Privacy Policy — Scourgify

The short version

Scourgify remembers when you last did things. To do that it stores the things you choose to track and the dates you logged them, tied to the account you signed in with. That is all.

It contains no analytics, no advertising and no tracking SDKs. Nothing about how you use the app is measured, profiled or sent anywhere.

The one exception is crashes. If the app falls over, it sends a technical report so the bug can be found and fixed. That report describes the code that failed, not you — see "When the app crashes" below for exactly what is in it.

What is stored, and why

Everything below lives in one Postgres database hosted by Supabase in London, United Kingdom, and is readable only by your own account (enforced in the database itself, not just in the app).

Your account

• The user id, email address and — if the provider supplies it — the name from whichever sign-in you used (Apple or Google). Scourgify never sees or stores a password; there is no email-and-password option.
• If you sign in with Apple and choose Hide My Email, Scourgify only ever receives Apple's relay address. It works exactly the same.
• Your display name, your device's timezone, the hour of the day you would like reminders, and your currency preference. The timezone and the hour are captured so a reminder arrives in the morning where you are rather than at some server's idea of morning.

The things you track

• For each item: its name, an optional category and icon, how often it repeats, whether it is paused or snoozed, and who it is for.
• The people you add to your household: a name, an optional emoji and colour. These are labels you type; Scourgify does not know or ask who they really are.

Your log entries

• The date you say something was done — which you can backdate, because the point is when it actually happened.
• An optional note and an optional cost, if you choose to add them.

Notifications

• If you allow notifications, a push token for the device, and a record of which reminders have already been sent. That record exists so a reminder is sent once and never repeated.

When the app crashes

• The error and where in the code it happened, the app version, the iOS version, the device model, and a random identifier for the install so repeated crashes can be recognised as the same problem.
• Not your email, your name, your account id, your items, your notes or your costs. Crash reporting is configured with personal information switched off, and screen recording — which some crash tools offer and which would capture whatever your notes say — is switched off entirely and is not something Scourgify will turn on.

What is deliberately absent: no location, no contacts, no calendar, no photos, no health data, no advertising identifier, no device fingerprint, no analytics, no screen-by-screen tracking, no record of what you tap. The app asks for exactly one permission — notifications — and only when you tap to allow it.

Who else is involved

Four services, each doing one job:

• Supabase — hosts the database and handles sign-in. Your data lives here, in London. Supabase acts as a data processor under its data processing agreement, which means it handles the data on Scourgify's instructions and not for its own purposes.
• Apple and Google — only to verify who you are when you sign in. Scourgify receives a signed token, an email address and sometimes a name. It sends them nothing about how you use the app.
• Expo's push service — used only to deliver a notification to your device, and only if you turned notifications on. A notification contains the name of the thing that is due and roughly how long it has been, because that is the whole message. Delivery goes on to Apple's push service, as it must for any iPhone notification.
• Sentry — receives the crash reports described above, and nothing else. Scourgify's Sentry data is stored in the European Union (Frankfurt). Sentry acts as a data processor, like Supabase, and SLC Studios Ltd is the controller instructing both.

There are no other recipients. Nothing is sold, and nothing is shared for advertising.

How long it is kept

For as long as you keep the account. Scourgify is a memory: a log from four years ago is the feature, not clutter, so nothing is deleted on a timer.

Deleting everything

Settings → Delete account, in the app. It is immediate and irreversible, and it is the one action in Scourgify with no undo.

It removes, in order: your push tokens, the record of reminders sent, your log entries, your items, the people you added, your household membership and household, and finally the account itself. The account is deleted last, deliberately — so that if any step fails you can still sign in and try again rather than being locked out of data that is still there.

You can also ask hello@scourgify.com to do it for you.

Your rights, and the legal basis for all this

If you are in the EU, UK or another place with similar law, you can ask for a copy of your data, ask for it corrected, or ask for it deleted. Deletion is built into the app, as above. For anything else, write to hello@scourgify.com.

Under the GDPR, Scourgify relies on exactly two legal bases:

• Performance of a contract (Article 6(1)(b)) for your account, the things you track and your log entries. These are the service you asked for — without them there is no app.
• Consent (Article 6(1)(a)) for notifications. You give it by allowing the permission, and you withdraw it by turning notifications off in iOS Settings, which stops them immediately. Nothing else depends on it.
• Legitimate interests (Article 6(1)(f)) for crash reports, and for nothing else. The interest is keeping the app from breaking; the data is technical rather than personal, which is why the balance comes out where it does. If you would rather not send them, say so at hello@scourgify.com.

There is no legitimate-interests processing for analytics, profiling, marketing or product measurement, because none of those happen.

You also have the right to complain to a supervisory authority. In Malta that is the Office of the Information and Data Protection Commissioner (idpc.org.mt).

Where the data goes

The database is in the United Kingdom, which for most users means their data leaves the EU. That transfer is lawful on two independent footings, either of which would be enough:

• The European Commission has decided the UK provides adequate protection — a decision renewed on 19 December 2025 and running to 27 December 2031 — so transfers from the EU to the UK need no additional safeguards.
• Separately, Supabase's data processing agreement already incorporates the EU Standard Contractual Clauses (controller-to-processor) and the UK International Data Transfer Addendum, which is the standard fallback if adequacy ever lapses.

Crash reports do not go to the UK at all — they are stored in the EU, in Frankfurt.

Nothing is transferred anywhere else, except that a notification you asked for travels through Expo's and Apple's push services to reach your phone.

Children

Scourgify is not aimed at children and asks for nothing that would identify one.

Changes

If this policy changes in a way that affects what is collected, the app will say so rather than quietly updating a page nobody reads.