. Apple Health is not available on a Mac or in the web app; there, Energy uses the sleep you enter by hand.

You can disconnect Apple Health, or just the activity permission, at any time in iPhone Settings → Privacy & Security → Health, or in benudge → Energy. Energy then falls back to manual entry, and workout goals fall back to ticking them off by hand. Android users enter sleep manually in V1.0; Health Connect support is planned for a later release and will be covered by an update to this policy.

9. AI processing

Captures, chore photos, Debrief transcripts, spoken preference answers and the inputs to suggestions and plans are processed by Anthropic Claude models under a zero-data-retention agreement: Anthropic does not store your content after responding and does not train on it. For Capture and the Debrief, speech recognition runs on your phone or in your browser; only when on-device recognition is unavailable or low-confidence is the audio clip sent to Deepgram, which transcribes it and does not store it. The onboarding voice step uploads the clip to our server for Deepgram transcription and deletes it after transcription. AI outputs can be wrong; nothing is added to your household without your review, and verdicts can be retaken. Your rhythm profile reaches the planner only as a short sentence ("you tend to work in longer weekend sessions"), never your timestamps.

Suggestions you see in benudge are generated from your own household data plus a published evidence list (see Settings → About → Where our suggestions come from). They are offered as options, never as advice about your relationship or health.

10. Children

benudge is not directed at children. Children under 13 use benudge only through a parent's Family account, as a profile with the kid role that a parent or guardian creates and controls. For those profiles:

• An adult account holder creates the child's profile and approves rewards and verdicts. Children do not create their own accounts, enter an email, or receive marketing.
• We collect for a child only: display name, age band, the chores assigned to them, completions, points, and verification photos they take if a parent enables it. No Debrief, Energy, health, interests, preferences, rhythm learning, AI suggestions or location features are available to kid profiles; the app enforces this.
• We treat children's data as sensitive: it is never used to train AI models, never used for analytics beyond counts, and never shown outside the household.
• Children's photos are processed only for the verdict and are deleted with the household's photos (30 days) or sooner on request.
• A parent can delete a child profile at any time from the household settings.

Teenagers aged 13 to 17 who use benudge with their own account should read this short version: we keep what you put into benudge to run your household's calendar, chores and lists; your private areas stay private from everyone, including your family; we never sell your data or show you ads; you can download or delete everything from Profile → Account; a parent or guardian can ask us about your data through dpo@benudge.io. This follows the PDPC's Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment (2024). [counsel: confirm the children's wording and whether a parent's consent must be verified for a 13–17 account] [counsel: confirm COPPA treatment for US families]

11. Marketing

We send product and marketing email only if you opt in (marketing_opt_in is off by default), and every such email carries an unsubscribe link, as Singapore's Spam Control Act requires. We do not market by phone call or SMS, so the Do Not Call Registry does not apply to us. Operational messages (security, billing, account) are not marketing and are sent as long as you have an account.

12. Sub-processors and transfers outside Singapore

We share the minimum personal data required with the following processors, each bound by a written contract that requires them to protect your data to a standard at least comparable to the PDPA (the PDPA's transfer limitation obligation). Because they are outside Singapore, each row is an overseas transfer; the contracts are the AWS Data Processing Addendum, the vendors' own data processing agreements, and EU Standard Contractual Clauses where the vendor offers them. [counsel: confirm the transfer mechanism per sub-processor against the PDPC's Transfer Limitation guidance]

Data we never send to any vendor: Debrief text, transcripts, health values, raw Energy scores (bands only), chore/event/list/note titles, your preference values or notes (analytics see only which question was answered), your rhythm timestamps (bands only), your partner's private rows, photos (except to Anthropic for the verdict and Amazon S3 for storage), emails or names (except to the email and shipping providers that need them), precise location, push, web-push or invite tokens.

13. Retention

We keep personal data only as long as the purpose in §2 needs it, and a nightly job (purge_retention in our worker) deletes it at the periods below. Deleting your account removes everything else within 30 days.

Calendar, chores, lists, notes, life-admin items and points are kept while your account is active and deleted with the account. Analytics events are pseudonymous and kept for 24 months. [counsel: confirm the 24-month analytics period]

14. Protection (security)

• Every link is encrypted. Your phone and browser only ever talk to us over TLS 1.2 or newer; our servers talk to the database, the queue and the photo store over TLS as well, and the service refuses to start in production otherwise. There is no plaintext path, inside or outside our cloud network.
• Encryption at rest. The database, photos and backups are encrypted by the provider. On top of that, field-level envelope encryption (AES-256-GCM) protects your private text and values with a key that belongs to you: Debrief transcripts and summaries, health values, personal memory, captures, the free-text notes behind your preferences and rhythm profile. That key is destroyed on account deletion (crypto-shred). Notes and household messages use a per-household key, so they remain readable to the household when one member leaves. Preference preset values (short labels such as online or evening), the coarse hours of your usual sleep window and your learned rhythm numbers are stored unencrypted by design, because they carry no free text and are needed for scheduling queries.
• What this is not. benudge is not end-to-end encrypted: our servers hold the keys so that they can time reminders, grade photos and plan your day. Our staff do not read your content; access is logged, and support tooling never shows private rows. [counsel: confirm this plain-language statement]
• Separation. Row-level security in the database separates households and separates each partner's private data within a household; the app serves only what the signed-in person may see.
• Access. Passwords hashed (bcrypt); short-lived access tokens; refresh tokens rotated on use and revoked if replayed; sign-in attempts are rate-limited; Sign in with Apple is bound to the device that started it; passkeys planned for a later release.
• Devices. Beacon proximity events are signed so a client cannot forge one. QR sticker secrets can be rotated by the household if a sticker is lost or shared. Leaving wall-display mode on a shared tablet requires the household's display PIN. On the phone, cached data is held in encrypted storage behind the device keychain.
• Remote configuration. On launch the app fetches feature flags, the minimum supported version and any maintenance notice so we can disable a feature quickly if it misbehaves; no personal data is sent with that request.
• Testing. Security posture: OWASP MASVS-L1 plus selected L2 controls. Static analysis and dependency scanning run on every change; one external penetration test before public launch.

15. Data breach notification

If we discover a breach of your personal data we assess it within 30 days. When the breach is notifiable under the PDPA (it is likely to result in significant harm to you, or it affects 500 or more people), we notify the Personal Data Protection Commission no later than 3 calendar days after that assessment, and we notify you as soon as practicable, with what happened, what data was involved and what we are doing about it. Where people in the UK or the EU are affected we also meet the 72-hour notification duty to their supervisory authority. Our DPO runs this process; the steps are written down in our operations runbook.

16. If you are outside Singapore

UK and EU. You keep your rights under the UK GDPR and the EU GDPR: access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with the ICO or your local supervisory authority. Our lawful bases are performance of our contract with you (providing the Service), your consent (Apple Health, microphone, location, rhythm learning outside the household, optional analytics, product emails), and legitimate interests (security, fraud prevention, crash diagnostics). [counsel: confirm whether an EU or UK representative under Article 27 is required for the beta and at launch]

California and other US states. You have the right to know, delete, correct, and to opt out of sale or sharing (we do neither), and the right not to be discriminated against for exercising these rights. Submit requests at privacy@benudge.io or in-app. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA. [counsel: CPRA "Limit the Use of My Sensitive Personal Information" applicability given health data]

17. Changes to this policy

We will notify you of material changes in the app and update the date above. Continued use after a change means you accept the revised policy.

18. Contact

dpo@benudge.io (Data Protection Officer) · privacy@benudge.io · support@benudge.io · [Company name] Pte. Ltd., [registered office address], Singapore