Nudge← Back to Nudge

On this page

Nudge Privacy Policy

Effective date: November 9, 2026
Last reviewed: November 9, 2026

1. Introduction

Nudge is a contact-sharing Android application owned and operated under the name Mernox Studios, an independent studio based in Dammam, Saudi Arabia. Mernox Studios is a studio name and is not a separately incorporated company. In this Policy, “we,” “us,” and “our” refer to the individual operator or operators responsible for Nudge.

Responsible operator and data controller: Osama Ahmed Ibrahim Kaoud.
Location: Dammam, Saudi Arabia.
Privacy contact: support@mernox.dev.
Additional contact or service address, if legally required: 8096 A4 4025 Al badi Dist.

This Policy explains how we handle personal information when you register for Nudge, create contact cards, exchange details, connect optional social accounts, make purchases, or contact us. Nudge is intended for global use by people aged 13 and older. Regional rights apply where the relevant law covers the processing.

2. Information We Collect

2.1 Information required for an account

To complete registration, you provide a name, an email address that you verify, and a password. Your name need not be a verified legal name. Authentication information is processed by our authentication provider. We do not display your password on a contact card or share it with other users.

Your first contact card includes your verified email and any phone number you chose to verify. Each contact card must contain at least one verified email address or phone number. Account registration information and the information you choose to share on a particular card may differ.

2.2 Optional information

You may choose to provide:

• A verified phone number or additional verified contact details.
• A profile photo or card banner image.
• Social account identifiers, handles, profile links, and public profile images.
• Business information, including company, profession, address, and website.
• Card appearance and sharing preferences.

Optional fields are not required for a basic account, although particular features need the information they use. Please avoid including sensitive information or another person's details without an appropriate right or permission.

2.3 Information generated when you use Nudge

We process account and session identifiers, verification-request records, delivery and verification status, attempt counts, and timestamps. Our verification backend uses a cryptographic representation of the request's IP address to help prevent abuse. Network and hosting providers also receive connection information necessary to deliver their services.

Contact exchanges generate temporary discovery tickets, public cryptographic keys and fingerprints, participant identifiers, selected-card snapshots, exchange decisions, and timestamps. Sharing history may contain received contact details, social links, and whether a social exchange was incoming or outgoing. Public social reads may be recorded on the device and synchronized later.

When you buy a paid feature, we receive purchase tokens, product and order identifiers where provided, purchase quantities, subscription and entitlement status, and information needed to handle restoration, refunds, and disputes. Google Play handles checkout and payment details. Nudge does not collect your full payment-card number through its checkout.

Nudge also stores information on your device, including login/session information, pending verification details, profile drafts, cached social profiles, history, and preferences. Logging out does not necessarily erase all local history or drafts. Account deletion performs a separate account-specific cleanup.

2.4 Device permissions and third-party sources

With your permission, Nudge can save received cards to Android Contacts and check for an existing Nudge contact entry to avoid duplicates. It does not upload your entire address book. You can select an optional photo through Android's photo picker. Notification permission supports Nudge notifications. NFC supports nearby sharing. Supported devices can offer SMS code assistance with your consent, without giving Nudge unrestricted access to your message inbox.

If you connect YouTube or Discord, we obtain the public channel or account identity and profile metadata needed to display and share that connection. Bluesky profile lookup returns public profile information. External avatar servers receive network requests when images are loaded.

The current application does not include advertising tracking or a dedicated usage-analytics or crash-reporting integration. It does not request GPS location access. An address you enter on a business card is information you provide, not automatically collected location data.

3. How We Use Information

We use personal information to:

• Create, authenticate, recover, and maintain accounts.
• Verify contact details and prevent impersonation, spam, and abuse.
• Create, store, edit, and display contact cards and optional social connections.
• Complete sharing actions you choose and maintain exchange history.
• Save received details to your device when requested.
• Verify purchases, deliver paid features, restore eligible purchases, and address payment disputes.
• Provide support, handle rights requests, investigate security issues, and meet applicable legal obligations.

We do not use your contact cards to send marketing on behalf of other users. Service messages, such as verification and recovery codes, support account operation.

Where the GDPR or UK GDPR applies, our legal bases are performance of the service agreement for account and sharing functions; legitimate interests in service security, fraud prevention, and support where those interests are not overridden by your rights; consent where required for optional processing; and compliance with legal obligations. You may withdraw consent for future processing without affecting earlier lawful processing. A device permission alone does not replace consent required by privacy law. Where Saudi law applies, processing must have a basis permitted by the Saudi Personal Data Protection Law and its regulations.

4. Data Sharing with Third Parties

4.1 Other users and sharing recipients

Nudge releases selected details through the sharing flow you use. Personal-card exchanges use confirmation controls. Business and social sharing may use one-way sharing or independent recipient decisions. Public NFC social sharing can make the selected public social link readable by nearby compatible devices, including devices without a Nudge account.

Recipients may retain, export, or use details you share. Updating or deleting your card does not update or recall copies already received. Consider each card's contents and sharing mode before sending.

4.2 Service providers and integrations

Instagram, X, and WhatsApp are supported as user-provided links or contact handles. Opening one of these links, a business website, or a Google Maps address search takes you to an external service that handles information under its own terms and privacy notice.

Our suppliers process information in their service-provider role where applicable. Some providers, including payment and social platforms, also act independently for their own services. Linking is optional. The current hosted integration stores public YouTube and Discord identity metadata rather than retaining their OAuth tokens as an ongoing account connection. You can remove linked connections through the app where offered and manage provider permissions directly with that provider.

4.3 Other disclosures

We may disclose information when legally required, in response to valid legal process, or when reasonably necessary and lawful to investigate abuse, protect people, or establish or defend legal rights. If Nudge's ownership or operation changes, any transfer of personal information must comply with applicable law and the notices or choices it requires.

We do not sell personal information or share it for cross-context behavioral advertising. Sending a card to a recipient at your request is part of the service, not advertising sharing.

5. Your Choices and Rights

You can edit cards, omit optional information, remove supported social connections, change sharing preferences, and manage device permissions. Certain verified account details may require a verification or support process to change.

You can request account deletion in Nudge Settings. The app requires password verification and confirmation. If you cannot access your account or need another privacy action, contact support@mernox.dev. Do not email your password or verification code.

We may ask for proportionate information to verify your identity or an authorized representative's authority. We will handle requests within applicable legal deadlines and explain any lawful refusal or limitation. Rights may be subject to exceptions. We will not discriminate against you for exercising rights protected by law.

5.1 EEA and United Kingdom

Where applicable, you may request access, correction, erasure, restriction, or portability, object to processing based on legitimate interests, and withdraw consent. You may complain to your local supervisory authority. GDPR requests generally require a response within one month, subject to permitted extensions with notice. Nudge does not use personal information for automated decisions producing legal or similarly significant effects about you.

5.2 California

If the CCPA, as amended by the CPRA, applies to us and your information, you may request disclosure of the categories and specific information collected, its sources, purposes, and recipients; correction; deletion; and portability. You may also have rights to opt out of sale or advertising sharing and limit qualifying uses of sensitive information. We do not sell information or engage in advertising sharing. We use account credentials for authentication, not to infer personal characteristics. Verified access, correction, and deletion requests generally receive a response within 45 days, subject to lawful extensions and notice. Authorized agents may contact the same support address.

5.3 Saudi Arabia and other regions

Under the Saudi Personal Data Protection Law, where applicable, you may be informed about processing, access and obtain a copy of your information, request correction or destruction, and withdraw consent where processing depends on it. You may complain to the Saudi Data and Artificial Intelligence Authority through its official channels. Other local laws may provide additional rights, including an appeal against a request decision. Contact us to exercise applicable rights.

6. International Processing

Nudge is operated from Saudi Arabia and uses external infrastructure and integrations. Information may be processed in countries other than where you live. Data-protection laws differ between countries.

Primary database hosting: Our Supabase project is hosted in the North EU region in Stockholm, Sweden. This describes the primary database location, not every processing location. Our operators access the service from Saudi Arabia, and verification, payments, social integrations, provider support, and infrastructure operations may involve other countries.

Provider-managed safeguards: Our infrastructure provider manages encryption and other security controls for its hosted services. Supabase states that customer data is encrypted at rest and in transit and publishes a Data Processing Addendum containing Standard Contractual Clauses for transfers where applicable. These contractual safeguards are distinct from encryption.

Applicable transfer arrangements: We use Supabase’s hosted services under its Data Processing Addendum, which includes Standard Contractual Clauses for international transfers where applicable. Supabase also applies technical safeguards, including encryption in transit and at rest. Although Nudge’s primary database is hosted in Stockholm, Sweden, certain support and operational processing may occur in other countries. For questions about these arrangements, contact support@mernox.dev. Provider-managed controls do not remove our own obligations for lawful transfers.

Where required, transfers must satisfy applicable Saudi transfer regulations and the GDPR or UK GDPR, including appropriate safeguards or a lawful exception. Contact us for information about the safeguards relevant to your information. Using Nudge is not, by itself, consent to an otherwise unlawful international transfer.

7. Data Retention and Deletion

Account information, profiles, social connections, saved history, and purchase entitlements remain available while needed to provide the account and associated features. The current service does not apply a fixed inactivity-based deletion period to these records.

Verification codes are valid for five minutes. Verification-request records older than two days are eligible for cleanup when another code request is processed. Temporary NFC tickets and exchange sessions expire quickly, but expiry does not itself erase their stored records. Later sharing requests perform limited batch cleanup, so physical deletion can occur after the expiry time.

Confirmed account deletion removes the authentication account and associated owned records through backend deletion and database relationships, followed by account-specific local cleanup. Requests can fail or be interrupted; follow the app's confirmation and retry instructions or contact support. Other recipients' saved histories and phone contacts are not remotely erased. Provider payment records and any records independently retained by external services are governed by their obligations and policies.

A one-way account identifier remains after deletion to prevent improper purchase reactivation and support eligible purchase restoration. It has no fixed automatic expiry in the current implementation and does not contain your contact details or purchase token. We do not describe this identifier as necessarily anonymous.

Backups: Mernox Studios does not create or maintain separate backups of Nudge user data. Any backups, replicas, or recovery copies independently maintained by service providers are subject to their applicable service arrangements and deletion schedules. This statement does not mean that no provider-held copies exist.

Supabase logs: Nudge currently uses the Supabase Free plan, which provides a one-day retention window for project logs. This log-retention window does not apply to stored accounts, profiles, contact history, or other database records. It also does not establish a deletion deadline for all provider-held security, billing, backup, or recovery records.

Other provider records: Retention depends on the provider, the service, and the type of record. Deleting a Nudge account does not delete a separate Google, Discord, or other provider account, or automatically terminate our provider accounts.

• Resend: Resend states that email and log data is retained for 30 days on its standard Free, Pro, and Scale plans, backups are retained for seven days, and remaining customer data is deleted within 90 days after termination of the Resend account. See Resend security and retention information.
• Google services, including YouTube and Google Play: Google applies different retention periods to different records. Some information remains until the user removes it or deletes their Google Account; payment, security, and legally required records may be kept longer. There is no single 18-month or 720-day limit for all Google information involved in these services. See Google data-retention information.
• Discord: Discord retains some information while a Discord account remains active. Its published retention guidance includes 180 days after deletion for certain trust and safety records, or up to two years where a user has been reported or flagged for violations. Other records can have different or longer periods, including records needed for legal obligations. These periods describe Discord's own services, not a fixed retention period for all Nudge connection data. See Discord data-retention information.

Other providers, including Authentica, apply their own retention terms and legal obligations to delivery, security, billing, and compliance records. We do not apply a single retention period to every provider or record. Contact us for information about a particular provider or record.

Support correspondence: We do not currently apply an automatic deletion schedule to support emails. Messages and attachments may remain in our support inbox indefinitely, including after an issue is resolved, unless you request deletion or they are otherwise removed. You can request deletion at support@mernox.dev. We will assess and fulfill requests subject to applicable law and any justified need to retain particular records. Deleting a Nudge account does not automatically delete a separate support-email conversation. Please do not include passwords, verification codes, or unnecessary sensitive information in support messages.

Legally retained records: Where a particular record must be kept for a legal obligation or an unresolved dispute, its retention depends on that obligation or dispute. Retention is limited to the relevant purpose and remains subject to applicable law.

Where limited retention is legally necessary for security, an unresolved dispute, or a legal obligation, the retained information must be limited to that purpose. No period in this Policy permits retention contrary to mandatory law.

8. Data Security

Nudge uses HTTPS for hosted network requests, authenticated backend operations, restricted database access, verification-attempt controls, and temporary cryptographic identifiers for online NFC exchanges. Supabase states that its hosted customer data is encrypted at rest and in transit. This is provider-managed encryption and does not mean that all information on recipient devices or external services is encrypted in the same way. Device data is stored in app-specific storage, and Android app backup is disabled. These controls reduce risk but cannot guarantee absolute security. Cloud processing and recipients' access mean Nudge is not an end-to-end encrypted private messaging service.

Protect your device and credentials, review what each card contains, and notify us of suspected unauthorized access. We will address security incidents and provide notices where required by law.

9. Children and Teenagers

Nudge is for users aged 13 and older and does not permit accounts for children under 13. We do not knowingly collect personal information from children under 13. If you believe such information has been provided, contact support@mernox.dev so we can investigate and arrange appropriate deletion.

Where the U.S. Children's Online Privacy Protection Act applies, we will not knowingly collect, use, or disclose an under-13 child's personal information without the notices and verified parental consent required by that law. Nudge does not currently offer an under-13 registration or parental-consent service.

Users aged 13 to 17 must have a parent or guardian's involvement where local law requires it. In the EEA, parental authorization for consent-based online processing can be required until an age between 13 and 16, depending on the country. A 13+ eligibility rule does not override these requirements. Do not submit information for an optional consent-based feature where legally required parental authorization has not been obtained.

10. Changes to This Policy

We may update this Policy to reflect service or legal changes. The effective date identifies the applicable version. We will provide additional notice of material changes and obtain consent where required. Changes do not remove rights you already have under applicable law.

11. Contact Information

For privacy questions, rights requests, security concerns, or concerns about a child's information:

Mernox Studios, Nudge
Email: support@mernox.dev
Location: Dammam, Saudi Arabia
Responsible operator and additional contact details: as identified in Section 1.