Privacy policy

Last updated 1 October 2026

The short version

Your camera image is analysed on your own computer. It is never uploaded, recorded or seen by anyone, including us.
There are no accounts, no cookies, no analytics and no ads.
If you pay, we get your email and what you bought, because that's how your plan is unlocked. Stripe handles the payment.
We never sell your data or share it for marketing.

This policy explains what personal data SitNudge handles, why, and what your rights are. It applies to sitnudge.com and everything on it, including the gift pages.

1. Who is responsible

Bufufu OÜ, an Estonian company (details at the end of this page), is the controller of the personal data described here. For anything about privacy, write to hello@sitnudge.com.

2. Your camera

SitNudge needs your permission to use your webcam. Once you give it:

Each camera frame is analysed by an AI model that runs inside your browser, on your computer. The model is downloaded from our site once and then runs locally.
Each frame is turned into five numbers: how far away your head is, how high it is, and how much it nods, tilts and turns. The image itself is dropped straight away.
No video, photos or snapshots are stored or sent anywhere. The numbers aren't sent either. Even your calibration is forgotten when you close the tab.
SitNudge does not recognise faces. It can't tell who you are or tell one person from another, and it never tries.
Press Stop, or close the tab, and the camera switches off.

So we never receive anything from your camera. Our server only handles payments and has no way to receive video.

3. What's kept in your browser

SitNudge uses your browser's local storage, on your own computer, to remember:

how many free trial minutes you've used;
your licence, if you've paid: a signed code that holds your email, your Stripe customer reference, your plan and when it needs checking again;
your settings, such as the detection method and the result of the background test;
on the gift page, the gifts you've bought in this browser, so you can find the card again.

We don't use cookies. This storage is only there to make SitNudge work as you asked, and none of it is used to track you. You can clear it at any time in your browser's site settings. If you clear your licence, you can unlock SitNudge again by logging in with your email.

4. What we handle, and why

When	What	Why, and the legal basis	How long
You buy a plan	Your email, your name and country if you give them at checkout, what you bought, the amount, and payment and subscription status. Never your full card details.	To give you the plan, unlock it, renew or cancel it, and handle refunds. Performing our contract with you (GDPR art. 6(1)(b)) and our accounting and tax duties (art. 6(1)(c)).	For as long as you have a plan, then 7 years, as Estonian accounting law requires.
SitNudge checks your plan	Your licence code, sent to our server about once a month. It contains no video and no usage data.	To confirm your plan is still active. Contract (art. 6(1)(b)).	Not stored. It's answered from Stripe's records.
You log in on another computer	Your email address, to send a login link if it matches a purchase.	To unlock your plan on that computer. Contract (art. 6(1)(b)).	We don't store it. The email itself stays in your inbox.
You buy a gift	Your email, and the names and message you write on the card.	To make the gift card and send you a copy of the code. Contract (art. 6(1)(b)).	Kept with the payment record, as for plans.
You buy after clicking one of our ads	The campaign tags on the ad's link (for example "reddit" and which ad it was), read from the address bar when you pay. They're never stored in your browser.	To count which of our ads lead to sales, so we stop paying for the ones that don't. Our legitimate interest (art. 6(1)(f)).	Kept with the payment record, as for plans.
You open a gift	Your email and the time you opened it.	So the gift is yours and unlocks on your other computers. Contract (art. 6(1)(b)).	Kept with the gift's payment record, as for plans.
You visit the site	Your IP address and the technical details every browser sends, handled by our hosting provider.	To deliver the site, keep it secure and limit abuse (such as rate limiting the payment endpoints). Our legitimate interest (art. 6(1)(f)).	Short-lived technical logs, usually a few days.
You email us	Your message and email address.	To answer you. Legitimate interest (art. 6(1)(f)), or contract if it's about your plan.	As long as needed to help you, and no longer than 3 years.

We don't create accounts or passwords. There's no database: Stripe's payment records are the only record of who has paid. We don't use your data for advertising or profiling, and we make no automated decisions about you.

5. Who else is involved

Stripe and Link (payments)

Payments go through Stripe's Link service, which is the reseller and merchant of record for your purchase. Your card details go straight to Stripe, and Link sends your receipts. For the payment, Stripe is an independent controller under its own privacy policy: see stripe.com/privacy and link.com/privacy. Stripe also keeps the purchase and gift records we use to unlock SitNudge.

Cloudflare (hosting and email)

Cloudflare hosts sitnudge.com, runs our payment server and sends our login and gift emails. It acts on our behalf as a processor. See cloudflare.com/privacypolicy.

Files loaded from other servers

To show the page, your browser fetches some files directly from other providers, which means they see your IP address and browser details:

Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for the typefaces. See Google's privacy policy.
jsDelivr (cdn.jsdelivr.net) for the code of Google's MediaPipe library, which runs the AI on your computer. See jsDelivr's privacy policy.

They receive no camera data and nothing about your plan. We use them because it makes the site faster and more reliable (our legitimate interest, art. 6(1)(f)).

We may also disclose data if the law requires it, for example to a tax authority or a court. We never sell or rent personal data.

6. Data outside the EU

Stripe and Cloudflare are based in the United States, and some data may be processed there. These transfers are protected by the EU–US Data Privacy Framework, under which both companies are certified, and by the European Commission's Standard Contractual Clauses.

7. Children

SitNudge works without any personal information, so anyone can use it, and the camera data never leaves the computer. Buying a plan is for adults. Opening a gift asks for an email address; for a child, a parent or guardian can simply use their own. SitNudge doesn't send reports about how anyone sits to anybody, including us and whoever gave the gift.

8. Your rights

Under the GDPR you have the right to:

see the personal data we have about you, and get a copy;
have it corrected if it's wrong;
have it deleted, unless we must keep it by law (for example accounting records);
restrict how we use it, or object to uses based on our legitimate interest;
receive it in a portable format.

To use any of these, write to hello@sitnudge.com from the email address the request is about, so we know it's you. We'll answer within one month. You can also ask Link support to delete your payment data held by Stripe.

If you think we've handled your data wrongly, please tell us. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn) or to the data protection authority where you live.

9. Security

The site is served only over HTTPS. Licences and login links are cryptographically signed, so they can't be forged or changed, and login links stop working after 24 hours. There are no passwords to leak, and no database of customers on our side.

10. Changes to this policy

If we change how we handle data, we'll update this page and the date at the top. If a change matters for paying customers, we'll also tell them by email before it takes effect.

The controller is Bufufu OÜ
Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
Registry code 16148822 · VAT number EE102338256
hello@sitnudge.com