1. Scope and operator
This notice covers this hosted SGE website and its free and paid tools, operated by Buddytown Consulting LLC. It does not cover independently operated linked websites or the separate services of ChatGPT, payment providers, or wearable companies. The Consumer Health Data Privacy Policy provides additional health-data details.
2. Information we collect
- Account: your Site-specific ChatGPT sign-in identifier and account email, membership status, and billing identifiers. SGE does not receive your ChatGPT password.
- Entries you choose: priority readings, check-ins, reflections, tags, symptoms, medications and doses, meals and nutrient values, walking and workouts, goals, experiments, tasks and reminders, and caregiver preferences. Some features require paid membership.
- Optional connections: selected wearable records and authorization credentials, files you import, food photos and meal notes submitted for analysis, and location or environmental search details.
- Operation: account-linked activity dates, feature categories, API request and error counts, processing durations, local save counts, upgrade-interest clicks, subscription events, and support correspondence. Hosting and other providers may process network and device information needed to operate their services.
Information comes from you, your sign-in provider, services you authorize, payment events, and your use of the service. Do not enter unnecessary information about another person.
3. Device and cloud storage
Free Priority measures are saved in this browser under the signed-in account identifier. The entry contents are not uploaded by free-use reporting; only action counts are sent. Clearing browser storage, changing browsers or devices, or using private browsing may remove those entries. Paid cloud mode stores entries in an account-linked Site database. A local entry is not automatically a cloud backup. Account and browser copies can differ.
Records in the app are separated by authenticated account. A page locks when its sign-in changes or cannot be verified on return. Device storage and downloaded exports are not an encrypted personal vault: someone with access to the same unlocked browser profile or exported file may access them. Use separate browser profiles on shared devices. Older unassigned browser records are not offered for subscribers to claim.
4. Purposes and choices
We use information to provide the tools you select, save and display your entries, calculate summaries and correlations, authenticate accounts, process subscriptions, import authorized records, respond to requests, secure and troubleshoot the service, and understand usage and subscription trends. Operational reporting does not include journal text, symptom values, medication details, task titles, meal photos, or health-entry contents.
We do not sell personal information or use your health entries for targeted advertising. We do not provide advertisers with your health entries. We do not use this service to make decisions about employment, credit, insurance, or eligibility for essential services.
5. Providers and other disclosures
OpenAI / ChatGPT Sites and hosting infrastructure provide hosted sign-in, application execution and cloud storage. When you choose cloud meal analysis, the selected photo and meal notes are sent to OpenAI for processing. The application requests non-stored API responses; this does not promise that every provider log or backup is immediately erased. Device analysis, where supported and selected, runs through your browser’s device model.
Stripe processes payment details and sends billing identifiers and subscription events to SGE. SGE does not store full card numbers. Wearable providers such as supported Oura, Withings or WHOOP connections send permitted records after you connect them. Directory and environmental data services receive the area, coordinates, search category or other query details required for the lookup; the app does not send them your journal contents. A third-party site you open receives information under its own policies.
Authorized service providers may access information as needed for their work. Internal support reports show operational aggregates, not members’ health entries. Necessary access for maintenance, security, legal requests or privacy requests remains subject to authorization and provider controls. We may disclose information when required by law, to protect people or service security, or in a business transfer subject to applicable privacy protections. Access by hosting and integration providers is governed by their services and agreements.
6. Retention and deletion
Local records remain in your browser until removed or cleared. Active cloud journal records remain until you replace or delete them, request deletion, or the service is discontinued. There is no automatic inactivity-deletion period currently configured. Deleting cloud health entries replaces the current journal with an empty copy; it does not automatically remove billing history, account identifiers, operational reporting, provider logs or backups, or copies you exported.
We retain other records only as needed for the stated purposes, security, accounting, disputes and legal duties. Different record types and provider backups have different retention requirements; this notice does not promise a universal purge deadline. Request broader deletion for a review of remaining information and applicable exceptions. Backup and provider deletion are handled subject to applicable obligations and provider processes; cancelling a subscription alone does not delete your records.
7. Your controls and privacy requests
Use My account to download or delete your cloud health entries and manage billing. Use Data & privacy in the tracker for local backups and deletion. Disconnect wearables in account or connection controls and revoke authorization with the provider if desired. Disconnection does not remove imported entries. To withdraw optional processing, stop using that feature, revoke the relevant permission or connection, and request deletion where appropriate.
Depending on your location and applicable law, you may have rights to access or obtain a copy, correct, delete, withdraw consent, restrict certain sensitive-data processing, opt out of sale or targeted-advertising sharing, appeal a request decision, or use an authorized agent. We do not sell information or conduct cross-context behavioral advertising; a Global Privacy Control signal therefore does not require switching off a sale or advertising-sharing activity in this application. We do not retaliate for exercising applicable privacy rights. We respond within the periods required by applicable law and explain relevant exceptions. You may contact your state privacy regulator or attorney general with a concern.
Contact Buddytown Consulting LLC, operator of The Social Good Experiment, at info@buddytown.com. Use the subject “SGE privacy request.” Identify your account email and the action requested. Do not email passwords, full payment details, photos, or health records. We may ask for proportionate identity or authorization verification before releasing, changing, or deleting personal information.
8. Adults and care tasks
Self-service accounts are for adults 18 and older. The service does not offer child accounts. Caregiver reminders are task-organizing tools, not authority to disclose another person’s health data. Use general task descriptions where possible. Only enter someone else’s information if you have appropriate authority and the use is permitted. Contact us if a child has provided information or someone else’s information was entered without authorization.
9. Security, location and updates
We use authenticated account controls, account-scoped database operations, access restrictions, and encrypted saved wearable authorization tokens. These controls do not guarantee absolute security or establish a health-record compliance certification. We assess suspected incidents and provide notifications when required by applicable law. Hosting and providers may process information in the United States or other locations where they operate. Contact us about your location-specific questions.
We update this notice when practices change, show the updated date, and provide additional notice or obtain consent when required. A privacy policy is not a substitute for any separate consent required for a particular health-data use.