Privacy Policy

Who we are

Sudden is an estate readiness application developed and operated by Sudden Ltd, a company registered in England and Wales (Companies House No. 17051584) and registered with the Information Commissioner's Office (registration no. ZC144642). We are the data controller for any personal information processed in connection with the Sudden app and website. For how our website uses storage, see our Cookie Policy.

For any privacy-related questions, contact us at: hello@sudden-app.com

What we collect

We collect two categories of data:

• Account data — your email address and encrypted password hash, used to authenticate you and manage your subscription.
• Vault data — the personal, financial, and legal information you enter into your vault modules. This is encrypted on your device before transmission. We store only the encrypted ciphertext — we cannot read it.
• Usage data — your readiness score, last check-in timestamp, subscription plan, and limited onboarding events such as the selected path and completed step. Onboarding events use opaque installation/session identifiers and never include what you type, vault values, contact details, documents, or email content.
• Payment data — website payments are processed by Stripe; in-app subscriptions are processed by Apple or Google and managed through RevenueCat. We receive transaction/entitlement status needed to activate your plan. We never see or store your full card details.

Your vault data

Your vault data — everything you enter across the nine modules — is encrypted using AES-256-GCM with a key derived from your password via PBKDF2 (100,000 iterations). Encryption happens entirely on your device.

What this means in practice:

• Sudden's servers store only encrypted ciphertext — a string of characters that is meaningless without your key.
• We cannot decrypt your vault. If you forget your password, you can reset it, but this clears your existing vault data — Sudden cannot recover it and there is no backdoor. Changing your password using your current password preserves your vault.
• A data breach of our servers would expose only encrypted data that cannot be read without your password.
• Nominees you invite can read only the fields you explicitly choose to share with them. Sudden still cannot read them.

How we use your data

We use your data only to provide the Sudden service:

• Email address — to authenticate your account, send nominee invitations on your behalf, and send essential service communications (receipts, security notices).
• Encrypted vault data — stored and returned to your device when you log in. We process it only to store and retrieve it; we cannot read its contents.
• Readiness score — calculated from your vault completion to show you progress within the app.
• Subscription status — to determine which features you can access.

We do not use your data for profiling, targeted advertising, or any purpose beyond delivering the service you signed up for.

Our legal basis for processing is contract performance (Article 6(1)(b) UK GDPR) — processing is necessary to provide the service you have requested.

We also rely on:

• Explicit consent (Article 9(2)(a) UK GDPR) — for special category data you choose to record, such as health information or information about your children. You give this consent when you enter that information, and you can withdraw it at any time by deleting it.
• Legitimate interests (Article 6(1)(f)) — for security monitoring, fraud prevention, and improving the service using anonymised, aggregated data (never vault content).
• Legal obligation (Article 6(1)(c)) — for keeping financial records and responding to lawful requests.

Sharing your data

We do not sell your data. We share it only in these limited circumstances:

• Supabase — our backend infrastructure provider (database and authentication). Stores encrypted vault data on our behalf under a data processing agreement.
• Stripe — payment processor. Handles subscription billing. Subject to their own privacy policy. We share only your email address to prefill checkout.
• Apple App Store or Google Play — processes in-app subscription purchases under the store account and privacy terms you use.
• RevenueCat — manages in-app subscription entitlements and receipt status. We identify your RevenueCat customer using your Sudden account ID, not vault content.
• Nominees you invite — if you invite someone as a nominee, they can see your email address and the vault fields you explicitly choose to share.
• Legal requirements — we may disclose data if required by law. Because vault data is zero-knowledge encrypted, any such disclosure would yield only unreadable ciphertext.

Where any provider processes personal data outside the UK, we make sure appropriate safeguards are in place under UK GDPR, such as UK adequacy regulations or the UK International Data Transfer Agreement. Details are available on request.

Data retention

We retain your data for as long as your account is active. If you delete your account, your vault data and profile are deleted from our live systems within 30 days.

Encrypted copies of your data may remain in backups after deletion. Because vault data is zero-knowledge encrypted, those copies remain unreadable to us. Payment records are retained for 7 years as required by UK financial regulations.

You can delete your account and all associated data at any time from Settings → Delete account in the app, by following the steps at sudden-app.com/delete-account, or by emailing hello@sudden-app.com with the subject line "Delete my account". We will process your request within 30 days.

Your rights

Under UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — request that we limit how we use your data.
• Portability — request your data in a portable format. On any plan, you can ask us for a machine-readable export; on Core and above you can also export a readable PDF in the app.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where we rely on your consent, withdraw it at any time.

To exercise any of these rights, contact us at hello@sudden-app.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to address any concern first, so please contact us before you do.

Security

Sudden is built with security as its primary design constraint:

• All vault data encrypted with AES-256-GCM before leaving your device
• Encryption keys derived via PBKDF2-SHA256 with 100,000 iterations
• Your encryption key is stored securely on your device (iOS Keychain / Android Keystore) and loaded into memory when you unlock your vault
• Face ID or fingerprint can be used to unlock the app
• All data transmitted over HTTPS/TLS
• No plaintext vault data ever stored on our servers
• Stripe, Apple, or Google handles payment credentials — we never see full card details

If you discover a security vulnerability, please contact us at hello@sudden-app.com before disclosing publicly.

No system is completely secure. If we become aware of a personal data breach, we will notify the ICO within 72 hours where required by UK GDPR, and tell affected users without undue delay.

Children

Sudden is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, please contact us at hello@sudden-app.com and we will delete the account promptly.

Adults may record information about their children in the vault (for example, guardian arrangements or medical details). We use it only to provide the service, never for profiling or commercial purposes, and, like all vault data, it is encrypted so we cannot read it.

Contact us

For any privacy questions, data requests, or concerns about how we handle your information: