Privacy Policy

Version 1.2.0 · Last updated 12 September 2026 · Applies to iOS build 4 (version 1.0.0), Android versionCode 1788976366, and the current Web build. Bundle identifier ai.onspace.mylife. Contact contact@onspace.ai.

1. Who We Are

“MYLIFE AI ORGANIZER”, “MYLIFE”, “we”, “our” or “us” refers to the publisher of the MYLIFE AI ORGANIZER mobile and web applications distributed under the Apple bundle identifier ai.onspace.mylife and the Android package ai.onspace.mylife. Support and privacy contact: contact@onspace.ai.

2. Scope

This policy covers the mobile apps (iOS and Android) and the web build served from the same codebase. It does not cover unrelated third-party services (for example, your bank or your device operating system) even when you reach them from links inside the app.

3. Personal Data We Collect

Everything below is collected only from you: either because you type it in, because you upload it, because you tap an action that requires it, or because it is a minimum operational metadatum needed to keep the Service running securely. We do not enrich your profile with data purchased from third parties.

3.1 Account & identity data

• Email address — required to create your account, to send you sign-in codes and to contact you for security or legal reasons.
• Password — hashed by our authentication processor (Supabase / OnSpace Cloud). The app never receives your plaintext password after sign-in; we can neither read nor recover it.
• Optional profile fields — full name / username, avatar image, preferred language (en/ar), timezone, preferred currency. You enter these yourself in Profile. All are optional except email.
• Consent records — timestamped acceptance of Terms, Privacy Policy, Billing Terms, Refund Policy, Acceptable-Use Policy, and the AI Data-Sharing consent (v1.0.0). Version numbers are stored so we can prove which version you accepted.

3.2 Content you create in MYLIFE

• Documents — image (JPG/PNG/WebP/HEIC/HEIF) or PDF files you upload to the private vault, plus metadata you attach: title, category, document number, issue date, expiry date, notes, tags.
• Deadlines — title, description, category, priority, dates, times, amounts, notes.
• Financial entries (Plus / Family / Pro plans) — manually entered debts, incomes, monthly expenses, income goals, and third-party subscription services you want us to remind you about (name, amount, next billing date). MYLIFE does not connect to your bank and does not read transaction data.
• Family members — full name, relation, birthday, avatar, optional emergency-contact flag and free-text notes.
• Health entries (optional, informational only) — height, weight, waist, blood pressure, smoking status, activity level, family-history flags, condition flags, medications, allergies, lab notes, and manually entered measurements (glucose, HbA1c, lipids, kidney markers). All calculations run on-device. Health data is never sent to the AI provider unless you paste it into a chat message yourself.
• Life events — title, event type, date, location, notes.
• AI conversations & messages — the messages you send to the assistant, its replies, and the model/latency/token metadata for each message.

3.3 Payment & subscription data

• Subscription state — plan (Free / Plus / Family / Pro), status, billing interval, current period start/end, cancel-at-period-end flag, trial expiry, provider (Apple / Google / PayPal / Paymob).
• Provider correlation IDs — the opaque IDs your payment provider gives us so we can reconcile your subscription. For Apple this is the App Store transaction receipt; for Google Play, the purchase token; for PayPal, the subscription ID; for Paymob, the order/transaction ID.
• We do NOT receive or store your card number, CVV, bank details or PayPal credentials. Card / wallet capture is performed entirely inside Apple, Google, PayPal or Paymob's own hosted checkout surfaces.

3.4 Operational & security data

• IP address and user-agent — captured for a limited set of security-sensitive events (payment initiation, PayPal / Paymob callbacks, AI external calls, account deletion, document sharing) and written to a private audit_logs table. Used to detect fraud, abuse and unauthorised access.
• Push notification token — only if you enable push. Stored in push_tokens with the platform (ios / android / web) and an optional device-id so reminders can be delivered.
• Diagnostics — request latency, error counters, AI-usage/credit meters. Used solely to keep the Service running. No third-party analytics SDK is embedded.
• Crash logs — surfaced by Apple TestFlight / App Store and Google Play Console at the platform level. We do not embed a third-party crash-reporting SDK inside the app.

3.5 Data we do NOT collect

• Precise or approximate location — Android ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION are explicitly blocked in the merged manifest, and no iOS location entitlement is requested.
• Device address book contacts — Android READ_CONTACTS is explicitly blocked.
• Calendar events, SMS / MMS, voice / microphone recordings — Android RECORD_AUDIO is explicitly blocked.
• Music files, videos, web-browsing history, installed apps list.
• Advertising identifiers — Android com.google.android.gms.permission.AD_ID is explicitly blocked; on iOS, NSUserTrackingUsageDescription is intentionally omitted and ATTrackingManager.requestTrackingAuthorization is never called.
• Cross-app or cross-site tracking data.
• Race / ethnicity, political beliefs, religious beliefs, sexual orientation, or any other special-category data.
• Fitness / step / activity tracking, biometrics. Face ID / fingerprint prompts are processed entirely by the operating system on-device; the biometric itself never reaches MYLIFE.
• Bank account transactions or balances (MYLIFE has no bank connection integration).

4. How the Data Is Collected

• Directly from you — by typing into forms, uploading files, capturing camera photos of your own documents, or selecting photos through the operating system's Photo Picker (on Android 13+ this is the system Photo Picker, so we do not need to hold READ_MEDIA_IMAGES).
• Automatically from your device — only the minimum necessary to run the Service: your IP address (from your network request headers), your user-agent (from the HTTP request), your Supabase auth session token (created when you sign in), and your push token (only if you enable notifications).
• From your payment provider — after you approve a purchase inside Apple, Google, PayPal or Paymob's own flow, the provider sends us the subscription/entitlement identifier so we can grant you the plan you paid for.

5. Why We Collect It (Purposes) and Legal Bases

6. Where Your Data Is Stored

• Database — a private PostgreSQL instance managed by our backend processor Supabase (OnSpace Cloud). Every user-owned table has Row-Level Security enabled so one user can never see another user's rows.
• Files — the document images/PDFs you upload live in a private Supabase Storage bucket at documents/<your-user-id>/<document-id>/<filename>. Access is only possible via short-lived signed URLs generated on demand. No file is ever public.
• Avatars — in a separate private avatars/<your-user-id>/ bucket, same signed-URL model.
• Locally on your device — your Supabase auth session (managed by @supabase/supabase-js using the platform's secure storage), your language/theme/currency preferences, and any queued offline drafts. No documents are cached in plaintext outside the OS's own secure app sandbox.
• Transit encryption — TLS 1.2 or higher between the app and every backend, and between the backend and every processor listed in §8.

7. Third-Party AI Processing (Explicit Consent Required)

7.1 Identity of the AI provider

MYLIFE AI ORGANIZER uses OpenAI (openai.com) to power its AI assistant (in-app chat) and its AI document-analysis feature. Requests are made server-to-server from our Supabase Edge Functions (mylife-ai-chat and analyze-document) to the OpenAI Chat Completions API at https://api.openai.com/v1/chat/completions. Your device never talks to OpenAI directly, and no OpenAI API credentials leave our servers.

7.2 Explicit affirmative consent

Before any of your personal MYLIFE data is transmitted to OpenAI, the app displays a full-screen in-app consent dialog that:

• Names the third-party AI provider (OpenAI).
• Lists the exact categories of data that may be sent (see §7.3 below).
• Explains why the data is sent and what OpenAI does with it.
• Presents two clearly labelled buttons: “Allow AI Data Sharing” and “Not Now”. No option is pre-selected. The dialog cannot be dismissed by an Android back-press or an iOS swipe — you must tap one of the two buttons.

If you tap Not Now, or if you later revoke consent, MYLIFE keeps working normally, but the AI chat and AI document-analysis features are disabled and no data is transmitted to OpenAI. Every AI request is verified twice: once by the app and once by the server. The server (edge functions mylife-ai-chat and analyze-document) refuses to call OpenAI with an HTTP 403 ai_consent_required response unless your account has ai_consent_status = 'GRANTED'.

7.3 Exact data sent to OpenAI

• AI chat — the message you just typed, plus only the MYLIFE rows that are directly relevant to answering that specific question. Relevance is inferred server-side from the wording of your question. For example, if you ask “what's my next appointment?” we include upcoming deadlines, reminders and events. If you ask about renewals, we include documents whose expiry date is within 30 days. If you ask about money (Plus/Family/Pro only), we include your debts, incomes, expenses and income goals. Your profile (name, timezone, currency, language) and today's local date are always attached so the model can interpret “today / tomorrow / this week” correctly.
• AI document analysis — the image of the document you explicitly submitted, its filename, its MIME type, the category you assigned it, and any issue/expiry dates you already entered. Only documents you submit for analysis are ever sent.

7.4 Data NEVER sent to the AI provider

• Your password, sign-in codes or auth session tokens.
• Your payment card, bank account details, PayPal / Paymob credentials or provider correlation IDs.
• Your entire vault. We only include the specific rows relevant to the specific question you just asked.
• Your health measurements (BMI, blood pressure, medications, allergies) — unless you paste them into a chat message yourself.
• Your device contacts, calendar, location, microphone, or the advertising identifier — MYLIFE does not have access to any of these to begin with.
• Any file that you did not explicitly submit for analysis.

7.5 OpenAI's treatment of your content

OpenAI processes the prompts we send it solely to generate the response you requested and returns that response to us. OpenAI does not use content submitted through the API to train its models. This is OpenAI's own default policy for API traffic — see openai.com/enterprise-privacy. We do not enable any opt-in training mechanism.

7.6 Revoking consent

You can revoke consent at any time in Settings → AI & Privacy → AI Data Sharing → Revoke consent. The next AI request from your account will be refused both by the app and by the server (HTTP 403 ai_consent_required). Your existing MYLIFE data is unaffected by revocation — nothing is deleted; only future AI transmission is stopped.

7.7 Consent record

Your decision is stored in your account (columns ai_consent_status, ai_consent_decision_at, ai_consent_version in the user_preferences table). The current consent version is v1.0.0. If we materially change what is disclosed to OpenAI in the future, we will bump the version and re-prompt you for consent before that new category is transmitted.

8. Third-Party Processors

The processors below act strictly on our behalf under a data-processing agreement. They do not use your personal data for their own purposes, do not receive it for advertising, and do not resell it. We do not sell your personal data, we do not license it to data brokers, and no third party receives your data for advertising, marketing profiling, cross-context behavioural advertising, or measurement.

No other third parties receive your personal data. There are no advertising SDKs (no AdMob, no Facebook Audience Network, no Unity Ads, no others), no third-party analytics SDKs (no Firebase Analytics, no Segment, no Mixpanel, no Amplitude, no AppsFlyer, no Adjust, no others), and no crash-reporting SDKs embedded in the app.

9. Retention

• Account & content — kept as long as your account is active. Deleted immediately (with cascading foreign-key delete on every user-owned row) when you delete your account.
• Documents & avatars — the underlying files in Supabase Storage are removed by folder (documents/<user-id>/* and avatars/<user-id>/*) when you delete your account.
• AI conversations & messages — kept until you delete a conversation, or until you delete your account (whichever is sooner).
• Legal acceptances — retained as long as the account exists so we can prove which Terms/Privacy/AI-consent version you agreed to.
• Audit logs — retained on a rolling window sufficient to investigate security incidents (typically up to 12 months) even after the associated user is deleted; the user_id reference is set to NULL so the log is no longer tied to an identifiable person.
• Payment / subscription events (billing_events, paypal_transactions, paymob_transactions) — retained as required by tax and accounting law (typically up to 7 years). The user_id reference is set to NULL on account deletion so entries survive as anonymised financial records only.
• Push tokens — deleted when you delete your account or when the platform reports the token is invalid.

10. Deleting Your Account & Data

1. Open MYLIFE AI ORGANIZER.
2. Go to More → Settings → Privacy & Security → Delete Account.
3. Confirm the dialog: “This permanently deletes your account, profile, and all data associated with it. This action cannot be undone.”

Deletion is executed by the delete-account Edge Function running with the service role. It cascades every row you own in every user-scoped table (documents, deadlines, debts, incomes, expenses, income goals, subscriptions, family members, life events, notifications, reminders, AI conversations, AI messages, agent actions, push tokens, user preferences, account subscription, legal acceptances), removes every file under documents/<your-user-id>/ and avatars/<your-user-id>/ in Storage, and finally deletes your authentication record from Supabase Auth.

If you no longer have the app installed, email contact@onspace.ai from your registered email address with the subject “Delete my MYLIFE AI account”. We process the request within 30 days.

11. Your Rights

Regardless of where you live, you have the following rights over your data. Where GDPR, UK GDPR, CPRA / CCPA, or a similar regime applies, these rights are legally binding on us.

• Access — see everything on your account in the app, or request a data export by emailing contact@onspace.ai.
• Rectification — edit or replace anything you entered directly in the app.
• Erasure / deletion — see §10.
• Portability — request a machine-readable export of your data.
• Restriction / objection — email us to restrict specific processing; you may object to any legitimate-interest processing at any time.
• Withdraw consent — for AI processing, in Settings → AI & Privacy → AI Data Sharing; for optional notifications, in Settings → Notifications.
• Opt out of sale / sharing / cross-context behavioural advertising — nothing to opt out of, because we do none of these.
• Lodge a complaint — with your local supervisory authority (in the EU/UK) or the applicable regulator.

12. Security

• Row-Level Security on every user-owned database table (authenticated_select_own_*, authenticated_insert_own_*, authenticated_update_own_*, authenticated_delete_own_*).
• Private Storage buckets with per-user folder policies (a user can never read another user's folder).
• Short-lived signed URLs for every file download (no file is ever public).
• TLS 1.2+ enforced end-to-end.
• Server-side rate limiting on authentication, AI, and payment endpoints.
• Third-party AI provider credentials and PayPal / Paymob credentials are stored only in server-side secrets and never shipped in the mobile binary.
• Independent verification of every AI consent decision on both the client and the server (defence in depth).

13. Children

MYLIFE AI ORGANIZER is intended for users aged 18 and over. It is not directed at children and does not knowingly collect personal information from anyone under 13. If we learn that a child under 13 has provided personal information, we will delete it.

14. International Transfers

Your data is stored on cloud infrastructure that may be located in the United States or the European Union depending on the processor. When personal data is transferred outside your country of residence, the transfer is protected by contractual safeguards (Standard Contractual Clauses where applicable, or equivalent).

15. No Tracking, No Ads, No Data Brokerage

• Tracking (Apple's definition) — MYLIFE AI ORGANIZER does not link user or device data with third-party data for advertising, and does not share user or device data with a data broker. Our App Store Connect → App Privacy → Tracking answer is No.
• App Tracking Transparency (iOS) — the ATT prompt is intentionally never presented. NSUserTrackingUsageDescription is not declared in Info.plist, and no runtime code calls ATTrackingManager.requestTrackingAuthorization.
• Advertising ID (Android) — com.google.android.gms.permission.AD_ID is explicitly listed in expo.android.blockedPermissions so Gradle's manifest merger strips it from the merged AndroidManifest.xml. Play Console → Advertising ID = No.
• Ads — no advertising SDKs are embedded in the app.
• Analytics SDKs — no third-party analytics SDKs are embedded in the app. Diagnostics (latency, error counters, AI credit usage) are used solely to run the Service.
• Data brokerage / sale — we do not sell, license, rent, or otherwise transfer your personal data to data brokers. Under CPRA / CCPA, you have nothing to opt out of because nothing happens.
• Personalised AI — the AI assistant personalises responses using only your own data inside your account. There is no cross-user pooling, no profile building for advertising, and no third-party sharing of prompts beyond the OpenAI processor role described in §7.

16. Changes to This Policy

If we materially change how we handle your data — in particular, if we add or change a third-party processor that receives your personal data, or if we change what is transmitted to the AI provider — we will notify you inside the app before the change takes effect, bump this version, and (where consent is required) re-prompt you. The current version and effective date are shown at the top of this page.

17. Contact

Questions, deletion requests, or privacy-related concerns: contact@onspace.ai.

18. Google Play Data Safety Alignment

The table below mirrors the answers we submit to Google Play Console's Data Safety form so users can verify that our declaration matches this policy.

18.1 Data collected and its purpose

18.2 Not collected

• Approximate location, precise location
• Contacts (device address book)
• Calendar events
• SMS / MMS
• Voice or sound recordings
• Music files, videos, web browsing history, installed apps list
• Android Advertising ID (AAID) — permission blocked in the merged manifest
• iOS Identifier for Advertisers (IDFA) — ATT prompt intentionally not requested
• Cross-app or cross-site tracking data
• Data used to build marketing profiles or advertising audiences
• Race / ethnicity, political beliefs, religious beliefs, sexual orientation
• Credit score, user payment info (handled by Apple / Google / PayPal / Paymob directly)
• Fitness / step / activity tracking
• Biometric data (Face ID / fingerprint are handled entirely on-device by the OS)

19. Apple App Privacy Alignment

Our App Store Connect → App Privacy declarations are:

• Contact Info — Email Address: linked to identity, used for App Functionality.
• User Content — Photos or Videos, Other User Content (documents, deadlines, health, finance, family, AI messages): linked to identity, used for App Functionality.
• Identifiers — User ID (our auth uid): linked to identity, used for App Functionality.
• Purchases — Purchase History: linked to identity, used for App Functionality.
• Diagnostics — Crash Data, Performance Data: not linked to identity, used for App Functionality.
• Tracking — No.
• Third-party AI processing — this policy identifies OpenAI as the AI processor in §7, discloses the exact categories of data transmitted, and confirms that the user's explicit affirmative consent is captured before any transmission occurs.