Privacy Policy

Account information. If you create an account with an email address, we store that address, a securely hashed version of your password, and whether the address has been verified. If you sign in with Google or Apple instead, we store the identifier that provider gives us rather than a password. You can also use the app as a guest, in which case we hold no email address and no password at all - only an anonymous account identifier.

Profile information. Your first and last name, your username, and a profile photo, if you choose to add one. All of these are optional, and any of them can be changed or removed from the Profile tab.

Content you create. The tasks and checklists you add, their emoji, their XP values, when they are scheduled, and whether they repeat - along with a record of which ones you completed and when.

Progress. Your XP total, level, current and best streak, daily totals, badges earned, and an activity record of the days you showed up.

Social connections. Friend requests you send or receive, friendships, the applause and nudges exchanged between you and your friends, and any accounts you have blocked.

Well-being sessions. When you use a focus timer, a breathing exercise, or a meditation, we record that the session happened and how long it ran. We do not record audio, and we collect no health data from your device.

Device tokens. If you turn on notifications, we store the push token your device issues so we can deliver reminders and friend activity. Turning notifications off removes it.

Technical information. Our servers keep standard logs - IP address, request times, and error details - for security, debugging, and abuse prevention.

We use the information above to:

• Run the app - store your tasks, keep your streak, and sync them across your devices.
• Authenticate you and keep your account secure.
• Show you to the friends you have connected with, and show their progress to you.
• Send transactional email: address verification and password resets.
• Deliver notifications you have asked for.
• Diagnose problems, prevent abuse, and improve the app.
• Meet our legal obligations.

We do not sell your personal information, we do not share it with advertisers, and we do not use your tasks to build an advertising profile of you.

Your friends can see your display name, username, profile photo, level, XP, and current streak, along with the activity feed showing the days you completed tasks. They cannot see the contents of your tasks.

The app also has a public ranking. If you appear on it, other users can see your username, photo, level, and XP. People who are not your friends see a limited version of your profile.

You can hide your activity feed from friends, and you can block another account, from the Profile tab.

We share information with a small number of providers who process it on our behalf, only to the extent they need it:

• Google and Apple - to authenticate you when you choose to sign in with them.
• Resend - to send transactional email such as verification codes and password resets.
• Cloudflare - to store and serve profile photos, and to serve our infrastructure.
• Our hosting provider - to run the servers and the database the app depends on.
• Apple and Google - as the stores that distribute the apps, subject to their own privacy policies.

We may also disclose information where the law requires it, or where it is necessary to protect our rights or the safety of our users.

We keep your information for as long as your account exists. When you delete your account, we remove your ability to sign in immediately and your profile stops being visible to other users.

A minimal record is retained afterwards so that shared history - a friendship, or applause given to another user - does not break for the people still using the app. Backups are cycled out on a rolling basis.

You can view and edit your profile, and delete your account outright, from the Profile tab in the app. Deleting an account cannot be undone.

Depending on where you live, you may also have the right to request a copy of your information, to have it corrected, to have it erased, to object to or restrict how we process it, and to complain to your local data protection authority. Write to support@co.dev and we will respond within the period the applicable law allows.

We do not discriminate against anyone for exercising these rights.

Passwords are stored hashed, never in plain text. Traffic between the app and our servers is encrypted in transit. Sessions use short-lived tokens that can be revoked.

No system is perfectly secure, and we cannot guarantee that a determined attacker will never succeed. If a breach affects your information, we will notify you as the law requires.

Kudos is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has given us their information, write to support@co.dev and we will delete it.

Our servers and our providers may be located in countries other than the one you live in. Where we move information out of your region, we rely on the safeguards the applicable law provides, such as standard contractual clauses.

We may update this policy as the app changes. When we do, we will revise the date at the top of this page, and for significant changes we will give notice in the app.

Questions about this policy, or about your information, go to support@co.dev.