Privacy and end-to-end encryption

Nudje’s answer to “who can see my reminders?” is: you, and nobody else. The free app keeps everything on your phone. If you subscribe to cloud sync, your data is end-to-end encrypted before it leaves the device — our servers store ciphertext they cannot read, ever. The full cryptographic design — keys, algorithms, threat model — is documented in How the encryption works, technically.

The free app: on-device by default

• No account. No sign-up. The app is fully usable without ever telling us who you are.
• Reminders, history, and streaks live in a local database on your phone.
• No tracking: no advertising identifier, no ATT prompt on iPhone, nothing sold — ever.
• The only data that leaves the device: anonymous crash reports and (if you leave it on) anonymous usage analytics — both to servers we host ourselves, with no third-party processors, no persistent identifiers, and a switch in Settings.

Cloud sync (Nudje+): zero-knowledge encryption

When you enable sync, your reminders are encrypted on your phone with XChaCha20-Poly1305, using keys that only your devices hold. What our servers store is indistinguishable from random bytes.

• Your recovery code is the only key to your data. It’s shown once when you set up sync. We cannot reset it, recover it, or read your data without it — that’s not a policy, it’s mathematics. Write it down somewhere safe.
• Sharing is encrypted too. When you share a caregiver profile, its key is wrapped for the other person’s device — the server relays sealed envelopes it can’t open.
• What the server does see: that an account exists, how many encrypted records it stores, when they sync, and who shares with whom. It never sees titles, times, medication names, or history. We spell this out because honest metadata disclosure is part of the promise.

Ads (and where there are none)

The free app shows a single, low-frequency banner — contextual only, never personalized, never tracking. And in the EU, UK, and Switzerland the app shows no ads at all, categorically. Both paid tiers remove ads everywhere.

Deleting your data

• Free app: delete the app, and everything it stored goes with it (export a backup first if you want one).
• Nudje+: Settings → Account → Delete account erases your ciphertext, keys, and account records from our servers. Under zero-knowledge encryption, erased ciphertext is unrecoverable by construction.