Privacy Policy

Otian AI LLC ("Otian AI," "we," "us," or "our") makes Archie, a desktop app for building personal AI agents that run on your own computer, and offers guided sessions to help people set them up. This policy explains what information we collect, how we use it, and the choices you have.

It covers three things, and they are quite different from one another: the Archie app, this website, and our guided services. The app is where most people's questions are, so it comes first. A plain-English version of this section, listing the connections Archie makes and what each carries, is on our Trust page.

The Archie App

What the app sends to us

Archie's servers receive two things about you always, and three more only where they apply. This is what the app sends; a handful of smaller records are created by the website and by our guided sessions instead, and those are described further down. The single list of everything our servers hold, from either source, is kept on our Trust page, and if that list and this section ever disagree, the Trust page is the one we maintain:

• Your email address, so you can sign in. It is held in our account system (Google Firebase).
• Whether you have a current plan, so the app can let you in. Payments are processed by Stripe; we never receive or store your card details.
• Which version of the Terms you agreed to, and when. Signing in to the app means agreeing to the Terms of Service and this policy, and the sentence saying so sits under the sign-in buttons. The app tells our server the date of the Terms it showed you, and the server writes that date and the moment you signed in beside your account, once per version. Nothing else about the sign-in is kept.
• Which version of Archie you are running, and a crash or error report if something breaks. Once every six hours the app records your account ID, its version number, whether you are on Mac or Windows, which edition it is, and the time. It overwrites the same record each time, and it exists so we know which versions are still in use before we ever stop supporting one. If Archie quits unexpectedly, the next time you open it a crash report goes with it: where in our code it happened and a shortened trace, scrubbed of anything secret-shaped. The crash message itself stays on your disk and is never uploaded. If something keeps failing, an error report goes too: where in our code it broke, the error line, and, for an add-on, its name and the tool that failed. None of these carries anything you wrote, received, or asked for, and there is no analytics service in Archie: nothing records what you do in it. Two counters do exist, and neither is analytics: the app keeps a log on your own computer of what each AI call cost, so its Account screen can show you your estimated spending, and while you are on the free starter credits our billing server counts what each call spent, because that is how the credits are subtracted. You can turn the version line, crash reports and error reports off, in the app under Settings, on a page that lists in full what is in each. Off means nothing further is sent and anything waiting to be sent is deleted.
• What the free starter credits spent, while you are using them. A new install comes with a small amount of AI usage we pay for, described under Your AI provider below. So that it can be stopped at the amount you were given, we keep a ledger for your account: how many tokens each call used, what it cost, and when. Beside it we keep a scrambled, one-way stamp of the computer and the internet address the credits were claimed from, so that the same computer cannot claim them repeatedly. A stamp cannot be turned back into a computer or an address; it can only be compared with another stamp. None of this holds any part of a request or a reply.
• The messages between your computer and your phone, if you turn on phone access. They sit in our database sealed with a key your computer generates and hands to your phone by QR scan. The key never reaches us, so we hold the messages and cannot read them. Three things about each message are not sealed and are therefore visible to us: the time it was left, the app version that left it, and whether it has been picked up yet. Phone access is off unless you switch it on, per computer. The sealing runs in a browser too, so you can watch a message of yours being sealed, and watch it refuse to open without the key.

Adding an add-on sends only a request to raise that add-on’s public install count; we keep no per-person record of which add-ons are yours.

Archie also checks our website for a new version. That request carries no version number, no device identifier, and no account information: it fetches a fixed file and the comparison happens on your computer. Our website is hosted on GitHub Pages behind Cloudflare, so both companies' servers see the request's IP address and the usual request details; we run no server for this.

What stays on your computer

Your agent's instructions, the files and notes you give it, everything it remembers, and your entire conversation history are stored on your own device, in Archie's application folder. We do not receive, store, or have any means of accessing them. Two exceptions, both described in full elsewhere in this policy: while you are using the free credits Archie starts you with, or the plan with the AI included, your conversations pass through our server on the way to the AI (see Your AI provider below), and if you turn on phone access, a sealed copy that only your own key can open sits in our database (see the list above). One thing to know about deleting: dragging the app to the Trash does not remove that folder or your keys, because your computer keeps app data separate from apps. Before you delete the app, use Resetting Archie on the Account page, which erases your agents and your saved keys from this computer. If you connected a phone, resetting also disconnects every phone and empties its sealed mailbox on our server. On Windows, the uninstaller’s box “Also remove my Archie data, agents, and settings” removes that folder but not the saved keys, so reset first there too. The setting that wakes the computer for routines stays behind, and wakes nothing once no routines are left.

The app contains no analytics or tracking software of any kind: not disabled by default, but absent. Nothing in Archie records what you open, what you run, or how often you use it, and there is no third-party analytics service in it to do so. The three things it does send, the version line, crash reports and error reports, are described above and can be switched off.

Your AI provider

To think, your agent must send your request to an AI model. You choose the provider: Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), Groq, xAI (Grok), DeepSeek, Mistral, or any other provider of your own that speaks the OpenAI format. Archie connects directly from your computer to the one you chose, using your own account and your own API key. On your own account that traffic does not pass through us, is not relayed or proxied by us, and we keep no copy of it, and it is governed by your agreement with that provider rather than with us. The two exceptions, where the AI is ours rather than yours, are the next two paragraphs. On your own account, and providers differ in ways that matter: where they run, how long they keep API traffic, and whether they train on it are their policies, not ours, so read the terms of the one you pick. If your agent searches the web, that search runs on the provider's infrastructure and is billed to your account.

The free credits are the exception. New installs come with a small amount of AI usage so you can try an agent before opening an account of your own. That usage runs on Claude, on an Anthropic account of ours, so those requests and their replies go to a server we operate, which forwards them to Anthropic and subtracts what they cost from what you were given. We do this because the alternative is putting our own provider key inside the app on your computer, where anyone could take it. That server does not log your request, the reply, or any part of either: what it records is your account ID, how many tokens went each way, and the amount spent. Connect an AI account of your own and this path stops being used from each agent's next start; the setup flow restarts your agent for you when you connect there, and an agent you leave running while adding a key in Settings switches over when it next starts.

The plan with the AI included is the other exception, and you choose it. That plan carries $25 of AI usage a month on the same Anthropic account of ours, through the same server, recorded the same way: your account ID, the tokens each way, and the amount, and never a request or a reply. We keep no copy of what passes through, and we use none of it, for training or for anything else. One thing differs from the free credits: it refills each month you pay, with nothing carried over. Email does not ride it. Your agent’s email features are switched off on this plan for now, the same as on the free credits, while Google finishes reviewing how Archie handles mail, so no mail of yours reaches our server on any plan we sell. Connect an AI account of your own and this path stops being used from each agent's next start, exactly as above.

Your API key is stored in your operating system's Keychain. It is transmitted only to the AI provider itself, and we have no means of reading it.

Accounts you connect

You may connect accounts you already use: Google (Gmail, Calendar, Tasks, and the Drive files you pick), Microsoft (Outlook mail and calendar, including Office 365), iCloud, Fastmail, Yahoo, AOL, Zoho Mail and GMX (mail, and the calendar where the provider has one), Telegram, Discord, Slack, Matrix, Todoist, Fireflies, GoHighLevel, and any other service you connect with a key of your own. Archie talks to those services directly from your computer, using access tokens issued to you and stored in your operating system's Keychain. On an AI account of your own, the contents of those accounts are not sent to us and we have no ability to access them. On the free starter credits the AI is ours, so what your agent reads from a connected calendar or task list rides its request through our server, unlogged, on the way to the model; mail never does, because every email feature refuses to run there. The two paragraphs above set this out in full. You can disconnect any of them at any time from within the app. iMessage, on a Mac, works differently, and it is worth reading the next section rather than this one.

Lights and plugs on your own wifi. Philips Hue, WiZ and LIFX bulbs and plugs you add on the Home devices card have no account behind them. Archie finds WiZ and LIFX on your own network. To find a Hue bridge, it asks Philips' own server which bridges are on your network, the way the Hue app does. That server sees your network's address and nothing about your lights. From then on Archie talks to them from this computer over your network, and those requests never leave it. What your agent learns about them, which is their names and whether they are on, goes to the AI account you connected like anything else your agent reads, and to the chat app it answers you in.

Text messages, on a Mac

There is no account to connect for this. Archie reads and sends through the Messages app on the computer it runs on, under permissions you grant in macOS. What follows is what happens on your side of that, because one of these features reads messages other people wrote.

Using iMessage as the app you talk to your agent in. Your agent lives in your own message-yourself thread. It reads that one conversation and no other, and it can never reply to anybody else, because the only conversation it is bound to is the one with yourself. What you say there is your conversation with your agent, and it travels like any conversation with your agent: straight to your own AI account, or through our server while you are on the free starter credits or the plan with the AI included, exactly as described under Your AI provider.

Text Replies, if you install it. This one reads the texts other people send you, so it can tell you which need an answer, offer a reply for you to send, and remind you of anything you agreed to. Because of that it deserves to be spelled out:

• It runs only on an AI account of your own. The free starter credits pass through our server, and so does the plan that includes the AI, and the people who text you never agreed to either. You can agree to it for what you write; you cannot agree to it for them. So this feature refuses to start until your agent has an AI account of your own, and on that account no text it handles ever touches a server of ours.
• It reads texts as they arrive, only while your agent is running, and never trawls your history on its own. When a new text arrives, it also reads the last few messages of that one conversation (up to twelve, which can include messages from before you switched it on), so the reply it offers fits the thread. It also sends up to eight of your own earlier texts, so the reply sounds like you. It picks them from the last sixty messages of that conversation, or from your other watched conversations when that one has too few.
• Verification codes, texts from short-code senders, and messages carrying opt-out phrasing like "reply STOP" are dropped on your computer, before any AI reads them. Group chats are excluded unless you turn them on. So is anyone you put on its ignore list, and if you set it to watch only certain people, everybody else is dropped too. A message past those filters is judged by the AI, so ordinary promotional texts can reach it.
• The text of a message leaves your computer in two ways. It goes to the AI account you connected, directly from your computer on your own key, so it can be read and answered; we are not in the middle of it and we keep no copy. And the card offering you the reply, which quotes the message, arrives through whatever chat app your agent uses, so it crosses that platform's servers the way anything you read there does.
• It reads your address book, on your computer, to turn a phone number into the name you saved for it. The lookup itself never leaves the computer; the resolved name then appears on the card, in the request to your AI account, and in any reminder it sets, and nothing else about the contact goes anywhere.
• If you switch it on, it also reads the messages you send, to catch things you promised. Off unless you ask for it.
• Nothing is ever sent without you pressing Send. Every reply is a draft you read first and can rewrite. A reply you do send goes from your own number, in your own thread, exactly as if you had typed it, because iMessage has no way to mark a message as written by an assistant.
• The text of your messages is never written into Archie’s logs. The internal draft record is deleted within a day; the card your agent posted stays in your chat like any message there, and a commitment it caught lives on as a reminder until it fires.
• You can turn the whole thing off, or uninstall it, at any time in the app.

Google user data (Gmail, Calendar, Tasks and Drive)

When you connect Google, Archie asks only for the permissions you tick on the connect screen, plus one that comes with any connection: your email address, which is how the app shows you which account you connected. The rest are separate permissions, and one you do not tick is never requested:

• Read your mail, so it can tell you what needs a reply and find what you ask it for.
• Send a reply, which it only ever does after showing you the exact text and waiting for you to send it or set a time for it.
• File mail out of your inbox, which is a label change. It never deletes an email, and anything it files is still in All Mail.
• See your calendar, so it can tell you what your week looks like and find you a free hour.
• Change your calendar. Every change is proposed first and applied only after a later message from you; the AI is what reads your message as a go-ahead, and nothing applies while you are away.
• Your Google Tasks, so it can add and complete items on your list.
• Files in Google Drive, only the ones you pick. This is Google’s per-file permission: your agent can open only the Sheets and Docs you choose in Google’s own picker, and nothing else in your Drive. A change it wants to make to one of those spreadsheets is proposed first and applied only after a later message from you.

This Google user data is handled under Google's rules for apps that use its APIs:

Archie's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Concretely, your Google data is:

• used only to provide and improve the email, calendar, task and file features you see in the app, and for no other purpose;
• fetched directly between your computer and Google: it is never stored on or accessible by Otian's servers. The exception that applies everywhere in this policy reaches only your calendar, task and Drive data here: while you are on the free starter credits or the plan with the AI included, what your agent reads there rides its AI requests through our server, unlogged, on the way to Anthropic (see Your AI provider). Your mail never rides them, on the free starter credits or on the plan with the AI included, because every email feature refuses to run on both. Reading your mail needs an AI account of your own, and on that account your mail goes straight from your computer to the provider you picked;
• sent to the AI account you connected, and only so it can answer you. Reading an inbox means giving a model something to read, so the message text goes to the provider you connected, on your account and your key, directly from your computer. We are not in the middle of it and we keep no copy;
• never used by us to train anything: we keep no copy that could be. Once sent to the AI provider you connected, training use is governed by your agreement with that provider;
• never sold, and never transferred to anyone besides the AI account above and the places you point your agent's answers at: the chat app you connected (cards and answers about your mail are delivered as messages there) and, if you turn on phone access, the sealed relay only your key can open. Beyond those, only to comply with the law or in connection with a merger of which you are notified;
• never read by a human except with your explicit consent (for example, to troubleshoot a problem you report to us), where required for security, or to comply with the law.

What Archie keeps on your computer between sessions: a marker of where it last read up to, so it does not re-read the same mail twice; each proposed reply (the sender, the subject, a one-line summary, and the draft text) for about a day, so the card's buttons keep working; fingerprints of replies it sent, so it can recognize its own writing later; and, only if you turn on the writing-style option, samples drawn from your sent mail, kept until you delete them. Message contents beyond that are read to answer you and are not stored, except whatever ends up in the conversation you can see and delete.

Microsoft account data (Outlook mail and calendar)

Outlook and Office 365 accounts work the same way and are treated the same way. When you connect one, Archie asks to know which account it is (sign-in identity, which every connection includes) and, beyond that, only for the permissions you tick on the connect screen: reading your mail, sending a reply, moving mail out of your inbox, seeing your calendar, and changing your calendar are separate permissions, and one you do not tick is never requested. Everything above about your Google data is equally true of your Microsoft data, including its exceptions: it is used only for the email and calendar features you can see, it moves directly between your computer and Microsoft, it is never stored on our servers (with the same starter-credits note as above), we never use it to train anything and once at your AI provider its use is governed by your agreement with them, and it is never sold. Access tokens are stored in your operating system's Keychain, and you can disconnect the account at any time from within the app, or revoke it yourself at myaccount.microsoft.com.

Mail and calendar from iCloud, Fastmail, Yahoo, AOL, Zoho Mail and GMX

These providers have no sign-in screen for an app like Archie. Instead you make an app password on the provider's own website (Archie shows you the page) and paste it once. Archie keeps it in your operating system's Keychain and sends it to that provider's own mail and calendar servers, directly from this computer, every time it opens the mailbox; it goes nowhere else. Removing the account in Archie, or revoking the app password on the provider's site, ends that access.

What the account can do is what the connect step could prove, and nothing is assumed. Archie signs in to the incoming mail server, tries the outgoing one so it knows whether sending will work, and, for providers that have one, looks for the calendar at the address that provider publishes (AOL and GMX have none worth connecting, so no calendar is looked for). Anything that did not answer is shown as missing on the Connections tab, and Reconnect tries again.

Everything above about your Google data is equally true of this mail and calendar: read to answer you and not stored beyond the markers described there, sent only to the AI account you connected, filed by moving a message into an Archive folder and never by deleting it, sent only when you send it or set a time, and changed on the calendar only after a later message from you. The starter-credits exception is the same too: mail from these accounts never rides them, and a calendar read while you are on the free credits passes through our server, which notes what each request cost and never what it said, on the way to Anthropic. The plan with the AI included works the same way: mail from these accounts never rides it, and a calendar read on it passes through our server on the way to Anthropic, kept nowhere.

What your agent can and cannot do on its own

We think you should know this before you connect anything, so we state it plainly. Archie can send email, send a text reply, and change a calendar you connect, but never on its own: no text goes out until you press Send on the exact draft, no email goes out until you send it or set a time for it, and your agent cannot set that time itself, and no calendar change applies on the turn it was proposed; only the exact proposed change can apply, never while you are away, and the AI is what reads your later message as the go-ahead. It can buy things on a website only if you switch buying on, and then only at shops you choose, up to limits you set, and after you tap to approve each order; it never types or stores a card you pay with, and the limit is checked against the price it reads on the page. Each purchase it makes is recorded on your own computer, with the amount it read, where you can check it against your statement; if you connect a payment service with a key that can move money, any change there is shown to you first and happens only after you approve it, and the app steers you toward read-only keys. On its own, your agent speaks only in the chats you connected, to the people on its list; the only way words it wrote reach anyone else is a draft (an email or a text reply) that you read and send yourself.

Review what it proposes before you approve it; an approval only protects you if you read it. The current status is always on our Trust page.

The app on your phone

There is a second app, for your phone, and it is a remote control for the Archie on your computer rather than a copy of it. Your agent is not running on the phone and never moves there. The app has no sign-in and no account of its own: your computer lets it in when the phone scans a code, and that code carries the key that seals everything between the two. What the app asks for on the phone, and why:

• The camera, for two things. It reads the square code that pairs the phone with your computer, and it takes a photo or a short video when you choose to show one to an agent. It is not on at any other time.
• Your photos, only at the moment you pick something to send. The app is handed the photos or video you chose and nothing else, and it never reads the rest of your library.
• The microphone, only while you are recording for an agent: a voice note you start with the talk button, a video you film, or Talk out loud, which listens until you close it. You can throw a voice note away instead of sending it, and the microphone stops on its own if you leave the app.

A photo, a video, a file or a voice message travels the way every other message between your computer and your phone does, described in the list at the top of this section: sealed on the phone with that key, left in the mailbox on our servers, and opened on your computer. We hold it and we cannot read it. The same three things stay in the clear as for any message there, which are the time it was left, the version of Archie involved, and whether it has been picked up yet. Once it is on your computer, your agent treats it like anything you type: your AI company sees the pictures your agent looks at, and only the words of anything spoken, which your computer works out itself.

When a phone pairs, we also keep the name it reports, unsealed beside the pairing, so your computer can list it among your phones. On an iPhone that is just “iPhone”. On an Android phone it is the name in the phone’s settings, which may include yours.

The phone app contains no analytics or tracking software of any kind, sends us no crash reports, and carries no advertising identifier. What it keeps on the phone is the key, the pairing, and any voice notes it saved so it can play them again without fetching them twice. Forget this pairing, in the app's own Settings, deletes all of that. To stop that phone being able to open anything new, press Revoke beside it on your computer, which retires the key.

Our Website and Guided Services

The next few sections are about our website and the guided sessions, calls, and communications that are part of our services, rather than about the app. From Data Retention onward, everything applies to all of it: the app, the website and the services alike.

Information We Collect

We collect information you choose to give us, including:

• Contact and intake information, such as your name, email address, phone number, and the details you share in our contact form, intake questionnaire, or discovery call about what you'd like help with.
• Session and communication records, such as notes from calls, emails, and messages we exchange while scoping and building your agent.
• Billing information, such as the details needed to invoice you for guided sessions. Each invoice we raise is kept on your account: the amount, what it was for, the date, and whether it has been paid. We do not directly store full payment card numbers; payments are handled through the payment method we agree on with you.
• Second-factor records, if you turn on two-factor sign-in: the encrypted secret your authenticator app shares with us, or, for the emailed-code method, a scrambled copy of the current code with its expiry and how many tries it has had. Removing two-factor sign-in from your account page deletes them.
• Your email address, for the weekly letter. One email a week from us. If you have an account here with a confirmed email address, you are already on it: we added existing account holders rather than asking each of them to opt in first, and the switch on your account page is where you turn it off. What we keep is your address and whether you are on or off. Resend delivers the letter and receives your address in order to send it. We do not track opens or clicks: there is no tracking pixel in an issue, and its links go where they say they go rather than through a counter, so we have no way of knowing whether you read one. Coming off it takes whichever is nearer: the unsubscribe link at the bottom of every issue, or that same switch. Turning it off leaves a note that you said no, kept for as long as your account exists, because without it the next sync would add you back; deleting your account removes your address from our record and from Resend altogether.
• A record of a checkout we had to refuse. We do not currently sell into every country. If a purchase reaches checkout from one we cannot serve, it is refunded and we keep a note of it: the account, the country, and the amount. It exists so that we can answer you when you write to ask what happened, and so we can count how often it happens.

We do not use tracking cookies or third-party analytics on this website. The outside resources our site does load are: Google Fonts, to display text in the site's typeface; Google's Firebase sign-in code and services, which power signing in and reading your own account; Formspree, which receives what you type into any form on this site (the contact form and the get-started questionnaire) and passes it to our inbox; on pages that offer booking, an embedded Google Calendar; and, in the Learning Library, YouTube’s video player, which loads only when you press play on a video, after which YouTube counts that play.

How We Use Your Information

We use the information we collect to:

• Respond to inquiries and schedule consultations and sessions
• Understand what you need help with and plan how to build it
• Deliver, support, and maintain the AI agent we build with you
• Send invoices and handle payment for our services
• Improve how we explain and deliver our services

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Access to Your Accounts During Setup

Building your agent sometimes involves connecting it to accounts you already use, such as email or a calendar. We only ever connect or configure something after you've explicitly approved it during a guided session; nothing is set up behind the scenes. We do not retain copies of your account credentials once a session ends, and we do not access your connected accounts outside of scheduled sessions unless you've asked us to for support.

Third-Party AI Providers

The agents we build typically run on AI models from providers such as Anthropic (Claude) or OpenAI (ChatGPT). On every plan except the one with the AI included, you create and pay for your own account directly with the provider you choose, and we do not mark up that cost or collect it. On that one plan the AI is ours: it runs on our own Anthropic account and $25 of usage a month is inside the price you pay us. Information you send to your agent (for example, an email draft it helps you write) is processed by that provider under their own privacy policy and terms, which we encourage you to review. We don't control, and aren't responsible for, how those providers handle data on their end.

Service Providers We Use

We rely on a small number of trusted companies ("subprocessors") to run our accounts, billing, and communications. Each processes only the limited information described above, only to provide its service to us, and under its own terms and security practices:

• Google Firebase: sign-in and the account record (your email and license status).
• Stripe: payment processing. Stripe handles your card details directly; we never receive or store them.
• Resend: delivery of our email, both the transactional kind (sign-in codes, verification, and account notices) and the weekly letter, if you have turned that on. Resend receives your email address in order to deliver these messages.
• Render: hosting for the small service that handles sign-in, licensing, account management, account email, and adding one to an add-on's public install count when you add one, and that relays your AI requests while you are on the free starter credits or the plan with the AI included (forwarding them to Anthropic without logging their content). It answers on archie-4f35.onrender.com, which is the name you will see if you watch Archie's connections yourself.
• Cloudflare: it sits in front of our website, including the file Archie checks for updates, so it sees the IP address and the usual details of each request to the site. It hides the email addresses on our pages from bots, and if a page fails to load, your browser may report that failure to it.

We do not use third-party advertising or analytics services.

Data Retention

How long each thing is kept, in days and months rather than in the words "as long as needed". Where a period is longer than you might expect, it is either a control we would have to rebuild without it or a record the law requires us to keep, and the table says which.

Two things sit beside that table rather than in it. A deletion is a deletion from our live systems, and our database provider keeps its own short-term backups, currently seven days, so a record can sit in one of those after it is gone from ours. And deleting your account does not wait for any of these periods: it removes your account and everything filed under it straight away, including invoices and two-factor records, and the three items keyed separately (failure reports, the version line, and the credit ledger) fall away on the schedule above or on request, whichever comes first.

You can ask us to delete your contact and intake information at any time; see "Your Choices" below.

Data Security

We take reasonable steps to protect the information you share with us, including limiting who has access to it. That said, no method of storage or transmission is completely secure, and we can't guarantee absolute security.

If we are breached. If personal information we hold about you is exposed, we will tell you within 72 hours of establishing that it happened, by email to the address on your account. We will say what was taken, when, what we have done about it, and what you should do, and we will say all of that even where the honest answer is that we do not yet know. If we are still working out the scope at 72 hours, you will hear that at 72 hours rather than hearing nothing until we are finished. We will not wait for legal advice about whether a notice is required before sending one.

What limits the damage is the shortness of the list above: a breach of us cannot produce anybody's conversations, mail, calendar entries, files or API keys, because we do not hold them. How to report something you have found is on its own page.

Children's Privacy

Our services are intended for adults. We don't knowingly collect information from anyone under 18.

Your Choices

You can ask us to access, correct, or delete the personal information we hold about you, or ask us to stop using it for a particular purpose, by emailing us at the address below. We'll respond as quickly as we reasonably can. You can also delete your account yourself from your account page (it asks you to have signed in recently first). That removes your sign-in, your account record, and your purchase history; a few operational records outlive it for the reasons they exist at all, including crash reports, the version line, and the free-credit ledger with its abuse-prevention counters, none of which contains anything you wrote. Email us to ask for those too.

Your Privacy Rights (GDPR & U.S. State Laws)

Depending on where you live, you may have rights over your personal information, including the right to access it, correct it, delete it, receive a portable copy, or object to or restrict certain uses. To exercise any of these, email us at the address below; we will not discriminate against you for doing so.

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing your information are: performance of a contract (to provide the app, licensing, and services you buy), legitimate interests (to secure our systems and communicate with you about your account), and consent (for anything you optionally connect, such as your Google account, which you can withdraw at any time by disconnecting it in the app).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other U.S. state privacy laws.

Changes to This Policy

We may update this policy from time to time as our services change. The "Last updated" date at the top of this page reflects the most recent revision. If changes are significant, we'll do our best to let existing clients know directly.

Contact Us

Questions about this policy or your information? Email us at [email protected].