1) What Urge is
Urge (“we,” “us”) is a mobile app for daily discipline, habits, and motivation. Much of your data stays on your device. If you enable optional sync, data may be stored in iCloud via CloudKit under Apple’s terms. If you use social or posting features, we also process data through Supabase (hosted backend: authentication, database, storage, and related services we configure). This policy describes each layer.
2) Data on your device (local)
The app stores information locally to run Urge, including:
- Account & profile: Display name, onboarding state, habit and streak data, task completion history, liked and seen quotes, daily state, optional tasks, and custom nudges.
- Settings: Notification preferences (times, quiet hours, sounds), quote categories, themes and icons, accessibility and text scale, hard mode, streak freezes, Pro badge preference, and—when you use social features—cached public profile fields such as handle, bio, and avatar URL.
- Session storage: Social sign-in session data may be kept in UserDefaults (or equivalent local storage). This is not your full Apple account; Sign in with Apple is handled by Apple, and the app uses tokens with our backend as described below.
3) Sign in with Apple & Supabase Auth
When you use Sign in with Apple, Apple performs sign-in. The app exchanges tokens with Supabase Auth so you receive a user identifier and session for features that require an account. We do not receive your Apple password.
4) Optional iCloud backup & CloudKit sync
If you turn on sync (where available), an encrypted snapshot of the same broad categories of local data—such as profile-related fields, streaks, completions, likes, seen quotes, and tasks—may be stored in your iCloud via CloudKit. That processing is governed by Apple’s iCloud terms and your Apple ID settings, in addition to how the app is built. Optional iCloud backup of the app may also apply based on your device backup settings.
5) Social & backend (Supabase)—only if you use social / posting
If you do not use social or posting, the backend data below generally does not apply beyond what Supabase Auth requires for sign-in, if you sign in at all. If you do use social features, we process the following categories through Supabase (and services we connect to it), for example:
- Public profile: Handle, display name, bio, avatar image URL (the file may be stored in Supabase Storage), follower and following counts, account deactivation state, and optional Elite visibility for Pro subscribers where the app provides it.
- Posts: Text, visibility (public, friends, or private), timestamps, and engagement counters.
- Likes: Which user liked which post.
- Relationships: Follow and unfollow between accounts.
- View events: Data about views of posts or feeds to power feed ordering and in-app analytics.
Supabase’s infrastructure and security practices apply to data hosted there. See Supabase’s privacy information.
6) Creator analytics (e.g. Pro)
For eligible accounts (such as Pro), the app may show creator analytics: aggregated metrics derived from the events above (for example, views and likes over time windows). These are based on data already collected for operating the social product—not separate advertising profiles.
7) Safety & moderation (reporting)
If you report a profile or post, the app may send information to our review pipeline (for example, stored in Supabase or an ingest service we operate) such as: report type, reasons, optional free-text detail, identifiers for the reported user or post, a short text preview of the reported content where needed for review, and context such as app version, build, device model, and platform. This processing is for moderation and safety, not for advertising. Reports may be handled so the reported user does not see your identity (anonymous from their perspective) where the app is designed that way.
8) Subscriptions
Purchases and subscription status are processed by Apple via the App Store and StoreKit. The app uses that status to unlock Pro features. Apple’s privacy policy and terms apply to payment data; we do not receive your full payment card number.
9) Game Center (optional)
If you enable it, streak-related scores may be submitted to Apple Game Center leaderboards. Game Center is governed by Apple’s terms and policies.
10) Analytics & what we don’t bundle for ads
In-app screens and Supabase-backed metrics (such as feed or creator analytics described above) are the main analytics story tied to product features. We do not rely on separate third-party analytics SDKs (such as Firebase Analytics, Crashlytics, or Mixpanel) in the app as of this writing; if we add such services later, we will update this policy.
11) Notifications
If you allow notifications, Urge may send them according to your notification settings (times, quiet hours, etc.) and system permissions—for example reminders, streak or task prompts, or social activity where applicable.
12) How we use and share data
We use the information above to run Urge: habits and discipline features, optional sync, authentication, social features, analytics shown in the app, moderation, support, security, and legal compliance. We do not sell your personal information. We share data with service providers needed to operate the app (such as Supabase and Apple). We may disclose information if required by law or to protect the safety and integrity of the service.
13) Security
We use reasonable technical and organizational measures suited to the service. No method of storage or transmission is perfectly secure; protect your device, Apple ID, and account access.
14) Your choices & deleting your data
You can manage many settings in the app (notifications, themes, social visibility, deleting posts, follow/unfollow, etc.) where those controls exist.
Where the app provides it, you may delete your data—including local data, data in Supabase tied to your account, and settings consistent with the deletion flow—including use of in-app delete all data or account deletion features. iCloud/CloudKit data is subject to Apple’s controls and your sync/backup settings. Retention may be limited where the law requires or for legitimate security and backup practices as described in the app.
15) Changes to this policy
We may update this Privacy Policy from time to time. We will update the effective date at the top when we do.
16) Contact
If you have questions about this policy, contact Jasstej Singh at jasstej.business.official@gmail.com.