Privacy Policy

Effective Date: October 16, 2026 · Version 1.6

OhRight, LLC (“OhRight”, “we”, “us”, or “our”) operates the OhRight! web application and the OhRight! iOS app (including its Apple Watch companion). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By creating an account or using the Service, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

Account information: Email address, password (stored as a cryptographic hash by Supabase — we never store or access your plaintext password), and display name/nickname.
Obligation data: Task titles, notes and descriptions, due dates and times, categories, priority levels, and recurrence rules you create, and the original text you typed or spoke to create a task.
Calendar data: iCal URLs you provide and the calendar event data imported from those sources (event titles, dates, times, locations).
Natural language input: Text you submit for AI-powered obligation parsing, if you allow AI. When you use voice input, your speech is turned into text by Apple’s speech recognition (in the iOS app) or your browser’s speech service (on the web), and only the resulting text is sent to us — OhRight never receives or stores the audio itself (see Section 1.4).
Payment information: If you subscribe to the Pro tier on the web, payment details are collected and processed directly by Stripe, Inc. If you subscribe in the iOS app, Apple processes the payment and we receive transaction and subscription-status records from Apple. We do not store your credit card number or full payment details on our servers.

1.2 Information Collected Automatically

Usage data: Actions you take in the Service (task creation, AI parses, calendar syncs, filter use) are logged for tier enforcement and analytics purposes. These logs include the action type, timestamp, and your user ID.
Device and browser information: We may collect your IP address, browser type, operating system, and device type through standard server logs and our hosting provider (Vercel). When you accept the Terms of Service and this Privacy Policy, we record the versions you accepted, the time, your IP address, the platform (web or iOS), and your browser or app’s user-agent string, as part of the consent record we retain for security, fraud-prevention, and legal-compliance purposes.
Mobile device information: If you use the iOS app, we store a push-notification token for your device so we can send you reminders, along with basic device details (such as a device identifier and the platform) needed to deliver them.
Cookies: The Service uses essential cookies for authentication session management. We do not use advertising or third-party tracking cookies.

1.3 Information from Third Parties

Apple: If you subscribe in the iOS app, Apple tells us about your purchase and subscription status (for example, renewals, cancellations, and refunds).
Google: Sign-in with Google is not currently offered. If we offer it in the future, we would receive your name, email address, and profile picture URL from Google, and nothing else from your Google account.

1.4 Artificial Intelligence Processing

If you allow it, we use Anthropic’s Claude API (“Anthropic”) for two things:

Understanding what you type or say. The text you enter (or the text transcript of what you say) is sent to Anthropic, along with today’s date and our list of categories, to turn it into structured obligation data (title, date, time, category, recurrence).
Writing your reminders. When AI-written reminders apply to your account, we send Anthropic the task’s title, notes, category, and due date and time, your nickname (if you set one), and the text of up to two earlier reminders, so it can write the push notification and the tap-to-read message. Tasks in the Health and Financial categories (and categories whose names suggest health or money matters) get standard reminder text that is not written by AI.

We ask first. Before anything you enter is sent to Anthropic, the app asks whether you want to use AI and lists what would be sent: what you type or say when adding a task; your task titles, notes, categories, and due dates; your nickname, if you set one; and the text of your recent reminders. Nothing is sent to Anthropic unless you choose Allow AI.

If you say no. If you choose Not now, you can still add tasks yourself and get reminders in standard wording that is not written by AI. Adding tasks by voice (in the iOS app, with Siri, or on Apple Watch) needs AI, so it is not available while AI is off. We won’t ask again, but you can turn AI on at any time in Settings.

Changing your mind. You can withdraw your consent at any time by turning off Use AI in Settings. From then on, nothing new is sent to Anthropic. Withdrawing does not delete tasks or reminder text that were already created; they stay in your account until you edit or delete them or delete your account. If we change what we send to Anthropic, we will ask you again.

Record of your choice. We keep a record of each AI choice you make (allow, decline, or withdraw): the choice, the time, the version of the AI notice you saw, the platform (web or iOS), your IP address, and your browser or app’s user-agent string. We keep these records the same way as your acceptance of our Terms and this Policy (see Section 4).

Anthropic’s published commercial terms and privacy materials, as of the Effective Date of this Policy (see https://www.anthropic.com/legal for current terms), say that inputs and outputs from its API are not used to train its models by default, and that they are deleted within 30 days unless a longer period applies, for example when content is flagged under Anthropic’s Usage Policy (kept up to two years) or retention is required by law. See Section 3 (How We Share Your Information).

We save the text you entered, the resulting task, and the reminder text we send you (including AI-written text), together with a record of each AI generation (the text produced, the model used, and usage counts), so we can show you your reminders, control costs, and improve quality. We do not save the full prompts sent to Anthropic. AI outputs can be inaccurate, so please review them before relying on them (see our Terms of Service for more on AI limitations).

Reporting an AI-written note. If an AI-written reminder or note is wrong or upsetting, you can report it. A report saves the reason you choose, any comment you add (up to 500 characters), a copy of the reminder text you reported, which reminder style wrote it, and the time. We use reports to review and improve AI-written text. A report is kept until you delete your account, and is deleted with it.

Voice input. In the iOS app (including Siri and Apple Watch), your speech is turned into text by Apple’s speech recognition. Where your device supports it, this happens on-device; otherwise Apple may process the audio on its servers, under Apple’s own privacy terms. On the web, voice input uses your browser’s built-in speech service, which may send the audio to your browser’s maker under its own terms. In every case, OhRight never receives or stores the audio itself: only the resulting text is sent to us, and we handle it exactly like typed input (including sending it to Anthropic for parsing, as described above).

1.5 iOS App and Apple Watch

Device calendars: If you give the iOS app calendar access, it reads your device calendars on your device to show them alongside your tasks and to warn you about conflicts. That calendar data stays on your device and is not uploaded to us. You can turn calendar access off at any time in your device’s Settings.
Notifications: We store a push-notification token for your device so we can send you reminders.
Hide details on lock screen: If you turn on Hide details on lock screen in Settings, your reminders show a general message (for example, “You have a reminder. Tap to see it.”) instead of the task, and the task’s name and details are left out of the notification, including what we send through Apple and Expo to deliver it. You see the details when you open the app.
Apple Watch: If you use the Apple Watch companion, your phone shares your sign-in with your watch so the watch can show your tasks.

1.6 You Choose What You Enter; Sensitive Information

You choose what you enter. OhRight! does not ask for health, medical, or other sensitive information and is not designed to collect it. Some tasks you choose to enter may describe personal matters (for example, “refill prescription” or “pay credit card”). We use that text only to provide the Service to you, as described in this Policy, including, if you allow AI, sending it to Anthropic as described in Section 1.4. We do not sell it, use it for advertising, or use it to infer anything about your health. Please don’t enter information you don’t want processed this way, such as detailed medical information, account numbers, or government ID numbers. You can edit or delete any task at any time, or delete your account.

Not medical, not for emergencies. OhRight! is a general-purpose reminder tool. It is not a medical device, does not give medical advice, and does not diagnose, treat, or manage any condition. Do not rely on it for emergencies or for anything where a missed reminder could put someone’s health or safety at risk. In an emergency, call 911 or your local emergency number.

2. How We Use Your Information

We use the information we collect to:

Provide the Service: Create and manage your account, store and display your obligations and calendar events, process AI-powered input parsing, and enforce subscription tier limits.
Process payments: Manage Pro subscriptions via Stripe.
Communicate with you: Send reminders by push notification, email briefings you turn on, and transactional emails (account verification, password resets, subscription and account notices), and, if you have not opted out, occasional marketing email.
Improve the Service: Analyze usage patterns to identify bugs, improve features, and optimize performance.
Ensure security: Detect and prevent fraud, abuse, and unauthorized access.
Comply with legal obligations: Respond to legal requests and enforce our Terms of Service.

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

Service providers: We share data with third-party providers who help us operate the Service:
- Supabase: Hosts our database and authentication system. Your account data and obligations are stored on Supabase infrastructure.
- Vercel: Hosts our application. Server logs may contain IP addresses and request data.
- Anthropic: If you allow AI, parses what you type or say into tasks and writes reminder text via the Claude API, as described in Section 1.4. Anthropic’s handling of API data is described in its own policies at https://www.anthropic.com/legal.
- Stripe: Processes payments for Pro subscriptions bought on the web. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy.
- Apple: Handles App Store purchases and subscription status, delivers push notifications (Apple Push Notification service), and may provide speech recognition for voice input, as described in Section 1.4.
- Expo: Delivers push notifications to the iOS app (it receives your device’s push token and the reminder title and text) and delivers iOS app updates.
- Resend: Sends our emails, such as sign-up confirmations, password resets, email briefings, subscription and account notices, and marketing email if you have not opted out. It receives your email address and the message.
- Google: Sign-in with Google is not currently offered. If we offer it, Google’s handling of your data will be governed by Google’s Privacy Policy.
Legal requirements: We may disclose your information if required by law, subpoena, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice before your information becomes subject to a different privacy policy.

4. Data Retention

Account data: Retained for as long as your account is active.
Usage logs: Retained for 24 months from the date they are produced. After account deletion, usage_logs entries tied to your account are anonymized — your user_id is removed (set NULL). Aggregate analytics may continue to use the anonymized records during the 24-month window. (A scheduled purge job is planned for a future release.)
Consent records: Retained for the life of your account plus 24 months after deletion, as required for legal compliance. This includes the record of your AI choices.
Reports of AI-written notes: Retained until you delete your account.
Inactive accounts: Accounts with no login activity for 12 or more months may be deleted after 30 days’ notice to your registered email address.

4.1 Account deletion and data we retain afterward

When you delete your account from Account Settings → Danger Zone → Delete Account (in the iOS app: Settings → Delete Account), the deletion happens immediately. This is a hard delete, not a 30-day grace period. If you cannot access your account, you may instead email us at info@ohright.ai as a fallback, and we will delete your account within 30 days. Deleting your account does not cancel an App Store subscription; cancel that in your Apple ID settings.

What deletion removes immediately: your account and login, tasks and notes, categories, recurrence rules, calendar sources and imported calendar events, notification settings and push tokens, your reminder history (including AI-written reminder text and our records of AI generations), and reports you made about AI-written notes.

What we keep after deletion, and why:

Former-user record. We retain a minimal record of your former email in a “former_users” table (with your country, sign-up and deletion dates, and marketing preference) so we can recognize you if you sign up again, determine eligibility for promotional offers, and honor your marketing preferences. The internal row_inserted_at field tracks when this row was first created. We retain this record on a legitimate-interest basis (GDPR Article 6(1)(f)) until you request its erasure or we no longer have a legitimate purpose for retaining it.
Consent records. Your records of accepting the Terms and this Policy, and of your AI choices, are kept for 24 months after deletion, as proof of consent.
Anonymized usage logs. Your user ID is removed (see Section 4).
Purchase records. App Store transaction records, with your user ID removed, are kept as long as needed for tax, accounting, and fraud-prevention purposes. Stripe keeps its own payment records for web purchases under Stripe’s privacy policy.
Privacy-request records. If you contacted us through /contact-privacy, we keep that request (your email, message, date, IP address, and how we resolved it) as a compliance record.
Backups. Deleted data can remain in our database provider’s encrypted backups for a limited period, until those backups are overwritten. We do not restore deleted accounts from backups.
Service-provider logs. Our hosting, email, push, and AI providers may keep short-term logs under their own terms (see Section 3).

In the rare event that the deletion partially fails (your authentication row is removed but your application data is not), our administrator is alerted automatically and remediates the partial state within seven (7) days using a documented runbook.

4.2 Erasure of post-deletion records (GDPR Article 17 / CCPA right to delete)

You may request that we erase the post-deletion record we keep (the “former_users” row, including your email and unsubscribe token). Submit your request via the /contact-privacy form. We will respond within 30 days at the email you provide. We do not rely on a public support@ohright.ai inbox for this purpose; the form creates a durable record for our compliance log.

4.3 Marketing communications and country defaults

We use Vercel’s x-vercel-ip-country header (an IP-derived country estimate) to determine the default marketing-email setting at signup. Users in the United States are opted in by default, consistent with the opt-out model under the U.S. CAN-SPAM Act (15 U.S.C. § 7701 et seq.). Users outside the United States are opted out by default; we will not send you marketing email unless you affirmatively opt in. This aligns with the stricter consent regimes in other jurisdictions — including Canada (CASL), the EU and UK (GDPR & ePrivacy) — which require express consent before sending commercial electronic messages. You can change this preference at any time. Every marketing email contains an unsubscribe link; if you lose the link, request a new one at /u/resend. As required by the CAN-SPAM Act, every marketing email will also include OhRight, LLC’s valid physical postal address: 418 Broadway Ste R, Albany, NY 12207.

5. Data Security

We implement industry-standard security measures to protect your information, including:

Encryption in transit (TLS/HTTPS) for all data transmitted between your browser and our servers
Encryption at rest for database storage (provided by Supabase)
Row Level Security (RLS) policies ensuring users can only access their own data
Password hashing using bcrypt (handled by Supabase Auth)
Server-side API keys and secrets are never exposed to client browsers

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

In the event of a data breach affecting your personal information, we will notify affected users and applicable regulators as required by law, including the New York SHIELD Act.

6. Your Rights and Choices

6.1 All Users

Access: You can view your obligations, calendar data, and account information at any time through the Service.
Correction: You can edit your tasks at any time and update your nickname and password through Account Settings. For anything else, contact us via /contact-privacy.
Deletion: You can permanently delete your account and your data from Account Settings → Danger Zone → Delete Account (in the iOS app: Settings → Delete Account), except for the limited records described in Section 4.1. The deletion is immediate; there is no 30-day grace period. If you cannot access your account, you may instead email us at info@ohright.ai as a fallback, and we will delete your account within 30 days. To erase the post-deletion record we keep (your former_users row), submit a request via /contact-privacy.
Data export: You can request a copy of your data in a machine-readable format (JSON) via /contact-privacy. Export requests are fulfilled on request within 30 days. Because account deletion permanently and immediately removes your data (see Section 4.1), export requests must be submitted while your account is active — we cannot produce an export of data that has already been deleted.

6.2 US State Privacy Rights (including California)

Depending on where you live (for example, California, Virginia, Colorado, Connecticut, Texas, or Oregon), and to the extent a state privacy law applies to us, you may have the right to:

Access / know: Request the categories and specific pieces of personal information we hold about you, and get a portable copy.
Correct: Ask us to correct inaccurate personal information.
Delete: Ask us to delete your personal information, subject to the exceptions described in Section 4.1.
Opt out: Opt out of the sale or sharing of personal information, targeted advertising, or profiling. We do none of these.
Appeal: If we decline your request, you can appeal by replying to our decision. If we deny your appeal, you may contact your state Attorney General.
Non-discrimination: We will not discriminate against you for exercising these rights.

Do Not Sell or Share My Personal Information: OhRight! does not sell or share personal information for cross-context behavioral advertising, and does not use personal information for targeted advertising.

Categories we collect: identifiers (email, nickname, IP address, device push token); account, consent, and purchase records; the tasks, notes, and other text you enter; reminder text; and usage activity. Sources, purposes, and retention are described in Sections 1 through 4.

To exercise these rights, submit a request via /contact-privacy. We will verify your identity before processing your request and respond within 45 days. An authorized agent may submit a request on your behalf with your written permission.

6.3 European Economic Area Residents (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

Legal basis: We process your data based on: contract performance (to provide the Service), legitimate interest (analytics, security), and consent (where applicable, including sending your content to Anthropic for AI features, which you can withdraw at any time by turning off Use AI in Settings).
Right to access: Request a copy of your personal data.
Right to rectification: Request correction of inaccurate data.
Right to erasure (GDPR Article 17): Request deletion of your data (“right to be forgotten”). Use the /contact-privacy form for post-deletion record erasure requests.
Right to data portability: Receive your data in a structured, machine-readable format.
Right to restrict processing: Request that we limit how we use your data.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Right to lodge a complaint: You have the right to file a complaint with your local data protection authority.

International transfers: Your data is stored and processed in the United States. By using the Service, you consent to the transfer of your data to the US. We rely on our agreements with our service providers, including their data-protection terms, to safeguard international data transfers.

7. Children’s Privacy

The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@ohright.ai, and we will promptly delete such information.

8. Cookies and Tracking Technologies

We use only essential cookies required for authentication and session management. We do not use:

Advertising or marketing cookies
Third-party tracking pixels
Cross-site tracking technologies

Our hosting provider (Vercel) may collect standard server analytics (page views, response times) in aggregate form that does not identify individual users.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or by prominent notice within the Service at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes acceptance of the changes.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

OhRight, LLC
418 Broadway Ste R, Albany, NY 12207
Email: info@ohright.ai