Privacy Policy

This Privacy Policy explains how Quantum Leap Co., Ltd("we", "us", "our"), a company registered in Taiwan, collects, uses, and protects your personal data when you use the Nudge app and website (the "Service"). We are the data controller for your personal data.

1. Information We Collect

• Account information: your email address and basic profile details, provided when you sign in (e.g. via Google).
• Your content: the tasks, notes, tags, and related data you create in Nudge.
• Usage and device data: basic technical information needed to operate and secure the Service (e.g. log data, device/OS type).
• Payment information: when you subscribe, payment is processed by Paddle.com (international orders) or NewebPay (藍新金流) (payments made in Taiwan). We do notcollect or store your full card details — see "Payments" below.

2. How We Use Your Data

We use your data to: provide and maintain the Service; sync your content across your devices; authenticate your account; respond to support requests; send essential service notices; and comply with legal obligations. We do not sell your personal data.

3. Legal Bases (for EU/EEA/UK users)

Where the GDPR or UK GDPR applies, we process your data on these legal bases: performance of a contract (to provide the Service you signed up for), legitimate interests (to keep the Service secure and improve it), consent (where required), and legal obligation.

4. Payments

Subscription payments are handled by our reseller Paddle.com, which acts as the Merchant of Record. Paddle processes your payment details and applicable taxes. We receive transaction records (such as the fact of payment, plan, and country) but not your full card number. Paddle's handling of your data is governed by Paddle's own privacy policy.

For payments made in Taiwan, payment is processed by NewebPay (藍新金流) as our payment service provider. For those orders, Quantum Leap Co., Ltd is the seller of record and issues the invoice. We receive transaction records but not your full card number. NewebPay's handling of your data is governed by NewebPay's own privacy policy.

5. Google Calendar Data & Google User Data

If you choose to connect your Google Calendar, we request the https://www.googleapis.com/auth/calendar.readonly scope. With this permission, Nudge fetches calendar events for the current day (or week) and displays them next to your tasks. We do not modify, create, delete, or export any calendar data.

Nudge's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar events are fetched on demand each time you view the Tasks screen. We read events for the displayed date range only.
• Events are rendered in the interface and are not stored in our database or logged.
• Google user data is never sold, shared with third parties for advertising, or used to train machine-learning models.
• Google user data is used only to provide the user-facing calendar view feature described above.

6. Third-Party Services

We use a limited set of providers to run the Service, including:

• Zeabur — hosting and database infrastructure.
• Google — sign-in and (if you connect it) calendar integration.
• Paddle — payment processing (international orders).
• NewebPay (藍新金流) — payment processing (orders made in Taiwan).
• Apple — app distribution and push notifications (iOS/macOS).

These providers process data only as needed to provide their part of the Service.

7. Data Retention

We keep your data for as long as your account is active. If you delete your account, we permanently delete your account and associated content within 30 days, except where we must retain limited records to meet legal or accounting obligations (e.g. transaction records held by Paddle).

8. Your Rights

You have the right to access, correct, export, or delete your personal data, and (for EU/EEA/UK users) to object to or restrict certain processing and to lodge a complaint with your local data protection authority. To exercise any of these, email mike@nudge.tw. To delete your account and all associated data, email us and we will action it within 30 days. You can also disconnect Google Calendar at any time from Settings → Calendar → Disconnect, which deletes the stored OAuth tokens immediately, or revoke access directly at myaccount.google.com/permissions.

9. International Transfers

We operate from Taiwan and use providers that may process data outside your country. Where required, we rely on appropriate safeguards for such transfers.

10. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. Google OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to disk. No method of transmission or storage is completely secure, but we work to protect your information and maintain backups.

11. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app, and reflected by updating the "Last updated" date above.

13. Contact

Quantum Leap Co., Ltd
5F., No. 47, Qingfeng Rd. Sec. 1, Zhongli Dist., Taoyuan City 320, Taiwan
Email: mike@nudge.tw