Privacy Policy

Who this policy covers

This policy covers the Spudlet iPhone app, its widgets, Live Activities and Apple Watch companion, and spudlet.com. It explains how we handle information when you use your personal space, pair with someone, exchange little moments or gifts, or join the website’s launch list.

Information Spudlet uses

• Device and service information: a generated device identifier, platform, device model, operating-system and app version, activity times, notification preferences, and push or Live Activity delivery tokens.
• Your shared space: display names, timezones, invitation and pair identifiers, moods, pokes, hearts, care messages and replies, call availability, shared-break sessions, memories, and the times and delivery or read states associated with these actions.
• Apple account information, if you sign in: your Apple account identifier and the name and email Apple shares with us. You may choose Apple’s private relay email. We verify Apple authorization tokens; we do not receive your Apple password or Face ID data.
• Gifts and purchases: the gift, sender and recipient, delivery and thank-you states, and Apple transaction identifiers, product, verification, amount, currency, refund and purchase-environment records. Apple handles payment details; we do not receive your full card number.
• Website and support information: the email you provide to join the launch list, an optional person’s email if you provide it, share-button usage, and information you send when requesting help. Only provide someone else’s email with their permission.
• Operational information: connection and request details, including IP addresses and error or security logs, processed by our service and infrastructure providers to deliver and protect Spudlet.

Some things stay on your phone

Your name and mood in an unpaired personal space are stored locally. Creating or joining an invitation sends the name and timezone needed for that invitation. When you pair, your latest mood from that local day may be shared with your person; earlier personal days are not imported into shared history.

An optional phone number you save for your person is stored on your phone and is not sent to Spudlet’s servers. Choosing to call passes the number to the iPhone’s calling service. Spudlet does not record calls or read your address book.

Local caches, pending sends, settings and device credentials help the app work across interruptions. The app shares the data needed for widgets, Live Activities and its Watch companion through Apple’s device mechanisms. Local data may also be included in Apple-managed device backups, subject to your settings.

Your photo and happy potato portrait

If you choose the optional photo feature in Profile, we ask before uploading it. We store the original photo privately and separately from a smaller processing copy and the generated portrait. The original is retained so you can request a new makeover with a future AI model; we do not automatically regenerate or send it to a new provider.

After you confirm, a smaller copy is sent to OpenAI to generate a happy potato portrait. OpenAI processes that copy under its API data terms. The original is not sent for this generation. We do not use this feature to identify you, and the portrait is not used for advertising.

After you choose Use this Spud, the generated portrait becomes your profile picture in Spudlet and can appear in Together, widgets, Live Activities and the Watch companion. Small copies of selected portraits are cached on your devices for these screens. Your paired person can see your selected portrait while the pair is active; they cannot access your original photo or unselected previews. Uploading or generating a replacement does not publish the new portrait automatically.

You can delete your uploaded photos and generated portraits from Profile. This removes all portrait versions and their processing copies from active storage; your iPhone photo library is unchanged. Deleting an Apple-linked account also removes the portraits associated with that account. Minimal request identifiers and timestamps remain to enforce the one-generation-per-24-hours limit; backup copies expire as backups rotate.

Why we use this information

We use information to create and synchronise your space, connect you with your person, deliver messages and reminders, maintain history and collections, verify purchases and refunds, recover an Apple-linked collection, answer support requests, and prevent abuse or duplicate transactions.

Where a legal basis is required, these purposes rely on providing the service you request, our legitimate interests in security and reliability, legal obligations, or your consent where required. You can withdraw permissions or consent using the controls below; this does not undo processing that was lawful before withdrawal.

We do not sell personal information or use the mobile app to track you across other companies’ apps and websites for advertising.

Who can see your information

• Your paired person can see the information you share in your space, such as your name, mood, messages, activity and gifts. Someone opening a valid pending invitation link can see the inviter’s display name and invitation code. Treat that link as private.
• Apple provides sign-in, in-app purchases, push notifications, TestFlight and device services. Apple processes information under its own privacy terms.
• We use Hetzner for hosting and Cloudflare for traffic delivery and security. They process the information needed to provide those services. Our primary hosting infrastructure is in Finland; providers may also process data in other countries. Contact us for information about applicable international-transfer safeguards.
• Authorised operators can access service records to operate, troubleshoot and support Spudlet. Shared activity is stored on our servers and is not end-to-end encrypted.
• We may disclose information when legally required, to protect people or the service, or in a business transfer subject to applicable data-protection requirements.

Our little world, in numbers

The public website displays combined counts of actions such as pokes, hearts, moods and care messages over the last 14 days. These charts do not display names, pair or device identifiers, individual mood values, or message contents. The 14-day display window is not a promise that underlying service records are deleted after 14 days.

Interactive previews on the website do not send a real message or buy a gift. Website cookies and local browser settings support security, sessions and appearance; infrastructure providers also process traffic for delivery and abuse prevention.

Website traffic and optional analytics cookies

We also keep our own cookieless page-view counter for public Spudlet website pages. It stores only a calendar day, an approved page path and the combined number of views. It does not store visitor identifiers, IP addresses, browser details, referral sources or individual visit records, and it does not use cookies or browser storage. These daily totals are retained for traffic trends and include repeat views; they cannot identify people or count unique visitors. Known automated requests and page prefetches are excluded where detected. This counter works regardless of your analytics-cookie choice.

Spudlet.com uses Google Analytics Advanced Consent Mode to measure basic traffic on public website pages. Before you choose, or if you select Without cookies, the Google tag sends limited page-view and consent signals without reading or writing analytics cookies or assigning a persistent analytics identifier. Google receives technical information such as request headers, browser details, time, referral origin and the public page being viewed. Google processes this information on its infrastructure, which may be outside your country.

If you choose Allow analytics, Google may use analytics cookies to associate visits into users and sessions, and we also measure clicks on the App Store download link. A click does not tell us whether you installed the app. Choosing Without cookies keeps analytics storage denied and removes existing Google Analytics cookies. You can change your choice using Cookie settings at the bottom of public website pages; your choice is remembered for up to six months. Allowing analytics cookies is optional and does not affect access to the website.

Cookieless signals support aggregate measurement and modeling. They do not tell us who visited or reliably distinguish one person viewing several pages from several people. Google may exclude these signals from reports until its modeling thresholds are met; we do not describe those reports as a complete count of individual visitors.

This website measurement does not include the mobile app, admin pages, invitation codes, unsubscribe links, email or form contents, custom card messages, shared moods, photographs or gifts. We strip query strings and fragments from reported page locations. Advertising storage, Google signals and advertising personalization are disabled.

Notifications and shared screens

Notifications, widgets, Live Activities and Watch screens may show your person’s name, messages, mood or gifts where another person can see them. Use your device’s notification-preview and lock-screen settings to choose what is visible. Notification permission is optional and can be changed in iPhone Settings; automatic daily reminders also have an in-app control.

How long we keep information

We retain service data while it is needed to provide shared history, account and collection recovery, support and security, or to meet legal obligations. An invitation expiring, ending a pair, signing out or uninstalling the app does not automatically erase all server records. Pair history currently has no automatic deletion period just because a pair has ended.

Limited transaction and refund records may be retained after account deletion for reconciliation, fraud prevention and legal obligations, with account links and names removed as described below. Deleted information may remain in rotating recovery backups until those backups are overwritten. Contact us to request deletion or details about retention for your records.

Your choices and deletion

• You can edit your display name in Profile, change notification permissions in device Settings, turn off automatic daily reminders in the app, and end a pair from Profile.
• If you connected an Apple account, open Profile → Collection & purchases → Delete my account. The current app asks Apple to confirm your identity and revoke the connection, removes your account and collection access, and clears your name from gift records. Purchase records needed for refunds and reconciliation remain. Account deletion does not automatically refund purchases.
• The Apple-linked account and the device-based pair are separate. Deleting that account does not itself erase all device, pair, shared-history or notification records. Contact us to request deletion of those records, including if you never signed in with Apple.
• You can request access, correction, deletion or a copy of your personal information, withdraw consent, object to or restrict processing where applicable, or ask to leave the launch list. We may need proportionate information to verify the request. Never send your Apple password, device passcode or full payment-card details.
• Information already received or saved by your person may remain in their records. Where applicable, you may also complain to your local data-protection authority.

Keeping your little world safe

We use HTTPS for production traffic, device-authenticated requests and access controls to protect the service. Some credentials are stored using platform security and server-side encryption. These measures do not mean that every record is encrypted at rest or that shared content is end-to-end encrypted.

If you believe information was shared without permission, or a child provided personal information inappropriately, contact us so we can review and take appropriate action.

Changes to this policy

We may update this policy as Spudlet changes. We will update the date on this page and provide additional notice or request consent when required for a material change. This page describes the current service; new features may require additional information.