Draft — pending legal review

Privacy Policy

Last updated: 23 October 2026

1. Who we are

Pledgd ("we", "us") provides a habit-tracking service where users commit money to a charity if they miss a habit. The data controller of the personal data described below is:

• PLEDGD LTD, a company registered in England and Wales, company number 16989178. Our registered office is shown on our Companies House record.
• Privacy contact: [email protected]
• ICO registration number: pending
• We are not required to appoint a Data Protection Officer. Our privacy lead is Aidan Hughes, Director.

Pledgd is offered only to people who live in the United Kingdom.

2. What we collect

• Account data (via Clerk): email address, name, phone number if you add one, and sign-in identifiers (including those from a social sign-in provider if you use one).
• Payment data (via Stripe): card details are collected and stored by Stripe directly and never reach our servers. We keep your Stripe customer ID, the IDs of your charges and their amounts and dates.
• Habit data: the habits you create (titles, schedules, stake amounts, charity), your check-ins and missed deadlines, and your time zone (used to calculate your deadlines). Habit titles are free text: please avoid putting health, religious or other sensitive details in them.
• Consent records: when you confirmed you are 18 or over and live in the UK, and which version of our terms you accepted and when. We keep these to show that you agreed to the terms each charge is made under. We also record whether you accepted app analytics, and when.
• Complaints: what you tell us when you make a complaint, and our response.
• Group data: the groups you create or join, your activity for each group, your check-ins, which days or weeks you were in, the outcome of each and reactions you leave.
• Contact discovery data (iOS and Android apps only, if you choose to use it): hashes of the phone numbers in your address book. See section 5.
• Push notification data (if you turn notifications on): the push endpoint and encryption keys your browser or device gives us, and its user agent.
• Email preferences: whether you have agreed to marketing emails (with the time and where you agreed, and when you withdrew), and whether you have turned off group activity emails.
• Payment event records: copies of the event messages Stripe sends us about your payments (which can include your Stripe customer ID, email address and card brand and last four digits), and internal job records used to process charges and notifications reliably.
• Device and log data: IP address, browser, operating system and request details recorded in our hosting logs; our rate limiter also briefly holds your IP address. Our logs also record the email address each email was sent to.
• Diagnostic data (via Sentry), which differs by surface:
  • Pledgd app and our servers: error reports with stack traces, error messages, browser and operating system, and the page or request URL (without anything after the "?"). Performance traces for every app page load and every request to our servers: which pages, API routes, database queries (the query text, never the values in it) and calls to our providers ran, and how long each took. Performance profiles, which record which parts of our code were running and for how long, and contain no personal data. Server logs at information level and above (for example "reminder sent", with internal IDs), from which we remove email addresses, IP addresses, card numbers and credentials before they are sent. We configure Sentry not to collect IP addresses; it filters session and authentication cookies and headers, and we strip request bodies (where habit titles could appear) from app reports. Error messages and URLs can still contain internal IDs or an email address. In the app, reports carry your account ID, name and email. If an error occurs or you send a bug report, it includes a masked recording of your screen activity from shortly before that moment to the end of your visit (all text and inputs masked, images and card fields blocked); in a desktop browser a bug report can also include a screenshot you choose to take and mark up. If you accept analytics when the app asks (see App analytics below), we also record a masked replay of every visit, masked in the same way and carrying the same account ID, name and email; if you later turn analytics off, we stop recording every visit and go back to recording only around errors and bug reports. Replays already recorded are kept for the retention period below.
  • Marketing site (pledgd.app): only after you accept optional cookies. Error reports and performance timings for every page load, plus session replays (a recording of what happens on the page) for 10% of visits and for every visit where an error occurs. All text in replays is masked and all images and media are blocked, and we configure Sentry not to collect IP addresses or cookies.
• Marketing-site analytics (via PostHog, EU region): only after you accept optional cookies. Pages visited, clicks and other interactions, a pseudonymous browser ID, device and browser type, referrer, your IP address (used to estimate your approximate location), and that you joined the waitlist.
• App analytics (via PostHog, EU region): in the Pledgd app on the web, iOS and Android, only if you choose Accept when the app asks (signed in, or when you open a pact invite link). Nothing is loaded or stored before you choose, and you can change your choice at any time in You > Privacy. We identify you to PostHog only by your Pledgd account ID, never your name, email or phone number. We record the pages you view (without anything after the "?" in the address, and with invite codes removed) and these actions: signing up, accepting the terms, adding a card, creating a commitment (its schedule, stake and type), creating a pact (its period, repeat, target and stake), sharing an invite (how, and whether the pact runs for a day or a week), sharing a result card (which card and how), opening an invite link, seeing the install prompt, installing the app and opening feedback. Invite links you share carry a random code tied to your account so we can record who invited whom. We also record your sign-up week, whether you have a card saved, how many active commitments you have, whether you are Pledgd staff, and the campaign tags (utm_source, utm_medium, utm_campaign and ref) of the link you first arrived from. PostHog collects your device and browser type and uses your IP address to estimate your approximate location. If you accepted, our servers also send PostHog, with your account ID only and no location: charges that succeed or fail (the amount, the donated share, our fee, and whether it was solo or a pact), refunds and their reason, each check-in, each missed solo check-in and each pact day or week you fell short in (solo or pact, day or week, and a stake band such as "£10 to £24", never the exact amount), joining a pact (its period, repeat and stake band, and the account ID of who invited you), and how each pact day or week ended (held or broken, number of members, period and repeat). PostHog does not record clicks in general, screen recordings or heatmaps, and we never send it commitment titles; the masked replays described under Diagnostic data come from Sentry, under the same choice.
• Correspondence: emails you send to our support or privacy addresses.

3. Why we use it and our lawful bases

• Contract — to provide the service you signed up for: your account, tracking habits and group commitments, charging stakes when you miss a deadline, donating proceeds, and sending service emails (charge receipts, failed payments, payment confirmations and deadline reminders).
• Legal obligation — to keep financial and accounting records (HMRC and the Companies Act) and to make fundraising records available to the charity we raise money for.
• Legitimate interests — to keep the service secure and prevent fraud; to diagnose bugs in the app and on our servers; to keep payment event and job records so charges are processed exactly once and can be audited; to match your contacts when you ask us to; and to send group activity emails (for example when a buddy joins or a pact's day or week ends), which you can turn off. We have balanced these interests against your rights, and you can object to any of them (section 8).
• Consent — for push notifications, marketing emails, analytics in the app, and analytics and error monitoring on our marketing site. You can withdraw consent at any time (section 8).

4. Automatic charging decisions

When a check-in deadline passes without a check-in, our system charges the stake you set to your saved card, without a person reviewing it first. This is a decision based solely on automated processing with a significant effect on you, governed by Articles 22A to 22D of the UK GDPR. It is necessary to perform the contract you entered into when you set the stake, and it uses no special category data.

The safeguards we provide are:

• Information: you see the stake, charity and deadline before a commitment starts, and we usually email you when a charge is made.
• Make representations and ask for human review: you can tell us your side and ask for a person to review any charge.
• Contest the decision: if a person reviewing the charge finds it was wrong, for example because an outage stopped you checking in, we will refund it and reverse the donation where appropriate.

To use these safeguards, email [email protected]. Requests within 14 days of the charge are handled under the refund process in section 6 of our Terms of Service; we will still have a person review a charge if you ask later.

5. Who can see your data

• Group members: members of a group you join can see your display name (or, if you have not set one, the part of your email address before the @), your activity, your check-ins, whether you have checked in today, your chosen charity and whether you hit the target for the day or week. Every member has the same stake, so members can see the stake amount and whether the group's stakes were donated; each day's or week's result names anyone who fell short. If you share a solo commitment with a group, its title, check-ins and misses appear in the group feed. Anyone signed in who opens a group's invite link can see its members' first names before joining. The app does not show members your email address. Group activity emails tell members when someone joins, when a day or week locks and how it ended.
• Contact discovery: in the iOS and Android apps you can choose to find friends from your address book. With your permission the app takes each phone number stored in international format and turns it into a SHA-256 hash on your device; contact names and raw numbers never leave your device. The hashes are sent to our server, compared with the hashes of Pledgd users' phone numbers, and discarded rather than stored. We return the display names of matching users (or the part of their email address before the @ if they have not set one). On the web you can search for one number at a time, which is hashed the same way. These hashes are not anonymous: because there are relatively few possible phone numbers, a SHA-256 hash can be reversed by trying every number, so we treat the hashes as personal data, including those of your contacts who do not use Pledgd. If you add a phone number to your account, we store it and its hash, so anyone who has your number and uses this feature can see that you use Pledgd and your display name.
• The charity: Médecins Sans Frontières (UK) receives aggregate donation amounts in batched transfers. It receives no personal data about you, except that if you complain about our fundraising, we may share your complaint with them.
• Stripe: receives your email address, our internal IDs for you and your habits, and the amount, date and charity of each charge. It does not receive your habit titles or descriptions.

6. Service providers and international transfers

We use these providers to run the service. Except where stated, each acts as our processor under a data processing agreement and only uses your data on our instructions.

• Clerk (USA) — sign-in and account management.
• Stripe (USA / EU) — payment processing, as our processor. Stripe is also an independent controller for its own fraud prevention, anti-money-laundering and identity-verification duties, under Stripe's privacy policy.
• Resend (USA) — sending emails.
• Railway (USA) — hosting our app servers, our Postgres database, and the Redis server that queues background jobs such as charges and notifications, plus our server logs and database backups.
• Sentry (EU region, Germany) — error monitoring, bug reports and session replay (section 2).
• Cloudflare (global network) — secure connection (TLS) and traffic routing for our web addresses, so it handles your IP address and request details.
• Google Workspace (USA / EU) — our support and privacy mailboxes.
• PostHog (EU region, Germany) — analytics in the app and on our marketing site, only with your consent.
• Web push services — if you turn on notifications, your browser or device chooses the service that delivers them (Apple, Google Firebase Cloud Messaging, Mozilla, or your browser's equivalent). Notification content is encrypted end to end before it leaves our servers, so these services only see the push endpoint, an encrypted message and when it was sent.

Several of these providers are in the USA, so your data is transferred outside the UK. Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), we rely on that. Otherwise we rely on the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses included in the provider's data processing agreement. Data held in the EU (PostHog, and Stripe and Google where they store data there) is covered by the UK's adequacy regulations for the EEA.

7. How long we keep it

Our retention periods are below. Some are not yet enforced by our systems; we are putting that in place before launch.

• Account, habit and group data: while your account is open. When you delete your account we delete or anonymise it within 30 days, and ask Stripe and Clerk to delete your customer and account records.
• Financial records (donation amounts, fees, charity, payout batches): 6 years from the end of the financial year of the charge, as HMRC requires. After account deletion these are kept without any link to you.
• Records Stripe holds as an independent controller: kept by Stripe under its own policy.
• Stripe payment event records: 90 days after processing; records that failed to process are kept until resolved.
• Internal job records: 30 days after processing.
• Audit trail of status changes (for example a habit being missed and charged): 6 years, with the financial records; we remove links to you 30 days after account deletion.
• Push subscriptions: until you turn notifications off, the push service reports the endpoint has expired, or 180 days without use.
• Contact discovery hashes: not stored.
• Analytics events (app and marketing site): 12 months in PostHog. Your app analytics choice is kept with your account as a record of consent and deleted with it.
• Server logs and error reports: up to 90 days, depending on the provider's retention settings.
• Database backups: deleted data can remain in backups until they expire (our target is 14 days).
• Support and privacy correspondence: 2 years after the case closes; requests to exercise your rights and complaints: 3 years.
• Marketing consent records: while you are subscribed and for 2 years after you withdraw, so we can show your consent was valid.
• Waitlist entries: 6 months after public launch, unless you create an account.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you — you can download a copy at any time from Settings > Download my data in the app;
• have inaccurate data corrected;
• have your data erased (subject to legal retention obligations) — you can delete your account from Settings in the app (if you are in a group pact's day or week that has already locked, you still count for it, including your check-ins so far);
• restrict processing;
• object to processing based on our legitimate interests — we will stop unless we have compelling grounds that override your interests, or need the data for legal claims;
• data portability — receive your data in a machine-readable format;
• withdraw consent at any time (without affecting processing before you withdrew):
  • push notifications: turn them off in Settings > Notifications or in your device or browser settings;
  • marketing emails: use the one-click unsubscribe link in any marketing email or the toggle in your email preferences; you can turn off group activity emails there too;
  • app analytics: turn it off in You > Privacy in the app; we stop sending analytics and delete PostHog's cookies and storage on that device;
  • marketing-site cookies: use Cookie settings in the footer of any page on pledgd.app;
• not be subject to a solely automated decision without the safeguards in section 4.

To exercise any of these rights, email [email protected]. We respond within one month of receiving your request. If a request is complex or you make several, we may extend this by up to two further months; if so, we will tell you within the first month and explain why.

9. Complaints

If you are unhappy with how we handle your personal data, please complain to us first at [email protected], or see our complaints procedure. We acknowledge data complaints within 5 working days, then investigate and tell you the outcome without undue delay. If you are still unhappy, you can complain to the Information Commissioner's Office at any time (ico.org.uk/make-a-complaint).

10. Cookies

Our marketing site, pledgd.app, uses one strictly necessary cookie, pledgd-cookie-consent, which remembers your cookie choice for 150 days and does not need consent. Two optional services run only if you choose "Accept All" in the cookie banner: PostHog analytics (EU-hosted), which sets cookies to count visits and see which pages are used, and Sentry error monitoring and session replay (described in section 2), which store identifiers in your browser.

You can change your choice at any time from Cookie settings in the footer of any page. If you withdraw consent we stop both services and delete the PostHog cookies from your browser.

The Pledgd app (app.pledgd.app and our iOS and Android apps) uses cookies and device storage needed to run it: sign-in cookies from Clerk, fraud-prevention cookies from Stripe when you save or use a card, and pledgd.analytics-consent, which remembers your analytics choice on the device and does not need consent. We ask whether you accept analytics, with Accept and Reject given equal weight, and ask again after 12 months if you accepted or about 6 months if you rejected. Signing out forgets the choice on that device; your account keeps it.

If you accept, PostHog stores a pseudonymous ID in a cookie on .pledgd.app (shared with our marketing site, so we can see which campaign brought you) and in your browser storage, and we store the campaign tags of the link you first arrived from (pledgd.analytics-attribution), plus a marker so your sign-up is counted only once (pledgd.analytics-signed-up). You can turn analytics off at any time in You > Privacy; we then delete these from that device.

11. Security

We use TLS in transit, encryption at rest for our database, and industry-standard access controls. Payment card details are handled by Stripe and never touch our servers.

12. Age

Pledgd is only for adults: our Terms of Service require you to be at least 18. We do not verify age when you sign up. If we learn that an account belongs to someone under 18, we will delete it. If you believe this applies to an account, contact [email protected].

13. Changes

If we make material changes to this policy we will notify you by email or in-app at least 14 days before the change takes effect.

• 23 October 2026: performance traces for every app page load and server request, performance profiles, server logs from information level, and masked replays of every app visit for people who accept analytics.
• 22 October 2026: added optional product analytics in the app (PostHog, EU region, only with your consent), the app's cookies and device storage, and how to change your choice.
• 22 October 2026: group pacts can now run for a single day (Today) as well as weekly; updated what members see and how account deletion affects a day or week already locked.
• 11 October 2026: added our company details, every service provider and transfer safeguard, contact discovery, push notifications, group visibility, automatic charging decisions, retention periods, response times and the complaints process; corrected the description of error monitoring.
• 23 May 2026: first published.