Privacy policy

In short

Question	Answer
Do you know my name or email?	No. Your account is anonymous; Sign in with Apple, if you add it, gives us only an identifier.
Who sees what I send?	Only your partner and you.
Ads or tracking?	None. No third-party analytics.
Do you train AI on my content?	No.
Contacts or location?	Never asked for.
Can I delete everything?	Yes: Settings › Delete account. A report sent to us about a partner is kept until you ask us to delete it.

What the app handles

Your account. The app creates an anonymous account with a key kept in your iCloud Keychain. There is no password and we never see your name or email address. If you choose “Save your cat and notes”, you link the account to Sign in with Apple, and we then also keep an identifier that is unique to our app.
Pairing. An invite code, valid for 24 hours, links your account to your partner's. We keep only a one-way hash of the code, never the code itself. A pair is exactly two accounts.
Devices and sessions. A random device ID, and a session that keeps you signed in. We keep only a one-way hash of the session token.
What you send each other. Drawings, notes and photos (Moments), with who sent them and when, and what you add together: list items, wishes, calendar dates, places, date night plans, games and the things you buy for the room.
Onboarding answers. A few questions you can each skip: your age range (never your date of birth), how we should talk about you, the name your partner calls you, and what you want to do together. The day your story started stays on your phone.
Pick tonight. Each partner's latest swipe on each film or show in the last 24 hours. A title you both want is a match, and your partner gets a notification that names it.
Who knows who. For each day's round, which questions it asked, who it was about and the option each of you picked. Neither of you sees the other's picks until you have both answered. We keep each week's score.
Push token. An Apple identifier used to notify your device, if you allow notifications.
Usage counts. How many times each account did named things in the app on a given day (for example paired, sent a note, petted the cat, opened the shop), with the app and iOS version. Never what a note says or shows, your name or anything you type. We use it to see whether the app works for couples.
Test variants. To compare two versions of a screen, each pair is placed in one version; both partners always get the same one.

Where it goes and how long it stays

Everything above is stored on our own backend, which runs on Cloudflare.

Notes, drawings and photos are kept in your pair's private storage, reachable only by the two accounts in the pair, for as long as the pair exists.
Account and pairing data are kept as long as the account exists.
Pick tonight swipes are kept for 24 hours. To suggest titles, our backend asks The Movie Database (TMDB) for titles like the ones on your list, by their TMDB numbers only, never with your account.
Usage events are written to Cloudflare's analytics storage with a one-way hash of your pair (never your account or network address) and deleted after three months.
Abuse protection counts requests per minute against a one-way hash of the caller's network address; the address itself is not stored.
Server logs record the type of request, whether it worked and how long it took. They hold no note content, tokens, codes, emails or addresses, and are kept for 7 days.

Notifications are sent through Apple Push Notification service. Ourio has no in-app purchases. We don't sell your data or use it for advertising.

Your data on your device

The app keeps your session, device ID and recent notes on your phone to show them. Deleting the app removes these from your phone, but not from our backend: use Delete account for that.

Unpairing and deleting your account

Unpair (Settings › Partner): you stop sharing with each other. You can pair again with a new code.
Block partner: you are unpaired, and neither of you can pair with the other again.
Delete account (Settings › Delete account): your account and what you sent are deleted from the server, your partner is unpaired, and everything on the phone is erased. This can't be undone.
Reports you or your partner sent us about the other are kept after either account is deleted, so we can still act on them. Email us to have one deleted.

To ask about your data, or to have a report deleted, email support@ourio.app.

Children

The app asks your age range on first launch. If you are under 13, the app stops there, your answer is never sent and no account data is kept for you.

Changes

We will say here when this policy changes, and change the date above.