Privacy policy
Nag stores your tasks so it can nag you about them. It does not track you, sell anything about you, or build a profile of you. This page says exactly what it keeps, where, who else is involved, and how to get rid of it.
- What Nag stores
- Using Nag without an account
- Device permissions
- What it is used for
- Who else is involved
- Advertising
- How long it is kept
- Your choices and rights
- Security
- Children
- Changes
- Contact
The short version. Signed in, Nag keeps your email address, your tasks (with their notes, files and history), your settings, and the push tokens of the devices you use, on servers run by Supabase. That is what syncing and server-side nagging need. Signed out, nothing leaves your device. Ads on the tasks screen come from Google and are requested as non-personalised on iOS. You can delete everything from Settings.
What Nag stores
When you sign in, Nag keeps the following in your account. Nothing else is collected.
| Data | Why |
|---|---|
| Email address | It is your sign-in. Nag sends a six-digit code to it and never stores a password. |
| Tasks: title, type, spoon estimate, time anchor, repeat rule, notes, and the history of alerts, snoozes, deferrals, completions, skips and spoon checks | So your tasks follow you between devices, so the server can nag a device that has not synced yet, and so the Friction tab can show you your own patterns. |
| Attachments: the photos and files you add to tasks, with their names, types and sizes | So they open on every device you use. They are stored in a private bucket under a folder only your account can reach. |
| Settings: parts of the day, week start, sound and re-nag preferences | So the server nags on the schedule you chose. |
| Push subscriptions: a push token per device or browser, a device name such as "iPhone (a1b2c3)", and when the device last synced | So the server can send a nag to a device that does not hold its own alarm. The device name is there so you can recognise it. |
| Siri token: a hash of the personal token the Siri shortcut uses, if you turn Siri on | So text you dictate to Siri lands in your account and nobody else's. The token itself stays on your phone. |
| Delivery log: for each nag the server sent, the task, the device it went to, and whether delivery succeeded | To debug notifications that do not arrive. It contains no task text. |
| Feedback: the problem reports and ideas you send from Settings, with your app version, platform, system version and device model | So they can be read and answered. Nothing about your tasks is included unless you type it. |
Nag has no analytics, no crash reporting, no advertising identifier collection of its own, and no third-party sign-in. It never asks for App Tracking Transparency permission because it does not track.
Using Nag without an account
You can use Nag without ever signing in. Tasks, files and settings then stay on your phone or in your browser, alerts come from the device itself, and nothing is sent to any server. Signing in later uploads what is on that device into your account.
In the browser, tasks and settings live in the site's local storage and attached files in its IndexedDB database. Clearing the site's data in your browser erases them, and Settings → Erase everything does the same on any device.
Device permissions
Nag asks for these only when the feature that needs them is used, and works without any of them.
- Notifications: to deliver nags. On iOS they are marked time-sensitive so a nag can reach you during a Focus mode; you can turn that off for Nag in iOS Settings.
- Photos and camera: only when you attach a photo to a task, and only the photo you choose or take. Nag does not read your photo library, and nothing is uploaded unless you are signed in.
- Siri: only if you turn Siri on in Settings. Apple converts what you say to text; Nag receives the text and nothing else.
Nag does not use your location, contacts, microphone (outside Siri, which Apple handles) or any advertising identifier.
What it is used for
- Running the service: syncing tasks and files between your devices, sending nags to devices that need them, and adding tasks you dictate to Siri.
- Showing you the Friction tab, which is computed from your own task history and shown only to you.
- Sending sign-in codes to your email address. Nag sends no other email: no newsletters, no reminders by email, no marketing.
- Reading and answering the feedback you send from Settings.
Nag does not sell personal data, does not share it with data brokers, and does not use it to train anything.
Who else is involved
Nag runs on services from these companies. Each sees only what its job needs.
| Service | What it handles |
|---|---|
| Supabase | The database, file storage and sign-in system that hold your account. Everything in the table above lives here. |
| Brevo | Delivers the sign-in code emails. Brevo sees your email address and the code, and keeps its own delivery logs under its privacy terms. It is used for nothing else: Nag sends no other email. |
| Apple | Push notifications to iPhones go through the Apple Push Notification service. If you use Siri, Apple processes what you say and passes the text to Nag under Apple's own privacy terms. |
| Expo (Expo Application Services) | Relays push notifications from Nag's server to Apple, using the push token of your device, and delivers app updates. Expo sees the token and the notification text, which is the task's title and the nag's wording. |
| Your browser's push service (Apple, Google or Mozilla, depending on the browser) | Web notifications while the tab is closed go through the browser vendor's push service. The content is encrypted to your browser; the vendor sees only that a message was sent. |
| Google (AdMob on iOS, AdSense on the web) | Serves the one ad on the tasks screen. See Advertising. |
Servers may be located outside your country, including in the United States. Where required, transfers rely on the providers' standard contractual clauses.
Advertising
The tasks screen shows one banner ad after the first open task. On iOS it comes from Google AdMob and is requested as a non-personalised ad: Nag never asks for tracking permission and never passes Google an advertising identifier for tracking. Google still receives your IP address, coarse location derived from it, basic device information and diagnostic data about its own ad component in order to serve and measure the ad, and uses its own cookies or identifiers under Google's advertising policies. In the EEA, the UK and Switzerland, Nag shows Google's consent form before the first ad and honours your choice.
On the web the ad comes from Google AdSense, which sets cookies as described in Google's policies. You can opt out of personalised ads at Google's ad settings.
Nag shares none of your task data with Google, and the ad never sees what you are being nagged about.
How long it is kept
- Your account and everything in it stays until you delete the account, or delete individual tasks and files, which removes them from the server as well as your devices.
- A task you delete is marked deleted and kept for 90 days so your other devices learn about the deletion, then removed from the server for good, together with its delivery log entries.
- The delivery log is kept for debugging and is deleted with the account.
- Feedback you send is kept so it can be acted on, and is deleted with the account.
- Sign-in codes expire after ten minutes. Sessions on your devices last until you sign out.
Your choices and rights
- See and export everything: Settings → Export JSON gives you a file of your tasks, history and settings. Attachments open, and can be saved, from each task.
- Delete everything: Settings → Account → Delete account removes your account, tasks, notes, files, settings, push subscriptions, feedback and Siri token from the server, and clears the device. It cannot be undone and takes effect immediately.
- Stop notifications in your device's notification settings; Nag will still work in the app.
- Turn Siri off in Settings, which revokes the token.
- Use Nag signed out, in which case there is no account to hold anything.
If you are in the EEA, the UK or another place with data-protection rights, you can also ask for access, correction, deletion, restriction or portability of your data, object to processing, and complain to your local data-protection authority. Nag processes your data to provide the service you signed up for; ads in the EEA and UK rely on the consent you give in Google's form. Write to the contact below for anything the Settings screen does not cover.
Security
Everything travels over TLS. On the server, row-level security means your account can only ever read or write its own rows and its own files. On your phone, the session is encrypted at rest with a key held in the iOS Keychain. No system is perfectly secure, so if you believe your data has been exposed, contact us and we will investigate.
Children
Nag is not directed at children under 13, and under 16 in the EEA and UK, and does not knowingly hold their data. If you believe a child has created an account, contact us and it will be removed.
Changes
If this policy changes in a way that matters, the app will say so on its next update and this page will show the new date at the top. Continuing to use Nag after that means you accept the change.
Contact
Nag is run by Daniel Mullins, 325 Stonecrest Dr, Nashville, TN 37209, United States, who is the data controller for your account. Questions, requests and complaints: me@danielericmullins.com.