Privacy Policy
The short version. What you write in Ndge stays on your iPhone. If you sign in with Apple, a copy also goes to your own private iCloud account, which belongs to you and not to us. We run no server that holds your answers and we have no way to read them.
Separately, the app sends anonymous usage counts so we can tell whether it is working, and you can switch those off. If you subscribe to the full archive, Apple and RevenueCat process the purchase. Neither of those ever includes anything you write.
What Ndge stores on your device
Questions, your answers, any notes you type, and any photos you attach are saved in a private database on your iPhone that only Ndge can read. Deleting the app removes all of it.
iCloud backup, if you choose it
Signing in with Apple is optional and nothing in the app requires it. If you do sign in, your entries are mirrored to your own private iCloud database using Apple's CloudKit.
That data sits in your personal iCloud account, governed by Apple's privacy policy. We cannot see it, query it, or export it. You can switch the backup off at any time in Settings, or revoke access entirely in iOS Settings under your Apple Account.
When you sign in, Apple gives the app a user identifier and, on the first authorisation only, your name. Both are stored in your device's keychain and are never transmitted anywhere. Ndge does not request your email address.
Anonymous usage measurement
Ndge sends a small set of events to PostHog, an analytics service, so we can see whether people keep using the app. Every event is a count, a yes/no, or a value from a fixed list.
| Collected | Not collected |
|---|---|
| A random identifier created when you install the app Whether the app was opened, and for how long Whether a check-in was answered, skipped or put off How many options you tapped, and whether you added a note or photo App version, iOS version, device model, screen size, language, time zone | Your questions or answers Anything you type Your photos Your name or email address Your location Your IP address Any advertising identifier |
This is enforced by how the app is built rather than by policy alone. The event format has no field capable of carrying free text, and an automated check fails the build if one is ever added.
IP-based location lookup is disabled, and the IP address itself is discarded rather than stored. If you sign in with Apple, the random installation identifier is linked to a one-way cryptographic hash of your Apple user identifier so that the same person on two devices is counted once. The identifier itself is never sent.
You can turn usage measurement off in the app under Settings → Privacy & support. Off means this phone sends nothing further.
Subscriptions
The full archive (every note beyond the last four days) is an optional auto-renewable subscription, monthly or yearly, bought through Apple's App Store. Apple handles payment: Ndge never sees your card, your Apple Account email or your name, and payment is governed by Apple's privacy policy.
To know whether a subscription is active, the app uses RevenueCat, a service that verifies App Store receipts. What RevenueCat receives from the app:
- A random customer identifier created on your phone. It is not your Apple ID, not your name, and not the analytics identifier above.
- The App Store receipt, which plan was bought, and when it started, renews or ends.
- The app version, iOS version and device model, and the IP address of the request, which RevenueCat uses to prevent fraud and to identify the storefront.
Nothing about your notes, answers, photos or questions is ever sent to RevenueCat. A subscription belongs to the Apple Account that bought it; Restore purchases in the app asks the App Store for it on a new phone. Subscription records are kept by Apple and RevenueCat for as long as the subscription exists and as their retention rules require afterwards.
A subscription changes what the app shows, not what it keeps. Your notes are saved on your device whether or not you subscribe, and a subscription is not a backup: iCloud backup, described above, is separate and optional.
What we never do
- We do not sell or rent your information.
- We do not share it with advertisers or data brokers.
- We do not track you across other apps or websites.
- There are no third-party advertising or tracking SDKs in the app.
Where data is held, and for how long
Your entries stay on your device, and in your own iCloud if you enabled backup, for as long as you keep them. Anonymous usage events are held by PostHog for up to one year and then deleted. Subscription records are held by Apple and by RevenueCat under their own retention terms.
Your choices
- Use Ndge without signing in. Everything works.
- Turn iCloud backup off in Settings at any time.
- Revoke Sign in with Apple in iOS Settings → your name → Sign in with Apple.
- Switch usage measurement off in Settings → Privacy & support.
- Delete the app to erase everything stored on the device. Deleting the app does not cancel a subscription: cancel it in iOS Settings → your name → Subscriptions, or from Manage subscription in the app.
- Email us to have anonymous usage data associated with your installation, or the subscription record RevenueCat holds, deleted.
Children
Ndge is not directed at children under 13, and we do not knowingly collect information from them.
Changes
If this policy changes in a way that affects what is collected, the date at the top will change and the update will be described here.
Contact
Questions about this policy, or about your data: [email protected]
Ndge is an independent app made by Saransh Bedi. It has no server, no account system beyond Sign in with Apple, and no business model built on your data: the only thing it sells is the archive subscription described above.