Privacy Policy

1Fegud and This Policy

Fegud is a Canadian wellness company based in Toronto. We operate fegud.com, the Fegud mobile app, Fegud for Teams, online purchases, and related support and communication services. This policy explains how Fegud handles personal information across those services.

This policy applies to website visitors, individual app users, employees invited through an organization, company administrators, buyers, subscribers, and people who contact us. It does not replace a company customer’s own employee privacy notice or the privacy policies of third-party websites that you choose to visit.

2Roles and Legal Grounds

For consumer accounts, website forms, purchases, support, and Fegud’s own operations, Fegud generally decides why and how personal information is handled. For company-sponsored services, the customer organization may decide certain purposes for employee account and program-administration data, while Fegud processes that information to provide the service. Fegud may still make its own decisions for security, billing, support, service improvement, and legal records.

Why processing is permitted

• Service delivery and requests: to create an account, provide requested cards or checklists, process an order, answer a message, and operate features you choose to use.
• Consent: for optional marketing, device permissions, health-platform connections, and other activities where consent is required.
• Legitimate business purposes, where permitted: to secure the service, prevent misuse, understand performance, improve features, and keep business records, balanced against your privacy interests.
• Legal obligations: to meet tax, accounting, consumer-protection, law-enforcement, and regulatory requirements that apply to us.

The privacy rules and rights that apply can depend on where you live, where you work, how you use Fegud, and whether a customer organization is involved. This policy describes Fegud’s practices and does not limit rights provided by applicable law.

3What We Collect

Information you provide

• Account and profile details: name, email address, company or invitation details, department or role when provided, display name, language, country, accessibility settings, and profile image.
• App activity: bingo cards, completed squares, points, streaks, achievements, challenge participation, team memberships, reactions, posts, comments, uploaded media, and notification preferences.
• Wellbeing check-ins: the answers and scores you choose to submit in the employee app, plus the date and period of each check-in.
• Website forms: the fields shown on the form, such as name, email, request topic, message, play preference, and a separate marketing choice where offered.
• Orders and subscriptions: products, plan, transaction reference, billing status, delivery details, and related customer-service records. Payment card details are handled by the payment provider, not stored by Fegud.
• Support and correspondence: messages, attachments, troubleshooting details, and records of our response.

Information collected automatically

• Device and service data: IP address, device and browser type, operating system, app version, language, time zone, identifiers, authentication events, and security logs.
• Website activity: page address, referring page, approximate location derived from IP, visits, clicks, scrolls, and other interactions recorded by our website, analytics, session-replay, security, and advertising tools.
• Mobile diagnostics: crash, error, and performance information when diagnostics are enabled in a production build.
• Push notifications: an app push token and platform after you grant notification permission.

Information received from organizations and other sources

A customer organization may provide work email addresses, names, departments, roles, employment or invitation status, and organization settings. Payment, hosting, authentication, email, app-store, analytics, and security providers can send us transaction, delivery, account, and technical records needed to run the service.

4Sensitive and Local-Only Data

Mobile health integrations

If you turn on Apple Health or Health Connect integration, the app may read today’s step count or active minutes on your device to decide whether an eligible activity is complete. The numeric health value is evaluated on the device and is not sent to Fegud. Fegud receives only the resulting activity-completion status. You can remove health permission in your device settings.

Burnout Audit on fegud.com

The public Burnout Audit calculates answers, score, priority area, and result band in your browser. Those assessment answers and results are not sent to SureForms, WordPress, analytics tools, or Fegud. After the questions, a separate form sends the first name, work email, and optional marketing choice shown on that form so Fegud can unlock the result and email the workplace conversation checklist. That request is not linked to the browser-local score.

Employee Wellness ROI Calculator on fegud.com

The Employee Wellness ROI Calculator performs its arithmetic in the visitor’s browser. When a visitor asks Fegud to email the result, a separate form sends the visitor’s first name, work email, currency, calculated result summary, and optional marketing choice to SureForms and Fegud’s transactional email provider. The source numbers are not sent to analytics. Optional marketing permission is recorded separately from result delivery.

Employee wellbeing check-ins

Wellbeing check-in answers and scores submitted inside the employee app are stored with your account so you can see your history and request an export. They are treated as private individual information. Company reporting uses aggregates and suppresses small-group results; it does not show an employer your individual answers or score.

5How We Use Personal Information

• Create and secure accounts, authenticate users, and manage invitations.
• Provide app features, cards, challenges, team spaces, notifications, exports, and account deletion.
• Deliver requested downloads, checklists, transactional messages, purchases, subscriptions, and support.
• Generate company-level participation and wellbeing reporting without exposing individual private activity.
• Prevent fraud, abuse, unauthorized access, and service disruption.
• Diagnose errors, measure performance, understand how the website and products are used, and improve Fegud.
• Send marketing messages only where we have the required permission or another lawful basis. You can unsubscribe from marketing email at any time.
• Measure website campaigns and audiences using tools described in section 11.
• Maintain accounting, consent, suppression, security, audit, and legal records.

We do not use individual employee wellness activity to make employment decisions. Fegud does not provide employers with a tool to rank, discipline, or evaluate employees from private Fegud activity.

6Providers and Other Disclosures

We use service providers to run Fegud. They receive the information needed for their role and handle it under their own terms, privacy commitments, and our agreements where applicable. Providers can change as the service changes.

Supabase

Database, authentication, storage, and server-side functions.

Vercel and Cloudflare

Application hosting, delivery, performance, security, and abuse prevention.

WordPress, DreamHost, and SureForms

Website hosting, publishing, and form processing.

Expo and device-platform services

Mobile app build, delivery, updates, health permissions, and push-notification delivery.

Sentry

Production crash and error diagnostics when configured.

Twilio SendGrid

Transactional and account email, including requested data exports and website deliveries.

Sender.net

Marketing email for people whose permission has been activated in the marketing system.

Google, Microsoft, Meta, GTM Kit, Burst Statistics, and Cookiebot

Website analytics, session replay, advertising measurement, tag management, first-party statistics, and cookie-choice management.

Stripe and SureCart

Payments, subscriptions, checkout, order administration, and fraud controls.

We may also disclose information to professional advisers, auditors, insurers, regulators, courts, law enforcement, or transaction counterparties when reasonably necessary and legally permitted. If Fegud is reorganized, sold, or transfers a service, personal information may transfer with appropriate notice and safeguards.

7What an Employer Can See

A company administrator can see account and roster information needed to run the company program, such as the identity, work email, department, role, invitation status, and account status supplied by the organization or member. Administrators can also see company-level participation and program reporting.

• Not shown as individual employer reporting: private activity choices, completed squares, streaks, reactions, comments, wellbeing check-in answers, wellbeing scores, or on-device health values.
• Shared spaces are different: a post, comment, nickname, reaction, image, or other content that you intentionally share with a team or feed is visible to the audience shown in the app. That audience may include coworkers or company administrators who are members of the space.
• Aggregate reporting: reporting is combined, and small-group results are suppressed where applicable to reduce the risk of identifying a person.

Read the Fegud Privacy Promise for a shorter explanation written for employees and teams.

8How Long We Keep Information

We keep personal information only for a defined business, service, security, or legal reason. Some periods are enforced directly in a product or form. Other records are reviewed and deleted, anonymized, or retained as needed for the purpose described below and applicable law.

Active accounts and app activity

Kept while the account is active. A member can request an export or delete their own account in the app. The self-serve export covers the account categories prepared by the export tool; broader access requests can be sent to [email protected]. Deletion removes the account subject to limited audit or legal records. Posts and comments can remain without the account link, and text written by another person can still contain a name they typed or mentioned.

Departed company members

The current service schedule targets anonymization 12 months after deactivation. Completion history may remain only in de-identified aggregate form. Automated enforcement depends on production configuration. You can contact [email protected] to request deletion or confirm the status of a record.

Cancelled company tenants

The current service schedule targets tenant deletion after a 60-day period for reactivation, export, and dispute handling. Automated enforcement depends on production configuration. Accounting, suppression, dispute, and other records that must be retained are handled separately.

Employee-app support threads

The current service schedule targets deletion 24 months after the last activity. Automated enforcement depends on production configuration.

Contact form entries

SureForms is configured to delete contact entries after 730 days.

Burnout Audit result-access forms

SureForms is configured to delete the submitted name, work email, and marketing choice after 90 days. The browser-local answers and score are not submitted.

Employee Wellness ROI Calculator result forms

SureForms is configured to delete the submitted first name, work email, currency, calculated result summary, and optional marketing choice after 90 days. The source numbers are not sent to analytics.

Free bingo signup and consent records

Kept while needed to deliver the requested cards, manage the subscription, document permission, and honour unsubscribe or do-not-contact choices. Suppression records may be kept to avoid contacting someone again.

Orders, subscriptions, tax, and accounting

Kept for the period required by applicable tax, accounting, payment, dispute, and consumer-protection rules.

Security, diagnostic, analytics, and advertising records

Kept according to the configured service and provider periods, then deleted or aggregated. Provider copies can follow the provider’s own retention rules.

De-identified aggregate information

May be kept when it can no longer reasonably be linked to a person or customer.

A legal hold, dispute, security incident, regulatory request, or backup cycle may require a longer period. We limit retained information to what is reasonably needed for that purpose.

9Security

Fegud uses administrative, technical, and organizational safeguards appropriate to the information and service. These include access controls, authentication, encryption in transit, provider security controls, database row-level access rules, logging, backups, and review of sensitive operations.

No online service can promise perfect security. If we identify a breach affecting personal information, we will investigate, contain it, document it, and notify affected people and authorities when applicable law requires notification. Please email [email protected] if you believe you found a security issue.

10Your Choices and Privacy Rights

Depending on your location and relationship with Fegud, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent, or complain to a regulator. We may need to verify identity before acting and may be unable to complete a request where an exception applies.

• In the employee app: use Privacy Settings to request the categories prepared by the self-serve export tool or delete your account. The export is prepared for the authenticated account and emailed through SendGrid. Contact [email protected] for a broader access request.
• Marketing email: use the unsubscribe link in the message. We may keep a suppression record so the address is not added back.
• Device permissions: change push-notification and health permissions in your device settings.
• Website privacy requests: email [email protected] or use the Contact page. Tell us what you are requesting and which Fegud service you used.
• Company-sponsored accounts: we may coordinate with the customer organization when it controls the relevant employment or roster record.

We aim to acknowledge and complete verified requests within the period required by applicable law. We do not charge for ordinary requests, but the law may permit a reasonable fee or refusal for requests that are manifestly unfounded, excessive, or repetitive.

Regional contacts

• Canada You may contact the Office of the Privacy Commissioner of Canada. Quebec residents can also contact the Commission d’accès à l’information du Québec.
• United States State privacy rights vary. California residents can review the California privacy guidance.
• United Kingdom You may contact the Information Commissioner’s Office.

11Cookies, Analytics, Session Replay, and Advertising

The Fegud website uses cookies, local storage, pixels, tags, scripts, and similar technologies. These tools can receive IP address, device and browser details, page and referrer addresses, identifiers, and interaction data. The exact cookies and storage items can change when providers update their technology.

Essential and security technology

Supports site delivery, checkout, cart, forms, load balancing, fraud prevention, and security through WordPress, SureCart, Stripe, Cloudflare, and related services.

Burst Statistics

Provides first-party website statistics in WordPress.

Google Tag Manager and Google Analytics

Manage tags and measure visits, traffic sources, events, and site performance. Google may process device, identifier, and browsing information under its privacy terms.

Microsoft Clarity

Provides session replay, heatmaps, and interaction analytics. Fegud masks form areas that can contain names, email addresses, messages, or assessment access details, but Clarity still receives technical and interaction information outside masked fields.

Meta Pixel

Measures page visits and advertising activity. Meta can receive browser, device, identifier, and page-activity information and may use it according to Meta’s privacy policy.

Cookiebot

Stores and communicates website cookie choices where the consent tool is available.

Your controls

• Use the site consent control when it is displayed.
• Block or delete cookies and site data through your browser. Blocking essential storage can affect checkout, forms, and sign-in.
• Use the Google Analytics opt-out, Microsoft privacy controls, and Meta account or advertising controls.
• Use browser privacy tools or content blockers to limit scripts and pixels.
• Contact [email protected] to object to website analytics or advertising use and tell us which device or visit is involved. We do not currently promise an automated response to every browser Do Not Track signal.

12International Processing

Fegud is based in Canada. Our providers and customer users can process information in Canada, the United States, the United Kingdom, and other countries where they operate. Privacy laws and government-access rules can differ from those in your home location.

Where a cross-border transfer requires a contract, assessment, or other safeguard, Fegud and the relevant customer or provider are responsible for putting the required measure in place. You can contact us for information about the providers and regions relevant to your use of Fegud.

13Payments and Purchases

Stripe and SureCart handle website checkout, subscriptions, payment status, fraud signals, and order administration. Fegud receives transaction identifiers, product or plan details, status, billing contact information, and limited payment metadata, but not the full payment-card number. Stripe, SureCart, banks, app stores, and other payment services handle information under their own privacy terms.

We retain order, refund, chargeback, subscription, tax, and accounting records for the period reasonably required by law and to resolve payment disputes.

14Children

Fegud is intended for adults and workplace users. It is not directed to children under 13, and we do not knowingly ask a child under 13 to create an account. A higher minimum age may apply where local law requires it. If you believe a child provided personal information without appropriate permission, email [email protected] so we can investigate and take appropriate action.

15Changes to This Policy

We update this policy when services, vendors, legal requirements, or data practices materially change. The “Last updated” date at the top shows the current version. For a material change, we may also use an in-product notice, website notice, or direct message when appropriate and when we have a reliable way to reach the affected person.

Previous versions and the effective timing of a change can be requested from [email protected].

16Contact and Complaints

For privacy questions, access or deletion requests, objections, complaints, or concerns about this policy, contact:

Privacy email

[email protected]

Security reports

[email protected]

General contact

fegud.com/contact

Mail

Fegud, Toronto, Ontario, Canada

We will review the concern, may ask for information needed to verify identity or locate the record, and will respond within the period required by applicable law. You can also complain to the privacy regulator in your region using the links in section 10.