Privacy Policy

Last Updated: March 21, 2026

Overview

Nudge ("we", "our", or "the App") is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use our AI coding tool approval application.

Information We Collect

1. Anonymous Authentication Data

• What: An anonymous Firebase Authentication user ID
• How: Created automatically when you pair your device with a CLI tool
• Purpose: To link your mobile device with your AI coding tool session
• PII: None — no email, name, phone number, or password is collected

2. Device Token (FCM)

• What: A Firebase Cloud Messaging registration token
• How: Generated by Firebase when you grant notification permissions
• Purpose: To deliver push notifications to your device
• Storage: Stored server-side in Firestore, associated with your anonymous user ID
• Rotation: Automatically rotated on app reinstall; invalid tokens are cleaned up

3. Approval Event Data

• What: Tool name, provider name (e.g., "Claude Code"), event description, tool input (e.g., shell commands for Bash), working directory path, and your approval/denial response
• How: Sent by the CLI plugin when your AI coding tool requests permission
• Purpose: To display the approval request and deliver your response back to the CLI
• Storage: Stored in Firebase Realtime Database with a 24-hour TTL (auto-deleted). After you respond, the TTL is shortened to 1 hour to minimize the data exposure window. Sensitive fields (tool input, description, working directory) are end-to-end encrypted (AES-256-GCM) using a shared key established during pairing — our servers store only ciphertext and cannot decrypt your data. Additionally, all data is encrypted at rest by Google Cloud (AES-256) and in transit (TLS 1.3).
• Credential redaction: Before encryption and transmission, the CLI plugin automatically redacts common credential patterns (Bearer tokens, API keys, AWS keys, --password flags) from command strings, replacing them with [REDACTED]. Large code blocks (file content, diffs) are truncated to 2,000 characters.
• Note: Working directory paths may contain your system username (e.g., /Users/yourname/project).

4. Subscription Data

• What: Subscription status (free/pro) and expiry date
• How: Managed by RevenueCat through Apple's App Store
• Purpose: To determine feature access (daily event cap for free users, unlimited for Pro)
• Payment data: We never see or store credit card details — Apple handles all payment processing

5. Stable Device Identifier

• What: A randomly generated device identifier stored locally on your device
• How: Generated once at first launch and persisted in device Secure Store
• Purpose: To track daily event usage for the free plan cap (30 events/day). This identifier survives re-pairing to prevent cap circumvention.
• PII: None — this is a random UUID, not linked to any hardware identifier or personal information

Data We Do NOT Collect

• Personal identification information (name, email, phone number)
• Full source code files or complete repository contents — tool inputs containing code snippets (e.g., file edits, diffs) are truncated to 2,000 characters before transmission and auto-deleted after 24 hours
• Raw credentials or secrets — these are automatically redacted from commands before transmission
• Device identifiers for tracking or advertising
• Location data
• Contacts or other personal data
• Usage analytics or crash reports (MVP)
• Browsing history or app usage patterns

How We Protect Your Data

Communication Security

• All communication uses HTTPS with TLS 1.3
• CLI-side tokens are stored in ~/.nudge/config with file permission 600 (owner read/write only)
• Mobile-side tokens are stored in device Secure Store

End-to-End Encryption

• Sensitive event fields (tool input, description, working directory, session name) are encrypted client-side using AES-256-GCM before being sent to our servers
• The encryption key is derived during device pairing using PBKDF2 (600,000 iterations) and shared only between your CLI and mobile device
• Our servers store and relay only ciphertext — we cannot read your data, even if compelled
• Push notification payloads include a compact encrypted blob that is decrypted on-device by iOS Notification Service Extension before display

Push Notification Security

• Push notification payloads contain unencrypted metadata (tool name, event type) for notification routing, plus an encrypted blob for display content
• The encrypted blob is decrypted on-device before the notification is shown to you — Apple/Google servers see only ciphertext
• Payload size is limited to 4KB (FCM/APNs limit), with automatic truncation of large fields

Data Retention

• Approval events (Realtime Database): Auto-deleted after 24 hours (shortened to 1 hour after response)
• Pairing codes: Expire after 10 minutes; one-time use
• FCM tokens: Removed when device is unlinked or token becomes invalid
• User data: Deleted entirely (Firestore + Realtime Database) when you delete your account

Third-Party Services

Firebase (Google)

• Purpose: Anonymous authentication, Firestore database, Cloud Messaging (push delivery)
• Data shared: Anonymous user ID, FCM token, event metadata
• Privacy Policy: https://firebase.google.com/support/privacy

RevenueCat

• Purpose: Managing in-app purchases and subscriptions
• Data shared: Anonymous user ID, purchase history (managed by Apple)
• Privacy Policy: https://www.revenuecat.com/privacy

Apple Push Notification Service (APNs)

• Purpose: Delivering push notifications to iOS devices
• Data shared: Notification content (tool name, description — no source code)
• Privacy Policy: https://www.apple.com/privacy/

Your Rights and Controls

You have complete control over your data:

• View: See all approval events in the app's Events screen
• Unlink Device: Signs you out and disconnects your device from the CLI. Your server-side data (anonymous user ID, session history, pairing records) is retained so you can re-pair later without losing context. Local credentials and cached events are cleared from your phone.
• Delete Account: Permanently and irreversibly deletes your account and all associated data — including your anonymous user profile, approval events, session history, pairing codes, and FCM tokens — from both the server (Firestore, Realtime Database, Firebase Auth) and your device. This action cannot be undone.
• Revoke Permissions: Disable push notification permissions in iOS Settings at any time

Permissions Explained

Push Notifications (Required)

• Purpose: To receive approval requests from your AI coding tools
• Scope: Alert, sound, and badge notifications
• Note: You can revoke this permission anytime in iOS Settings, but you will not receive approval requests

Camera Access (Optional)

• Purpose: To scan QR codes for device pairing
• Scope: Camera access only during QR scanning
• Note: You can pair using a text code instead — camera is not required

Children's Privacy

Nudge is a developer tool and is not intended for use by children under 13. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Updating the "Last Updated" date
• Displaying a notice in the app (for material changes)

Data Deletion

To delete all your data:

1. Open the Nudge app
2. Go to Settings
3. Tap "Delete Account" at the bottom
4. Confirm deletion — this permanently removes your account, events, pairing codes, and device tokens from our servers

Alternatively, uninstalling the app removes all local data. Server-side data (anonymous user ID, events) is auto-deleted after 24 hours of inactivity.

Contact Us

If you have questions about this Privacy Policy or your data:

Email: app.nudge@enterx.jp

Legal Compliance

This app complies with:

• Apple App Store Review Guidelines
• General Data Protection Regulation (GDPR) principles
• California Consumer Privacy Act (CCPA) principles
• Japan's Act on the Protection of Personal Information (APPI)

Your Consent

By using Nudge, you consent to:

• This Privacy Policy
• Anonymous authentication for device pairing
• Push notification delivery for approval requests
• Storage of event data on our servers (24-hour TTL)

You can withdraw consent by:

• Deleting your account in Settings
• Unlinking your device
• Revoking notification permissions
• Deleting the app

Summary: Nudge collects no personally identifiable information. Authentication is fully anonymous. All sensitive event data is end-to-end encrypted (AES-256-GCM) — our servers cannot read your data. Credentials are automatically redacted before encryption. Push notification content is encrypted and decrypted only on your device. Approval event data is auto-deleted after 24 hours. You can delete your account and all data at any time from Settings.