Privacy notice.

What the browser stores

The browser stores local copies of task-promise labels, call tasks, plans, progress, summaries, feedback, saved transcripts, diagnostics, simulated fines, and preferences.

Task-promise labels stay in account-scoped browser storage. The server receives no task label.

Local storage does not mean that all call content stays local. OpenAI processes live speech, typed turns, selected call details, and current tool values.

Saved call sheets never return to OpenAI. Optional camera video stays in the browser.

Stripe handles card and billing details. Ughbusting AI does not receive or store your full card number.

If you opt in to product analytics, the browser also stores a PostHog identifier.

What data the service uses

Why the service uses data

• Create and authenticate registered accounts, then send private sign-in links.
• Run a requested Realtime accountability call and return recognised speech and assistant audio.
• Control call admission, reconnects, allowances, security limits, and the application budget.
• Protect the service and diagnose terminal voice faults without sending call content to the server log.
• Give the account holder local call history, feedback exports, preferences, and deletion controls.
• Record content-free task promises, self-declared outcomes, stakes, waivers, payment evidence, and Buddy stub rewards.
• If you opt in, understand how members use the application and fix confusing parts of it, using masked product analytics and session replays.
• Show anonymous Google Calendar conflicts across every calendar you own or have chosen to show, not just your primary calendar, and create or update requested Ughbusting call events.

• Contract supports membership signup, payment, renewal, cancellation, access, and service-confirmation processing.
• Legitimate interests supports the requested beta service and account administration.
• Legitimate interests supports authentication, security, admission, fixed diagnostics, and content-free operations measurement.
• Legitimate interests supports requested task promises, shadow accountability records, and content-free Buddy rewards.
• Contract supports separately accepted live-stake terms, the payment mandate, the displayed cap, waivers, and collection through Stripe.
• Legal obligation supports six-year pseudonymous stake mandate, invoice, payment, refund, and dispute evidence.
• Legal obligation supports rights handling and the minimum compliance records.
• Explicit consent is the Article 9 condition for special-category data that a user chooses to share during a live call.
• Consent is the Article 6 lawful basis for optional seven-day shared transcripts used for product improvement.
• Consent supports the optional Google Calendar connection. You can withdraw it with the disconnect control.
• Separate explicit consent is the Article 9 condition for optional seven-day shared transcripts used for product improvement.
• This release processes no marketing data.
• Consent is the Article 6(1)(a) lawful basis for optional product analytics and masked session replays. It is off by default. You can withdraw it at any time in Account, under "Privacy and account data". Withdrawing does not affect your membership or any other feature.
• For members in Canada, your opt-in is your express consent to optional product analytics. You can withdraw it at any time in the same way.

Service providers and international processing

Your information may be processed outside the country where you live, including in the UK, Ireland, Germany and the US. While it is in another country, that country's courts, law enforcement or national security authorities may be able to access it under local law.

Some provider account and subprocessor-notice evidence remains a release gate.

Retention and deletion

Account-local browser content

180 days after the last meaningful use, or earlier deletion by the user.

Browser call sheets

The newest 20 sessions, with a 180-day maximum age.

Browser diagnostics

The newest 250 fixed technical events, with a 30-day maximum age.

Active account identity

While the account stays active.

Onboarding profile

The username, first-call start boundary, and first-call completion record remain while the account stays active, or until account deletion. An account created before 17 September 2026 can also retain the older shadow-stake and membership-interest fields, which the current onboarding no longer sets.

Ugh Buddy profile, rewards, and unlocks

The selected appearance, room, items, content-free progress, stub ledger, purchases, and unlock evidence remain while the account stays active, or until account deletion.

Browser task-promise labels

The newest 50 labels remain in the account-scoped browser store until local or account deletion.

Task promises

Opaque task settings and states remain while the account stays active, or until account deletion.

Requested visits and reminder delivery records

30 days after completion, cancellation, suppression, or expiry. Earlier account deletion removes these records.

Optional reminder preferences

While the account stays active, or until account deletion. Withdrawal stops future requested reminders.

Task notice delivery records

90 days after the latest creation, claim, failed delivery, accepted delivery, or notice expiry. Earlier account deletion removes these records.

Task shadow-penalty evidence

Content-free amount, state, waiver, and timestamp evidence remains while the account stays active, or until account deletion. It contains no task label.

Live-stake mandates and financial evidence

Completed mandate, invoice, payment, refund, and dispute evidence remains pseudonymous for six years. Pending or processing stakes are voided on account deletion. The record contains no task label.

Booking penalty evidence (a missed booked call or an unbooked week)

A non-stake booking penalty remains 90 days after it occurred. A settled penalty with live-stake authority remains pseudonymous for six years, the same as other financial evidence. A pending, processing, failed, or held penalty keeps its slot and plan link while it stays open.

First-call schedule

Until the user cancels it, its call timer starts, the first call completes, or the user deletes the account.

Weekly call plans and usage alerts

90 days after the planned week or alert time, or earlier account deletion for identifiable plans.

Google Calendar connection and event references

While connected, or until disconnect or account deletion. Access tokens and busy intervals are not stored. Created Google events remain in the member’s calendar.

Google Calendar revocation debt and evidence

A failed revocation keeps the encrypted credential in the private retry queue until Google revocation succeeds. Success clears the credential. The remaining content-free evidence stays for three years.

Disabled or revoked accounts and failed or expired registration links

30 days before deletion eligibility.

Identifiable admission and operations rows

90 days. The paid-beta release activates daily deletion only after the approved retention sequence. Before activation, no automatic schedule applies.

Public lifecycle notice outbox rows

90 days after the row’s own due time. The record contains amount, currency, cap, and date evidence, never free text.

Automatic-collection consent record

While the account stays active, or until account deletion. Withdrawal stops future automatic attempts and is itself recorded as a separate timestamped event.

Operational live-call consent and withdrawal state

Until its pending or bound call expiry. The paid-beta release activates daily deletion only after the approved retention sequence. Before activation, no automatic schedule applies.

HMAC IP-limit rows

Rows expire after their limit window. The paid-beta release activates five-minute cleanup only after the approved retention sequence. Before activation, no automatic cleanup schedule applies.

Minimal invitation, consent, rights-request, and deletion evidence

Three years. These records contain no call content.

Optional shared transcript

The live copy lasts up to seven days after completion or sharing, whichever is earlier. The hourly job removes it within one hour after expiry; backup residue can remain for up to seven more days.

Shared-transcript administrator access events

90 days. Events contain fixed values and no transcript content.

Shared-transcript deletion outbox and signed markers

Completed Supabase outbox rows and private Vercel Blob markers remain for three years. Pending outbox rows remain until deletion completes. These content-free records contain opaque identifiers, the deletion actor, and timestamps. Vercel can retain deleted Blob-marker residue in its backups for 30 additional days.

Ordinary support records

12 months.

Membership, refund, and contract evidence

Pseudonymous plan, price, acceptance, payment, and subscription records remain for six years. A refund case remains actionable until its final resolution, then remains for six years.

Stripe payment records

Stripe applies its own legal, fraud-prevention, and account-retention periods.

Application session cookie

Eight hours, or earlier sign-out or revocation.

OpenAI Realtime content

Default abuse-monitoring content can remain for up to 30 days.

Supabase database backups

The current Pro plan provides daily backups with seven days of access.

PostHog identifier cookie and browser storage

Set only after you opt in. The cookie ph_ followed by our project key, and matching browser storage, hold a random identifier and session details. They last up to one year after your last use, or until you withdraw consent, when the application removes them from this browser.

PostHog analytics events

PostHog keeps events for one year on the free plan. PostHog does not state when it deletes older events, so they can remain after that year until you withdraw consent or delete your account.

PostHog session replays

30 days after recording, unless you withdraw consent or delete your account first.

PostHog data after withdrawal or account deletion

Within 30 days after you withdraw consent or delete your account, we ask PostHog to delete your analytics events and replays. During the beta, an operator does this by hand. PostHog destroys replays when it receives the request and deletes events later in a background job.

Product analytics consent record

While the account stays active, or until account deletion. Withdrawal stops future capture and is itself recorded with its own timestamp.

This deployment runs the configured five-minute HMAC cleanup and daily general-retention schedules. Their activation required a preview, a separately approved manual prune, and a zero re-preview.

The separately configured hourly transcript-share expiry job removes only expired shared transcripts and their linked content-free records.

Your information rights and support

Open Account to delete this browser's local data. In History, Saved conversations can delete one saved conversation or all saved conversations. Diagnostics can delete all local diagnostics.

The internal response target is 28 days. The legal deadline can change for a complex request.

Use the privacy email for access, correction, deletion, restriction, objection, portability, complaints, or support.

The applicable rights depend on the approved lawful bases and the circumstances of each request.

Release gates

1. Complete the ICO data-protection fee self-assessment.
2. Record each provider agreement, international-transfer safeguard, account identity, support-access rule, retention fact, and subprocessor-notice owner.
3. Run one existing-account live-call consent journey before external self-registration.
4. Complete one controlled live charged-and-waived cycle on the controller’s own card before an external live stake.

Read the ICO privacy-information requirements

Read the ICO lawful-basis guide

Artwork credits

The 3D room includes "Bonsai" and "Gramophone" by Don Carson (CC BY 3.0), via Poly Pizza. Other 3D models are CC0 (no attribution required) from creators including Quaternius, CreativeTrio and Isa Lousberg. Bonsai source Gramophone source

Complaints

Contact the controller first if you can. You can also complain to the Information Commissioner's Office.