What we collect. What we never touch.

It’s a short list. We only ask for what actually makes the app work.

• Your email address: to create and secure your account (via Supabase Auth).
• What Sign in with Apple or Google hands us: if you choose one of those buttons instead of an email code, the provider returns a unique account identifier, your email address (Apple’s may be a private relay address), and your name if you let it through. That is the whole of it. We ask for no other permission, we never read your Gmail, contacts, calendar, files or photos, and we never post anything anywhere on your behalf. What comes back is stored in Supabase Auth purely to be your login, is used for nothing else, is never sold, shared, or used for advertising, and is deleted with the rest of your account.
• Your display name: the name your friends see, and the name that appears on anything you post to the public community board.
• Your daily log: whatever you say, and whatever you type alongside it. A log now takes a voice note, so almost every day you log carries a recording, and that recording is kept as well as transcribed. The demand lifts in exactly two situations, both of them a door that is shut rather than a preference: a microphone your phone will not ask you about again, and a transcription service that will not answer. It never lifts because you would rather not, and there is no setting for it. The audio goes to OpenAI to become the text your score is generated from (see section 03), and the file itself is stored in a private bucket where the friends you have accepted can press play on it for 14 days. The file is then deleted outright once it is 30 days old, whether or not you ask. Section 04 has the detail on who can hear it.
• Your device’s time zone: a zone name like “Asia/Kuala Lumpur”, stored on your profile so a “day” ends at your midnight and not ours, and so an evening reminder fires at the hour you picked. It is a zone name, never a coordinate.
• Your health score: the number your log generates, plus the average of your last 14 logged days.
• Anything you post to the community board: the feature requests, comments, and votes you choose to submit. These are public by design, carry your display name, and are handled by Canny (see section 03). Nothing on the board is private; your daily logs never appear there.
• Photos you attach to a day: at least one, and up to six. A photo is no longer something you add if you feel like it, it is part of what a log is. The demand lifts only if the picker on your phone will not open at all, which is the photo half of the same rule: compulsory for anyone who can, never impossible for anyone who cannot. The files live in a private bucket, and adding one grants your accepted friends’ accounts read access to it for the next 14 days. There is no per-photo private setting, so treat anything you attach as shared with your circle. Remove one and it comes off your day for everyone. Section 04 has the detail.
• Your spoken promise: the one line you read out loud when you set up. The audio goes to OpenAI to be turned into text, and that text goes to Anthropic to check you actually said the line (see section 03). The clip itself is then kept, in a private folder that only your own account can read. That is the difference between it and a spoken daily log: a daily log is audible to your accepted friends for 14 days, and your promise is audible to nobody but you. It goes when your account goes.
• Product analytics: Mr. Chud ships PostHog, and it is the only analytics SDK in the app. It records what you did, never what you wrote: named product events (opened the app, finished onboarding, logged a day, saw the paywall), the screen you’re on, your Supabase user id, your app version, and your platform. The PostHog SDK also attaches ordinary technical context to each event by itself: your device model, OS and OS version, app build, screen size, timezone and the SDK version. We tell PostHog to skip its IP-based location lookup, so no city, region, postcode or coordinate is derived from or stored against your events. Here is the part we will not round off: that switch has not always been there. Every event from a version of the app that carries it arrives with no location on it at all. Events sent by older versions, before the switch existed, did carry a coarse city, a postcode and an approximate latitude and longitude, every one of them worked out from the IP address the request arrived from and never from your device, and those older events are still in our analytics under your user id. None of it comes from GPS, we never ask your device where it is, and we do not use any of it for anything. Section 04 has what happens to that record when you delete your account. The code enforces a hard no-content rule: every property that goes out is an enum, a boolean, a count, or a coarse band, so entry text, reflections, your Chud’s name, your username, your email and any token are structurally incapable of ending up in an event. Even your score goes in as a band (“60-79”), never the words behind it. It runs on our own PostHog project, it is used only to see which parts of the app work, and it is never used for advertising or joined with your activity in any other app or website.
• Crash diagnostics: Mr. Chud ships Sentry, and it is the only crash-reporting SDK in the app. When the app crashes or hits an error it sends Sentry the error and its stack trace, your app version and build, your device model, OS and OS version, and your Supabase user id, so a crash can be tied to a session rather than guessed at. Sentry is never sent a screenshot, a view hierarchy, or a session recording: a picture of this app is a journal entry, so all three are switched off in the code and are meant to stay off. It never receives the text of a log, your reflection, your Chud’s name, your username or your email. One thing we will not round off: the report travels over the internet to Sentry’s servers, so Sentry’s own systems see the IP address the request arrives from, and an IP address can be resolved to an approximate country and region. We never ask your device for its location, no coordinate is stored on a crash report, and we do not use that region for anything. Separately, Apple and Google may hand us their own crash reports through App Store Connect and Play Console, and only if your device is set to share diagnostics with them.

That’s it. No GPS or precise location, no contacts access, no browsing history, no advertising identifiers, and no microphone access outside of two moments: the voice note a daily log requires, and the promise you read out loud at setup. Both of those are asked for where they happen. The microphone dialog is raised inside the log itself, the first time you press record, and never before it, on either platform. Your photo library is never opened: the picker that appears belongs to iOS or to Android, it runs outside this app, and what comes back is the pictures you tapped and nothing else, so Mr. Chud has no reading of your library and never asks for one.

This is the part we take the most seriously, because it’s the whole reason you’d trust the app enough to be honest in it.

• The text of your entry is stored in your own row in our database, because that row is what makes your “Days” calendar work months later. It goes to Anthropic for exactly as long as it takes to score it, and to nobody else: not to your friends, not to an advertiser, not to any other processor. The audio of the voice note goes to OpenAI to become that text, and the recording is then kept on our side: the friends you have accepted can play it for 14 days (section 04). They get the sound of your day and nothing else. The text of the entry, the reflection you wrote on it and every caption stay with you.
• Mr. Chud is one person, and that person can technically query the database your row sits in. Nobody reads your entries as a matter of routine, no other person or company is given access to them, and no feature anywhere in the app shows the text of one of your entries, or the reflection you wrote on it, to anyone but you. Section 04 is exact about what a friend does reach, and it is the score a day earned and never the words behind it.
• We do not sell your data. Ever. To anyone. Full stop.
• We don’t run ads and there is no ad-network tracking code anywhere in the app.
• Your entries are never used to train anyone else’s model beyond what’s strictly needed to score that one entry.

We use a small number of outside services (“processors”) to run Mr. Chud. Each one only gets what it needs to do its single job. None of them get the full picture, and none of them may use your data for anything beyond running the app.

Your circle sees both of the names you typed: your display name, and the name you gave your Chud, which the board prints next to it on every card. They also see the art style you picked for him, his current state on the ten-step ladder (Goated, Locked In, Mid, Fell Off, Cooked, Burnt, Wrecked, Folded, Walahi, Big L), your health score and its daily delta, your streak, and your level. The number the board shows by default is the average of your last 14 logged days, the same number your Chud wears. The board can also be switched to a single day, and on that one a friend who has not logged that day reads as no log rather than as a number. On the average board there is a number for everyone who has ever logged, including someone who stopped weeks ago: their average simply holds where their last 14 logged days left it. Those are 14 days they logged, not the last 14 days on the calendar, so an average can be older than it looks, and a friend who has been away still shows one. Their copy of your row is also told how many days it has been since you last logged, whether or not the card prints it.

Your accepted friends are also granted access to the photos you attach to a day. Every photo you add is shared with them the moment you add it, there is no per-photo private setting in the app, and the grant reaches back 14 days and no further. Remove a photo and it comes off your day for everyone. The leaderboard prints those photos on your card, so your circle sees them as pictures and not only as a permission. A log now requires at least one photo, so this is no longer a thing that happens on the days you opt into it. Treat any day you log as a day your circle gets a picture from. If you would rather a day stayed yours alone, the only way left is not to log it.

A log now requires a voice note (section 01 has the two narrow cases where that demand lifts), so there is a recording of your voice on almost every day you log, and your accepted friends can press play on it, on your card on the leaderboard, for 14 days from the day you logged it. After that the clip expires and is deleted, and the card simply says there is no voice note for that day. What crosses is the audio and nothing else: not the transcript it produced, not your reflection, not a caption. Blocking someone, or the clip being reported, ends their access to it immediately. Typing more is not a way around this one: the words you type are still yours alone, and the recording still goes out. If you would rather a day was not audible to anyone, the only way left is not to log it.

Your circle can also open your history. Your card on the leaderboard opens a calendar of your days, laid out the same way as the one on your own Days tab, and a friend can page back through it a month at a time. Two things cross, per day: the date, and the score that day earned. Nothing else on the day is sent to them. Not the text of your entry, not the reflection, not the notes the model wrote while it was scoring you, not your running average at that point in time, and no handle that would let their app ask for any of it.

There is no cut-off on this one, and that is the part to read twice. The photo grant and the voice grant stop at 14 days. The calendar does not. It reaches back as far as your account does, so a friend who joined your circle today can page back to the score you earned on your very first day, and will still be able to next year. A day you did not log has no tile, so what they read off that calendar is also which days you skipped. A day you logged that never got a reading shows as logged with no number against it. Photographs and recordings are not part of this: page back into a month older than 14 days and there is nothing to look at and nothing to play, only dates and numbers.

Only an accepted friend can open it, blocking someone ends it in both directions the moment the block exists, and removing someone from your circle ends it outright.

They never see the text of your entry, or the reflection you wrote on it, on the board or in that calendar. The board and the calendar both run on the score, not the confession behind it. That’s the whole design.

The community board is the one public surface: posts, comments, and votes you make there are visible to every other Mr. Chud user, under your display name. Your logs and scores are never posted there for you.

We keep your logs and scores for as long as your account exists. That’s what makes your “Days” calendar and campaign progress work over months. Read that line together with section 04: because we keep the scores, and because your circle can open a calendar of them, the length of your account is also the length of a friend’s reach into your score history. Deleting your account is the only thing that shortens it.

Photos are the exception, and they expire on their own. A scheduled job deletes every attached photo once it is 90 days old, whether or not you asked. Your friends’ access to one runs out much sooner than that, at 14 days.

Spoken daily logs expire too. A recording carries its own expiry from the moment you log it: 30 days, after which it is deleted from storage by a scheduled job. Your friends’ access runs out well before that, at 14 days. The text it was transcribed into stays with your day, because that is what your calendar and your score are built on.

One honest exception. Anything you posted to the public community board (feature requests and comments) stays on the board after you leave, because other people voted on it and replied to it. Your name comes off it: deleting your account strips your identity from those posts and they show as written by “a chud.” If you want a specific post taken down entirely, email us and we’ll remove it.

Mr. Chud is meant for people 13 and up. If you’re under 13, please don’t use it. If we learn that a user is under 13, we’ll delete the account.

This policy will keep evolving as the app does. When it changes, we’ll update the date at the top of this page, and we’ll notify you in-app before anything meaningfully different takes effect.