Privacy Policy

OpenAlly™ is a mobile-first AI platform for Android, iPhone, and Mac. Its conversations and most working data are kept on the device you are using. When you choose an external AI service, messaging service, search service, or other integration, that service receives the information needed for the action you requested. If you choose OpenAlly cloud AI, the OpenAlly service processes the information needed for that AI request. When you connect WhatsApp Business, a dedicated OpenAlly service also processes the connection and temporary message delivery described below. YouTube channel management uses a separate cloud service for authorization, publication records, reply rules, performance reports and owner-approved analysis. Connecting Gmail also uses a dedicated cloud service for encrypted credentials, cached correspondence and the inbox controls described under Connected Accounts, including on Free or BYOK.

Almost everything you do in OpenAlly stays on your device, including Health records, medicines, and authorized health-store copies, which live in an encrypted vault on the device. A few things do leave it: your account, crash diagnostics, usage analytics on Android (never Health screens), a push-notification registration, the notes you write in the Notes app, and whatever you send to the model provider, channels, or tools you connect. A request also reaches the OpenAlly service when OpenAlly cloud AI is the model you select. WhatsApp Business uses a dedicated delivery service even though its agent runs on your designated device. The YouTube service retains the specific channel and analysis records described below; complete original videos still upload directly to YouTube. The Gmail service retains the connected inbox records described below, and authorized mail reaches your chosen model only with separate processing consent. Health facts reach a cloud model only if you turn that on. This page walks through each one, plainly, so there are no surprises.

Which platforms this covers. This policy covers the Android, iOS, and macOS/desktop builds of OpenAlly. One difference matters for privacy and we call it out where it applies: the usage analytics described below ship only in the Android build. The iOS build sends no usage analytics, and neither does the desktop app.

Who's responsible. This app and this policy are operated by Matterward Labs, the data controller for your personal information. You can reach us anytime at support@openally.ai.

The app-service data flows. These are the recurring signals the app sends to us or processors we use. Requests you direct to a chosen model, messaging service, search provider, or other integration are covered separately below:

• crash diagnostics;
• usage analytics on Android, limited to categorical information, covered in the next section;
• a push-notification registration for your install (Google's Firebase Cloud Messaging), covered below; and
• your account record (email, display name, plan) and the settings that follow you to a new device, covered below;
• the relevant model request, only if you select OpenAlly cloud AI.
• the notes you write in the Notes app: the title, the text, the tags and whether you pinned it, stored in your account so the same notes appear on your other devices. Covered below.

Each is described in the sections below. OpenAlly stores your conversations, business records, Health vault, and local feature data such as SMS Analyser, Voice Notes, automations, and connections on your device. When you use your own AI or integration account, the service you choose receives the information needed for that request; we do not receive or store it. OpenAlly cloud AI is a separate option processed by the OpenAlly service. Health is described in its own section because Play and privacy law treat it as sensitive, even when it never reaches us.

Crash reports. When the app crashes, OpenAlly sends a diagnostic report to Google so we can find and fix the problem. A report includes your device model, OS version, app version, a random installation identifier, and technical details about the error. It does not include your conversations or message content, and we don't use it to identify you personally, but a random installation ID and crash data are still considered personal data under some laws, so we count it here. This data is processed by Google as our processor; crash reporting is enabled as part of using the app under our Terms, and you can turn off Google-level crash and usage sharing in your device settings. You can read more in Google's privacy policy.

We do measure how the app is used on Android. The Android build of OpenAlly includes Google's usage analytics. We use it to see which features people use and where they encounter problems. The iOS and desktop builds do not send usage analytics.

What we measure. The fixed categories are:

• screens and features you open;
• broad actions such as starting a conversation, sending a request, changing an agent or AI service, or connecting an integration;
• whether a request included an attachment, without the attachment itself;
• setup milestones and changes to permissions you control; and
• general app-readiness and error status.

What this information never carries. We limit analytics to fixed categories rather than names or text you provide. It never carries message content, prompts, model responses, chat or session titles, contact names, phone numbers, SMS, file contents, URLs, API keys, Health readings, medicine names, or anything else you typed or received. Use of Health screens, Health features, and Health permissions is not recorded at all.

Who this information is attached to. Google gives your installation a random identifier. If you are signed in, we also link the analytics to your OpenAlly account identifier, the same account identifier behind your profile, so activity across your devices lines up. Said plainly: while you are signed in, your analytics identifier is your account identifier, and this analytics data is not anonymous. Signed out, it is tied only to the random installation identifier. We also record broad account, setup, app-readiness, and preference categories. These do not contain text you supplied.

Turning it off. Analytics collection is enabled in the Android release build. You can turn it off in the app under Settings → Privacy & data. That takes effect immediately. You can also email support@openally.ai and we will disable analytics collection for your account and erase the analytics data already held against it. Uninstalling the app also ends collection. Where the law requires your consent before we may store an identifier on your device or process this data at all, we will not treat you as having given it merely because you kept using the app.

OpenAlly sends push notifications through Google's Firebase Cloud Messaging, for example when someone signs in to your account, or when a feature request or support ticket you raised changes status. Google acts as our processor for this. On iPhone and iPad, Google hands each notification to Apple's push service, which delivers it to your device. From time to time we also send an announcement to every installation that allows notifications, or to those on one platform or using one app language.

What Google receives. When the app starts, Google's Firebase software in the app gives this installation a random identifier and registers it with Google, with basic technical details such as the app and operating-system versions. Google uses that identifier to address a notification. With each notification it receives a short title and text and the identifiers the app needs to open the right screen, never the content of your conversations or messages. On iPhone and iPad, Google also holds the address Apple's push service gives your device, so it can pass the notification on. While notifications are allowed, the app also joins announcement groups for everyone, for your platform and for your app language, so Google knows which of those groups the installation is in.

We do not give Google your account. Push delivery does not send Google your OpenAlly account identifier. Which installation belongs to which account is known only to us. Usage analytics on Android is separate and is described above.

What we keep. When you sign in, our servers record that this installation belongs to your account. The record also holds which sign-in it belongs to, the platform, a device model label, the app version, the country, language and time zone your device reports, and whether notifications are allowed. We use it to send your notifications to your devices and nobody else's, to avoid notifying the device where you just did something, to name the device in sign-in alerts and in your list of signed-in devices, and to count how many devices can receive notifications. We keep your language and time zone so notifications can be written in your language and announcements timed for where you are. We also keep a record of each notification we send you: what kind it was, when we sent it, whether it reached each of your installations, and whether you opened it.

How long. We delete an installation's record when you sign out on that device or delete your account. We also delete it when Google tells us the installation can no longer be reached (for example, after you uninstall the app), and otherwise once that installation has not checked in with us for 90 days. The app checks in when you open it. The record of each notification we sent is kept for 90 days.

Older versions of the app. Versions of the app released before this change used OneSignal to deliver notifications. Until you update, such a version still contains OneSignal's software, which registers the installation with OneSignal, with basic device and app information and, while you are signed in, your OpenAlly account identifier. We no longer send any notification through OneSignal, and updating the app removes its software. To have a record OneSignal holds about you removed, email us at the address below. OneSignal's own handling is described in its privacy policy.

Your control. Nothing is shown unless you allow notifications in your device settings, and you can turn them off there at any time. To have our records of all your installations deleted, email support@openally.ai, or delete your account. Google's own handling is described in Google's privacy policy.

You need an OpenAlly account to use the app, and signing in is part of setup. You can sign in with a one-time code sent to your email, with WhatsApp, with a passkey you added in Settings, or with Google, Apple (on iOS), Facebook, GitHub, Discord, LinkedIn, X, or Spotify. The information that keeps you signed in is protected by your device's credential safeguards.

Our servers keep your account record: your email, display name, and subscription plan. They also keep the settings that follow you when you sign in on another device: your assistant's name, look, and tone, your language and country, the AI model you chose and how each AI provider is set up, and your workspace names and display preferences. API keys, sign-in tokens, and other credentials are never part of this; a new device asks for them again. Your conversations, messages, and business records are not stored in your account. The notes you write in the Notes app are, as described above. Connected Gmail and YouTube records are kept in their separate services, not in these synced account settings.

If you sign in with WhatsApp, you send a sign-in message from your own WhatsApp to OpenAlly Miro, our WhatsApp agent. That links your WhatsApp number to your account so the same number can sign you in again, and the message travels through Meta like any WhatsApp message.

Signing in also authorizes optional downloads for on-device AI and voice features. The SMS, audio, and other content on your device is never uploaded when you request one. You can delete your account and server-side profile in the app, or via our data deletion request page. Deleting your account also removes its synced settings and the WhatsApp number linked to it.

You choose where each AI request is handled. You can keep it on your device, use an AI service with your own provider key or existing subscription, use a service you host yourself, or select OpenAlly cloud AI. For an external service you connect, that service receives the prompt, conversation context, and images you chose for the request under its own privacy terms; OpenAlly does not receive or store that request. If a Health question is involved, see the Health section: Health facts are not sent unless you turn on remote-model access. Gmail content requires separate inbox model-processing consent; its connection and cached mail are handled by the Gmail service even when the model request goes directly to an external provider.

OpenAlly cloud AI. When you select it, the OpenAlly service and its disclosed AI-processing provider receive the content you chose for the request. We keep service usage totals and information needed to keep the service reliable and prevent abuse. Those metering records do not contain prompt or response text. YouTube workflows separately retain generated reply drafts, imported or transcribed text and analysis summaries so you can review delivery and resume analysis. Gmail separately retains cached mail, drafts and approval/delivery records needed for its email features. The recipient, purpose and retention are listed below.

What our AI-processing provider commits to. OpenAlly cloud AI runs on Cloudflare Workers AI. Cloudflare states, on its Workers AI data-usage page:

“You own, and are responsible for, all of your Customer Content.”

“Cloudflare does not make your Customer Content available to any other Cloudflare customer.”

“Cloudflare does not use your Customer Content to (1) train any AI models made available on Workers AI or (2) improve any Cloudflare or third-party services, and would not do so unless we received your explicit consent.”

“Your Customer Content for Workers AI may be stored by Cloudflare if you specifically use a storage service (e.g., R2, KV, DO, Vectorize, etc.) in conjunction with Workers AI.”

These are Cloudflare’s words about its own service, quoted so you can hold them to it, and they are not a promise we make on their behalf. They say nothing about the AI services you connect yourself, which are governed by their own terms.

Connecting your own service. The app identifies the service before you connect it. You may enter a provider key, sign in to a supported subscription on that provider's page, or supply an address you control. The information that authorizes future requests is protected by your device's credential safeguards and is not uploaded to us.

Separately from the AI providers above, you can connect an account you already own on another service so the assistant can act on it for you, an Instagram professional account, for example. A model provider receives your prompts, whereas a connected account is something the assistant acts on, using access you granted.

What connecting does. You sign in on that platform's own page, never inside OpenAlly, and never by typing that account's password into our app, and choose which permissions to grant. The credential for a direct device connection is protected by your device's credential safeguards. It is not retained by us, included in backups, or synced between your devices. Gmail and YouTube use the separate cloud authorization described below; connecting Gmail is independent of Google sign-in to OpenAlly and Google Drive backup.

When our service is involved. Some platforms require an OpenAlly service to complete the account connection. The temporary sign-in information for a direct device connection is not retained. Gmail and YouTube use their own authorization and connection records. If you publish a post with an image, we may also hold the image briefly so the platform can retrieve it. It is not listed or browsable and is deleted after publishing, and in every case within one day. YouTube thumbnail bytes in an approved publication record can remain until that record expires, within 30 days of its creation.

What the assistant may do with a connected social account, and what it may never do. It can act only on the account you connected. Anything published goes out because you approved that specific thing, or because you armed a rule that says exactly what to reply and to whom, and a rule can be disarmed at any time. When someone comments on your post or messages your account, the assistant can reply to that person about that interaction. It cannot start a conversation with someone who did not contact you first, cannot message your followers, cannot browse or export your audience, and cannot post because a comment or a message told it to.

Your account's own numbers. If you grant that permission, the assistant can also read the connected account's own audience metrics (reach, follower counts, and how individual posts performed) to show them to you in the app and to answer questions about them. These are the aggregate figures the platform already shows you about your own account, not information about the individual people behind them. For direct device connections they are read when you open that screen, stay on your device and are not sent to us. YouTube reports also synchronize in the cloud, including while your devices are offline. Granting this is optional: decline it and everything else still works, minus those screens.

Other people's data. Answering a comment or a message means handling something a third party wrote. That content is handled on your device for a direct device connection. If you use an external or cloud AI service for that reply, the relevant content is also sent to that service under the choices described above; if you use local AI, it stays on the device. We do not store direct-connection correspondence on our servers. YouTube cloud replies and connected Gmail correspondence have the separate handling and retained records described below. We do not use this correspondence to train models.

Gmail inboxes. Gmail uses a dedicated Google authorization flow, separate from signing in to OpenAlly or backing up to Drive. You consent on Google's page, then confirm the verified inbox and its agent assignment in OpenAlly. Initial access is for reading; drafting, sending or organizing mail may need additional Google authorization. We do not ask for your Google password. Our dedicated Gmail service, hosted on Cloudflare, keeps encrypted Google credentials and Gmail-derived records, including cached messages and attachments, draft and delivery records, inbox rules, writing preferences, agent permissions and synchronization state. We use these to provide the Email features you authorize and reconcile changes made in Gmail.

Each inbox has its own agent permissions for reading, drafting, sending and managing labels, stars and mailbox state. Google permission alone does not authorize an agent to use every operation. An owner-confirmed assignment starts with reading and drafting enabled; sending and label management start disabled. Mail enters an AI task only with explicit model-processing consent and current inbox access. The authorized content needed for that task reaches the model you choose, which may be on your device, an external provider you connect, or OpenAlly cloud AI. Google credentials are not sent to the model. Review that provider's data-use terms before enabling processing.

On Free and BYOK, the assigned agent runs on your device; background work depends on the device and operating system. Optional continuous cloud monitoring requires Premium, a Premium-backed lead agent and your monitoring approval. It uses your Premium token allowance and the spending controls shared with other unattended work. A plan lapse, exhausted allowance or invalid assignment pauses cloud work. Connecting Gmail does not require Premium. Cloud monitoring, automatic sending or labeling, urgent alerts and learning from Sent mail all start disabled. When enabled, Sent-mail learning uses up to 40 Sent messages to prepare private, editable writing preferences, rather than train a general-purpose model.

If you request work-contact suggestions, we read relevant correspondent names and email addresses. You select OpenAlly Contacts or a specific Business CRM, review duplicates and approve the import. Duplicate checks use the selected destination; approved imports become records there, with their own deletion controls. Importing a contact does not grant trust, agent access or a messaging connection. Disconnecting Gmail does not erase contact records you chose to import.

OpenAlly's use and transfer of information received from Gmail follows the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. We use it for the email features you authorize, not advertising, sale of data or generalized AI model training. Transfers to a selected model are limited to the authorized email task and require your consent. Operational logs do not contain mail bodies, attachments, addresses or Google tokens. Email attention pushes carry generic copy and opaque identifiers; the app fetches details after checking your current inbox access.

Gmail credentials and active feature records remain while the inbox is connected, until you remove the records or disconnect; there is no general fixed expiry for cached mail and delivery records. Disconnect stops new automatic work and removes active cached content, jobs, rules, approvals and delivery records. Account deletion starts the same service cleanup. We also request Gmail watch shutdown and revoke Google access. If revocation cannot be confirmed, minimal encrypted credentials remain solely for retry until revocation is confirmed; there is no fixed completion deadline for that retry. Offline device copies, exports and hosting recovery copies have separate deletion controls or retention. Removing OpenAlly's records does not delete your original messages, drafts, labels or sent mail in Gmail.

Disconnect an inbox in Email, or revoke access directly at Google's permissions page. Revoking at Google prevents further authorized access; disconnect in OpenAlly or send a deletion request to remove our stored records without waiting for another access check. Read Google's Privacy Policy for Google's handling, and our data deletion request page for OpenAlly's removal controls.

YouTube channel management. OpenAlly uses YouTube API Services. You sign in on Google's page and confirm the authorized channel inside OpenAlly; your Google email alone does not establish channel ownership. Our dedicated service, hosted on Cloudflare, keeps an encrypted Google refresh authorization, the connected channel's identifier and its account/workspace association, the access you give agents, and reply rules you save. These are cloud records, unlike a direct device connection. We do not ask for your Google password.

We access the connected channel's information, owned-video metadata and thumbnails, comments and reply identifiers, and raw channel/video performance information available through YouTube's Data, Analytics and Reporting APIs. We use it to manage the channel you connected, prepare publication changes, prevent duplicate replies and synchronize performance reports. Reports can be delayed or omit metrics. We retain publication drafts and approval/status records, reply drafts and delivery records, analytics/report caches and the approved analysis text described below. Cloud reports and activated reply rules can continue while every device is offline.

Publishing, metadata/thumbnail changes and individual replies require owner approval. Replies start as drafts. Automatic sending requires you to activate a rule for selected videos, and editing an active rule disarms it. A rule can use your static text or cloud AI. For an AI reply, the relevant comment and your reply guidance reach OpenAlly cloud AI and Cloudflare Workers AI; the generated reply is retained as a draft or delivery record. Static replies do not require AI inference. You control which agents may read or draft against each connected channel. Limits and credits can pause new work; a schedule already accepted by YouTube stays on YouTube.

Complete original videos upload from your device directly to YouTube, within OpenAlly's supported 2 GB limit, without OpenAlly cloud storage or relay. If you separately approve creator analysis after a credit estimate and spending budget, your device can send audio segments and sampled frames to OpenAlly cloud AI, currently processed by Cloudflare Workers AI, or you can supply a transcript. Imported text skips transcription. The YouTube service retains transcript text, intermediate summaries and analysis observations so that work can resume. It does not store the audio segments or sampled frames in its feature records; those inputs still reach the processing provider.

YouTube API-sourced records and linked transcripts, summaries, chat context, search and retained knowledge have source deadlines of at most 30 days; refreshing a source does not extend an older derived record. Unapproved publication drafts expire after 24 hours, and approved publication records expire within 30 days of original creation. Connection grants, owner-authored rules and agent-access controls remain while the connection exists. Usage counts and short duplicate-prevention records support limits and delivery. Shorter deletion-request deadlines take priority, as described under Data Retention & Deletion.

You can disconnect a YouTube channel in OpenAlly or revoke Google access at Google's permissions page. Disconnect stops new work for that connection, removes its active service records and starts revocation. An encrypted revocation request can remain for up to seven days while Google is unavailable; this does not guarantee that Google confirms revocation. Published videos/comments and schedules already accepted by YouTube remain there unless you separately change them. Original files and exports you keep have their own deletion controls. Read Google's Privacy Policy for Google's handling, and use our data deletion request page for OpenAlly's stored YouTube data.

Disconnecting. For a direct device connection, disconnecting removes the credential from your device and asks the platform to revoke OpenAlly's access. You can also revoke access from the platform's own settings at any time, without opening our app. That is the control that does not depend on us. Content already published stays published; it belongs to your account, and removing it is done where it lives.

The connected accounts available to you may vary by platform and app version. These privacy rules and any service-specific handling above apply to each one.

You can connect an assistant you already use to your OpenAlly account, so that it can act on your account from its own chat. ChatGPT is the assistant this works with today; each assistant's operator is named in the third-parties table below, and receives nothing until you connect that assistant. This is the mirror image of a connected account above: there, OpenAlly acts on a service you own; here, another service acts on OpenAlly, with access you granted. How it works and what it can do is described on the assistant connectors page.

What the assistant's operator receives. When the assistant makes a request on your behalf, our service receives the arguments of that request and returns a reply; the assistant's operator, named for each assistant in the third-parties table, receives that reply because it runs the assistant you are talking to. That is all it receives from us. It never receives your OpenAlly conversations, your credentials, your account email, or anything on your device the assistant did not ask for and you did not approve. What the operator does with its own chat is governed by its own privacy policy, not this one.

What we receive and store. A record of each connection: which assistant, what it may access, when it was connected and when it was last used. If you choose to approve a sign-in in the OpenAlly app rather than with an email code or password, a record of that request: the code the sign-in page showed you, the two decoys shown beside it on your phone, and which of your devices approved it. Signing in with an email code or password creates no such record, and the address you type there is used to find the account, not stored with the request. A record of each action an assistant asked your device to run, including the request and the result the device returned. That record is kept for 30 days from the moment the action was created and is then deleted, whether the action ran, was declined, or expired unanswered. Notes an assistant creates or edits are stored in your account like any other note, marked with the assistant's name. We do not receive the assistant's conversation, and we do not use anything an assistant sends or receives to train anything.

What you approve. Signing in happens in one place: the OpenAlly sign-in page the assistant sends you to. You can use a code we email to the account address, your existing account password, or approval in the OpenAlly app. Ordinary account passwords are sent to our authentication provider, Supabase. Dedicated store-review passwords for our sample account are verified by OpenAlly, which stores only their hashes. Neither kind is sent to the assistant. In every case the request names the assistant and lists what it will be able to access before you approve it. The assistant never signs you in inside its own chat, and it cannot produce a sign-in link of its own. Reading your account, devices, notes and tickets, and writing notes and tickets, then happens on your instruction in the chat. Anything that runs on your device, a prompt to the agent or a read of your business counts, runs automatically within the access you grant when connecting. Its outcome is recorded and you receive a notification. Some of these actions need an OpenAlly plan; without one the assistant says so and sells nothing.

Device action records. We record the requesting connection, the device session that claims the action, its status, timestamps and result. These records are kept for thirty days. A request can be claimed by only one signed-in device. The connection's access, account status and any required plan are checked before execution. OpenAlly must be available on the device; a queued request may expire without running.

Your control. In the app, under Profile, Security, every connected assistant is listed and can be disconnected. Disconnecting takes effect within seconds: the assistant's next request is refused, and any action it had already sent to your device is expired in the same moment, so a queued request cannot start after disconnecting. An action already running may have performed work before revocation; disconnecting does not undo it. You can also remove OpenAlly from the assistant's own settings. Deleting your account removes every connection and every record above.

Some on-device AI and voice features need an optional download from OpenAlly. You choose whether to request it, and a signed-in account is required to authorize the download. Only the requested supporting files are delivered. None of your prompts, audio, SMS, or other content is uploaded during this process.

When you ask OpenAlly to search the web or open a page, your query is sent to the search provider you've configured (DuckDuckGo by default, or Brave, Google Custom Search, or SerpAPI if you enable and set them up), and each visited site receives the requested address and ordinary connection information. These requests are subject to those providers' and sites' own policies. OpenAlly does not receive or store them.

If you use the in-app Feature Requests or What's New screens, your votes and any feature-request text you submit are stored on our servers. Please don't include personal or sensitive information there, since other users may see what you post.

A messaging service you connect, such as WhatsApp, Telegram, Discord, Slack, Signal, LINE, Google Chat, iMessage, Mattermost, Nextcloud Talk, Twitch, or Zalo, receives the messages sent and received through that account under its own privacy policy. Direct device connections handle messages on your device. WhatsApp Business uses the dedicated OpenAlly delivery service described next. If you ask an external or cloud AI service to help with a reply, the relevant message content is also sent to that AI service under the choices described above.

Credentials for direct device connections are protected by your device's credential safeguards. WhatsApp Business authorization grants are instead encrypted in the dedicated OpenAlly service so it can operate the connection.

If you connect WhatsApp Business, Meta and a dedicated OpenAlly service process your business correspondence. We keep encrypted Meta authorization grants and verified business, phone-number, workspace and designated-device mappings. Messages, attachments, customer numbers, selections and submitted forms pass through this service to operate the inbox you connected.

Temporary queued correspondence is encrypted and deleted after your device confirms durable receipt, or after seven days, whichever comes first. Pending outbound content is also encrypted and expires within seven days. Delivery identifiers, timestamps, consent, approval and cost-policy records support reliable delivery and prevent duplicate sends. Tokens and message bodies are excluded from our logs and usage analytics. Removal from the active service is not immediate removal from our hosting provider's database recovery history, which can cover the previous 30 days.

Your designated OpenAlly device keeps inbox history, notes, business records and agent activity. The agent runs on that device; the AI provider you select receives the context needed to generate its reply. If you enable eligible Business App coexistence, only history Meta makes available with your consent is imported. Importing history does not send fresh AI replies.

We process this correspondence to support the connected business's customer conversations and the actions its owner authorizes. The business is responsible for its customer notices, permissions and handling of customer requests. We do not use correspondence from this service for advertising or training a general AI model. Your selected AI provider's separate data terms still apply.

Disconnect a number from WhatsApp Business in OpenAlly to stop its connection. This does not delete your Meta business account, unrelated numbers, device history, or copies held by Meta or customers. To request deletion of service records, use Request Data Deletion and identify the affected business number. A customer can also contact the business directly about copies in its inbox. Delete device history and backups separately.

If you enable backup, your data is encrypted on your device before it is uploaded to the private OpenAlly area of your own Google Drive account. OpenAlly does not request access to the rest of your Drive. Your recovery code is created on your device, shown only to you, and never sent to us; without it, a backup cannot be opened, including by us.

Backups are not deleted when you uninstall the app. If you want them gone, remove them from your Google Drive yourself.

Health is not in the backup. Health Connect and Apple Health copies, and the Health vault itself, are excluded from backups. Turning backup on does not upload your Health records.

OpenAlly includes an optional Health app: a local records-and-medicines store, not a clinical product. It is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Use it to organise facts you already have. For medical advice, diagnosis, or treatment, consult a qualified clinician. OpenAlly is an AI agent platform; Health exists so your assistant can answer from records you keep on this device, not so we can run a health service in the cloud.

What Health accesses, and only with your say-so. On Android, Health can read from Health Connect the categories you allow:

• steps;
• heart rate;
• sleep;
• weight;
• distance;
• active calories burned;
• exercise / workouts.

Those permissions are read-only. OpenAlly never writes to Health Connect. You can skip Health Connect entirely and enter measurements and medicines yourself. On iOS, the same read-only pattern uses Apple Health after you grant it. You can also import a prescription or lab report you choose: camera or files, for on-device review before it enters the vault.

Where it is stored. Accepted Health records live in an encrypted vault on your device, not on our servers. We do not sell Health data, use it for advertising, credit, insurance, employment, or unrelated profiling, or train our own models on it. Uninstalling the app deletes the local vault. It does not delete the originals in Health Connect or Apple Health. In the app, Health → Privacy lets you disconnect a source and delete the OpenAlly copy.

When it can leave the device. By default it does not. Your assistant can read granted Health categories on the device. A cloud model sees Health facts only if you turn on Remote model under Health → Privacy and then ask a Health question. That send is purpose-bound to the turn you approved. OpenAlly still does not receive a copy. The provider you chose processes that projection under its own terms; we cannot promise they will delete it. Turn Remote model off to revoke future sends. Health notifications on the lock screen are generic. They never include a medicine name, dose, or reading.

What we never do with Health data. No advertising, data brokerage, insurance or employment eligibility, public sharing, or Health Connect access in a child-directed product. Crash reports and usage analytics are not allowed to carry Health values; Health screens and Health skill grants are excluded from analytics entirely.

OpenAlly requests device permissions only when needed for features you choose to use:

You can keep the following work on your device, without sending its content to us or an external service:

• AI tasks you choose to run locally;
• voice-note transcription;
• SMS safety analysis through the separate Aster companion;
• search across knowledge you keep in OpenAlly;
• image preparation, including resizing, conversion, and removal of hidden photo details;
• spoken playback using your device's built-in voices; and
• Health record organisation, read-only Health Connect / Apple Health imports, medicine reminders, and document imports.

Your conversations, SMS Analyser data, Voice Notes, automations, connections, and Health vault are kept on your device. The Notes app is the exception and is deliberately different: it is the one feature built to follow you across devices, so a signed-in account keeps a copy of those notes.

We never see your card. Payment is taken by a payment processor, not by OpenAlly. On Android that is Google Play Billing; outside an app store, mainly in India, it is Razorpay. Your card number, UPI ID and banking credentials go to them under their own privacy policies and never reach us.

What they tell us. Google Play sends a purchase token for the transaction, the product bought, an order identifier and the storefront country. Razorpay sends the subscription or payment-link identifier, the amount, the currency and whether the payment succeeded. We store the purchase token only as a one-way fingerprint, never the token itself.

What we keep. The plan you are on and the dates of the period you paid for, the amount and currency charged, the billing country, your numbered receipts, and usage totals for the AI included with your plan so that your allowance and credits can be counted. The billing country tells us which price list applied to your purchase and is kept as part of the payment record; we do not use it to calculate tax.

We do not charge tax and we issue payment receipts, not tax invoices. Where a purchase goes through Google Play or the App Store, that store is the seller of record and handles any tax itself. A receipt from us records what you paid and is not a tax document.

Cancelling and deleting are different things. Deleting your OpenAlly account does not cancel a subscription. Cancel a Google Play or App Store subscription in that store, and a Razorpay subscription from the plan screen in OpenAlly (or email us and we will cancel it for you). See Request Data Deletion for how, and Refunds and Cancellations for what a cancellation returns.

OpenAlly keeps your conversations and working data on your device. When you use an AI provider or connected service, that service receives the information needed for the request. Direct device connections do not send those requests to us; WhatsApp Business and YouTube use dedicated services as described above. If you choose OpenAlly cloud AI, the OpenAlly service processes the relevant AI request. The recipients below are the parties that receive data for the purposes shown. Local conversations, SMS, and audio are not uploaded unless you choose to include them in an AI or integration request. The "category" column uses Google Play's collect / share wording so this page lines up with our Data Safety disclosures.

Sensitive credentials (API keys, channel tokens, your backup recovery code) are protected using your operating system's credential safeguards and encrypted storage. Gmail and YouTube cloud authorization grants and retained source records are encrypted in their dedicated services. Health records use a separate encrypted vault on your device. Optional backups are encrypted on your device before they leave it, using a recovery code shown only to you. OpenAlly does not hold that code and cannot open the backup. Health vault contents are not included in backups.

Most of your data, conversations, settings, credentials, session history, Health vault, lives on your device, and we keep it only until you delete it or uninstall the app. Uninstalling removes all local data, including Health. Backup data stored in your Google Drive is not removed when you uninstall; you'll need to delete it from Google Drive separately. Health Connect and Apple Health originals are not deleted when you uninstall OpenAlly or purge the Health vault.

How long we keep things:

• On-device data is kept until you delete it or uninstall the app.
• Connected Gmail credentials, cached mail and attachments, drafts, rules, permissions, synchronization and approval/delivery records remain until removed or disconnected. Disconnect or account deletion stops new work and starts removal of active service records. If Google revocation cannot be confirmed, minimal encrypted credentials remain only for retry until Google confirms revocation, without a fixed retry deadline. Offline devices, exports and hosting recovery copies have separate removal or retention; original Gmail messages and provider-side changes remain in Gmail. Uninstalling alone does not disconnect cloud monitoring.
• YouTube API data and linked analysis, transcript, summary, chat/search and knowledge records have source deadlines of no more than 30 days. Unapproved publication drafts expire after 24 hours; approved operation records and their thumbnails expire within 30 days of creation. Connection grants, owner-authored rules and access controls remain until removed or disconnected. A requested deletion, account deletion or in-app YouTube revocation has a shorter deadline: we remove associated YouTube service data as soon as possible and within seven calendar days. The general 90-day window below does not apply to that data.
• Revocation through Google's permissions settings is separate: associated YouTube API data must be removed within 30 calendar days. You can also disconnect in OpenAlly or send us a deletion request so cleanup does not depend on a later Google access check. Local derived copies are removed when the device next runs its authenticated synchronization or retention cleanup; a powered-off device cannot receive an immediate erasure instruction. Clear local OpenAlly data or uninstall on that device if you need physical removal while it is offline. Provider recovery history and processing logs can have separate retention; contact us about those copies rather than assuming active-record deletion instantly erases every recovery copy.
• WhatsApp Business temporary correspondence is deleted after device acknowledgement or within seven days; our hosting provider's database recovery history can keep copies for up to 30 days after that. Encrypted grants and connection/control records support the connected account; request deletion of service records through the deletion page. Device and Meta copies have separate deletion controls.
• Health vault data is kept on the device until you delete it from Health → Privacy, or uninstall. Health Connect / Apple Health originals stay where they are.
• Account data (email, display name, plan, synced settings, and a linked WhatsApp number) is kept on our account service until you delete your account or request deletion.
• Other server-side deletion requests are processed within about 90 days, with an email confirmation. YouTube data follows the shorter deadlines above; Gmail's in-app disconnect and account-deletion cleanup follow the controls and revocation limits described above.
• Billing records, the plan, the period dates, the amount and currency charged, the billing country and the fingerprint of the purchase token, are kept for as long as the law requires us to keep accounting records, and then deleted.
• Receipts are kept for the same period, for the same reason. A receipt is a record of a payment that was really made, so it is one of the few things a deletion request does not erase; it is retained under our legal obligation to keep it and is not used for anything else.
• AI usage totals, the counts that meter your plan’s allowance and any credits, are kept while the period they belong to is open and for a short window after it closes so that a dispute can be answered, then deleted. They are counts, never prompt or response text.
• An assistant connection is kept until you disconnect it in the app or delete your account. Records of actions an assistant asked your device to run, including the request and the result, are kept for 30 days, then deleted. A sign-in request you approve in the app expires after 15 minutes and its record is deleted about a week later. Notes made through an assistant are your notes, kept until you delete them, with a deletion marker kept for 30 days so your devices can sync the deletion.
• Crash data is kept by Google under its own policies.
• Analytics events are held by Google for the user-level retention window configured with Google, which is at most 14 months from your last activity, after which they expire automatically. Aggregate reports that cannot identify you or your device may be kept for longer.
• The record linking an installation to your account for push notifications is deleted when you sign out on that device, when you delete your account or ask us to remove it, or when Google tells us the installation can no longer be reached (for example, after you uninstall). Otherwise it is deleted once that installation has not checked in with us for 90 days. The record of each notification we sent you is kept for 90 days. Google keeps its own delivery records under its own policies. If you used a version of the app released before notifications moved to Google, OneSignal keeps the record that version created under its own policies until we remove it, which we do when you ask.

Analytics and push are inside the deletion promise. A deletion request covers them both. When you delete your account or use the data deletion request page, we delete the analytics data recorded against your account identifier and the push registrations linked to it, within the same ~90-day window and with the same email confirmation. Records of the notifications we sent you expire after 90 days in any case. Analytics recorded while you were signed out is tied only to a random per-install identifier, which we cannot match to you, tell us your install's identifier, or simply uninstall, and it expires on the schedule above.

To request deletion of any server-side data associated with your account, visit our data deletion request page.

You can delete your account in the app or via our data deletion request page. You can also ask to access, correct, or get a copy of the limited account data we hold by emailing support@openally.ai. Because your conversations, Health vault, and most of your data live only on your device, you control them directly, uninstalling removes everything local, though Drive backups have to be deleted separately. Health Connect and Apple Health originals are not ours to delete.

Analytics and notifications specifically. To turn off usage analytics, use Settings → Privacy & data in the app, or email us with "Analytics opt-out" in the subject and we will erase what we already hold. To stop push notifications, revoke the notification permission in your device settings. That takes effect immediately, and email us if you also want our records of your installations deleted. Neither choice degrades the app in any way.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws.

Analytics is not a sale or a share. The usage analytics described above are processed by Google as our service provider, for our own product purposes only. They are not used for cross-context behavioural advertising, not disclosed to any advertising network, and not exchanged for money or anything of value.

Your privacy rights. You can ask us for help with a privacy request by emailing support@openally.ai.

California residents also have the right to know, delete, and correct their personal information, and the right not to be treated differently for exercising these rights. Health records on your device are sensitive personal information under CPRA. We collect them only on the device, for the Health features you use, and we do not sell or share them for advertising.

If you're in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, and port your personal data, and to object to its processing. You can withdraw consent at any time, and you can lodge a complaint with your local data protection authority. To exercise any of these, email support@openally.ai.

Our legal bases (Article 6 GDPR):

• your consent (Art. 6(1)(a)), for usage analytics, for push notifications, and for crash reporting where consent is required;
• performance of a contract, or steps taken at your request (Art. 6(1)(b)), to provide the app and your account; and
• our legitimate interests (Art. 6(1)(f)), app stability, security, and fraud prevention. We do not rely on legitimate interests for analytics.

Health data (Article 9 GDPR). Health records are a special category of personal data. We process them only with your explicit consent: you set up Health, you grant Health Connect or Apple Health categories (or enter records yourself), and a cloud model sees Health facts only if you separately turn on Remote model. You can withdraw that consent by disconnecting the source, turning Remote model off, deleting the vault, or uninstalling. OpenAlly is not a covered entity under HIPAA; encryption on the device is not a HIPAA certification.

Consent for the identifier itself (ePrivacy). Storing or reading an analytics identifier on your device is regulated separately from the question of a lawful basis: under Article 5(3) of the ePrivacy Directive (and the national laws implementing it), it needs your consent unless it is strictly necessary to deliver a service you asked for. The analytics identifier described above is not strictly necessary (the app works exactly the same without it), so we treat it as requiring consent in its own right, on top of the Article 6 basis. If you are in the EEA or UK and have not given that consent, email support@openally.ai and we will switch analytics off for your account and erase what was collected. The installation identifier used for push notifications is stored so that notifications can reach your device; if you never allow notifications, nothing is shown, and you can have our record of it deleted on the same request.

Withdrawing consent is as easy as giving it and costs you nothing, the app keeps working, in full, either way. Withdrawal takes effect going forward and, for analytics and push, we also erase what we already hold when you ask us to.

Matterward Labs Private Limited is incorporated in India, and if you are in India your personal data is handled under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). We are the Data Fiduciary; you are the Data Principal.

Consent, and only consent. The DPDP Act has no "legitimate interests" basis. Except for the narrow legitimate uses the Act itself lists, we may process your personal data only with your consent, and section 6 requires that consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data actually necessary for the stated purpose. So, for users in India:

• Usage analytics is opt-in. We ask, you choose, and we do not read "you kept using the app" as a yes. Bundling it into your acceptance of our Terms would not be valid consent, so we don't do that.
• Health is opt-in on the device. Setting up Health, granting Health Connect categories, and turning on Remote model are each a clear affirmative action. Refusing any of them still leaves the rest of OpenAlly working.
• Refusing costs you nothing. Consent cannot be conditioned on access, so every feature of OpenAlly works whether you say yes or no.
• Purpose is capped. We use the data only for the purpose we stated when asking, and only the data needed for it.

Withdrawal means erasure, not just "we'll stop". You can withdraw consent at any time, and it must be as easy as giving it. Under section 8(7), once you withdraw (or once the purpose is served) we must erase your personal data and cause our processors to erase it too, unless a law requires us to keep it. That is what we do: when you withdraw consent for analytics or push notifications and ask us to erase what we hold, we delete the analytics data and the push registrations linked to your account, not merely flip a switch to off.

Your rights. You have the right to a summary of the personal data we process and what we do with it, including the processors we share it with (s.11); the right to correction, completion, updating and erasure (s.12); the right to grievance redressal (s.13, below); and the right to nominate someone to exercise these rights if you die or become incapacitated (s.14). To use any of them, email support@openally.ai.

Children. Under section 9, anyone under 18 is a child for the purposes of the Act. We may not process a child's personal data without verifiable consent from a parent or lawful guardian, and we may not track a child, serve them targeted advertising, or otherwise monitor their behaviour, at all, and with no opt-in that could authorise it. See the Children section below for how that works in practice.

You can complain to the regulator. If our response to a grievance doesn't satisfy you, or we don't respond in time, you may complain to the Data Protection Board of India. Please raise it with us first through the process below, but this right is yours, and nothing on this page limits it.

If something about how we handle your data isn't right, we want to hear it from you before you hear it from anyone else. Section 13 of the DPDP Act requires us to publish a readily available means of grievance redressal, and this is it.

• Grievance Officer: the Data Protection Officer, Matterward Labs Private Limited
• Email: support@openally.ai, put "Grievance" in the subject line so it is routed correctly
• Acknowledgement: within 72 hours of receipt
• Resolution: within 30 days of receipt. If a matter genuinely needs longer, we'll tell you why and when to expect an answer

Please include enough detail for us to find you, the email address on your account, if you have one, and what you'd like us to do. Exercising your rights or raising a grievance is free, and we won't treat you differently for it.

If you are not satisfied with the outcome, or we miss the deadline above, you may complain to the Data Protection Board of India. Users in the EEA or UK may equally complain to their local supervisory authority.

Some of our processors, for example Google (Crashlytics, Analytics and Firebase Cloud Messaging), OneSignal (for older versions of the app only), our account and storage provider, Google/Gmail and Google/YouTube, Cloudflare for the Gmail and YouTube services, and the AI providers you choose, may handle data on servers outside your country, including in the United States. Where required, those transfers rely on appropriate safeguards, such as the EU Standard Contractual Clauses or the relevant provider's certification. Prompts you send to an AI provider are transferred under that provider's own terms and safeguards.

OpenAlly is not directed at children, and we do not knowingly collect personal information from them. Health Connect and Apple Health are not used in a child-directed product. Health is for an adult owner of the device. Where the age threshold sits depends on where you are, and we apply the higher one:

• India (DPDP Act, s.9): under 18. Anyone under 18 is a child under the Act. We will not process a child's personal data without verifiable consent from a parent or lawful guardian.
• EEA / UK: the age of digital consent set by your country, between 13 and 16.
• United States (COPPA): under 13.

No behavioural monitoring of children, ever. Section 9(3) of the DPDP Act prohibits tracking a child, behavioural monitoring of a child, and targeted advertising directed at a child. There is no consent that unlocks this, so we don't offer one: OpenAlly is not directed at children, and we do not knowingly use a child's data for analytics or a behavioural profile.

If you believe a child has provided personal data through the app, email support@openally.ai and we will erase it and the associated analytics and push records.

This policy is about the OpenAlly app. The website at openally.ai is informational, it doesn't set advertising or tracking cookies. It uses only essential local storage, such as remembering your light or dark theme preference.

In Google Play's Data Safety terms: crash diagnostics, app interactions and other app-performance data (the usage analytics above), the installation identifier used for push notifications, as a device or other ID, and your account email are collected. YouTube connection, publication, comment/reply and performance records, and the creator-analysis inputs and text you approve for cloud processing, are also collected. Connected Gmail credentials, cached messages and attachments, drafts and inbox-control records are collected; authorized mail sent to a selected model follows the processing disclosure above. Health and fitness data (steps, heart rate, sleep, weight, activity, medications, and records you enter or import) are collected on the device and are not sent to OpenAlly; and your conversations, SMS, audio, business records, and Health vault are not collected by us merely by being on your device; content you choose to include in an AI or integration request follows that service's disclosure. If you turn on Health remote-model access, the Health facts you approve for a turn are sent to the AI provider you chose, not to us. Data in transit is encrypted, and you can request deletion of everything held server-side.

If we update this privacy policy, we'll update the "Last updated" date at the top of this page and post the new version here. For material changes that affect how we use your personal data, we'll give you a more prominent heads-up, such as an in-app notice, and, where required, ask for your consent again. We encourage you to check back from time to time.

What changed in this version. The Gmail disclosure identifies dedicated Google authorization, encrypted service storage, per-inbox agent permissions and separate model-processing consent. It explains device processing, optional Premium monitoring and token use, defaults, Google Limited Use requirements and disconnect/deletion controls, including pending revocation and offline/recovery copies.

Other October 2026 changes. The YouTube disclosure now identifies cloud authorization grants, publication records, reply rules/drafts, performance synchronization and owner-approved creator analysis. It adds Google privacy and revocation links, source-retention and deletion controls, and a seven-day deadline for requested YouTube deletion or in-app revocation separate from the general service-request window.

Other October 2026 changes. Push notifications are now sent through Google's Firebase Cloud Messaging, and we no longer send any through OneSignal. With the current app, Google receives a random identifier for each installation, not your account, and the link between your installations and your account is kept only on our servers. A version of the app released before this change still contains OneSignal's software until you update it; the Push Notifications section says what that sends. The Push Notifications section, the recipients table, retention and international transfers describe the new arrangement, including what our record holds, the announcements we may send, and when each record is deleted. The India section no longer calls push notifications opt-in, because the app registers for them when it starts, and erasing what we hold for analytics or push now follows your request to erase it.

The September 2026 version. This update adds the Health section, Health Connect / Apple Health read-only access, the on-device vault, optional remote-model sends, deletion, and the matching Data Safety and permission disclosures. It also records that usage analytics can be turned off in Settings → Privacy & data, and that Health screens are excluded from analytics. An earlier version of this page said we collected no usage analytics; the Android build does, it did when that sentence was live, and correcting it is why a prior revision existed. Because Health is a material change, it gets an in-app disclosure before Health Connect access is requested, not a silent edit to this page.

It also corrects the Account & Sign-in section. An earlier version said an account was optional; the app requires one, and the section now lists every way to sign in, including WhatsApp, and the settings your account carries between devices.

It also corrects the Assistant Connectors section. An earlier version said an assistant started the sign-in and that email was the route for people with no phone to hand. Neither is true any more: an assistant cannot start a sign-in or produce a sign-in link, signing in happens only on the OpenAlly sign-in page, and the emailed code is the ordinary route, with an existing account password or approval in the app as alternatives. The records described there changed with it, so the retention entry for a sign-in request was corrected too.

Questions about this privacy policy? Reach us at support@openally.ai.

Matterward Labs

OpenAlly™ and the OpenAlly logo are trademarks of Matterward Labs Private Limited.