Privacy Policy

Version 1.0. Effective October 5, 2026. Last updated October 8, 2026.

Nudge is a family location sharing service operated by stotl LLC, a Delaware limited liability company. We built Nudge on one rule: every time someone looks at where you are, we send you a notification and record it in your history. This policy explains what we collect, why, who receives it, how long we keep it, and what you can do about any of it.

This policy covers the Nudge mobile app and nudgegeo.com. By using Nudge you agree to the practices described here.

1. Who we are

stotl LLC
41 Watchung Place, Suite 523, Montclair, NJ 07042
(551) 800-1157
legal@nudgegeo.com

2. Where Nudge is available

Nudge is offered to people in the United States. We do not accept accounts from, or knowingly process personal information of, people in the European Economic Area, the United Kingdom, or Switzerland.

Your information is stored and processed in the United States.

3. Age requirements

Nudge recognizes three age groups: child under 13, teenager 13 to 17, and adult 18 or older.

1. You must be 18 or older to purchase a subscription or create a family.
2. People aged 13 to 17 can create an account, join a family by invitation, and use friend connections.
3. A child under 13 can only use Nudge after a parent or guardian creates a family and invites them. A child under 13 cannot create an account on their own.

How we determine your age

Before you authenticate, Nudge asks for your date of birth. At the same moment the app reads an age signal from the platform: Apple's Declared Age Range on iOS, Google Play age signals on Android where Google Play provides them. Both are configured to answer in the same three age groups Nudge uses: under 13, 13 to 17, and 18 or over.

On iOS 26 and later, Apple shows a sheet that asks your own Apple account for your age range. Some regions have laws requiring an app to ask. We ask everywhere the sheet is available, not only where it is required, because a range your Apple account reports is harder to misstate than a date typed into a form. The range comes from your Apple account; we report what it tells us and do not verify it ourselves.

Where the sheet is unavailable, on older versions of iOS, on Android where Google Play does not provide a signal, or where you decline to share it, your age group comes from the date of birth you entered, with one exception described in Section 5. We record the result: which age group was reported, by which platform, and how. Where no signal was available at all, the record shows that nothing was reported.

Our server compares the two. If they disagree, the more restrictive answer wins, and a date of birth claiming you are older than the platform signal says is rejected. The server then issues a short lived attestation that is required to finish signing up.

We check again every time you sign in. Your age group is not fixed at sign up. It is the lower of what your date of birth implies and what the App Store or Google Play reports now, and we compare them on every sign in, not once.

This exists so that a parent who withdraws approval through the App Store or Google Play changes something real. When they do, the store reports a lower age group, our server takes it, and the account moves down. For a child under 13 that means collection stops and the account waits for a guardian. An app that reads the store only at sign up cannot do this, and a parent's decision there means nothing.

The check can only lower an age group, never raise one. A store signal that is missing or that reports higher than your date of birth changes nothing.

We keep a record of how your age group was confirmed: whether a signal was available, its source, the method it reported, the age group it returned, and the result of the comparison. On iOS the method is what Apple reports about how the age was established. On Android the method we record is the supervision status Google Play reports for the account. We keep this record as evidence that your age group was verified rather than merely typed, and we use it for nothing else. We keep nothing else the app store sent.

Your date of birth cannot be changed after your account is created, by you or by us. If it is wrong, the only remedy is to delete the account and create a new one. This is deliberate: your age group determines every protection in Nudge, and an editable date of birth would make those protections optional.

4. Parents and guardians

This section is our notice to parents under the Children's Online Privacy Protection Act. If your child is under 13, read it before you consent.

How a child under 13 joins Nudge

A child under 13 cannot sign up on their own. If a child tries, Nudge shows a screen explaining that a parent or guardian must invite them, with a button that opens a message to a parent from the child's own phone. Nothing is stored. We collect no personal information from a child before consent.

To add a child under 13, a parent or guardian must:

1. Hold an adult account.
2. Be in a family that holds an active paid subscription, purchased through the App Store or Google Play by its Family Manager. A monetary transaction connected to a request for consent is one of the verification methods the FTC recognizes under the COPPA Rule. We record the transaction reference on the consent record. A second guardian in the same family consents under that subscription rather than holding one of their own.
3. Read the parental consent screen, which states what Nudge collects from the child, what it keeps, who receives it, what Nudge never does, and the parent's right to review or delete.
4. Affirm that they are the child's parent or legal guardian and consent to the collection described.
5. Send the invitation. The invitation message goes through the parent's own phone. Our servers never message the child.

What we record when you consent

Each consent event is recorded with the guardian's account, the child's account, the family, the version of the consent text shown and the language it was shown in, the time, the age signal source and method for the guardian, the subscription transaction reference, and the invitation. Consent records are never overwritten. When a child's account is deleted, the record is marked deleted and kept for three years so we can answer questions about a consent that was given.

If we change what we collect

If we materially change what Nudge collects from children, how it is used, or who receives it, we do not rely on your earlier consent. We increment the consent version, pause collection from every affected child, notify the guardian, and require a fresh consent before collection resumes. While a child's account is paused, their phone reports nothing and nobody can view them.

What we collect from a child under 13

After consent, and only after consent:

1. Location, in the background as the child moves, for as long as they have an Always On relationship. Sharing to a parent or guardian is Always On and the child cannot turn it off. Anyone else in the family sees them only as a guardian sets it; at Nudge Only, the child decides whether to send them their location, in answer to a nudge or on their own.
2. Date of birth, to confirm the age group.
3. Phone number, to sign them in. Firebase holds it as the sign in credential. Our own servers hold only a keyed hash.
4. First name.
5. Battery level, charging state, and whether location permission is on.
6. A device identifier and a push token.
7. Records of who viewed the child and when, and of nudges sent and received. These contain no coordinates.
8. If they report a problem to us from inside the app, what they write in that report. We do not collect an email address or any other contact detail from a child. When we have looked at their report we tell them so, by notification, and nothing more.
9. The name a family member has saved for the child in their own phone's address book, where that family member has synced their contacts. It is used as the heading on notifications about the child, so it forms part of the notification we hand to Apple or Google to deliver.

We do not collect a photo of your child, and we do not perform face detection, facial recognition, or any biometric processing. The face you see next to their name comes from your own phone's address book. We do not collect analytics, crash reports, or purchase data from a child's device. Those tools collect nothing until the age group we send the app resolves to 13 or over, which is the same age group every rule on our servers reads, so an account the app store has lowered keeps all three off. Where the app has no answer, on a first launch with no connection, it treats the person as a child and starts nothing. Our subscription provider receives nothing about a child.

Protections that apply to a child under 13

1. No friends. The friend system does not exist for them.
2. No contact upload. The server refuses it.
3. A guardian sets what everyone else in the family sees of them, and they cannot change it themselves. They can propose a change, or ask someone to share with them, and a guardian, or that person, decides.
4. They cannot leave the family and cannot delete their own account while a guardian is present. Only a guardian can remove or delete them. The one exception is an account with no family at all, which can delete itself, because the rule exists to stop a child leaving a guardian and there is no guardian to leave.
5. Push notifications are not initialized until the account is bound to a guardian.

Your rights as a parent or guardian

1. Review. Ask us at privacy@nudgegeo.com for the personal information we hold about your child. We verify that you are the guardian on record.
2. Delete. Delete your child's account in the app, or at nudgegeo.com/delete-account after signing in with your own phone number. Removing a child from the family deletes their account, their location at once, and their own history. Other people's copies of events with the child, such as a guardian's record of a look, stay on those people's own clocks and show no name. Their sign in credential at Firebase is deleted and we keep a confirmation for 30 days.
3. Refuse further collection. Deleting the account stops all collection. There is no partial mode.

A child's account exists only while a guardian is present in their family. If the Family Manager deletes the family, or the last guardian leaves or deletes their own account, every child under 13 in that family is deleted at the same moment, because a child with no guardian has no basis for us to hold their information. We name the children who will be deleted before the action is confirmed. Teenagers keep their accounts as individual users.

If you believe your child is using Nudge without your consent, write to legal@nudgegeo.com and we will investigate and delete.

5. What we collect

Account information

1. Your phone number, used to create and verify your account by SMS through Firebase. Firebase retains it as your sign in credential. Our servers store only a keyed hash generated with a secret we hold, so a copy of our database does not reveal anyone's number.
2. A display name, up to 50 characters, which you or the person who invited you provides. We ask for a first name and do not check what is entered.
3. Your date of birth.
4. A device identifier and push notification tokens.
5. Your family's name, if you create one.

We do not collect profile photos. The face you see next to someone's name comes from your own phone's address book and never leaves your device.

IP addresses

Your IP address reaches Google Cloud, which hosts our servers, the way it reaches any website you open. We read it, turn it into a hashed key so we can apply rate limits, and use it for nothing else. That hashed key lasts as long as the rate limit window and no longer.

We do not write your address to our own logs and we do not store it in our database. Google keeps its own record of requests to the services it hosts, as it does for every service on its platform. Those records are kept 30 days.

Location

Always On relationships. If you have at least one Always On relationship, your phone reports its position in the background as you move. It reports on movement, not on a timer, and a phone that is still stops reporting until it moves again.

Our server keeps one position for you and replaces it every time a new one arrives. There is no trail in our live systems. We cannot reconstruct where you have been from them, because the previous position no longer exists. Encrypted backups and the database's recovery log hold up to seven days of writes, which includes positions our live systems have already deleted. They exist only for disaster recovery, are never read for any other purpose, and are not searchable.

Nobody watches these reports. They exist so that when someone opens your location, there is an answer.

When it stops. When your last Always On relationship ends, whether because you switched to Nudge Only, left a family, or a connection was removed, your phone stops reporting and our server refuses further location from you.

While a family is locked, its Always On relationships are paused. If they are your only Always On relationships, your phone may keep sending its position, and our server discards it without storing it. Your battery and other phone status are still received and kept for 24 hours, and are not shown to the family.

Nudge Only relationships. That person cannot see you without asking. Your location leaves your phone to them only when you send it: when you answer a nudge, or when you share your location with a friend without being asked. Nudge Only toward one person does not stop your phone reporting in the background while someone else sees you on Always On. Each of these is an action you take, and what you send is a single point, not a stream. In every case the coordinates are deleted after 24 hours. You are told the first time the person opens it, and you can see on your own screen how many times they have opened it since.

What we keep from each report. Latitude, longitude, a timestamp, your battery level, and a flag recording which mechanism produced the report. Accuracy, altitude, heading, speed, and motion activity are discarded on arrival and never reach our database.

The app asks for permission to use your phone's motion sensor. It uses it to tell whether you are moving, so it can stop asking for your position when you are not, which saves your battery. What the sensor reports stays on your phone.

Permission. We ask for background location permission when a sharing relationship is created that needs it, not during general setup. You can change or revoke the permission in your device settings at any time. If a change breaks a sharing relationship you hold, we tell you once. We do not nag you to restore it.

Device pulse

Your phone reports its battery level, charging state, whether location permission is on and at what precision, whether low power mode is on, whether background app refresh is on, whether battery optimization or app hibernation is affecting Nudge, which mechanism sent the report, the reasons sharing is currently blocked if any, and the time it last checked in.

Your family can see your battery level, charging state, low power mode, check in time, and which mechanism sent the last report, whatever your sharing setting is. They can also see whether Nudge can reach your phone: working, location turned off, app not installed, signed out, or waiting on a parent's consent. It updates live, so they know whether your phone can be reached before they try to look.

A friend sees none of this. Not your battery, not whether your location is on, not whether you have signed out or removed the app, and not whether your phone can be reached at this moment. A friend who nudges you is asking you a question. It reaches you if your phone can take it, you answer it or you do not, and it expires after 24 hours. Nothing tells them anything about your device either way.

If a setting on your phone stops it from sharing your location, you are told at once, at any age, the specific setting is named, and there is a way to fix it. That fact is yours and we do not withhold it from anyone.

Who else is told depends on your age. If you are under 18, your Family Manager and any Parent or Guardian in your family are told two minutes later, and told again when sharing resumes. If you are 18 or over, nobody is told at all. No friend is ever told, at any age.

Two other things are treated differently, because they are ways of disappearing rather than settings that broke. If a child under 13 signs out, or their phone stops answering at all because the app has been removed, every guardian in their family is told, whether or not they hold Always On access.

Turning sharing off deliberately, or changing what you share, is a choice rather than a breakage, and it never triggers any of this. How long sharing was interrupted is recorded in your history.

Contacts

The friend feature works from your phone's contact list. If you do not grant contacts access, you can still use Nudge with your family.

1. Phone numbers from your contacts are hashed on our servers on arrival. Raw numbers are never stored.
2. We compare the hashes to hashes of existing Nudge users and return the matches. A hash that matches nobody, and that you did not invite, is discarded.
3. For a number that matches someone already on Nudge, we keep the hash and the fact that it matched, whether or not you go on to connect with them. We keep the name you have saved only where you and that person are connected, and the name is erased when a connection ends. A notification already sent with that name keeps its own copy for up to 14 days, as Section 13 describes. Everyone else's name is returned to your own phone and never written down. We keep nothing else from your address book: no email addresses, no photos, no notes, and nothing at all about a number that matched nobody.
4. The name you have saved is used as the heading on notifications about that person, so a notification reads using the name you know them by. For that purpose the name is part of the notification we hand to Apple or Google to deliver. It is also returned to your own app alongside your connections and your history.
5. Children under 13 never appear as a match to anyone, and neither does an account whose age we cannot determine. Teenagers never appear as a match to an adult.
6. Match results carry no age and no photo.
7. Limits: 500 numbers in one request, and three syncs per hour. A large address book is sent as several requests belonging to one sync, so the hourly limit is on syncs, not on how many numbers a sync carries. A sync whose contents have not changed since the last one does not count against it.
8. We never message anyone in your contacts. Invitations to people not on Nudge go out through your own phone.
9. When you delete your account, every contact-derived hash and saved name tied to it is deleted, including rows other people hold about your number.
10. Our servers do not keep a raw phone number from anyone's address book. For one hour after a sync, the numbers you sent are held in memory on the server that received them, so that repeating the same sync costs nothing. They are not written to disk.
11. The app reads your contacts on your phone when you use the friend feature. It does not keep your address book. Names, numbers, photos and dates of birth are read, used and dropped. Where the app needs to know roughly how old a contact is, so it can show you the right screen when you invite them, it works that out while it reads and keeps only the answer. We receive the numbers, which we hash on arrival, and the name, which we keep only as described above. A photo and a date of birth never leave your phone.

Three things from your contacts do stay on your phone. For each invitation you send to someone not yet on Nudge, the app keeps their number and the name you have saved for them until the invitation is answered or expires, so it can show you who you are waiting on. It keeps your phone's own reference to a contact you have invited, for the same period, so it does not offer them again. And for people you are connected to, it keeps the name you have saved for them alongside the connection, so lists read in the names you know.

12. One case sends more. When you invite someone to your family we ask for their date of birth, and the app offers the one saved in your contacts so you do not have to look it up. The date you send is stored on the invitation until it is answered, and it decides which consent screen the person sees.

The invited person's own answer decides their age group, from the date they enter and what the App Store or Google Play reports, whichever is lower. What you put on an invitation cannot place anyone in an age group they did not earn.

If you invite someone as a child under 13 and they enter a date that says they are an adult, we ask their phone for an age signal before going further. Where none is available, or they decline to share one, they join as an adult carrying their own date, and we tell you that the person you invited as a child joined as an adult. Where the phone's signal agrees with you, because Apple reports them under 13 or Google Play reports the account as supervised, they join as a child, and the date you entered becomes theirs and is permanent. In that case the platform, not you, has decided, which is what Section 3 says always happens.

Hiding a location from your map

When someone sends you their location, it appears on your map. You can hide it. We record that you hid it, as your account, the identifier of the location, and the time. We keep no coordinate in that record and the person who sent it is never told. The coordinate itself is deleted within 24 hours as usual. The record that you hid it goes when you restore the pin, when the nudge it belongs to is deleted, or when you delete your account.

Records of views and nudges

View records. Every time someone opens your location, we write two records of it, one belonging to each of you. Each shows who looked, whose location they opened, when, and what the outcome was. We send you a notification every time, including when someone looked and your phone did not answer within 30 seconds.

The two records are separate. Each person controls how long their own copy lives and each person's copy is deleted with their own account, so one person's history can hold an event the other's no longer does. Neither record ever contains a coordinate.

Nudge records. Who asked, who received, when, and whether a location was sent back.

Request records. Who asked whom for Always On, or what change a child under 13 proposed, who answered, how it ended, and when. A record of a request about a child under 13's sharing also holds the internal account numbers of the two people it was about.

None of these contains coordinates. Each person's own copy is deleted on the schedule that person chose, up to a year, and when that person deletes their account.

Reports

If you report a person or a problem from inside the app, we collect what you write, the account you reported if you named one, and your email address so we can tell you what we did. The email address is required if you are 13 or over. We never ask a child under 13 for one; when we have looked at a child's report we tell them so by notification instead.

The report is never shown to the person you reported. We read every report we store and act on the account where action is warranted. Your email address is used to answer that report and for nothing else. It is deleted when you delete your account, and what you wrote is deleted when either you or the person you reported deletes an account. The record that a report existed remains.

Two limits apply. You can send five reports a day. And a second report about the same person within a day is not stored; the app accepts it and nothing is added to the first. If something further has happened, write to safety@nudgegeo.com instead, where nothing is discarded.

Technical information

App version, platform, session identifiers, and, for users 13 and over only, analytics and crash diagnostics.

6. How friend connections work

Nudge is built so a stranger cannot find you.

No discovery. There is no public profile, no search, no friend finder, no suggestions. There is no way for another user to look you up.

You must already have their number. To invite someone as a friend you must have their phone number saved in your phone's contacts.

Invitations go through your own phone. For someone not yet on Nudge, the message is sent from your device. If they already use Nudge, the request arrives in the app.

We store the invitation as a hash. A keyed hash of the recipient's number, so we can match the invitation if they join. An unaccepted invitation to someone not on Nudge stops working after 30 days and is deleted 30 days after that, so it can be sent again in between. Sending it again starts the clock over. A friend request to someone already on Nudge expires after 30 days and the record that it was sent is kept. A request for Always On, between friends or in a family, and a change a child under 13 proposes for a guardian to approve, expire after 30 days and are deleted 30 days after they are answered, cancelled or expire. An expired request cannot be accepted, declined or cancelled by anyone; it is over. See Section 13.

Both sides act. A connection forms only when one person invites and the other accepts.

Children under 13 have no friends at all.

Rules for teenagers.

1. A teenager and another teenager can hold either Always On or Nudge Only, by request and acceptance, and either can go back to Nudge Only at any time.
2. A teenager and an adult outside the teenager's family are Nudge Only. Always On is not available for that pair until both are 18. When the teenager turns 18 the restriction lifts, but nothing changes automatically. Always On still requires one to ask and the other to agree.
3. Only the teenager can start a connection with an adult outside their family. An adult cannot send a friend request to a teenager, and an adult's contact matching never reveals that a teenager is on Nudge.

Removing a friend ends sharing in both directions immediately. Neither of you is sent anything; they see the connection is gone the next time they look.

Joining a family with someone you are already friends with replaces the friendship with a family relationship. If either of you leaves that family, the relationship ends and the friendship is not brought back. Rebuilding it takes a new friend request that the other person accepts. If the two of you belong to more than one family together, leaving one changes nothing between you; the connection is held by the families you still share. While the family that first connected you is locked, sharing between you is paused, even if another family you share has an active plan. Deletion is silent.

7. How we use information

1. To operate Nudge and show your location to the people you share it with.
2. To tell you when someone has looked.
3. To determine your age group and enforce the protections that go with it.
4. To process your subscription through the App Store or Google Play.
5. To send notifications.
6. To prevent fraud and abuse and to investigate reports of misuse.
7. To meet our legal obligations, including COPPA.

We do not use your information for advertising and we do not sell it.

8. We do not sell your data

We will never sell, license, rent, or otherwise transfer your personal information, including your location, to data brokers, location intelligence firms, advertisers, ad networks, or any third party for their own commercial use. This applies to every user and to every child. No merger, acquisition, or corporate event changes this without direct notice to you first.

9. Who receives your information

Inside Nudge

Your location goes to the people you share it with, according to the sharing type in place. Battery, charging state, low power mode, check in time, and whether Nudge can reach your phone go to everyone in your family whatever your sharing setting is, and to nobody else. The name you have saved for someone in your own address book is returned to your app alongside your connections and your history.

Service providers

Crashlytics, Analytics, and RevenueCat are not started on a device until its age group resolves to 13 or over, and our servers send RevenueCat nothing about a child. No third party stands between us and Apple or Google for notifications. A child's notifications, including the one telling them someone checked their location, are handed straight to the platform that delivers them.

The background location library that produces movement reports runs only on your phone. It sends no personal information to its maker; it performs a license check that carries no user data. Movement reports and the battery reading go to our servers, not to the library's vendor.

Each provider is bound by written data processing terms, may use your information only to perform its service for us, and may not sell it, use it for its own purposes, or combine it with other sources for advertising or profiling.

What we notify people about

Beyond the notice that someone opened your location, Nudge sends notifications for the events below. Each goes to the people the event concerns.

1. A nudge sent to you, and an answer to a nudge you sent.
2. A friend request and an answer to one. A friendship ending is not notified; the other person sees the connection is gone the next time they look.
3. A family invitation, an answer to one, someone joining, someone leaving, and someone being removed. Leaving or being removed is told to everyone still in the family, children included.
4. A request about how someone shares with you or with your child, and its answer. When a request expires, or ends because someone left the family, the person who asked is told.
5. A change to how you and another person share, and a guardian's change to how your child under 13 shares.
6. Your phone sharing location again after an interruption, and the interruption itself, as described in Section 5.
7. A new device signing in to your account, told to everyone in every family you belong to, whatever their sharing setting, and recorded in their history. No friend is told.
8. Signing out. Everyone in your family sees your state change to signed out on their screen. No friend does. For anyone 13 or over nothing further happens: nobody is sent a notification and nothing is written to anyone's history. A child under 13 is the exception; their guardians are sent a notification and it is recorded, because for a child signing out is one of the two ways to stop being visible and a guardian is responsible for them.

A notification goes to the phone you are currently signed in on and to no other. Signing in on a second phone detaches the first, and a phone you have signed out of receives nothing further. If we cannot tell which phone is current, we send nothing rather than send to all of them, so a notification is occasionally missed rather than delivered to a phone that should not have it.

9. For a child under 13: their guardians are told when the app appears to have been removed from their phone.
10. A prompt to you when Nudge appears to have been closed on your phone and cannot report.
11. A 13th or 18th birthday that changes how people share: to the person, their guardians, and the others affected.
12. Subscription events, to the Family Manager: a payment problem, a renewal being turned off, the plan ending, and the plan coming back.

Separately from that list, an administrator at stotl can send a notification to a named person's phone, with wording they choose. It exists to test that delivery works. It is not used to contact people.

Legal requests

We disclose personal information to a government authority only where we are required to, or where we believe in good faith it is necessary to prevent imminent harm. Send legal process to legal@nudgegeo.com. We require a warrant for anything touching location. Where the law allows it, we tell the affected person first.

Civil subpoenas, including those from custody and divorce proceedings, are handled the same way: we require valid legal process, we notify the person whose records are sought where the law allows and give them time to object, and we produce only what exists.

Most of what gets requested does not exist. We keep one current position for at most 24 hours and no history of movement. What does exist is the record of who opened whose location and when, without coordinates, for as long as the person whose record it is has chosen to keep it, up to a year.

Business transfers

If stotl LLC is acquired or merges, your information may transfer. We will tell you before it becomes subject to a different policy.

10. When your age group changes

Your age group can move for two reasons.

A birthday moves it up. When you cross 13 or 18, your permissions and the rules that govern your relationships adjust on their own. At 13 the friend feature becomes available and analytics and crash reporting start on your device. You can also delete your own account, although what actually decides that is whether a guardian is present rather than your age; see below.

At 13 you also start setting what each person sees of you, except your guardians, who keep seeing you at Always On. A relationship with someone in your family who is 13 or over and not your guardian becomes one shared setting: if you both had Always On it stays, and otherwise you are both on Nudge Only. Any change you had proposed for a guardian to approve ends, and so does any request a guardian made on your behalf to someone who is not a guardian. At 18 the restriction on Always On with adult friends lifts, and your relationship with each guardian becomes one shared setting in the same way. You, your guardians and anyone else whose relationship with you changed are told, and it is noted in your history. Beyond that, Always On still has to be requested and accepted.

The app store can move it down, on any day. As described in Section 3, we read the store's age signal on every sign in and take the lower of it and your date of birth. If a parent withdraws approval through the App Store or Google Play, or the store's answer changes for any other reason, your age group drops the next time you sign in.

What happens then is that the account pauses. Its phone stops reporting, nobody can open its location, its friendships end, and everyone connected to it sees that it is waiting on a parent's consent. Nothing is deleted, and family membership is left in place, so resolving the pause restores the account rather than rebuilding it. A guardian in the family re-consents and the account resumes.

One case cannot resume. If an account with no family is lowered to under 13, there is no guardian to re-consent and the pause does not lift. That account can delete itself, because the rule that stops a child deleting their own account exists to keep them from leaving a guardian, and there is no guardian here.

The check only ever lowers an age group. A missing signal, or one that reports higher than your date of birth, changes nothing.

Friends have one more: if two teenagers hold Always On and one turns 18 while the other is still 17, the pair drops to Nudge Only and both are told. It can come back when the second one turns 18 and one of them asks.

11. Location: the specifics

1. Your location is visible only to the people you share it with: those who see you on Always On, and anyone you send it to. If you are under 18, your guardians always see you on Always On; if you are under 13, a guardian decides who else does.
2. Opening someone's live location starts a view session lasting five minutes. Before any location reaches the viewer, we send that person a notification and record the view in their history; if their phone has to be asked for its position first, we do this when it answers, or after 30 seconds if it does not. There is no way to see someone's location without both happening, and every look notifies, however many times you have looked before. If the person looking stops before anything appears, you are told that too, in its own words.
3. During the session the viewer sees the position update as the person moves. If the app on the subject's phone is closed, the phone is asked for a new fix every 30 seconds and the viewer's screen says so.
4. A session ends when the viewer taps done, at five minutes, when the sharing type changes, or after 30 seconds without a fix.
5. Coordinates held for a session are deleted when the session ends.
6. Two people looking at once means two sessions and two notifications.
7. If we have no current position, the viewer may see your most recent one from the past 24 hours, labeled with its time. We notify you either way.
8. A viewer can start at most 20 sessions per hour and 120 per day, counted by each server handling their requests. This limit is on opening someone's live location. It does not apply to a location someone sent you, because that was sent once, by their choice.

A location someone sent you works differently, because they chose to send it. The first time you open it, we tell them and record it. Every later time you open it is recorded but does not notify them again, since they already know it arrived.

The person who sent it sees the whole record on their own screen. Their share shows how many times you have opened it, or that you have not yet, and tapping it lists every view with its date and time. Their thread also shows a daily summary of how many times you looked that day, with the times.

A location drawn on your map is a look. When someone sends you their location, your map draws a pin for it, and drawing that pin is opening it: the person who sent it is told, the first time, and it is recorded. There is no way to see a location on Nudge without the person who sent it being told, on the map or anywhere else. If we cannot write the record, we do not send the location.

Two opens of the same share by the same person within ten seconds count as one. This deliberately misses a genuine second look rather than counting a single open twice.

9. If you stop sharing while someone is viewing, their session ends at once.
10. Precise location is sensitive personal information under several state laws. We use it only to run Nudge.
11. You can ask your phone for directions to someone. From a location they sent you, and during a session where you are watching their live location, the app can hand their position to a maps or ride application you choose from those installed on your phone. Their position is all that is handed over; no name goes with it, and the application shows a street address without being told whose it is. It only ever hands over a position that person has already been told about, and it never starts a session or fetches a position of its own. Once it reaches that application, the application's own policies apply.
12. We do not build profiles of your movement, do not geofence, and do not infer anything about your health, your habits, or the kinds of places you go. Our live systems keep one point and no history, so there is nothing to infer from. Our database's recovery log, which exists so we can restore the service after a failure, holds the last seven days of writes and could therefore reconstruct a week of positions. It is never read except to recover from a failure, and it is not searchable.
13. The app keeps a number of things on your own phone so it opens where you left it: enough about who is signed in to draw the first screen, your family list, your accepted connections and the names you have saved for them, your session, your phone number, your age group, the invitations you have sent, when you last opened each conversation, and a set of flags about where you were in the app. It does not keep the part of the map you were last looking at; that is a position and it is deleted every time the app starts. The location library keeps at most one position of its own for at most a day, so a report is not lost when the app is closed.

These stay on your device and are not sent to us beyond what this policy already describes. Your session, your phone number, your age group, the invitations you have sent, your references to invited contacts, and your map style preference are held in an encrypted store whose key is kept in your phone's keychain. Your date of birth is not kept on your phone at all. The rest sits in ordinary app storage, which your phone protects while it is locked.

One credential sits in ordinary app storage rather than the encrypted one. The part of the app that reports your position while Nudge is closed needs a token to do so, and the software we use for that keeps its own settings and gives us nowhere encrypted to put it. That token lasts 24 hours, can do nothing but send your own position, cannot read anything, is replaced whenever the app starts or you sign in, and is removed when you sign out.

14. Whether a notification reaches you depends on your device settings, your network, and Nudge notifications being enabled.

12. Artificial intelligence

Nudge does not use artificial intelligence or machine learning to analyze your location, to profile you, or to make any decision about you. We do not use your personal information to train any model. Device attestation and fraud prevention tooling provided by our platform providers may use automated analysis to distinguish real devices from abuse; that analysis never touches your location. If any of this changes we will update this policy and give notice first.

13. How long we keep things

This section is our written retention policy. It covers children's information on the same terms as everyone else's. We keep almost nothing indefinitely; the rows below that say kept are the exceptions.

What we keep with no time limit

Almost nothing. Most of what happens between you and another person, family invitations, people joining and leaving, friendships made and ended, sharing changes, a new device signing in, and your phone number changing, is kept on the same clock you chose for your history and goes when that window passes.

What is genuinely kept until your account is deleted:

1. Billing events: a subscription starting, renewing, lapsing, or being restored.
2. Your family, its members and their roles, and your connections to other people, for as long as they exist.
3. The record that a subscription event was processed.
4. Counts of how often age checks were refused and for what reason. These contain no personal information.

What deletion means

You delete your account in the app, or at nudgegeo.com/delete-account after signing in with your phone number. A child under 13 in a family cannot delete their own account; their guardian does it. A child with no family can, as Section 10 explains.

The moment you confirm, three things happen at once. Your access tokens are revoked and every device signed in as you stops working. Your location, and every coordinate held anywhere about you, is deleted. Your name, date of birth, hashed phone number, device identifiers and push tokens are erased from your account record, which is left holding an identifier and the date you deleted.

At the same moment your own history is deleted: your copy of every view and nudge, your connections, and your notifications. Those rows are permanently removed 30 days later, along with what remains of your account record.

The other person's copy of a shared event is theirs and stays, the way a call log survives the other person leaving. It keeps the event and its date, and it shows no name at all once your account is gone. A record of a request about a child under 13's sharing also keeps the internal account numbers of the two people it was about; once an account record is removed, its number leads to nothing. The name they had saved for you went with the deletion, along with every other record anyone held about your number. Where an outcome was recorded on your side rather than theirs, their record keeps the event and loses the outcome.

Deletion is then sent to the providers in Section 9 that held something keyed to your account: your subscription record at RevenueCat and your sign in credential at Firebase. Each is retried until the provider confirms, and we keep the confirmation for 30 days. Google removes deleted data from its backups on its published schedule. Crash and analytics data is not keyed to your account and ages out on the schedule above.

Two things are kept on purpose. The record that a report existed, without what was written in it, for 12 months. And, if you are a guardian who consented for a child, the consent record, for three years, so we can show that consent was given.

One thing outlives the promise and cannot be made not to. Our backups and the database's recovery log hold seven days of writes, so for up to a week after you delete, a copy of your data exists inside them. They are never read except to recover the service after a failure, and our recovery procedure requires that every deletion made since the recovery point is applied again before the restored database serves anyone.

If you sign up again with the same number, you get a new account with a new identity everywhere. Nothing from the deleted account carries over.

Deleting your account does not cancel a store subscription. If you hold one, cancel it through the App Store or Google Play, or it will keep billing. We tell you this before you confirm.

This is deletion, not anonymization.

14. Security

1. Encryption in transit everywhere, and encrypted connections only to our database.
2. Encryption at rest, including backups.
3. Phone numbers stored only as keyed hashes, with the key held in a secrets manager that no person reads from.
4. Database access limited to the running service and one named person, with audit logging of every read and write.
5. Database network access restricted to a single host.
6. We do not log the content of any request, on any route.
7. Coordinates and credentials are masked wherever they appear in a log, including inside an error message or a stack trace, whichever part of the service or of a library wrote the line. Our systems recognize these by their shape, so the masking holds regardless of what produced the text. An invitation link is masked the same way; an invitation code on its own is short enough that no rule can tell it from ordinary text, so instead nothing writes one.
8. A name and a phone number have no shape and cannot be recognized that way. Instead, nothing writes one to a log. That is enforced by a test, on our servers and in the app, asking the same question of each: it inspects every log call and fails the build if one would write a value that is not a fixed, shapeless thing like a count or a status.
9. Administrative access restricted to a named list of accounts. Signing in verifies the identity token and reads the email from it, and a caller with no entry on the list is refused without learning why. An existing administrator can add another; nobody outside the list can.
10. A written information security program covering children's personal information, reviewed at least annually, and a documented incident response plan.

What people at stotl can see. No tool we operate displays a coordinate, at any permission level. That is the line that matters and it holds without exception.

Our administrative tools do show, to the named people who hold access: the account list with display names, dates of birth, hashed phone numbers, app version and last sign in; who is connected to whom, how they share, and each side's age group; how many contacts an account has synced, but not who they are; the text of reports and who sent them; a child's parental consent record; family membership, family names, and subscription state; and the history of views, nudges and other events between accounts, without coordinates. No tool we operate shows a server log. People holding the editing role can change an account's display name, its notification tokens, and the flags that record which parts of setup a person has finished, and can delete an account outright. They cannot set a photo. These actions are not individually attributed or audited.

Direct access to the database, which holds current positions and the names you have saved for your contacts, is held by one named person under audit logging of every read and write.

Security reports. If you find a vulnerability, write to legal@nudgegeo.com with "security" in the subject line. We acknowledge within two business days and do not pursue people who report in good faith.

No system is perfectly secure. If an incident compromises your information we will tell you without undue delay and as the law requires.

15. Your rights

1. Access. Ask us at privacy@nudgegeo.com for a copy of what we hold about you, and we will put it together and send it. There is no button in the app that does this. A parent or guardian may ask for their child's.
2. Correction. Update your display name in the app. Your date of birth cannot be changed, in the app or by us; there is no path for it. If it is wrong, delete the account and create a new one.
3. Deletion. Delete your account in the app or on the website.
4. Location control. Change your sharing type, as the Terms describe, switch a connection to Nudge Only, or revoke location permission in your device settings.
5. How long your history lives. Choose how long your own records of views and nudges are kept: one day, 30 days, 90 days, 180 days, or a year. A year unless you change it. Shortening it deletes what falls outside the new window immediately, and we tell you how many records that is before you confirm. Notification records are separate and you can clear them at any time.
6. Notifications. You can turn off push notifications in your device settings. If you do, view alerts and nudge requests will not reach you, though the record of every view is still written to your history and you can read it in the app. Nudge is designed around those notifications and does not work as intended without them.
7. Global Privacy Control. We do not sell or share personal information and do not run targeted advertising, so there is nothing a Global Privacy Control signal would turn off. Our servers do not read the signal, because there is no practice for it to stop.

A teenager's own account. Anyone with an account can delete it without anyone else's permission. A teenager aged 13 to 17 does not need a parent's approval, and a parent cannot delete a teenager's account. We do not mediate between them.

How to reach us. Email privacy@nudgegeo.com. We confirm receipt within 10 business days and answer within 45 days. If we need longer we will tell you before the 45 days are up and take no more than 90 in total.

Verifying you. We may need to confirm you control the account, usually with a code to your registered number. For a request about a child, we confirm you are the guardian on record.

Authorized agents. You may appoint one. We will ask for written authorization and may verify with you directly.

16. State privacy rights

If you live in a state with a comprehensive consumer privacy law, you may have the right to know what we collect, to delete it, to correct it, to obtain a portable copy, to opt out of sale, sharing for targeted advertising, and profiling, to limit the use of sensitive personal information, to appeal a denial, and to be free from retaliation for exercising any of it.

There is nothing to opt out of. We do not sell personal information. We do not share it for cross context behavioral advertising. We do not run targeted advertising or profiling. We have no advertising program and no relationships with ad networks or data brokers. This applies to every user including those under 16, for whom no such practice has ever occurred and none is intended. If it ever changes we will update this policy and provide an opt out before anything begins.

Sensitive personal information. Precise location is sensitive under several state laws. We use it only to provide Nudge.

Exercising your rights. Email privacy@nudgegeo.com. Same timelines as Section 15. If we deny a request you can appeal by replying to our answer.

California Shine the Light. We do not share personal information with third parties for their direct marketing, so there is nothing to report.

Washington. Washington law treats precise location as consumer health data when it could reveal a visit for health care. We treat every location we handle as such data under that law, and we publish a separate Consumer Health Data Privacy Notice at nudgegeo.com/health-data describing what we collect, why, who receives it, and your rights under it.

17. Your safety

Location sharing can be misused, particularly in coercive relationships. Your safety matters more than any feature here.

You can stop sharing at any time. Anyone can remove a friend. Anyone aged 13 or over can leave a family, except the Family Manager, who cannot, and except the last guardian of a child under 13, who cannot leave while that child is in the family. A child under 13 in a family can neither leave nor delete their own account; only a guardian can remove them. When your last Always On relationship ends, background collection stops.

Before you leave a family we show you who will lose your location and whose location you will lose, by name. Leaving tells everyone still in the family. Being removed by a guardian tells everyone except the guardian who did it. If you need to go without anyone being told, delete your account.

Stopping sharing does not hide everything. Your family can still see your battery and check in time. If you need to be fully invisible, delete your account.

Deleting is silent and immediate. Your family and friends receive no notification and nothing tells them why you disappeared. Your location is deleted at once and your account's access is revoked at once. We also ask Firebase to revoke your sign in credential; if that call fails we log it and the deletion goes ahead regardless, so in rare cases a credential issued before deletion can stay valid for up to an hour. Leaving a family, by contrast, tells everyone still in it.

No one can look at your live location without a record. Every look sends you a notification and is recorded in your history before any location is shown, including repeat looks by the same person, simultaneous looks by different people, looks where your phone did not answer within 30 seconds, and looks the viewer stops before anything appears, which are announced in their own words. Whether the notification reaches you depends on your device settings; the record does not.

A location you chose to send is different. You are told the first time it is opened, not every time, because you already know it arrived. Every later view is recorded and you can see the full list on your own screen.

A stranger cannot find you. There is no discovery of any kind. Anyone inviting you as a friend must already have your number saved, and you see who they are before you accept. An adult cannot start a connection with a teenager at all.

If someone is misusing Nudge. Report it from inside the app or write to safety@nudgegeo.com. Anyone can report, including a child or teenager on their own behalf, and the person reported is never told. We read every report we store and act on the account where action is warranted, and we tell you when we have: by email if you are 13 or over, by notification if you are younger. A second report about the same person within a day is not stored, so write to safety@nudgegeo.com if you have more to tell us about someone you already reported.

If you are in danger, contact emergency services. If you are experiencing domestic violence or coercive control, the National Domestic Violence Hotline is available at 1-800-799-7233 or thehotline.org.

18. The website

nudgegeo.com is a marketing site hosted by Vercel. It uses two analytics tools. Vercel Analytics counts page views in aggregate, sets no cookies, follows nobody between sites, and strips query strings. Google Analytics gives us the same kind of aggregate traffic information and does set cookies; advertising features and Google signals are turned off, and we do not permit Google to use the data for its own advertising.

Neither runs on the pages where a link can carry something about you: the invitation pages, the page for parents, and the account deletion page.

We do not respond to browser Do Not Track signals, because there is no tracking to turn off. We honor Global Privacy Control as described in Section 15.

An invite page shows the name the inviter gave when they signed up, and nothing else about them. The page for parents of children under 13 shows nothing personal at all.

19. Links to other services

Nudge may link to services we do not operate. This policy does not cover them.

20. Changes to this policy

We may update this policy. When a change is material, meaning it affects what we collect, how we use or share it, how we protect it, or your rights, we will say so in the app. For adults and teenagers we do not record which version you have seen, and continuing to use Nudge is how you accept it. Children under 13 are the exception: their guardian's consent is recorded against a specific version, and a material change requires a fresh consent before collection resumes.

If a change affects how we handle information from children under 13, we give the parent or guardian direct notice, and where the change is material we pause collection from the child and require a fresh consent before it resumes.

21. Contact

General and legal: legal@nudgegeo.com
Privacy requests: privacy@nudgegeo.com
Safety and misuse: safety@nudgegeo.com, or report from inside the app
Phone: (551) 800-1157
Mail: stotl LLC, 41 Watchung Place, Suite 523, Montclair, NJ 07042

For a COPPA question, use legal@nudgegeo.com and say it is a COPPA inquiry. We answer those first.