This Privacy Policy explains how OldMate ("OldMate", "we", "us", or "our") handles personal information in the OldMate mobile app and on askoldmate.com. OldMate is operated from Australia by [EXACT LEGAL OPERATOR], at [PUBLIC BUSINESS ADDRESS].
Privacy questions can be sent to [email protected]. General product support is available at askoldmate.com/support.
1. What OldMate handles
| Information | What happens to it | Why |
|---|---|---|
| Account information | Your email address, password, account identifier, encrypted session, and authentication/security records are processed using Supabase Auth. Supabase handles the password credential; OldMate does not store a readable password in its own database. | To create and secure your account and protect access to online processing. |
| Voice recordings | Audio is recorded on your device. When you stop recording, a temporary copy is sent through a Supabase Edge Function to OpenAI's audio-transcription service. A relationship-memory recording is saved locally after a successful capture; short voice-dictation audio used to fill a text note is deleted after transcription. | To turn your recording into text and let you replay it. |
| Typed notes | Text you type into the note-capture screen is sent through Supabase to OpenAI for the same enrichment step as a voice transcript, then the resulting note and structured fields are saved locally. | To organise a note when you choose to type instead of keeping a saved recording. |
| Transcripts and relationship context | The transcript is sent through Supabase to OpenAI for enrichment. When updating an existing person, their name and existing summary may also be sent. OpenAI returns structured context, tags, follow-up ideas, commitments, and questions. | To organise the information you asked OldMate to remember. |
| Saved relationship memory | Contact names, notes, transcripts, summaries, tags, commitments, suggestions, questions, and saved audio are stored in the app's local database or files on your device. | To provide search, recall, playback, and follow-up features. |
| Technical records | Our service providers may process IP address, request headers, account ID, timestamps, status codes, and similar security or invocation logs. | To authenticate requests, limit abuse, diagnose faults, and keep the service available. |
| Support messages | We receive the contact details and information you choose to include when asking for help. Please do not email recordings, passwords, or other people's sensitive information. | To respond to your request and improve support. |
| Website analytics | If you choose “Sounds good” on the website banner, Google Analytics may process browser/device information, approximate location derived from IP address, pages viewed, referrer, and interaction data. The Google script is not loaded before that opt-in. Your choice is stored locally in your browser. | To understand website use and improve our public information. |
OldMate does not read your iPhone address book. A name mentioned in a recording is treated as content you chose to provide, not as access to the device Contacts database.
2. Local storage and online AI processing
OldMate is designed so the durable copy of your relationship memory is stored on your device rather than in an OldMate cloud contact database. Online processing is still essential to the current transcription and enrichment features. Before the first transfer, OldMate asks you to allow OpenAI processing and explains the data and purpose. Audio, transcripts, typed notes, and—where relevant—an existing contact name and summary leave your device only after you allow that processing.
OldMate sends enrichment requests with OpenAI's store setting disabled, so the Responses API does not keep application state for later retrieval. Under OpenAI's standard controls, enrichment content may still appear in abuse-monitoring logs for up to 30 days. OpenAI states that audio sent to its audio-transcription endpoint has no application-state or abuse-monitoring content retention, and that API content is not used to train its models unless the API customer explicitly opts in. These settings and statements must be rechecked before launch and whenever the integration changes.
Your device's operating system may include app data in an encrypted device or iCloud backup if you enable those Apple services. Those backups are controlled through your Apple account and Apple settings, not by OldMate.
3. How we use information
We use personal information only as reasonably necessary to:
- create, authenticate, protect, and delete accounts;
- transcribe recordings and generate the structured memory you request;
- provide search, playback, editing, deletion, and other app features;
- prevent abuse, enforce rate limits, secure the service, and troubleshoot faults;
- answer support, privacy, and legal requests; and
- understand use of the public website where analytics is permitted.
We do not sell app personal information, use it for targeted advertising, or combine it with data from other companies to track you across apps or websites.
4. Service providers and disclosures
OldMate uses the following categories of recipient:
- Supabase for email/password authentication, Edge Function hosting, and operational/security logs;
- OpenAI for audio transcription and AI enrichment;
- Google Analytics for consented website analytics and Google Fonts to deliver website typography (font requests expose ordinary network metadata such as IP address and user agent);
- our website host and domain/DNS providers to deliver askoldmate.com; and
- Apple when it independently provides App Store distribution, device permissions, or backups you enable.
We select providers that publish privacy and security commitments and require them to process information under applicable contractual and data-protection terms. Before publication, we must verify those terms and then confirm here that every third party receiving personal information provides the same or equal protection described in this policy. We may also disclose information where required by law, to protect rights or safety, or in connection with a business transfer subject to appropriate safeguards. We do not give service providers permission to use app content for their own advertising.
5. International processing
Supabase, OpenAI, Google, and other providers may process information outside Australia, including in the United States and other locations where they or their subprocessors operate. Where required, we rely on contractual and other safeguards for international transfers. The production regions and data-residency settings must be confirmed in this policy before launch.
6. Retention and deletion
- On-device content: kept until you delete the note/contact, use the account-deletion flow, erase app data, or uninstall the app, subject to any device backup you control. Signing out ends the session and hides that user's library, but does not erase its SQLite rows or recording files.
- Supabase account: kept until the account is deleted, except for limited records that must be retained for security or legal reasons.
- OpenAI audio transcription: no content retention is currently documented for the endpoint OldMate uses.
- OpenAI enrichment: application-state storage is disabled in OldMate's request; standard abuse-monitoring logs may still retain content for up to 30 days unless different approved controls apply.
- Operational and authentication logs: kept only for the security, troubleshooting, and compliance period configured with the production provider. The exact maximum period must be inserted before publication.
- Support records: normally kept for up to 24 months after the request closes, unless longer retention is reasonably required.
- Website analytics: retained according to the production Google Analytics property setting, which must be inserted before publication.
Use Settings → Delete account to initiate full deletion. After confirmation and password reauthentication for email accounts, OldMate deletes the Supabase Auth account and that user's locally stored contacts, notes, generated fields, caches, recordings, and AI-permission record. Processing copies and operational logs expire under the periods above. If you can no longer access the app, use the access-recovery guidance at askoldmate.com/privacy-choices.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, receive a portable copy, withdraw consent, or complain to a regulator. Some of these rights apply only in particular circumstances.
- Edit a contact name or delete notes and contacts inside the app.
- Stop future microphone access in iOS Settings.
- Review or withdraw permission at Settings → Privacy & AI. Withdrawing permission stops requests and later pipeline stages started after withdrawal; it cannot recall a request already transmitted for processing. Voice/typed capture and enrichment are then unavailable, while local viewing, editing, deletion, support, and account controls remain available.
- Delete your account and current-user local data from Settings → Delete account.
- Change website analytics consent on our Privacy Choices page.
- Email [email protected] for a privacy request or complaint.
8. Information about other people
OldMate is designed to help you remember people, so your recordings and notes may contain someone else's personal information. You are responsible for having a lawful basis and any permission required to record, store, and submit that information for AI processing. Recording laws differ by location. Do not use OldMate for covert or unlawful surveillance, and avoid recording highly sensitive information that is not necessary for your purpose.
9. Security
We use safeguards appropriate to the service, including authenticated API requests, encrypted network transport in production, a locally encrypted authentication session, access controls, and rate limiting. Saved SQLite contact data and audio files do not currently have separate application-layer encryption beyond protections supplied by iOS and the device. No system is perfectly secure, so keep your device locked and up to date.
10. Children
OldMate is not directed to children and should not be used by anyone who cannot lawfully consent to the handling described here without a parent or guardian. The minimum-age and parental-consent position must be finalised consistently across this policy, the Terms, the OpenAI service configuration, and the App Store age-rating answers before launch.
11. Changes and contact
We may update this policy when the product, providers, or law changes. We will update the date above and provide additional notice where required. Contact [email protected] or phone [PUBLIC SUPPORT PHONE] with a question, request, or complaint. We will acknowledge privacy complaints and explain the next steps within a reasonable period.