What we collect. What we never touch.

It’s a short list. We only ask for what actually makes the app work.

• Your email address: to create and secure your account (via Supabase Auth).
• What Sign in with Apple or Google hands us: if you choose one of those buttons instead of an email code, the provider returns a unique account identifier, your email address (Apple’s may be a private relay address), and your name if you let it through. That is the whole of it. We ask for no other permission, we never read your Gmail, contacts, calendar, files or photos, and we never post anything anywhere on your behalf. What comes back is stored in Supabase Auth purely to be your login, is used for nothing else, is never sold, shared, or used for advertising, and is deleted with the rest of your account.
• Your display name: the name your friends see, and the name that appears on anything you post to the public community board.
• Your daily log: whatever you type or say. If you use voice, the audio is transcribed to text and then discarded (see section 03).
• Your health score: the number your log generates, plus the average of your last 14 logged days.
• Anything you post to the community board: the feature requests, comments, and votes you choose to submit. These are public by design, carry your display name, and are handled by Canny (see section 03). Nothing on the board is private; your daily logs never appear there.
• Photos you attach to a day: up to six per day, if you choose to add them. The files live in a private bucket, and adding one grants your accepted friends’ accounts read access to it for the next 14 days. There is no per-photo private setting, so treat anything you attach as shared with your circle. Remove one and it comes off your day for everyone. Section 04 has the detail.
• Your spoken promise: the one line you read out loud when you set up. The audio goes to OpenAI to be turned into text, and that text goes to Anthropic to check you actually said the line (see section 03). Unlike a spoken daily log, the clip itself is then kept rather than discarded, in a private folder that only your own account can read. It goes when your account goes.
• Product analytics: Mr. Chud ships PostHog, and it is the only analytics SDK in the app. It records what you did, never what you wrote: named product events (opened the app, finished onboarding, logged a day, saw the paywall), the screen you’re on, your Supabase user id, your app version, and your platform. The PostHog SDK also attaches ordinary technical context to each event by itself: your device model, OS and OS version, app build, screen size, timezone and the SDK version. We have turned PostHog’s IP-based location lookup off, so no city, region, postcode or coordinates are ever derived from or stored against your events. The code enforces a hard no-content rule: every property that goes out is an enum, a boolean, a count, or a coarse band, so entry text, reflections, your Chud’s name, your username, your email and any token are structurally incapable of ending up in an event. Even your score goes in as a band (“60-79”), never the words behind it. It runs on our own PostHog project, it is used only to see which parts of the app work, and it is never used for advertising or joined with your activity in any other app or website.
• Crash diagnostics: Mr. Chud ships Sentry, and it is the only crash-reporting SDK in the app. When the app crashes or hits an error it sends Sentry the error and its stack trace, your app version and build, your device model, OS and OS version, and your Supabase user id, so a crash can be tied to a session rather than guessed at. Sentry is never sent a screenshot, a view hierarchy, or a session recording: a picture of this app is a journal entry, so all three are switched off in the code and are meant to stay off. It never receives the text of a log, your reflection, your Chud’s name, your username or your email. One thing we will not round off: the report travels over the internet to Sentry’s servers, so Sentry’s own systems see the IP address the request arrives from, and an IP address can be resolved to an approximate country and region. We never ask your device for its location, we never store a coordinate, and we do not use that region for anything. Separately, Apple and Google may hand us their own crash reports through App Store Connect and Play Console, and only if your device is set to share diagnostics with them.

That’s it. No GPS or precise location, no contacts access, no browsing history, no advertising identifiers, and no microphone access outside of the moments you choose to speak: a voice log, or your promise.

This is the part we take the most seriously, because it’s the whole reason you’d trust the app enough to be honest in it.

• The text of your entry is stored in your own row in our database, because that row is what makes your “Days” calendar work months later. It goes to Anthropic for exactly as long as it takes to score it, and to nobody else: not to your friends, not to an advertiser, not to any other processor. If you spoke it instead of typing it, the audio went to OpenAI to become that text and was then discarded.
• Mr. Chud is one person, and that person can technically query the database your row sits in. Nobody reads your entries as a matter of routine, no other person or company is given access to them, and no feature anywhere in the app shows one of your entries to anyone but you.
• We do not sell your data. Ever. To anyone. Full stop.
• We don’t run ads and there is no ad-network tracking code anywhere in the app.
• Your entries are never used to train anyone else’s model beyond what’s strictly needed to score that one entry.

We use a small number of outside services (“processors”) to run Mr. Chud. Each one only gets what it needs to do its single job. None of them get the full picture, and none of them may use your data for anything beyond running the app.

Your circle sees both of the names you typed: your display name, and the name you gave your Chud, which the board prints next to it on every card. They also see the art style you picked for him, his current state on the ten-step ladder (Goated, Locked In, Mid, Fell Off, Cooked, Burnt, Wrecked, Folded, Walahi, Big L), your health score and its daily delta, your streak, your level, and how long it has been since you last logged.

Your accepted friends are also granted access to the photos you attach to a day. Every photo you add is shared with them the moment you add it, there is no per-photo private setting in the app, and the grant reaches back 14 days and no further. Remove a photo and it comes off your day for everyone. This version of the app has no screen that renders a friend’s photos, so for now the sharing is a permission rather than a picture on a wall. It is the permission that decides who can reach the file, so treat every photo you attach as shared. If you would rather a day stayed yours alone, don’t attach a photo to it.

They never see the text of your entry, or the reflection you wrote on it. The leaderboard runs on the score, not the confession behind it. That’s the whole design.

The community board is the one public surface: posts, comments, and votes you make there are visible to every other Mr. Chud user, under your display name. Your logs and scores are never posted there for you.

We keep your logs and scores for as long as your account exists. That’s what makes your “Days” calendar and campaign progress work over months.

Photos are the exception, and they expire on their own. A scheduled job deletes every attached photo once it is 90 days old, whether or not you asked. Your friends’ access to one runs out much sooner than that, at 14 days.

One honest exception. Anything you posted to the public community board (feature requests and comments) stays on the board after you leave, because other people voted on it and replied to it. Your name comes off it: deleting your account strips your identity from those posts and they show as written by “a chud.” If you want a specific post taken down entirely, email us and we’ll remove it.

Mr. Chud is meant for people 13 and up. If you’re under 13, please don’t use it. If we learn that a user is under 13, we’ll delete the account.

This policy will keep evolving as the app does. When it changes, we’ll update the date at the top of this page, and we’ll notify you in-app before anything meaningfully different takes effect.