Privacy Policy — Nudgerator

Last updated: May 7, 2026

The Nudgerator is a reminder app that understands medication refill cycles, free-trial deadlines, and all your recurring tasks that need to be done again, eventually. It's operated by Omega Darling (contact: [email protected]). This policy explains what data the service collects when you create an account on app.nudgerator.com or use the Nudgerator Android app, how that data is used, and your rights.

What we collect

When you sign up and use Nudgerator, the service stores:

• Account credentials. Your chosen username and a salted, one-way hash of your password (PBKDF2-SHA256 via Werkzeug). The plaintext password is never stored, logged, or transmitted after the initial submission.
• Two-factor authentication state (only if you enable 2FA). A TOTP secret used to verify codes from your authenticator app — encrypted at rest with a server-only key (AES-128 via Fernet) so a read-only database leak does not expose your 2FA seed. Single-use backup codes are HMAC-hashed at rest.
• Reminder data you create. Item names, categories, dates, notes, pickup history, archive flags, and per-item notification preferences. If you choose to use the medication category, the names you enter may be health-related — that information is stored alongside your other reminders, isolated to your user account.
• Notification topic. An ntfy.sh topic string (per-user, randomly generated by default) used to deliver push notifications to your devices.
• Account metadata. The timestamp your account was created and the timestamps of items you've created, edited, archived, or deleted.

Nudgerator does not collect: location data, camera or microphone input, contacts, photos, advertising IDs, browser fingerprints, device identifiers, IP address logs, analytics events, or any data outside the categories listed above. The app contains no third-party advertising or analytics SDKs.

How we use it

Your data is used solely to provide reminder-tracking functionality:

• Authenticate you when you sign in.
• Store and display the reminders you create.
• Compute due dates and trigger notifications via ntfy.sh.
• Sync your data between the web and Android clients you use.

Where it lives

• Server. A private server at the operator's residence in the United States, running Flask and SQLite in a Docker container. The database file is on a private volume; only the operator has shell access.
• Android device. A local cache of your reminder data is kept on your device for offline use. It is removed when you log out, switch accounts, or uninstall the app.
• Backups. The operator runs filesystem-level backups for disaster recovery. These include account and reminder data and are kept on private storage controlled by the operator.

What we share

Nothing. Nudgerator does not sell, trade, lease, or share your data with third parties. The operator does not access individual users' reminder data except as strictly required to debug a problem you have explicitly reported.

One third-party service is involved by design: ntfy.sh is the public push-notification relay used to deliver reminders to your devices. When a reminder fires, the notification body and your ntfy topic are sent to ntfy.sh so they can route the push. You can change your ntfy topic at any time in Settings, or disable push notifications entirely.

Account deletion

To delete your account and all associated data, email [email protected] from the address on file (or, if you didn't supply an email at signup, from any address while including your username and a recent backup-code identifier so we can verify ownership). Deletions are processed within 7 days and remove every row tagged with your user ID — items, pickups, settings, tombstones, TOTP state, and the user record itself. Deleted data is not recoverable.

Children

Nudgerator is not directed to children under 13, and the operator does not knowingly collect personal information from anyone under 13. If you believe a minor has created an account, contact us and we will delete the account.

Changes to this policy

If this policy changes in any material way, the change will be announced via in-app notification. The "Last updated" date at the top of this page always reflects the current version.

Contact

Questions or concerns: [email protected]