Effective 27 October 2026. This policy describes how Elysra ("we") handles information when you
use the Nudglow Android app, the Nudglow API at api.nudglow.com, and this website.
Nudglow is a utility that keeps your PC awake by running pointer-movement workflows you build on
your phone.
| Information | When | Purpose |
|---|---|---|
| A one-way hash of your Google account identifier | Only if you choose Sign in with Google | Create your account. The app sends Google's signed sign-in token to our server once; the server verifies it and keeps only a one-way hash made from your Google account identifier and our app's Google client ID. It does not read, store or log your email address or profile name; the app shows your email address on your phone so you can see which account is signed in. We request only basic sign-in scopes (openid, email, profile) — no Gmail, Drive or other scopes. |
| Credit balances, the date your current credit cycle ends, reservations and usage totals (in milliseconds) | While you use credits | Operate the credit meter that governs how long workflows run. Totals only — never the contents of your workflows or anything typed into them. |
| Purchase receipts (Google Play purchase tokens) | Only if you buy a subscription | Verify the purchase with Google Play, make the account you used a member, grant the credits you paid for and confirm (acknowledge) the purchase to Google Play. Google Play notifies our server of renewals, cancellations, holds and refunds, and when the app opens it asks Google Play for your active subscriptions and sends their purchase tokens so a membership is restored without any action from you. Payment itself is handled by Google Play; we never see card details. |
| Rewarded-ad verification data (signature, transaction id, ad unit, one-time nonce) | Only when you claim a rewarded-ad reward | Confirm with Google that a real ad view happened before granting ad credits. Contains no advertising profile data. |
| A hashed, app-specific device identifier and a Google Play Integrity result | When the app sets up your account on this device (automatically, the first time you open it, so you do not need to sign up), and when you sign in with Google on a device that can provide the result | Fraud and abuse prevention and fair usage limits: so that reinstalling the app or switching accounts cannot reset credits, the daily rewarded-ad limit or the free credit cycle. See Device identifier and device check. Not used for advertising or analytics. |
| One-way markers that the first-run bonus was given | When your account receives the one-time 300-credit bonus after its first completed run | Give the bonus only once per account and once per device. The markers are SHA-256 hashes of the account identifier and of the hashed device identifier; they record only that the bonus was given and are kept after account deletion so it cannot be claimed again. |
| One-way markers that this cycle's free credits were given | When a free account receives its 10 free credits for a 30-day cycle | Give the monthly free credits only once per account per cycle and once per device per 30-day period. SHA-256 markers only (of the account identifier with the cycle end, and of the hashed device identifier with the period); kept after account deletion. |
| Anonymous abuse-prevention events (event type, time, the hashed device identifier and a one-way account marker) | When an account is created on a device, a free allowance is deferred or refused, or a rewarded ad is credited or refused at its daily limit | Limit new accounts per device (at most three a day) and let us review abuse in aggregate counts. Never contains your account identifier, email or the raw device identifier. Deleted after 90 days; kept for that time after account deletion so deleting and re-creating accounts cannot reset the limit. |
| In-app offer and purchase events: which offers you were shown, accepted or dismissed; when a Premium step or preview was opened without a membership; the result of a purchase sheet, a rewarded-ad load and a low-balance start | Only with an online account, only while Personalized suggestions is on (its starting value depends on where you are, see below), and only after the app showed you its notice or you allowed it | Choosing which in-app offers to show (for example the membership or a rewarded ad), and A/B testing those offers. Prices are never personalized. First-party only. See In-app suggestion events. |
| Technical logs (event name, outcome, duration) | Always | Reliability and abuse detection. Logs deliberately exclude account identifiers, tokens and request bodies. |
When the app sets up its account for this device (the first time you open it), or when you sign in with Google on a device that can provide it, the app sends two things to the Nudglow API over HTTPS:
Settings.Secure.ANDROID_ID). It is
specific to this app's signing key and the Android user on the device, and it normally survives
uninstalling and reinstalling the app. Our server immediately turns it into a keyed one-way hash
(HMAC-SHA-256 with a secret held only on the server) and keeps only that hash. The original value is
not stored and not written to logs. We do not read the IMEI, serial number, MAC address, SIM
identifiers, advertising ID, or the list of apps installed on your device.Why: to prevent fraud and abuse and to keep usage limits fair. A guest account is tied to the hashed device identifier, so a guest's credits, the limit of two rewarded ads per day, the 240-credit ad balance cap, the first-run bonus, the monthly free credits and the free credit cycle apply per device rather than per installation, and at most three new accounts can be created on one device per day. If several accounts are used on the same device we record that for abuse review; it does not stop you from signing in. When you first sign in with Google, your guest credits can be carried into your new Google account.
The same hash and device check are also used to make sure each one-time bonus is granted only once per device (see One-time bonuses).
Not used for advertising, never combined with the in-app suggestion events, not sold, and not shared with third parties other than Google Play Integrity itself, which returns the result. Retention: the device record (the keyed hash and a few counters, such as how many guest accounts the device has had; it never contains your name, email address or Google account identifier) is kept while the device is in use and for as long as its guest counter is needed to make sure a deleted or Google-adopted guest account is never given out again. We do not currently delete device records after a period of inactivity. Devices with no activity for a long time may be pruned in future; we will give notice here and in the app first. Deleting an account removes that account's own links to the device and replaces its guest with a random placeholder that is not connected to you, as the account deletion page describes. Other accounts used on the same device keep their own links. Reasonable limits of this approach: a factory reset, a different Android user profile or a modified device can produce a different identifier, so the check reduces rather than eliminates abuse.
The app shows a one-line notice about this device identifier the first time it opens, and the same notice is always available under Settings > Privacy. The account for this device is set up automatically so that nobody has to sign up to use the free credits; signing in with Google is optional and lets you use the same credits and membership on several phones. The device identifier is used only for the fraud-prevention purpose described here.
Free accounts receive 10 credits (10 minutes of movement) once in every 30-day credit cycle, and an account receives one bonus of 300 credits, once, after its first completed run (at least one minute of workflow use recorded by our server). Neither is a trial and neither unlocks Premium features. To stop them being collected many times by the same person, the server uses these signals, only for fraud prevention:
These signals are not used for advertising or for the suggestion events, and are not shared except with Google Play Integrity, which returns the result.
After account deletion we keep only the one-way markers of each bonus the account received (and, for a bonus granted later, its one-way receipt record, which holds the same markers). They contain neither your account identifier nor your device identifier and only record that the bonus was given, so that deleting and re-creating an account cannot collect it again. They are kept while the bonus is offered. Everything else about the bonuses is deleted with your account (the network hashes are not linked to your account and expire after 30 days in any case).
While Personalized suggestions is on and you use an online account, the app sends the Nudglow API a small record of these events. They are used only to choose which in-app offers to show and to A/B test them; prices are never personalized. Each event is a fixed category and a count:
We never include the contents of your workflows, anything you type, the names of your computer or other devices, the device identifier or your IP address. The server adds only the hour it received the event. Events are linked to your Nudglow account, are used only to choose and time the app's own suggestions and to measure whether they help, are not shared with AdMob or anyone else, are not used for ad personalization and are never sold.
Retention: events are deleted 90 days after we receive them, when you turn the setting off, after 30 days without any use of your account, and with your account if you delete it. We keep no per-account summaries of them.
Where it starts: the app works out, on your phone only, which rules apply from the country codes of your SIM, your mobile network and your language settings. It never sends that country to us, never stores it and never uses your IP address for it; it downloads the whole list of rules instead. Where the law asks for your permission first, the app asks you, and the setting stays off unless you choose Allow (closing the question counts as Don't allow). Elsewhere the setting starts on and the app shows a short notice the first time, with a button to turn it off right away. In a few places the feature is not offered at all. In every case nothing is recorded, not even on your phone, until you have seen the notice or chosen Allow, and events from before that are never used.
Your choice: you can change it at any time in Settings › Privacy and accessibility. Your choice is stored with your account on our server, so it also applies after reinstalling the app or on another phone. When you turn it off, the app sends that to us at once (and keeps trying if you are offline); our server then deletes the events it already received in the same step and refuses any that arrive later, including ones still waiting on another phone. Purchases and rewarded-ad credits work the same either way: they are verified through Google Play and AdMob as described above, not through these events.
If you uninstall the app first: Android does not tell an app that it is being uninstalled, so a change you made just before uninstalling may not have reached us. In that case: events are deleted 90 days after we receive them in any case; we delete all events of an account that has not been used for 30 days; and you can ask us by email to turn suggestions off or to delete your suggestion events, without deleting your account (see the account deletion page).
We do not read or store the contents of your workflows, the text you configure to be typed, the names of programs or windows on your computer, your contacts, photos, files or location. Workflow definitions live on your phone. The mouse activity itself happens on your own computer and is not recorded anywhere.
The app can show rewarded ads served by Google AdMob. Google's SDK collects device and advertising identifiers subject to your consent choices and Google's policies; see How Google uses information when you use our partners' sites or apps. You can decline ads entirely — the app works without them — and you can reset your advertising identifier in your Android privacy settings at any time.
All traffic to the API uses HTTPS. Session tokens, account identifiers and challenge nonces are stored only as one-way hashes (SHA-256 of long random or already hashed values; the device identifier is a keyed HMAC, see above). Database credentials are held in restricted secret files, and the database is reachable only from the API service's private network. Server sessions expire after 24 hours, when you sign out, or when you delete your account; while you use the app it renews the session automatically (with your Google account or the device check). The app keeps its current session token on your phone, encrypted with a key held in the Android Keystore and excluded from backups and device transfers, so it does not have to sign in again at every launch. Suggestion events are deleted 90 days after receipt, and the bonus IP-prefix hash after 30 days. Financial records (credit grants, purchases, ad rewards and usage totals) are kept in an append-only journal so your balance can be reconstructed and audited; they are retained while your account exists and for up to 24 months after deletion in anonymized form where required for accounting and fraud prevention.
Nudglow is a productivity utility and is not directed at children. We do not knowingly collect information from children. The Google Play listing declares a target audience of 18 and over, and the app does not take part in Google Play's Families program.
If this policy changes materially we will update this page and, for significant changes, show a notice in the app before the change takes effect.
Elysra · support@nudglow.com · privacy@nudglow.com