Privacy Policy

Hi! This Privacy Policy explains what information Ovvash collects, why we collect it, who helps us process it, and the choices and rights you have. We've tried to keep it in plain English. If anything is unclear, email us at support@ovvash.com.

In this policy, "Ovvash", "we", "us" and "our" mean the Ovvash service and the business that runs it, including the website at ovvash.com and our apps. "You" means anyone who visits our website or uses Ovvash.

The short version

• We collect what you give us (your account details and what you enter into Ovvash) plus a small amount of technical data needed to run the service securely.
• Some of what you enter can be sensitive, like health information (medicine, diet, body and meal details) and financial records. We treat it with extra care.
• Will we sell your information? Not for a million dollars. We do not sell your personal information, we do not use it for advertising, and we only use AI providers' paid API services, under terms that don't let them train their models on your data.
• When you use AI features, your message and the app data needed to answer it are sent to our AI providers to generate a reply.
• You can ask us for a copy of your data or to delete your account at any time by emailing support@ovvash.com.

1. Who is responsible for your data

Ovvash is the "data controller" for the personal information described in this policy (meaning we decide how and why it's used). For purchases, our payment partner Paddle acts as Merchant of Record and handles payment details under its own privacy policy (see Section 5).

2. Information we collect

Information you give us

• Account information: your email address, password (stored only as a secure hash, never in plain text), and, if you choose to add them, profile details such as your name, username, profile photo, bio, phone number, date of birth, gender, blood group, marital status, job title, country, time zone and preferred currencies. All of these extra profile fields are optional.
• Sign-in with Google: if you sign in or link your account with Google, we receive basic profile information that Google shares with your permission, such as your name, email address and profile photo.
• Your content in Ovvash modules: everything you add to Ovvash, such as:
• Habits and To-Do: habits, tasks, checklists, projects and completion history.
• Journal: journal entries and anything you attach to them.
• Finance: income, expenses, budgets, wallets, recurring payments, subscriptions you track, and receipts.
• Medicine: medicines, dosages, schedules and dose logs.
• Diet: meals, foods, recipes, and body or meal information you choose to log.
• Goals: goals, milestones, target dates and progress you choose to track.
• Data in any future modules you choose to use (for example, Fitness or Study).
• Images you upload: for example receipt images you scan, journal images, and your profile photo.
• AI conversations: messages you send to our AI features ("Talk to AI" and the AI chat page at ovvash.com/ai), the AI's replies, entries the AI proposes, and whether you confirmed them.
• AI feedback: your likes and dislikes on AI replies, any written feedback you choose to add, and a record of which AI model produced the reply.
• Support and feedback messages: anything you send us by email or through feedback forms.
• Preferences: settings such as language, theme, which modules you've turned on, notification choices, and email preferences.
• Things you choose to make public: if you turn on your public habits dashboard or create a journal share link, the information you choose to share (see Section 5).

Information collected automatically

• Technical and log data: IP address, browser and device type, operating system, pages and features used, timestamps, and error logs. For each signed-in device we keep a session record (sign-in method, browser/device description, IP address and when it was last used), so you can see and sign out your devices in your settings. We use this to keep Ovvash secure, prevent abuse (for example, limiting repeated failed logins), and fix problems.
• Usage limits: counts of how many AI messages and scans you use each day, so we can apply your plan's limits.
• Cookies and local storage: see Section 8.

Information from our payment partner

When you buy a subscription, Paddle processes your payment. We do not receive or store your full card details. Paddle shares with us what we need to manage your subscription, such as your plan, subscription status, renewal date, country, and transaction records.

3. Sensitive information (health and finance)

Some information you enter may be sensitive. This includes health-related data (for example medicines, doses, diet, meals, body information, and optional profile details such as blood group) and financial data (for example expenses, budgets and receipts). Under laws such as the GDPR and UK GDPR, health data is a "special category" of personal data, and under the CCPA/CPRA some of it may be "sensitive personal information".

You choose whether to enter this information. When you do, we use it only to provide the features you ask for (for example, showing your medicine schedule, tracking your spending, calculating your Ovvash Score, or answering your AI questions). We never:

• sell it,
• use it for advertising or share it with advertisers,
• allow AI providers to use it to train their models (we only use their paid API services, which don't train on your data), or
• use it to infer things about you for purposes other than providing Ovvash to you.

Where the law requires it, we rely on your explicit consent to process health data, which you give by choosing to enter it into Ovvash. You can withdraw that consent at any time by deleting the data or your account.

Ovvash is not a medical or financial service. The Medicine, Diet and Finance modules (and any AI replies about them) are tools for personal organization only. They are not medical, nutritional, financial, tax or other professional advice. Always talk to a qualified professional before making decisions about your health or money.

4. How we use your information

We use your information to:

• Provide Ovvash: create and secure your account, store and sync your data, show your modules, and calculate your Ovvash Score.
• Run AI features when you use them (see Section 6).
• Scan receipts and images when you ask us to (see Section 7).
• Manage subscriptions and trials, including your free trial, plan limits and access to paid features (together with Paddle).
• Communicate with you: account emails such as verification, password resets, security notices, and important changes to the service or these policies. We don't send marketing emails today. If we start, every one will have a one-click unsubscribe link, and we'll ask for consent where the law requires it.
• Improve quality: for example, using your AI ratings and feedback to improve the quality of AI replies, and using error logs to fix bugs. Where we analyze usage to improve Ovvash, we prefer aggregated or de-identified data.
• Keep Ovvash safe: prevent fraud, spam and abuse, and enforce our Terms of Service.
• Meet legal obligations, such as responding to valid legal requests and keeping records required by law.

Legal bases (EEA, UK and similar laws)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the service you signed up for (account, modules, sync, AI features you request, subscriptions).
• Explicit consent: for health-related data you choose to enter, and for any non-essential cookies or analytics where consent is required.
• Consent: if we ever send marketing emails, we'll ask for consent where the law requires it. We don't send marketing emails today.
• Legitimate interests: to keep Ovvash secure, prevent abuse, fix problems and improve the service, in ways that don't override your rights.
• Legal obligation: where we must keep or disclose information by law.

5. Who we share information with

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We share information only with trusted service providers that help us run Ovvash, under contracts or terms that limit how they can use it:

We may add or change providers over time (for example, OpenAI may be added as an AI provider in the future). We'll update this policy when we do.

We may also disclose information:

• If the law requires it, or to respond to valid legal requests from public authorities.
• To protect the rights, safety and security of our users, the public or Ovvash.
• In a business transfer, such as a merger, acquisition or sale of assets. If this happens, your information will remain protected by this policy or one at least as protective, and we'll let you know.
• With your permission, for example if you choose to share something publicly or with another person. Everything is private by default. If you turn on your public habits dashboard, anyone with the link can see your display name, profile details shown there and the habits you mark as public, with their progress. If you create a journal share link, anyone with the link can read that snippet. You can turn these off at any time.

6. How AI features work

Ovvash includes optional AI features, such as "Talk to AI" and the full AI chat page at ovvash.com/ai. Here's what happens when you use them:

• What is sent: your message, plus the relevant app data needed to answer it (for example, today's tasks if you ask about your day, or recent expenses if you ask about spending), and recent messages from the same conversation for context.
• Who receives it: our primary AI provider is Anthropic (Claude), with Google (Gemini) as a backup. We use only their paid AI provider plans, which don't train on your data, and we have never used free-tier or free-credit AI access — including for our own testing and prompt tuning. Providers may keep requests for a short, limited period to detect abuse and meet legal obligations, under their own terms. OpenAI may be used as a provider in the future; we'll update this policy if that happens.
• You stay in control: the AI can suggest entries (like a new task or expense), but nothing is saved until you confirm it.
• Chat history: we store your AI conversations so you can see them again. You can delete a single chat ("Clear chat") or all of your chats ("Clear all chats") in the app. This permanently deletes those messages and any ratings on them.
• Ratings and feedback: if you like or dislike a reply, or write feedback, we store it along with which AI model produced the reply, so we can improve quality.
• Limits and language: AI features are available on eligible plans and during your trial, with daily usage limits, and currently work in English only.
• Accuracy: AI can make mistakes. Replies are not medical, financial, legal or other professional advice. Please double-check anything important.

7. Receipt and image scanning

When you scan a receipt or image, the image you select is uploaded to Ovvash and sent to Google Cloud Vision to read the text (OCR). We use the result to suggest an entry (for example, an expense) that you can review before saving. We store the uploaded image privately in your account (in DigitalOcean Spaces, London, UK) so you can view it later, until you delete it or your account.

8. Cookies and browser local storage

We keep this simple:

• Essential cookies: we use a secure cookie to keep you signed in and protect your account. Ovvash can't work without it, so it doesn't need consent.
• Browser local storage: we store a few small settings directly in your browser, such as your theme (light or dark), language, notification sound, which AI chat you have open, and similar interface preferences, so the app loads the way you like it.
• Browser notifications: if you allow notifications, reminders are shown by your browser on your device. We don't use a third-party push notification service.
• Analytics and non-essential cookies: if we ever use analytics or other non-essential cookies, we will ask for your consent first where the law requires it, and we will update this policy.
• No advertising cookies. We don't use cookies to show you ads or track you across other websites.

You can clear cookies and local storage through your browser settings. If you block essential cookies, you won't be able to sign in.

9. Where your data is stored (international transfers)

Ovvash's app servers and database are hosted by DigitalOcean in the United States, uploaded files (such as photos and receipts) are stored by DigitalOcean in London, United Kingdom, and our website is hosted by Vercel, which serves it from data centers around the world. Our other service providers (such as our AI and OCR providers, and Paddle) may process data in the United States or other countries.

This means your information may be transferred to and processed in countries other than where you live, including the United States, which may have different data protection laws. When we transfer personal data from the EEA, UK or Switzerland, we rely on recognized safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or an adequacy framework such as the EU-U.S. Data Privacy Framework where a provider is certified. You can contact us for more information about these safeguards.

10. How long we keep your data

• Account and app data: for as long as your account is active, so we can provide the service.
• AI chat history: until you delete the chat or your account.
• Uploaded images: until you delete them or your account.
• Device session records: while the session is active, and for a limited time afterwards for security.
• After you delete your account: we delete or anonymize your personal information within a reasonable period, except where we need to keep some information longer to meet legal obligations (for example, transaction records), resolve disputes, or prevent fraud and abuse. Copies held in backups may remain for a limited time until they are overwritten.
• Payment records: kept by Paddle and by us as required by tax and accounting laws.

11. How we protect your data

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), hashed passwords, private file storage with short-lived access links, access controls, and limits on repeated login attempts. No system is 100% secure, so we can't guarantee absolute security, but we work hard to protect your data and will notify you and the relevant authorities of a data breach where the law requires.

12. Your rights and choices

Wherever you live, you can:

• Access the information we hold about you and get a copy of it (data export).
• Correct inaccurate information (many details can be edited directly in the app).
• Delete your account and personal information.
• Marketing emails: we don't send marketing emails today. If we start, every one will have a one-click unsubscribe link, and we'll ask for consent where the law requires it.
• Withdraw consent where we rely on it, without affecting processing that happened before.

To export your data or delete your account, email support@ovvash.com from the email address linked to your account. (We handle these requests by hand for now, so there's no in-app button yet.) We may need to verify your identity before acting on a request. We'll respond within the time required by law (generally within one month under the GDPR and 45 days under the CCPA).

Extra rights in the EEA, UK and Switzerland

You also have the right to object to processing based on legitimate interests, to restrict processing, and to data portability. You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to help first, so please contact us.

Extra rights for California residents (CCPA/CPRA)

• Right to know what personal information we collect, use and disclose (this policy describes it), and to get a copy.
• Right to delete and right to correct your personal information.
• Right to opt out of sale or sharing: we don't sell or share personal information for cross-context behavioral advertising, and we haven't done so in the past 12 months. Because we don't sell or share, there is nothing to opt out of, but we treat browser signals such as Global Privacy Control as a valid opt-out request.
• Right to limit use of sensitive personal information: we only use sensitive personal information to provide the service you request, as permitted by law.
• Non-discrimination: we won't treat you differently for exercising your rights.

Categories of personal information we collect (in CCPA terms): identifiers (such as email address and IP address); customer records (such as account and billing status); commercial information (such as subscription history); internet or other electronic network activity (such as log data); sensitive personal information (such as account login credentials, and health and financial information you choose to enter); and other information you provide in the app (such as journal entries and photos). We collect this from you, your device, and our service providers (such as Paddle and Google Sign-In), for the purposes in Section 4, and disclose it only to the service providers in Section 5.

You or an authorized agent can make a request by emailing support@ovvash.com. We may ask for proof that an agent is authorized.

13. Children

Ovvash is not meant for children. You must be at least 13 years old to use Ovvash, or at least 16 (or the higher age required) where your local law requires it to consent to data processing. We don't knowingly collect personal information from children below these ages. If you believe a child has given us personal information, contact us at support@ovvash.com and we'll delete it.

14. Changes to this policy

We may update this policy from time to time. If we make important changes, we'll let you know by email or with a notice in the app before they take effect, and update the "Last updated" date above.

15. Contact us

Questions, requests or concerns about privacy? Email support@ovvash.com. We're happy to help.

See also our Terms of Service, Refund Policy and FAQ.