1. Introduction
Welcome to OptiAI® ("the Service," "Application," or "App"), operated by Aspire Digital LLC ("Aspire Digital," "Company," "we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we look after your personal data when you visit our application and tell you about your privacy rights and how the law protects you.
2. Information We Collect
We may collect, use, store and transfer different kinds of personal data about you:
- Identity Data: First name, last name, username or similar identifier
- Contact Data: Email address, phone number
- Authentication Identifiers: When you choose to sign in with Apple ("Sign in with Apple") or Google ("Google Sign-In"), we receive basic identity information from that provider — typically your name and email address — to create and secure your account. If you use Apple's "Hide My Email" feature, we receive only Apple's private relay address, not your real email. Your credentials (passwords, Apple ID, Google password) are never shared with us — authentication is handled entirely by the provider.
- Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform
- Analytics & Advertising Identifiers: On mobile, standard device and usage identifiers used to understand app usage and measure how people discover OptiAI. This may include a device advertising identifier (the Google Advertising ID on Android); on iOS we rely on Apple's privacy-preserving SKAdNetwork and Apple Search Ads attribution (AdServices) for install attribution. See Section 9 (Cookies and Tracking) for details and your controls.
- Usage Data: Information about how you use our application and services, including derived engagement metrics such as your Opti Score
- Financial Data: Manually entered account balances (with only the last 4 digits of an account number stored — never a full account number), transactions (merchant, amount, date, and an optional tag linking it to a pet, child, or trip), budget envelopes and spending limits, income sources, and investment data you choose to input. These records are not shared outside your household except through the household visibility described in Section 11b.
- Health Data: Medical records, lab reports, health goals, fitness activity, and medication schedules you choose to input
- Reproductive Health Data: Menstrual cycle logs, fertility and TTC information, pregnancy records (including conception method, ultrasound images, measurements, conditions, medications, and baby names), pregnancy loss or termination records, perimenopause and menopause data, and mood logs entered via the Cycle & Pregnancy module. This is a special category of sensitive data governed separately in Section 8a.
- Home Management Data: Inventory information, maintenance records, warranties, grocery lists, pantry contents, and meal plans you choose to input
- Childcare Data: Information about children you choose to enter as a parent or legal guardian (see Section 10)
- Family Nicknames: Nicknames you choose to record for people in your household or family (for example "Bobby" for Robert), up to 10 per person. They are stored with that person's profile, are visible to the same household members who can already see that person, and are used only so that Opti understands who you mean when you use a nickname in chat (they may be included in the context sent to our AI provider for that purpose, as described in Section 7). You can edit or remove them at any time in Settings → Family Members, Health → Family, or a child's profile.
- Pet Data: Pet profiles, vaccinations, health events, feeding and activity logs, and milestones that you choose to enter
- Community Activity Data: Optional records of volunteering, charitable giving, acts of kindness, and civic engagement that you choose to log. By default these entries are marked private to your account.
- Uploaded Files and Images: Photos, PDFs, and other files you upload for parsing or analysis by AI features. Depending on what you choose to submit, these may include receipts, lab reports, prescriptions, vaccination records, medical history and doctor-visit summaries, financial documents (bank, credit-card, loan, and investment statements), insurance policies, property and vehicle titles, warranties, inventory records, travel documents (boarding passes, hotel confirmations, itineraries), event flyers, and other chat attachments. These documents may contain sensitive financial, health, or identity information — see Section 8 for how that data is processed.
- Voice Input: When you use voice dictation in chat, your spoken audio is processed by your device's or browser's speech-recognition service. On iOS this may be Apple's on-device or Siri speech-recognition framework; on the web it uses the browser's Web Speech API. The resulting text transcript is what reaches our servers — we do not receive or store raw audio. In Learning Studio, a young child's spoken answer in a lesson is recognized only on the device itself, and only when the device can do that without sending audio anywhere; otherwise the grown-up confirms the answer. The audio is never sent to us or stored.
- Subscription & Payment Identifiers: Stripe customer/subscription IDs (for web subscriptions), Apple original-transaction IDs and product IDs (for iOS in-app purchases), or Google Play purchase tokens and product IDs (for Android in-app purchases). We do not receive or store full payment card numbers, Apple ID credentials, or Google account payment details.
- Referral Attribution: If you apply a referral code at signup or in the app, we record which code was applied and when, for the operation of our influencer/affiliate program (see Section 16).
3. How We Use Your Information
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- To provide and maintain our Service
- To notify you about changes to our Service
- To provide customer support
- To gather analysis or valuable information to improve our Service
- To monitor the usage of our Service
- To detect, prevent and address technical issues
- To provide you with personalized AI assistance and recommendations
4. Data Security
We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. Our security measures include:
- Encryption of data in transit and at rest
- Regular security assessments and audits
- Access controls and authentication mechanisms
- Secure backup and recovery procedures
- Multi-factor authentication options
- Biometric authentication support, including an optional Face ID / fingerprint lock for the mobile app (see Section 11c)
- Password requirements: passwords must be at least 10 characters, and we check new passwords against lists of passwords known to have been exposed in public breaches (using a privacy-preserving check that does not send your password to anyone) and ask you to choose a different one if it appears on such a list
5. Data Retention and Deletion
We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Financial records created in the wealth module — including accounts, transactions, budgets, and income sources — are covered by the same Account Deletion and Backup Systems rules described below; there is no special-cased retention period for financial data.
Log and Activity Records
We keep the following records only for a fixed period and then delete them automatically:
- Product usage events (for example, which screens you open and which features you use): up to 13 months. After that we keep only aggregated totals that do not identify you.
- Security events (for example, sign-in attempts and account lockouts): 1 year. A record that is the reason an account is currently locked is kept until the lock is lifted.
- Household change history (the record of who added, changed or deleted an item in a shared household): 2 years.
- Administrative access audit log (the record of administrative actions on your account): kept for the life of your account and deleted with it.
Account Deletion
You may delete your account at any time through your account settings or by contacting support@optiai.me. Upon account deletion:
- Your personal data, including profile information, health records, financial data, and other content, will be permanently deleted within 30 days
- Data that has been shared with household members may remain accessible to those members, but your identity will be disassociated from it
- Children's data entered solely by you will be deleted along with your account
- Anonymized or aggregated data that cannot identify you may be retained for analytics and service improvement
- Active subscriptions will be canceled and no refunds will be issued for the remaining billing period
Data Export
You may request a copy of your personal data by contacting support@optiai.me. We will provide your data in a commonly used, machine-readable format within 30 days of your request, in accordance with applicable data protection laws.
Inactive Accounts
Accounts that remain inactive for 24 consecutive months may be subject to termination. We will attempt to notify you via email at least 30 days before any action is taken on an inactive account. Upon termination of an inactive account, your data will be handled as described in the Account Deletion section above.
Legal Retention
Notwithstanding the above, we may retain certain data as required by applicable law, regulation, or legal process (e.g., tax records, fraud prevention, or dispute resolution). Such data will be retained only for as long as legally required and will be securely deleted thereafter.
Backup Systems
Deleted data may persist in encrypted backup systems for up to 90 days before being permanently purged. During this period, backup data is not actively used or accessible and will not be restored except in the event of a system-wide disaster recovery.
6. Your Legal Rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data:
- Right to access: You can request copies of your personal data
- Right to rectification: You can request correction of inaccurate data
- Right to erasure: You can request deletion of your personal data
- Right to restrict processing: You can request restriction of processing your data
- Right to data portability: You can request transfer of your data
- Right to object: You can object to processing of your data
- Right to withdraw consent: You can withdraw consent at any time
Legal bases (EEA, UK and Switzerland). We rely on: contract (to run the Service you asked for: accounts, households, modules, AI features you use, payments); consent (tips and news emails, marketing measurement, special-category data you choose to add, child accounts, the AI tutor, Family Safety, connected health data; withdraw at any time); legitimate interests (security, fraud and abuse prevention, service improvement from aggregated data); and legal obligation (tax, accounting, responding to lawful requests). You may complain to your data protection authority (in the UK, the ICO).
7. Third-Party Services
We employ third-party companies and services to operate and deliver the Service. These providers have access to your personal data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose. By using the Service, you acknowledge that your data may be processed by the following providers:
- Web Payment Processing: Stripe, Inc. handles all payment transactions originating from our web application. Your use of these payment features is subject to Stripe's Terms of Service and Privacy Policy.
- iOS In-App Payment Processing: Apple Inc. handles all subscription purchases initiated from the iOS app via StoreKit / In-App Purchase. We receive only an opaque transaction identifier and product identifier from Apple — your Apple ID, payment method, and billing address are not shared with us.
- Android In-App Payment Processing: Google LLC handles subscription and Points purchases initiated from the Android app through Google Play Billing. We receive only an opaque purchase token and product identifier from Google, together with renewal, cancellation and refund notifications about that purchase. We do not receive your payment card details or Google account payment information.
- Data Storage and Authentication: Supabase provides database hosting, user authentication, and file storage services.
- Social Sign-In Providers: If you choose social sign-in, Apple (Sign in with Apple) and/or Google (Google Sign-In) authenticate you and share basic profile information (name, email, or Apple private-relay address) with us to create and secure your account. Your sign-in credentials are never shared with us.
- Artificial Intelligence: Google (Gemini) provides AI-powered features including recommendations, advisory suggestions, image and document understanding, content generation, and — for questions that need current information — an optional live web search through Google that returns cited sources. See Section 8 for details on what data is sent.
- Error Monitoring: Sentry is used for error tracking and performance monitoring to improve service reliability.
- Email Delivery: Resend handles transactional email delivery including account notifications and alerts, and receives the emails you forward to your OptiAI inbox address (see Section 11c).
- Bank Linking: If you choose to connect a bank, card, or brokerage account, Plaid provides the connection and retrieves account and transaction data for the accounts you select. Bank linking is available only in the United States and Canada. Your bank login is entered directly with Plaid or your institution and is never seen or stored by OptiAI.
- Web Hosting: Vercel provides frontend hosting and content delivery.
- App Distribution & Push Notifications: Apple and Google provide app distribution and push notification services through their respective app stores. Apple additionally sends us App Store Server Notifications about subscription lifecycle events (renewal, refund, expiration) for accounts that have purchased via iOS IAP.
- Notification Delivery & Messaging (mobile apps): OneSignal manages push notifications and notification-related email for our iOS and Android apps. We provide OneSignal with your account identifier, your account email address, your device's push token, and a small set of non-identifying attributes used to decide which messages are relevant — your subscription type, roughly how long you have had an account, a broad activity band, and which parts of the app you use. We do not send OneSignal any health, medical, reproductive, financial, or children's information, nor the content of anything you write in the app. See Section 9a for how to stop receiving these messages.
- Mapping & Geocoding: Google Maps provides location-based features, address autocomplete, and place geocoding, and Google Places finds businesses for Opti Concierge suggestions (see Section 8d).
- Calendar Integration: If you choose to connect a calendar, Google (Google Calendar) and/or Microsoft (Outlook/Microsoft 365) authorize a one-way, read-only import of your calendar events into your OptiAI account. See Section 7a for exactly what is accessed, how it is used, and our Google API Limited Use commitment.
- Weather Forecasts: Open-Meteo provides destination weather forecasts when you create a travel trip. Only the destination text you enter and the trip date range are sent — no personal identifiers.
- Grocery Delivery: Instacart's Developer Platform builds a cart link when you choose to order groceries through the Service. We send a list of items (no personal identifiers) and Instacart returns a checkout URL.
- Branded Food Data: Open Food Facts (an open, community food database) provides nutrition information when you scan a product barcode or search for a branded food. We send only the barcode number or the search term you enter — no personal identifiers — and receive back product and nutrition details. See Section 8b for how barcode scanning uses your device camera.
- Web Analytics & Advertising Measurement (web only): Google Analytics 4, Meta Pixel and Meta Conversions API — see Section 9.
Advertising Measurement
- What: in the Android app, the Google Advertising ID (a device ID) and a few app events: the app being installed or opened and an account being created (a "registration completed" event), plus basic device and app information. We never send your name, email or any content from your account.
- Who: Meta Platforms, Inc. (through the Meta SDK, app events only) and Google (through Google Play Install Referrer and Google Analytics for Firebase).
- Why: to measure which of our ads lead to installs and sign-ups. It is not used to show ads in OptiAI. The app shows no ads, and we do not sell your personal data.
- Your choice: on Android, go to Settings › Privacy › Ads › Delete advertising ID (or Reset advertising ID); the Meta SDK also stays off if you opt out of marketing measurement. The iOS app does not include the Meta SDK, does not read the advertising identifier (IDFA) and does not show the App Tracking Transparency prompt; it uses only Apple's privacy-preserving SKAdNetwork attribution and Apple's AdServices attribution token for Apple Search Ads (described below), neither of which identifies you across apps.
- Retention: Meta and Google keep this data under their own retention policies (Meta, Google). More detail is in Section 9.
Your use of the Service may be subject to the terms and privacy policies of these third-party providers. We encourage you to review them. Aspire Digital LLC may change third-party service providers at any time without notice, provided the functionality of the Service is maintained.
7a. Connected Calendars (Google & Microsoft)
When you explicitly connect a calendar, OptiAI performs a one-way, read-only import of your calendar so your events appear alongside your tasks inside your own OptiAI account and so we can send you timely reminders (for example, ten minutes before a meeting) with a one-tap link to join. This integration is entirely optional and is only active for accounts you choose to connect.
- What we access: via Google's
calendar.readonlyscope and Microsoft Graph'sCalendars.Readscope, we read your list of calendars (so you can choose which to import) and the events on the calendars you enable — including title, date, time, location, description, attendee email addresses, and any online-meeting join link. We never create, edit, or delete anything in your calendar. - How we use it: solely to display your events in your OptiAI account and to generate your meeting reminders. We do not use this data for advertising, profiling, or any purpose unrelated to providing these features.
- How we store it: OAuth tokens are encrypted at rest; we store only the minimal event fields needed to display the event and fire its reminder. Imported events are kept only while your calendar remains connected.
- Sharing: your calendar data is never sold, and is never shared with third parties except the infrastructure providers (Section 7) that host and process it on our behalf. It is never transferred to or used to train any AI model.
- Your control: you can disconnect any calendar at any time from Settings → Connected Calendars, which stops syncing, deletes the stored tokens, and revokes our access. You may also revoke access from your Google or Microsoft account security settings.
Google API Services Limited Use disclosure. OptiAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. AI and Data Processing
OptiAI uses artificial intelligence to provide personalized recommendations and assistance. Your data is processed to:
- Provide intelligent insights and recommendations
- Automate routine tasks and reminders
- Improve the accuracy of predictions and suggestions
- Enhance the overall user experience
Third-Party AI Service
AI features in OptiAI are powered by Google Gemini, a generative AI service operated by Google LLC. When you use AI-powered features, relevant data is sent to Google's servers for processing. Data sent to Google Gemini is processed in accordance with Google's Privacy Policy.
AI Features Are for Adults
Our AI provider's terms do not allow use by people under 18, so we send nothing to an AI model for a user who has told us they are under 18, whose own profile date of birth shows they are under 18, who uses a child account, or who has not yet told us their age. This is enforced on our servers for every AI feature, including chat, messaging apps, the email inbox, document and photo reading, read-aloud and Learning Studio. To confirm you are an adult we keep only your answer (adult or under 18), when you gave it and a log of changes; we do not ask for or store your age for this. An adult parent's own requests about their family are not affected.
Data Sent to AI
Depending on the AI feature you use, the following types of data may be sent to Google Gemini for processing:
- Your queries and prompts to AI features, including chat with Ask Opti
- Health metrics (e.g., fitness goals, workout history, health insights)
- Reproductive health data you explicitly send via AI features in the Cycle & Pregnancy module (e.g., cycle predictions, fertility insights, baby-name generation) — see Section 8a for the full privacy posture of this data
- Financial information (e.g., transaction summaries, budget data, goal progress)
- Home inventory and grocery data
- Meal preferences and dietary information
- Child development and education data (entered by parents/guardians)
- Pet care data (vaccinations, feeding logs, health events) when relevant to a tool the AI is using
- Travel plans and itinerary details
- Files and images you upload as chat attachments — for parsing, extraction, and follow-up actions. These may include photos and PDFs of receipts, lab reports, prescriptions, vaccination cards, recipe photos, and event flyers, as well as sensitive financial, health, and identity documents such as bank, credit-card, loan, and investment statements, insurance policies, property and vehicle titles (including identifiers like account numbers and vehicle identification numbers), medical history and doctor-visit summaries, warranties, and travel documents. When you choose to upload such a document, its contents — including any sensitive information it contains — are sent to Google Gemini for analysis. Attachments are stored in our secure storage and a signed reference is sent to Gemini at processing time; uploaded attachments are automatically purged from attachment storage within 7 days.
- Task and school-event attachments: when you ask Opti to create a task or reminder, or file a school event, from a photo or PDF you sent (in the app or a connected chat app), a copy of that file is saved on the task or event so you can open it later; you can also attach photos and PDFs to a task or school event yourself. These attachments are stored privately and are visible to exactly the people who can see the task or event under your household and Data Sharing settings (private and hidden-from items stay private). They are kept until you remove them or delete the task or event, and are deleted with your account. When a school notice yields several items (the event, tasks, and things to bring), you choose which to save, and nothing is saved until you confirm; items to bring go on your household's shared shopping list. AI assistants connected through our MCP server can see only an attachment's name and type, never the file.
- The transcript text produced by voice dictation (we never receive raw audio — your device's speech-recognition service produces text, and only that text reaches our servers)
Google Gemini is configured for OptiAI in a mode that, per Google's published terms for paid API customers, does not use your inputs to train Google's models. See Google's Gemini API Terms for details.
Live Web Search
To answer questions that depend on current information (for example, business hours, prices, or upcoming events), the AI assistant ("Ask Opti") may perform a live web search through Google. When it does, a short search query derived from your message is sent to Google's search service, and the AI may summarize the results and cite the sources it used. Search results are provided by third parties and may be inaccurate or out of date. We do not use your strictly private health information — such as menstrual cycle, pregnancy, mood, or mindfulness data (Section 8a) — to form web-search queries. Google's handling of search queries is governed by Google's Privacy Policy.
Consent and Control
When you first access a module that uses AI-powered features, you will be presented with a domain-level disclaimer that explains how your data is processed. These disclaimers are shown once per domain (Health, Nutrition & Food, Childcare, and Financial) and must be acknowledged before proceeding. Each disclaimer informs you that data may be sent to Google Gemini for analysis and links to both our Privacy Policy and Google's Privacy Policy.
Your data is never used to train AI models without your explicit consent, and you maintain full control over what data is processed by AI features. You can reset your disclaimer acknowledgments at any time by clearing your app data or contacting support.
8a. Reproductive & Sensitive Health Data (Cycle & Pregnancy)
The Service may include a Cycle & Pregnancy module that lets you track menstrual cycles, fertility and trying-to-conceive (TTC) information, pregnancy details (including conception method, ultrasound images, measurements, pregnancy-related conditions, medications, and baby names), pregnancy loss or termination, perimenopause and menopause, and mood. This category of information is considered a special category of sensitive personal data under many data-protection frameworks and is handled with heightened care.
Storage and Access
Reproductive health data is stored in our database with row-level security. It is strictly private to the account owner by default. This data is not included in the household data-sharing matrix — it is never automatically visible to household members, partners, or other users simply because they belong to the same household. A parent or guardian may track a minor dependent's cycle data within a separate account; that data remains owner-only on that account.
Sharing Is Explicit Opt-In Only
If you choose to share a specific pregnancy or cycle journey with a partner or co-parent, you must explicitly grant access to that individual. You may revoke this access at any time. No sharing of reproductive health data occurs without your deliberate, affirmative action.
AI Processing
AI-powered features within the Cycle & Pregnancy module — such as cycle predictions, fertility insights, baby-name generation, and chat-based assistance — process your reproductive health data via Google Gemini to deliver the feature. This processing occurs under the same terms described in Section 8 (AI and Data Processing). Google, as a paid API customer, does not use your data to train its models. External AI access (for example, via Claude or ChatGPT through OptiAI's MCP integration) requires your explicit grant of the cycle scope and is not enabled by default.
Ultrasound Images and Other Uploaded Files
Ultrasound images and other files you upload in the Cycle & Pregnancy module are stored in a private, encrypted storage bucket. They are accessible only to you via signed URLs that expire after a short period. These images are not accessible to household members unless you explicitly share them.
Retention and Deletion
You can delete individual cycle entries, pregnancy records, or uploaded images at any time within the module. All reproductive health data associated with your account is permanently deleted when you delete your account (within 30 days, as described in Section 5).
Jurisdictional Note
Reproductive health data is subject to additional legal protections and restrictions in some jurisdictions. We are committed to handling this data responsibly and lawfully. If you have questions about how your reproductive health data is protected under the laws of your jurisdiction, please contact us at privacy@optiai.me.
8b. Connected Health Data (Apple Health & Health Connect)
On mobile, you may optionally connect OptiAI to your device's health platform — Apple Health (HealthKit) on iOS or Health Connect on Android — to import health and activity data instead of entering it by hand. This integration is entirely optional, off by default, and only active if you explicitly choose to connect and grant permission.
- What we read: with your permission, we perform a one-way, read-only import of the following data types over a date range you choose: body metrics (weight, height, body-fat percentage, resting heart rate, steps), workouts (type, duration, energy, distance), and sleep (duration and timing). We never write, modify, or delete anything in Apple Health or Health Connect.
- Reproductive data is never accessed: we never request or read reproductive or cycle-related health data (such as menstruation, ovulation, cervical mucus, sexual activity, or basal body temperature) from Apple Health or Health Connect. This exclusion is enforced in the app's permission requests themselves.
- On-device until you import: your health-platform data stays on your device and is not transmitted to us unless and until you initiate an import. Imported data is stored in your OptiAI account under the same protections as other health data you enter manually (Section 4).
- How it's used: imported data is used only to populate your Health features and your personal metrics within the Service. It is never sold, never used for advertising or marketing, and never used to train any AI model. It is not shared with third parties except the infrastructure providers (Section 7) that host it on our behalf.
- Your control: you can stop importing at any time, and you can revoke OptiAI's access from the Apple Health app (iOS) or the Health Connect app / Android settings at any time. Deleting your OptiAI account permanently deletes imported health data as described in Section 5.
Our access to and use of Apple Health data complies with Apple's HealthKit requirements, and our access to and use of Health Connect data complies with Google's Health Connect permissions policy. Health-platform data is treated as sensitive personal data and is never used for any purpose beyond delivering the features you have enabled.
8c. Assistant Personalization and Memory
In Settings → Assistant you can tailor how Opti talks to you and what it remembers. These controls are yours alone; nothing here is shared with other household members unless you share it yourself.
- Voice & tone preferences: your chosen tone, humour, emoji and reply-length settings are stored in your account and sent to the AI service only as a short style instruction when Opti writes a reply. They never include your health, cycle, pregnancy, mood or mindfulness data.
- Family interests and memory: short facts you tell Opti to remember (for example, "we love camping") are stored in your account and used only to make Opti's suggestions fit you better. Content in our strict-privacy categories (reproductive, pregnancy, mood and mindfulness information) is refused and never saved as a memory.
- Memory manager: you can view, edit and delete anything Opti has remembered, pause automatic remembering at any time (anything you explicitly ask Opti to remember is still saved), and use "Forget everything" to permanently delete all memories.
- Children: on a child's account, Opti uses a kid-safe style by default, does not automatically remember interests, and the style and memory settings are managed by a parent or household owner.
- No training: as described in Section 8, Google Gemini is used under paid-API terms that do not use your inputs to train Google's models, and we never use your preferences or memories to train any AI model.
- Companions: the Opti Companion pictures (Opti and the plush friends and their outfits) are fixed artwork shipped with the app. They contain no personal data and are never generated from your information. Which companion and outfit you chose, and which outfits you have unlocked, are stored in your account and deleted with it.
- Deletion: these preferences and memories are deleted when you delete your account (Section 5).
8d. Opti Concierge
If Opti Concierge is available to you and you ask it to plan something, we use information you already keep in OptiAI to make a good plan. We send the minimum needed to outside services, and Opti never pays on your behalf in this version.
- What we use: your family calendar (to find a time that suits everyone), your saved providers and contracts, your budgets (to keep options within reach), your taste preferences, favourites and not-again list, and allergy and diet notes already recorded on child or family-health records. Allergy and diet notes are used only to filter out unsuitable places; they are not copied anywhere else and are never sent to a business or to the search service.
- What we send to search for places: a short description of what you are looking for (for example "Italian restaurant") and an approximate location, or your device location if you choose to share it. If you tell Opti your address so it can find places near you, we convert it once into an approximate location (about 1 km) and keep only that approximate location, not the address; only that approximate location is sent with searches, and the address itself is never stored or sent. You can change or remove this approximate location any time in Settings › Account › Home location. Place search is provided by Google (Places API). We do not send your name, your family's details, your calendar or your health information.
- What we store: each plan (what, when, the options shown and why, which one you chose, a confirmation number if you add one, and a step-by-step history), any feedback you give about a place, and your taste settings. Place details we show (such as name, phone and website) are kept with the plan so you can see what you were offered.
- Who can see it: you, and household members you choose to share with in Settings → Data sharing (Activities → Concierge, and Tastes & favourites). Budget amounts and allergy details are never written into a plan that others can see.
- Optional learning: "how was it?" check-ins (at most one a day, never asked of children), a "something new" suggestion (off by default), and learning from merchant names at connected banks (off by default, never amounts). You can switch each of these off at any time.
- Suggestions: if Concierge suggestions are available to you, Opti looks at information you already keep in OptiAI (anniversaries and birthdays, appliance warranties and home services, the timing of past haircuts, grooming or cleaner visits on your calendar, your family calendar's free time, and your saved providers) to suggest things worth planning. This happens inside OptiAI; nothing is sent to an outside service until you choose Draft it. Suggestions are visible only to you, are never made for children, never use health information or items you marked private, and you can snooze or dismiss any of them. A visit that is on another adult's calendar is suggested to them, not to you, and Opti only plans someone with a saved provider marked as theirs or as the whole family's (the "For" setting on each provider, which household members who can see that provider can also see). If you use WhatsApp or Telegram with Opti, a suggestion can appear in place of a tip in a reply and follows the same tip limits and "stop tips" setting.
- When you book: you book directly with the business on its own website, app or phone line. What you give the business is governed by that business's own privacy policy.
- Booking requests by email: if you ask Opti to email a business, the email goes from your household's Opti address on book.optiai.me, which is created automatically, and you are copied in. It contains what you saw before you tapped Send: your name, what you want to book, the times you offer, a callback number and anything you chose to add. Emails are sent and received through our email provider, Resend. When the business replies, we read the reply to find the outcome (a confirmed time, another time, a question or a no) and then discard the text: we keep the outcome, the times and a confirmation number, never the body of the email. Replies are accepted only from the business you wrote to. Each reply is also forwarded to your own account email, with the business as the reply address, so you can answer them directly (a reply about a health appointment request is forwarded as a short notice without its content). If a business replies STOP, we never email it again.
- Filling a business's web form: if you ask Opti to fill a business's form (United States households), we open that business's own web page in a browser we run ourselves on Google Cloud (United States) and Google Gemini reads screenshots of the page to find and fill the form. The values typed are the ones you see and confirm before anything is sent: your name, phone number, the email you choose (your household's Opti address on book.optiai.me, so replies reach Opti and are forwarded to you, or your own email) and, for home visits, your address, plus the service, dates and message. We never type card numbers, passwords, one-time codes or dates of birth. We do not record the browsing session; we keep two screenshots (the filled form and the business's confirmation page) privately for 90 days, opened only through short-lived links, and deleted with your account. What you send the business is governed by its own privacy policy.
- Quote and job details: when you ask Opti for quotes, availability or an answer from a few local businesses, it asks only the details that kind of business needs (for example home size, how often, pets, your child's age for a tutor or babysitter, or your car's make and model for a mechanic). It may suggest some of them from your own OptiAI data (Home Map rooms, your cleaning plan, pets, vehicles, children's ages) and always shows you what it used. Those details go into the form message or the call brief only for the businesses you pick, and only after you confirm.
- Phone calls to a business: if you ask Opti to phone a business (United States households), the business hears what you saw on the call card before you tapped Call (plus, unless you turn it off, the simple household facts described below): the reason for the call, the times you approved, the details you answered (such as party size, a note, an address or what a visit is for) and your first name. If the business asks, your verified mobile number is shared for this booking: this is on by default and you can turn it off on the call card for any call. If you have no verified mobile, Opti asks which number to give; that number is stored with that call only and is not added to your profile. A confirmation email address is shared unless you turn it off; it is your own Opti Inbox address on in.optiai.me when you have one for that household, otherwise your household's Opti booking address on book.optiai.me, never your personal email. A booking confirmation or link the business emails to either address is attached to that call. Opti never shares card numbers, ID numbers, your date of birth, medical details or your personal email. When you agree to the calling consent we store what it named (the business, the share choices, the last four digits of the number, the email address), a fingerprint of the exact wording you saw and the time you agreed. Opti may also answer a business's simple question during the call from a small fixed set of non-sensitive household facts, at most three per call and only when relevant to that kind of business: pets (kind and number only), how many people live in your household (a count only), home size (bedroom and bathroom counts), the type and brand of the relevant appliance (no model, serial number or location), your vehicle's make, model and year (for auto businesses only), and how many times you have used that same business before (a count and month). Opti never shares names, children's details, health or money information, ID numbers or date of birth, codes or passwords, when your home is empty, or where items are kept. Each call ends with a "What Opti shared" summary, and you can turn this off in Settings > Concierge ("Let Opti answer simple household questions on calls"). If the business asks a question during the call, we send you a notification and pass on only the answer you choose. We store the call card you approved and your share choices with the call. When Opti calls to move or cancel a booking it made, the business also hears that booking's existing day and time and its details (such as the party size), and the share choices start from the ones you made for the original call.
- Confirmation files: a QR code, barcode image, PDF ticket or wallet pass the business sends is stored privately with the booking, opened only through short-lived links, never shown in notifications, and deleted with your account. If you choose Add to Google Wallet, the booking's title, time and confirmation number are sent to Google to create the pass.
- Verifying your mobile number: you can add your mobile in Settings > Account. We send a 6-digit code by text message, or by an automated voice call that reads the code, through our telephony provider, Twilio (United States), which receives the number and the code to deliver them. Your number is saved to your profile, in international format, only after you enter the correct code, and one number can belong to only one account. We use a verified mobile only for things you ask for: a business calling you back after a call Opti made for you (you can turn sharing off on each call), call alerts and check-in calls you set up, and recognising you when you call the Opti line. We never use it for marketing texts or calls, and we never sell it. To prevent abuse we keep a short record of each code request (when, how it was sent, a one-way fingerprint of the number and of the network address, and whether it succeeded); the number itself is removed from that record as soon as the request finishes or expires, and the records are deleted after 90 days or with your account, whichever is sooner. You can change or remove your mobile at any time; removing it turns off the features above until you verify a number again.
- Health appointment requests: where available (currently the United States and India), the email shares only your name, the times you offer and a callback number unless you add more yourself; each email needs your own confirmation; the request, its replies and any files are visible only to you and never appear in shared views or notification text.
- Call transcripts: we never record the audio of a call. The written turn-by-turn text of a call Opti makes to a business is kept for 90 days so you can check what was said, then deleted; the call's outcome, time and booking details stay in your call history.
- Deletion: your plans, feedback and taste settings are deleted when you delete your account (Section 5).
8d-a. Opti Call Alerts
If you turn on Opti call alerts (United States households), Opti may phone your verified mobile shortly before items you chose, and, if a household member picks you as their backup, about their must-not-miss items.
- What we use: your verified mobile number (only the last four digits are stored with each call), the title, time and place of the item you created, your timezone, quiet hours and call settings, and the first names of your household's adults (so you can hand an item to someone).
- What we keep: no audio and no transcript of the call. We keep what you asked Opti to do (for example "moved to 3:45 PM" or "added milk"), whether the call connected, who confirmed, and a log of each step (notification, call, backup, family alert), so the household can see who has it.
- Who hears what: a call about a child's item or a whole-family item may reach your backup and your household; a call about your own item reaches anyone else only if you marked that item must not miss, and an adult's own medication is then named only as "their medication". Opti never reads out dosages, conditions, amounts or notes.
- Service providers: calls are placed through Twilio, and the conversation is handled in real time by Google's Gemini speech model; neither receives your OptiAI records beyond the item and the words spoken on the call.
- Consent and stopping: we store the version and a fingerprint of the consent wording you agreed to and when. Say "stop" on any call, or turn calls off in Settings > Call alerts, and Opti will not call you again.
- Leave-by alerts: to time a leave-by call we send your household's home address and the appointment's address to Google's Routes service for a live-traffic drive estimate. We keep only the estimated minutes, never the addresses or the route.
- Business calls from an alert call: if you say yes to Opti calling a business (for example to say you are running late), that call follows section 8d. We record that you agreed by voice, when, on which alert call, and a fingerprint of the sentence Opti read; a late notice shares only your first name and the appointment time, never your phone number or email.
- Your Opti line: when you call it we use the calling number to recognise your verified mobile, or the mobile number and PIN you key in. Your PIN is stored only as a one-way (bcrypt) hash; we log each PIN attempt with a fingerprint of the calling number (never the number itself) to stop guessing. As with alert calls, no audio or transcript is kept, only what you asked Opti to do.
- Businesses calling back: outgoing calls Opti places for you (section 8d) and the Opti line share one number. At the end of each call Opti gives the business that number and a booking reference for your booking (three letters and three numbers, for example KRX482); the reference is also shown in your chat and in the calendar event's notes. When someone rings the Opti line from a number that is not a family member's verified mobile, Opti asks for a booking reference. A valid reference links the call to that one booking, whatever number the business calls from; without one, Opti links it only when exactly one household had Opti call that business number in the last 30 days, and otherwise says nothing about any family and records no message. A reference stops working 30 days after the call, when the booking is cancelled, or once the booking is more than a day in the past. To stop guessing, we keep a record of each reference check — a one-way scrambled form (hash) of the calling number, whether the reference matched, and when — for 30 days, and stop checking references from a number after five wrong ones in a day. Once linked, Opti takes a short message for the person who asked for that call, in that household only, and reads nothing else from your account on that call, except that if the business asks how to reach you it gives the mobile number or confirmation email you agreed to share for that booking (otherwise it asks them to call the Opti line again). We keep no audio and no transcript: we keep the message as Opti wrote it down (at most 300 characters, plus any new time or confirmation number the business gave), when the business called, whether the call connected, whether a contact detail was given, and the last four digits of the calling number. A confirmation number the business gives is added to that booking and to its calendar event's notes; a new time is never applied until you tap to move the booking. Only the person who asked for the original call can see the message, as a card in Ask Opti (and a notification where your device can receive one); it stays in that person's call history until they delete their account. The call is handled the same way as other calls (Twilio and, in real time, Google's Gemini speech model), costs you no Opti Points, and a business can leave only a few messages a day.
8d-b. Care Check-ins
Care check-ins let an adult in your household (the "organiser") ask Opti to phone a family member, who may not use OptiAI and may be on a landline, at set times to check they have taken their tablets.
- What we use: the person's first name and the phone number the organiser entered (kept on our servers only; the app shows the last four digits), the times and the medications the organiser chose from that person's records, and the words the family chose to describe the tablet (for example "blood-pressure tablet"). The medication's name is spoken only if the organiser allows it.
- What we keep: no audio and no transcript. We keep whether the person said yes or no to the calls (with the version and a fingerprint of the question asked and which call it was), whether they said they took it (which logs a dose in that person's medication record, as the organiser), when Opti will call back, and, if they mentioned feeling unwell, a fixed category such as "dizzy" or "chest pain", never their words.
- Who sees what: the organiser and the household members they chose get the summaries and alerts. Notifications never show the medication's name; in the app, the name is shown only to adults who can already see that person's medications under Data Sharing, and others see "their morning tablet".
- Consent and stopping: the number is confirmed with a one-time call (press 1). On the first check-in call Opti asks the person if the calls are okay; if they say no, or say "stop" or "don't call me" on any call, Opti never calls them again and tells the organiser. The organiser can pause or remove a check-in at any time.
- Service providers: as for call alerts, Twilio places the call and Google's Gemini speech model handles the conversation in real time.
8e. Chat-App Channels (Telegram, WhatsApp, Messenger and Instagram)
If chat-app channels are available to you, you can connect your own Telegram or WhatsApp account to OptiAI from Settings and then send Opti messages, forwarded messages, photos and voice notes in that app to add items such as events and tasks.
- Telegram is a separate service: messages you send travel through Telegram, which processes them under its own terms and privacy policy. Telegram bot chats are not end-to-end encrypted. Do not send anything you would not want Telegram to process.
- WhatsApp is operated by Meta: if you use WhatsApp, Meta acts as a processor for delivering messages and processes them under its own terms and privacy policy. We keep your phone number (shown in international format) and display name so replies reach you, and, as with Telegram, we do not store the message content itself. Send STOP to opt out at any time. Business-initiated WhatsApp messages (such as a daily briefing) are sent only if you opt in.
- Messenger and Instagram are operated by Meta: if you connect Facebook Messenger or Instagram, Meta delivers and processes your messages under its own terms and privacy policy. We keep your page-scoped Messenger or Instagram identifier and display name so replies reach you, and we do not store the message content itself. Opti replies only within 24 hours of your message and never starts a conversation. Send STOP to opt out at any time.
- What we use: the content you send is read by AI (Google Gemini, Section 8) only to work out what to add. Photos and voice notes are handled in memory for that purpose only.
- What we keep: the items Opti creates (for example a title, date and time), your Telegram account identifier and display name so replies reach you, and minimal technical records (when a message arrived, a hashed message reference to avoid processing it twice, and the outcome). We do not keep the message text, photo or voice note itself, except that when a photo or PDF you send becomes a task or reminder, a copy is saved on that task or school event in OptiAI (see "Task and school-event attachments" in Section 8). Technical records are deleted after a limited period.
- Linking: a chat account is connected only from inside the signed-in app using a one-time link, never from the chat alone. Only adults can connect. Replies go only to the account you connected.
- Sensitive topics: medical, reproductive-health and similar sensitive content is not written automatically from a chat; Opti asks you to open the app instead.
- Feedback and tips in the chat: if you react 👎 to one of Opti's replies, we send a report to the OptiAI team with your account and the first 600 characters of Opti's reply (never your message). To make that possible we keep, for 7 days, the chat app's reference to each of Opti's replies and the first 600 characters of that reply; it is then deleted, and it is deleted with your account. Other reactions are only counted. If you send a message starting with "bug:", "feedback:" or "suggestion:", the text you wrote is sent to the team the same way as Settings → Feedback. Opti may add a short tip to a reply to a message you sent (at most a few a day, hours apart, and never to start a conversation); reply "stop tips" to turn them off. We record when each tip was shown and which feature it described, and whether you turned tips off.
- Family group chats: if you add Opti to a group chat (or create a WhatsApp group with Opti from Settings), we store the chat app's identifier for the group, its name, which household it is linked to, who added Opti and when, and whether it is active. We still do not store any message. Group members can read Opti's replies in the group; replies about health, money, documents or private items are sent to the asker's private chat instead, and the group only sees a short note that a private answer was sent. Opti reads only messages addressed to it (in Telegram, mentions, replies and commands; in WhatsApp, messages that start with "Opti"), and only answers connected adult members of the linked household; anyone else receives a single generic message telling them how to connect. For a WhatsApp group, a join request is approved automatically only when the phone number belongs to a connected adult of that household. Unlinking a group, or removing Opti from it, stops Opti answering there.
- Optional messages from Opti: Opti messages you first (for example a daily briefing) only if you turn that on in Settings, and you can turn it off at any time.
- Stopping: send STOP in the chat, or press Disconnect in Settings. Either ends the connection and deletes the link; items already added are kept. Deleting your account removes the connection.
8f. Document Vault
If the Document Vault is available to you, you can store copies of documents such as identity papers, policies, warranties, receipts and school papers.
- What we store: the file you upload (PDF or image) and its details: title, category, who it belongs to, dates you enter, an optional amount, reminder settings and links to related items in OptiAI.
- Storage and security: files are kept in a private store and encrypted at rest. New files are also encrypted with their own key before they are stored, and that key is protected by a separate secret that is not kept with your files. They open only through links that expire within about a minute, and only after you unlock the vault (Face ID, passcode or your authenticator code).
- Who can see it: only you, until you share a document with a named adult in your household, who sees it read-only. Sharing through Data Sharing settings can also reach a whole category where you allow it. Children are never offered as a share target and do not see documents by default. A child aged 13 or over can see a document about themselves only if an adult turns that on.
- Access log: we record each view, share, unshare and deletion of a document so you can see who opened what and when.
- AI processing: Opti reads the contents of a document only when you explicitly ask, one document at a time, using our AI provider as described in Section 8. We never use vault documents to train AI, and never read health documents this way. Opti can find a document and show its title, category and dates without reading it. When you add a document you can tap "Let Opti suggest details" so Opti reads that file once to suggest its name, type, whose it is and its dates; nothing is saved until you confirm.
- Files you already have: if you ask, Opti adds a private vault copy of receipts, insurance papers and trip documents you already stored elsewhere in OptiAI. The originals stay where they are.
- Reminders: expiry reminders go to you and anyone you shared the document with. They name the type of document, never a document number or health detail.
- Chat apps: if you use Opti in a chat app, it receives a link to open the document in OptiAI, never the file or its contents.
- Retention and deletion: we keep a document until you delete it. Deleting it removes the file and its record. Your documents, shares and reminders are deleted when you delete your account (Section 5). Backups are overwritten on the normal cycle.
8g. Check-in Calls on WhatsApp (India)
If you set up check-in calls for a parent or relative in India, we process the following to run the service:
- What we store: the person's first name and WhatsApp number, their language, the schedule you chose, the topics you asked about, any local contact you add, their consent status and when it changed, and a short written summary of each call (mood, medicines, meals, sleep, a note), plus any concern as a fixed category such as a fall. Summaries are readable by you and by the family members who already help care for that person in Elder care.
- They consent for themselves: under India's Digital Personal Data Protection Act, 2023, the person called gives their own consent by replying YES on WhatsApp, and can withdraw it at any time by replying STOP or telling Opti on a call. If they decline or withdraw, we stop contacting them and do not send reminders.
- No audio or transcript is stored: the call is processed as it happens to produce the summary. We do not keep a recording or a transcript.
- Providers: Meta Platforms (WhatsApp Business Platform) processes the call as our messaging provider, and our voice and AI providers process the content only to deliver the call and produce the summary. The person's WhatsApp number is shown to you only as its last four digits.
- Urgent alerts: if the person mentions something urgent, we alert you by push notification and show the local contact you chose.
- Deletion: you can stop the calls and delete past summaries at any time, and they are deleted when you delete your account.
8h. Family Safety (Check-Ins and SOS)
If a parent in your household turns on Family Safety, or you choose to let someone check on you, we process the data below. Our data protection impact assessment covers this feature. OptiAI is not an emergency service and never shares this data with emergency services or third parties except as described here.
- What we collect: check-in requests and answers (safe, need help, no answer) and when they happened; one precise location (latitude, longitude and accuracy) each time the person taps a check-in, and live locations during an SOS (up to 60 minutes, only while their app is open); an optional mood and short note; the phone number used for check-in calls (calls show only the last four digits in our records); and consent records (who agreed, when, the wording's version and fingerprint, and the child's country and age threshold).
- Lawful basis and children: for children, the consent of their parent or legal guardian (verifiable parental consent under COPPA for children under 13 in the US; parental consent under GDPR Article 8 / UK GDPR for children under the age set by their country, 13 to 16, and under 18 in India); for adults, their own consent, which they can withdraw at any time. Teenagers can see their own history, who can check on them and every time their location was viewed.
- How it is protected: locations and notes are encrypted at rest with keys held outside the database; this data is not available to other apps, AI assistants connected through our MCP server, data exports, household summaries, daily briefs or Opti's answers (Opti can say only when someone last checked in, never where).
- Who sees it: for a child, every parent or guardian in the household, and every request, schedule change, location view and SOS is visible to all of them and to the child; for an adult, only the people they chose. Pushes never include an address.
- Retention: locations, moods, notes and check-in records are deleted after 30 days; the safety activity log (which never contains locations or notes) is kept for about 13 months for accountability, then deleted.
- Service providers: check-in calls are placed through Twilio using a fixed recorded-voice script (no AI voice and no recording); maps are drawn by Google Maps when a guardian chooses to view a location, which sends those coordinates to Google.
- Legal requests: we disclose this data only in response to valid legal process we are required to follow, and notify the affected people where lawful.
8i. Importing Data From Other Apps
Settings > Import your data lets you bring information you already keep in another app (for example Cozi, Todoist, Google Keep, Apple Reminders, Notion or a spreadsheet) into OptiAI, from an export file (CSV, text, JSON, calendar .ics or PDF) or screenshots that you choose to upload, or attach in Ask Opti.
- What is read: only the files you upload for that import. We read them to find items OptiAI supports: tasks, calendar events, shopping list and pantry items, recipes, service providers and medications. Anything else in the file (for example notes, passwords, codes, personal contacts or money records) is not imported; it is listed back to you as something we could not place.
- AI processing: calendar (.ics) files and the Todoist export format are read by our own code. Other files and screenshots are sent to our AI provider, Google Gemini (Sections 7 and 8), only to sort their contents into those items. They are not used to train AI models.
- Review before anything is saved: nothing is added until you review the proposal and tap Import. Items that already exist are flagged. Medications and other private health items are left unselected until you choose them, and cycle, pregnancy and mood data are never imported automatically.
- Retention: uploaded files are stored privately (only you can access them) and deleted once the import is finished or cancelled, and after 7 days at the latest. The proposal built from them is cleared at the same time. We keep a record of each import (when, which app you named, its status and how many items were added) and links to the items it added, so you can undo the import for 7 days.
- Who can see imported items: each imported item follows the sharing settings of the area it lands in, exactly as if you had added it by hand. Your import record itself is visible only to you.
8j. Letters to Your Children
If you write a letter to your child in OptiAI, we process the data below to keep it safe and deliver it when you chose.
- What we store: the letter's title, words, any P.S. notes, an optional photo and voice note, the child it is for and their date of birth (to deliver at an age), your delivery choice (date, age, milestone or vault), who you shared it with, and, for delivery without an account, the email address you give us. If the child writes back, we store their reply.
- Encryption and access: the words, P.S. notes, replies, photo and voice note are encrypted at rest with keys held outside the database. Only you, a co-parent you share a specific letter with, and the child after delivery can read a letter. Opti's answers, daily briefings, household summaries and AI assistants connected through our MCP server see only titles and when a letter is sealed until, never its words.
- Retention: letters are kept long-term on purpose, with no expiry, until you delete an undelivered letter or your account. Delivered letters stay available to the child. Private email links and one-time codes are stored only as hashes.
- Children: the letter is written by the parent; a child's own data (their account, and any reply) is handled under our children's privacy terms above.
- Service providers: delivery emails and one-time codes are sent by our email provider (Resend); notifications by our push providers.
8k. Family Letters
If you write or receive a family letter (a letter between two members of a household who have accounts), we process the data below to keep it private and deliver it when the writer chose.
- What we store: who wrote it and who it is for, the household, the letter's words, an optional photo and voice note, a title, and when it opens (now, a date, or an occasion resolved to a date from information already in your account, such as a birthday or wedding anniversary). For a writer under 13 we also store when a parent was asked and which parent approved or declined.
- Encryption and access: the words, photo and voice note are encrypted at rest with keys held outside the database. Only the writer and the recipient can read a letter, and the recipient only once it opens; before then the recipient sees only who it is from and when it opens. A parent of a writer under 13 sees the letter once, to approve it. Family letters are never shared through Data Sharing, household roles or admin access. Opti's answers, briefings and AI assistants connected through our MCP server never see a letter's words.
- Children: a child under 13 can send a letter only after a parent approves it, as part of our children's privacy practices above.
- Retention: letters are kept until the writer deletes an undelivered letter or their account; a delivered letter stays with its reader.
- Service providers: notifications (which never include a letter's title or words) are sent by our push providers.
8l. Care Team and Care Log
If your family uses Care Team, or you join a family's Care Team as a caregiver, we process the data below to run the care log for the family.
- What we store about a caregiver: the name and role the family entered, the email address or mobile number the invitation was sent to, the dates of the engagement, shifts (start and end times, with no location), confirmation that you are 18 or older and which version of the Caregiver terms you accepted and when, the care log entries and messages you write, and your work record.
- Children's data entered by someone other than a parent: care log entries about a child (meals, naps, nappies, outings, homework, screen time, medication given, incidents, notes and photos) are written by the caregiver on the family's behalf and belong to the family's record. Naps, nappies and feeds of a child under two are stored in the family's Baby tracker; medication given is stored in the child's dose log. Parents in the household (and the household owner) can read the whole care log.
- What a caregiver can see: only a care card for each child assigned to them (name, age, photo if the family allows it, today's routines and schedule, allergies, diet, medication they may give, emergency contacts, the pick-up list and the doctor's and pharmacy's contact), the family's handover note and the house notes the family chose to share, and their own entries. A caregiver is never added to the household and gets nothing through household roles, Data Sharing, calendars, family feeds or Opti. Photos are shown through links that expire within minutes.
- Opti for caregivers: works in a restricted mode that can only turn the caregiver's words into care log entries (always shown for confirmation first), answer questions from that caregiver's own care cards, and pass a message to the family. Messages a caregiver sends Opti on WhatsApp or Telegram are handled the same way and only for the family they chose. The text is processed by our AI provider (Google's Gemini) to do this.
- Translation: entries, messages, summaries and handover notes may be translated by our AI provider into the reader's language; the original words are always kept.
- Alerts: incident reports are pushed to every parent at once (including during quiet hours) and, if not acknowledged within 15 minutes, emailed. Notifications to a caregiver never include a child's name.
- Retention and deletion: the care log is kept with the family's data until the family deletes it, the child's profile or their account. When care ends, the caregiver loses access immediately and keeps only their work record (family display name, dates, shifts, hours and an optional reference, never children's names, photos or entries). If a caregiver deletes their account, their work record is deleted and the family's entries stay, shown as written by a former caregiver. If the family is deleted, the caregiver's work record loses the family's name.
- Letters from a caregiver: a caregiver can write a letter (words, an optional voice note and photo) to a child assigned to them. It is encrypted like every letter in OptiAI, with keys kept outside the database, and is readable only by the caregiver while they are assigned, by the child's parents once it has been sent for review, and by the child once a parent has approved it and it has opened. Notifications say who wrote to whom, never what the letter says, and Opti never reads a letter into an answer or briefing. Letters a parent has not decided on are withdrawn when care ends (the family keeps the record, with the words), unsent drafts are deleted, and approved letters stay with the family and the child. If a caregiver deletes their account, their unsent drafts are deleted; letters already sent for review or approved stay with the family.
- Service providers: invitation and alert emails are sent by our email provider (Resend); notifications by our push providers; WhatsApp and Telegram by those services when the caregiver chooses them.
8m. Elder Care (cared-for adults)
If your family uses Elder care in Health > Family, or you are the person being cared for, we process the data below. This is health-related information about an adult, so access is limited to the people the person chose.
- What we store: the name, relationship and optional date of birth the family entered; for a person with their own account, the email address a request was sent to (until they answer) and their consent and any later revocation; for a managed profile, the basis the adult recorded, their name and the date; the care plan (routine, mobility aids, diet and fluids, medication schedule, appointments, emergency contacts and where an advance directive is kept, never the document); and the entries carers and family write (vitals such as blood pressure, pulse and blood sugar, medication given, meals and fluids, mobility, mood and orientation, visitors, and falls or incidents).
- Who can read it: the person themselves (always, including after they stop the log), the family members they chose, and a home aide only while assigned and while consent is valid. A parent or owner of a household who was not chosen cannot read it, and it is not shared through Data Sharing, family feeds or the Baby tracker; dated appointments and refill days appear only on the calendars and weekly digests of the person and their chosen readers (see Plan links below). Health records, documents and money are not opened by this feature. Entries are never used for advertising.
- Stopping: when a person with an account revokes consent, every aide and reader loses access at once and the aides' devices are cleared the next time the app opens; earlier entries stay in the person's account. A managed profile can be deleted by the adult who set it up, which deletes its entries. If the person deletes their OptiAI account, their log is deleted with it.
- Opti and translation: an aide's Opti works in the same restricted mode as for childcare (care log entries shown for confirmation first, answers only from that aide's care card). Family members who were chosen as readers can ask Opti about the log ("how did Dad sleep this week"). Text may be processed by our AI provider (Google's Gemini). Opti does not diagnose or give medical advice; "outside usual range" is an informational flag from fixed thresholds.
- Alerts: a fall report is pushed to the chosen readers at once (including during quiet hours) and emailed if not acknowledged within 15 minutes. Notifications to an aide never include the person's name or any health detail.
- Audit: creating a managed profile, and changes to who can read, are recorded in the household's audit log with the person who made them and the date.
- Plan links (appointments, refills, aide reminders): we store an optional date and time for an appointment in the care plan, a refill-by date and pharmacy name for a medicine on the care plan, and reminders a family editor sets for a home aide (the aide, the time, a short note, and for a medicine reminder which medicine). Appointments and refill days are shown on the calendars and weekly digests of the person and the readers they chose only, and a refill marker never shows the medicine name. If a reader adds a refill to the household shopping list we write a general label such as "Pharmacy pickup"; the medicine name is written only when the reader switches on "Show the medicine name", because the list is visible to the whole household. A private refill reminder is visible only to the person who created it. Aide reminders are shown only to an aide who looks after that person, inside their care dates (a medicine reminder only to an aide allowed to give that medicine); the notification to the aide's phone carries no name and no health detail. Everything stops the moment the person stops sharing or the aide's care ends, and reminders and refill dates are deleted with the profile. We do not read or write your Health medication records for this.
8n. Pet Care (pet sitters and walkers)
If your family uses Pets > Care Team, or you look after someone's pet through OptiAI, we process the data below. It describes pets and the family's home, not people's health.
- What we store: the care card the owner wrote for a pet (feeding amounts and times, diet rules, behaviour notes, vet and emergency vet names and phone numbers, where the gear is, and a house access note such as where a key is kept), medication dosing rules, and the log a sitter records (feeds, water, walks with their length, potty breaks, play, medication given, grooming, behaviour, photos and incident reports). A walk records how long, never where: we do not collect a route or a live location.
- Who can read it: the pet's owner, household parents, and members the owner shared Pets with; a sitter sees only the care card and own entries for the pets assigned to them, only while assigned, and never the pet's vaccination, health, weight or insurance records. The house access note is shown only to that pet's sitters.
- Stopping: when care ends or is paused the sitter's access stops at once and the family's data is cleared from their device the next time the app opens; they keep only a work record (family display name, dates, visits and hours, an optional reference), never pet names, photos or entries. If a pet is moved to Rainbow Bridge or deleted, access ends and its entries are deleted with it.
- Opti and translation: a sitter's Opti works in the same restricted mode as for childcare (entries shown for confirmation first, answers only from that sitter's care card). Text may be processed by our AI provider (Google's Gemini).
- Alerts: an incident report is pushed to the owner and household managers at once, including during quiet hours, and emailed if not acknowledged within 15 minutes.
8o. Household Team, Warmth and the Cleaning Schedule
If your family uses Household Team (or you work for a family as staff), we process the data below. It builds on Care Team (8k) and staff are never added to the household.
- What we store about staff: the name, role and contact the family entered, dates of work, check-in and check-out times and attendance marks (no location), tasks and routine ticks, reports of problems, leave requests, and, if the family records them, the pay terms, payments, advances, deductions, petty-cash spends and monthly statements. We do not store bank account or card numbers and block them in notes.
- Who sees pay: the family, the staff member concerned and a house manager the family gave the pay power. Nobody else in the household and no other family can see it. Pushes and lock-screen messages never contain amounts.
- Driver trips and live location: if a family and a driver both turn it on for one trip, the driver's position is shared for that trip only, overwritten as it moves, never kept as a track, and deleted when the trip ends or sharing stops.
- AI use by staff and caregivers: messages a staff member or caregiver sends to Opti for your family's workspace, and their voice recordings, are processed by our AI providers to log and translate, are billed to your family's allowance and are not used to train models. We keep a count of AI requests per person per day for the limit you set.
- Points, badges and reactions: we record the small setup rewards a family earned, reactions (who reacted, to which entry, with which reaction) and compute badges from counts of entries, photos, hours and days of service. Badges for a staff member or caregiver are visible to that person and, unless the family hides them, to the family.
- Cleaning schedule: the plan (rooms, tasks, who does what, ticks) is visible to your household. Room photos used to draft a plan are not stored; done-photos you attach are stored with your household's other photos.
- Opti Score: sub-features about your care team appear only if your household has an active helper, and use counts and dates, never what was written.
- Milestones from the care log: when a parent marks a care log entry as a milestone we store which entry it came from, the milestone and its date, and link (not copy) that entry's photos and voice notes to it. A caregiver may flag their own entry as "maybe a milestone"; that sends the parents a notification without the child's name, and the caregiver never sees whether it was marked. A pet's or an adult's moments are stored on their profile (an adult's only with their consent, and visible only to them and the people they chose). Milestones celebrate a moment; they are not a health assessment.
- Milestone photos and short videos: when you add a milestone (in Childcare, or with "Log a moment" in Learning) you can attach one photo and one short video (up to 60 seconds). The photo is kept with the milestone in a private storage area; the video goes into your private family media library described below. Both are seen only by the people who can already see that milestone (you, a co-parent, and anyone you granted Milestones through Data sharing). Caregivers and children with their own account cannot add them. They are not sent to an AI model. Deleting the milestone, the child's profile or your account deletes them, and they are included when you export your data.
- Photos, videos and voice notes (shared media library): photos, short videos, voice notes and PDFs added to a care log entry, milestone, task, school event or letter are stored in a private family media library. Photos are resized and converted on your device and the location and other hidden details (EXIF) inside them are removed before they are saved; a thumbnail is kept so the file previews quickly. Audio and video metadata is not currently removed. A file can be seen only by the people who can already see the entry it is attached to, so a caregiver loses sight of it the moment their access ends. Files are opened only through short-lived signed links. The person who added a file, or a parent, can delete it; files are also deleted when the entry, the family or the account is deleted. Each family has a storage allowance, and nothing in the library is used for advertising.
8p. Learning Studio (Home Learning Records, Tutor and Circles)
Learning Studio is for parents and guardians in the United States who plan and record their children's learning. This section explains what we collect and how we protect it. It adds to Section 10 (Children's Privacy and Parental Data) and, where stricter, it applies. A child never signs up on their own: a parent or guardian creates and controls each child's learning profile, and any sign-in for a child is an account that parent sets up under Section 10a (Child Accounts), which is how we obtain verifiable parental consent under the Children's Online Privacy Protection Act (COPPA).
- What we store: the child's first name and learning profile, plans and lessons, sessions (what was done, for how long), practice attempts and answers, marks and rubric self-assessments, portfolio items and hours, attendance, mastery and review dates (derived from attempts), transcripts and courses a parent issues, and reports and weekly notes. It belongs to your household and is used only to run these features.
- Lesson time (system-recorded): while a lesson screen is open, visible and in use, the app sends a short signal about every 30 seconds, and our servers add up the active seconds for that lesson. We store only the running total of active seconds, the time of the last signal and whether the lesson is the child's current one. We do not record what is on the screen, keystrokes or location. If a parent changes a lesson's minutes, we keep the recorded value, the new value, which parent made the change, when, and the reason they typed, and log the change in the household's activity log, so the hours you export show where each minute came from (system-recorded, adjusted by a parent, or logged by a parent by hand). This data is kept with the learning records and deleted with them.
- School records sharing: report cards, grades, subjects, homework, awards and school goals are visible to the child's parents and, only if a parent chooses, to a named adult in the household through Data Sharing → School records (view only, view and edit, or full access, as the parent picks). It never opens lessons, mastery, learning hours, learning-difference notes or tutor chats, and a parent's private note on an award is never shown to anyone else. Anyone a parent has given Learning records can also see School records, read-only. Earlier "Education" shares were moved to School records automatically, with the same person and the same access, and the change is recorded in the household's activity log.
- Learning differences (special category): notes about how a child learns, and the supports you switch on, are stored only after a separate agreement from you for that child (notice
special_category@2027-02). They are visible only to the parent or guardian who created them, plus anyone that person individually chooses through Data Sharing; they are never sent to an AI model, never used in analytics, Opti memory or anything else, and are excluded from exports and shared records by default. Withdrawing consent takes effect straight away for any new note or support; existing notes stay private until you delete them. We never infer, label or diagnose a learning difference, and our system will not answer "does my child have X". A formal plan you upload is stored privately in the same way. - Where to start and mastery: a "where to start" check is a planning aid, not a test or assessment. Mastery is calculated from your child's own attempts and used only to schedule reviews. In Kindergarten lessons we also keep, with each attempt, whether the child used "Show me" for that question, because a question only counts as known when it is reached without it.
- AI drafts: when AI helps draft a lesson, weekly note or narrative, we send the model the subject, grade level and learning goal, never your child's name, and never learning-difference notes. A parent reviews every draft. Our AI provider processes it under a data-processing contract as our processor, and is not permitted to train its models on it. Learning AI use is metered per household and recorded as counts and dates, not content.
- Future page (career and interest ideas): when a parent builds or refreshes a child's Future page, we send the AI model the same de-identified summary used for progress read-outs (grade level, grade trends, mastery percentages, homework and attendance rates, award counts by category, how long sessions run, and short interest topics), never the child's name, age, teacher remarks, learning-difference notes or any free text. We store the result (strengths with the evidence they came from, suggested pathways, areas or interests, suggestions, talk prompts and a short history of how it changed each term) until you delete it or the child's profile. Grade gap checks are visible to parents only. Interest topics a parent or a teen (13 and up, from their own child account) enters are stored as short topics, and only the topic is used. A teen sees only the pathways a parent chooses to share, the suggestions and talk questions for those shared pathways, and their own interest list, never grade gap checks or anything about an unshared pathway; a child account never uses AI. Someone you share Learning records with can read the page but not change it; a School records share does not include it. No salary or job-growth figures are generated or shown.
- Portfolio evidence: photos and files are stored in a private storage area, are opened only by short-lived signed links, and have location and other metadata (EXIF) removed from images on upload. Audio and video metadata is not currently removed, so please do not add recordings you would not want to keep.
- Code and labs: code a learner writes in the coding studio runs on their device and is saved only as the learner's attempt. Virtual labs are simulations; a lab report is learner-written text filed in the portfolio. Standards and open-licence materials (Common Core, NGSS, CSTA, OpenStax, Project Gutenberg, PhET) are credited as described in Terms Section 10U.
- Transcripts and compliance: a transcript or compliance document is created by the parent from the records; it is not accredited and is not legal advice. A teen can read their own transcript.
- Reports and problem notes: if you rate or report a lesson we keep your user and an optional note. Quality statistics we use to improve lessons are aggregate only.
- Teen visibility: for a teen aged 13 to 15 a parent sees full detail by default; for 16 to 18 a parent sees summaries by default, and a parent can change it. The teen is told what their parent can see and is told when it changes. The teen can see the same safety flags the parents see.
- Turning 18: when a child turns 18, they can take their records. A parent's access ends unless the adult child chooses to keep sharing.
School Records, Achievements and Insights
The Learning Studio now includes a child's school records (report cards, grades, subjects and teachers, homework, school notices), achievements and awards, learning goals and school history. These used to sit under Childcare, Education. They now follow the same access rule as Learning records.
- Who can see school records: the child's parents or guardians. A child with their own account sees their own awards and goals where the app shows them, not report cards or a parent's notes. Another adult in the household sees school records only if a parent grants it to that named person in Settings, Data sharing, School records (view only, view and edit, or full access), or has given them Learning records, which includes read-only access to school records. Other adults in a household no longer see school records automatically. Earlier "Education" shares were moved to School records with the same person and the same access. Caregivers and Circles never see them.
- Report card photos: if you add a report card from a photo, the photo is stored in a private storage area under your household, opened only by short-lived signed links, and kept until you delete it or delete the child's records. To read it, the image is sent to our AI provider, which acts under a data-processing contract as our processor and may not train its models on it. Opti shows you what it read and nothing is saved until you check and confirm. Learning AI use is metered per household.
- Achievements: an award has a title, date, category and an optional description. A parent can add a private note to an award; only parents see the note, never the child or another adult. The child sees the award and a "new" mark until they have looked at it. A share image of an award is built only from the title, category, date and first name, and is created on your device when you choose to share it.
- "How is your child doing" insights: a parent can ask for a short read-out of how a child is doing. We send the AI model only de-identified figures (for example grade trends by subject, mastery percentages, homework hand-in rate, attendance, weekly minutes, award counts by category and topic labels that pass a safety filter). We never send the child's name, teacher remarks, learning-difference notes or supports, diagnoses, or any free text you typed; the name is added back on your device. Insights are for parents only, require an adult account (18 and over), and each saved insight is kept with the evidence it relied on, so you can see why it was said, with the learning records, until you or the household delete them. They are suggestions, never a grade or an assessment.
- Homeschool report cards (OptiAI Core): for a child you homeschool with OptiAI Core, we work out a draft report card on our servers from the learning records already described above (lessons planned and mastered, answers to lesson checks and lesson time). No new kind of information is collected. When you finalise a card we keep an unchangeable copy of it, together with who finalised or reopened it, when, and any reason you gave for changing a grade, so the record stays trustworthy; this history is deleted with the child's records. Drafts are visible only to the child's parents; a finalised card is visible to the same people as other school records. A child account never sees report cards. If you ask Opti to draft strengths and next steps, we send our AI provider only the subject names and the numbers (for example lessons mastered and check accuracy), never your child's name, your comments, your grade changes or any free text, and it may not train on them. Grade 9 and up, finalised semester grades are added to the child's homeschool transcript in the app.
- Goals and school history: goals (target, progress, streaks) and a child's school history (past report cards, grades and the end-of-year grade change) are stored with the learning records, visible to the same people as above, and deleted with them. Ending the school year moves the grade up once.
Early Years (Birth to 5)
Early years in the Learning Studio (infant, toddler, twos, Pre-K 3 and Pre-K 4) is built for a grown-up to use. The activities are opened from your own account and your own device.
- The parent is the user: we collect no data from the child. Your child has no account and no login under 5, and nothing in early years asks a young child to type, speak or sign in.
- Voice and photo inputs are off: early-years activities do not use a microphone or a camera for the child.
- Analytics are off in Play together: the full-screen shared play session on your device records no analytics.
- "Log a moment": if you choose to log a moment from an activity, it is saved to your private Childcare record (Milestones). Any photo or short video you add stays in that private record and is not shared unless you grant access through Data sharing.
- Screen-time limits: each child's daily screen-time limit, bedtime and minutes used are stored on our servers, so the limit works across devices.
- Play history and stickers: when an activity is finished we save which activity it was, when it started and finished, the minutes on screen and, for Pre-K 3 and Pre-K 4, the sticker it earned. This is saved to the child's profile on our servers so it shows on every family device. It is recorded by the grown-up's account; we do not record audio, photos or video of the child, or anything the child says. Parents in the household and anyone you have shared Learning records with can see it. It is kept until you delete it or close the account, is included when you download a child's data, and is deleted with the child's profile.
- No diagnosis: nothing here assesses or labels your child.
AI Tutor (not available for now)
- Not available for now: OptiAI's AI features are for adults (18 and over). The AI tutor is switched off and no child's or teen's messages are sent to any AI model. It returns only after teen-facing AI moves to a provider whose terms allow use by teens; we will update this policy, and the parent notice, first.
- If it returns, consent and age: the tutor would be available only for ages 13 and up and only after a parent or guardian turns it on for that teen (notice
ai_tutor@2027-02). It is not available to children under 13 and we do not ask for or accept consent for under-13s. A parent can turn it off at any time and it stops immediately. - What the tutor receives: the teen's messages in the session and the lesson context. It does not receive learning-difference notes, financial information or your other family data. Tutor chats are never added to Opti's memory, never used for advertising, and never used to train a model.
- Retention: tutor chat text is kept for 12 months, then replaced by a short summary and the original text deleted. Session counts and dates are kept with the summary.
- Safety flags: a wellbeing or safety signal creates a flag that stores a category code and a time, never the words. Both parents or guardians and the teen can see it. Parents receive a notification without the child's name or content. Opti shows 988 Suicide & Crisis Lifeline information and urges a trusted adult. We do not contact emergency services for you. These automated checks are imperfect and may miss things or flag things in error.
Circles (Parents Only)
- What we store: membership (adult names and the households in a Circle), the children a parent attaches shown to other members as first name and age band only, events and RSVPs, posts by adults, and shared plans.
- Place: an event's place or address is shown only to families who replied "yes". We store no GPS or location of attendees.
- Trips and permission slips: we keep the slip, the typed name used as the signature, and when it was signed. Emergency contacts you give for a trip are readable only by the trip lead, for the trip and for three hours afterwards, and only for families that replied "yes".
- Reports and review: reports and the content they concern are reviewed by our Trust and Safety team. Posts may be screened automatically for unsafe content. Our targets are 4 hours for severe reports and 2 business days for the rest. We keep a log of reports and actions for safety and legal purposes.
- No children's media, no children's boards: Circles accept no photos or videos of children and have no boards for children or teens.
- Sharing a plan: shared plans include content only, never a child's data, and carry the licence you chose.
Security, Retention and Your Rights
We maintain a written information-security program with access controls and encryption in transit and at rest, and we keep children's data only as long as needed for the purpose: learning records until you delete them or close your account, tutor chat text for 12 months as above, and learning-difference notes until you delete them. We never sell children's data. We do not disclose it to anyone else except our service providers (which act on our instructions) and as the law requires; if we ever wanted to share it for any other purpose we would ask for your separate consent first. You can review, export or delete a child's learning data at any time in the app, or by writing to support@optiai.me, and each consent in Learning Studio can be withdrawn separately.
9. Cookies and Tracking
We use cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with small amounts of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
Google Analytics 4
Our website uses Google Analytics 4 (GA4), a web analytics service operated by Google LLC. GA4 collects anonymized page view data, device and browser information, and approximate geographic location (country/region level) to help us understand how visitors interact with our website. This data is used solely for improving the Service and is not linked to your OptiAI account. GA4 uses cookies to track sessions across pages. Data collected by GA4 is processed in accordance with Google's Privacy Policy.
Meta Pixel
Our website uses the Meta Pixel (formerly Facebook Pixel), an analytics tool operated by Meta Platforms, Inc. The Meta Pixel collects page view and conversion event data to help us measure the effectiveness of our advertising campaigns and understand how users navigate to our site. Meta Pixel uses cookies to track sessions. Data collected by the Meta Pixel is processed in accordance with Meta's Privacy Policy.
Meta Conversions API and First-Touch Attribution (web)
First-touch attribution. When you arrive on our website, the web app records, in your browser, how you got here: any campaign (UTM) parameters on the link, advertising click identifiers (such as Google's gclid, gbraid and wbraid, Meta's fbclid and the Meta cookies _fbc and _fbp, or ttclid), the page you landed on, the origin of the referring site, and your browser's user-agent string. If you then create an account, we store this first touch against your account (the first touch is kept and not overwritten by later visits, except that a later paid-campaign visit replaces an earlier organic one) so we can measure which of our channels bring people to OptiAI. We attribute only accounts created within a few days of that visit. On the native apps we do not use this web capture (see Android install attribution below).
Meta Conversions API (server-side measurement). When you create an account, or make your first paid subscription payment, after arriving from one of our advertisements, our servers may send Meta Platforms, Inc. a limited conversion event ("CompleteRegistration" for the account, or "Purchase" for the first subscription payment, with the payment value and currency). The event may include the Meta cookies or click identifier, your IP address and browser user-agent, and, only if you arrived through an advertising or campaign link, a one-way SHA-256 hash of your lower-cased email address, which Meta uses only to match the event to its own users. We do not send your name, and we never send any health, child, financial, household or other content you keep in OptiAI. Renewals are not reported. These events are not sent if your browser sends Do Not Track or Global Privacy Control, or if you have opted out of marketing measurement. Meta processes this data under Meta's Privacy Policy.
Do Not Track
Analytics tracking (Google Analytics 4 and Meta Pixel) is automatically disabled when your browser's "Do Not Track" (DNT) setting is enabled. We respect this signal and will not load tracking scripts when DNT is active. On our marketing website (myoptiai.com), Google Analytics and the Meta Pixel measure visits and clicks on our sign-up links; they are not loaded when Do Not Track or Global Privacy Control is on, or for visitors in the EU, EEA, UK or Switzerland unless they have opted in.
Native Mobile Apps
Google Analytics 4 and the Meta Pixel (web) are not active in the native iOS and Android apps; the Android app has a separate, consent-based install attribution described below. Web analytics tracking described above applies only to the web version of the Service (optiai.me). Mobile analytics in the native apps is described immediately below.
Mobile Analytics & Advertising Identifiers (Firebase)
In our native iOS and Android apps, OptiAI uses Google Firebase Analytics (Google Analytics for Firebase), a mobile analytics service operated by Google LLC, to understand how the app is used and to measure how people discover OptiAI (for example, install-to-registration attribution).
- What may be collected: On mobile this may include a device advertising identifier (the Google Advertising ID on Android) together with standard device and usage identifiers. On iOS, we use Apple's SKAdNetwork and Apple Search Ads attribution (AdServices) for privacy-preserving install attribution rather than a cross-app advertising identifier. Install and sign-up measurement events (for example, that an account was created, or that you used Opti for the first time) are recorded only for adult accounts and never for a child account.
- Who processes it and how: This data is processed by Google acting as our analytics and measurement provider. It is used only for aggregate analytics and attribution and is never sold. It is not used to build advertising profiles of you within the Service.
- Your controls: You can reset or limit your advertising identifier at any time in your device settings (on Android: Settings → Google → Ads; on iOS: Settings → Privacy & Security → Tracking / Apple Advertising). Residents of the EU/UK and California have rights over this data under the GDPR, UK GDPR, and CCPA — including access, deletion, and opt-out — which you can exercise using the contact details in Section 19.
Data processed by Firebase is handled in accordance with Google's Privacy Policy.
Android Install Attribution (Google Play Install Referrer and Meta app events)
In the Android app we measure which of our advertisements led to an install as described below. The iOS app has no Meta SDK and no advertising-identifier or App Tracking Transparency tracking; it uses only Apple's own Search Ads attribution (below).
- Google Play Install Referrer. On first launch the app reads the install referrer that Google Play provides: the campaign details of the link you installed from (such as UTM source, medium and campaign, or an advertising click identifier such as Google's
gclidor Meta'sfbclid) and the click and install times. It is kept on your device until you create an account; we then store it against your account as the first touch (as described above) so we know which channels bring people to OptiAI. It contains no name, email or content from your account. - Meta app events. The Android app includes the Meta (Facebook) SDK for app events only (no Facebook Login and no Audience Network). If marketing measurement is permitted for you, it reports to Meta Platforms, Inc. that the app was installed or opened and, when you create an account, a single "registration completed" event, together with the Google Advertising ID and basic device and app information, so Meta can credit the advertisement that drove the install. We never send your name, email, or any health, child, financial, household or other content. The SDK stays switched off if you have opted out of marketing measurement. You can also reset or delete your Google Advertising ID in Android Settings → Google → Ads.
- iOS: Apple Search Ads (AdServices). On first launch the iOS app asks Apple's operating system for an attribution token (generated on your device, no advertising identifier, no tracking prompt, valid for 24 hours). If you then create an account, our server sends that token to Apple, which tells us only whether the install came from an Apple Search Ads advertisement and, if so, the campaign, ad group, keyword and ad identifiers. We store those identifiers against your account as the first touch; we do not keep the token. Child accounts never send it.
- Not sold. This data is used only to measure and improve our advertising and is never sold. Meta processes it under Meta's Privacy Policy and Google under Google's Privacy Policy.
9a. Notifications and Notification Emails
If you install our iOS or Android app, we may send you push notifications and notification-related emails — for example reminders you have set up, activity in your household, and occasional messages about features in the Service. These are delivered by OneSignal (see Section 7).
To send them, we provide OneSignal with your account identifier, your account email address, and your device's push token. We also provide a small set of non-identifying attributes — your subscription type, roughly how long you have had an account, a broad activity band, and which parts of the app you use — solely so that messages are relevant rather than indiscriminate. We do not provide OneSignal with any health, medical, reproductive, financial, or children's information, and we do not provide the content of anything you write in the Service.
Onboarding and lifecycle messages. We also send helpful messages by email and push notification after you sign up, such as a setup checklist, a morning briefing or summary, tips for getting more from the Service, a periodic recap, offers about the paid plan, and occasional requests to invite someone or refer a friend. These are sent based on your account state and activity in the Service (for example which setup steps you have completed). You can turn them off at any time in Settings → Notifications (the email and push options there), and every such email contains a one-click unsubscribe link. Opting out stops these messages, not essential service messages such as password resets, security alerts and billing notices.
Lawful basis for tips and news emails. If you are in the EU, EEA, UK or Switzerland, we send tips and news emails only with your consent (for example the optional, unticked box at sign-up, or turning them on in Settings → Notifications); elsewhere we send them on the basis of our legitimate interest in helping you get value from the Service. Where we do not know your country, we use your time zone only to apply the stricter, consent-based rule. Every such email has an unsubscribe link, and you can change the setting at any time in Settings → Notifications.
Life setup reminders. If you start Life setup and leave it unfinished, we may remind you of the next step: at most one message a day, never between 9 pm and 8:30 am in your time zone, by push notification, email, or a chat app you have linked (Telegram or WhatsApp, only if you linked it), for up to about five weeks after your last activity. When a new version of OptiAI introduces Life setup, existing users may receive a short series (one email, then up to one push notification and one email if you have not opened the app) with their personal setup progress. These messages use only your setup progress (which steps are done, skipped or seen, and your overall percentage) and the name of the next step; they never include health, financial or children's details. Turn them off in Settings → Notifications → Setup reminders (which stops every channel), with the "Stop setup reminders" link in any such email, or by choosing "No thanks" when Life setup is offered. We store your setup progress and the state of your setup (started, paused, declined or finished) for as long as you keep your account; deleting your account deletes it.
How to stop receiving them:
- Push notifications: turn off notifications for OptiAI in your device settings (on iOS: Settings → Notifications → OptiAI; on Android: Settings → Apps → OptiAI → Notifications). This stops all push notifications from the app immediately.
- Emails: use the unsubscribe link included in any non-essential email we send. Unsubscribing stops those emails but does not stop essential service messages such as password resets, security alerts, and billing notices, which we must be able to send you while you hold an account.
- Everything: contact us using the details in Section 19 and we will remove you from notification messaging entirely. Deleting your account also removes your record from OneSignal.
If you are in the EU, UK, or California, your rights over this data — including access, deletion, and objecting to direct marketing — are described in Section 6 and can be exercised using the contact details in Section 19.
10. Children's Privacy and Parental Data
The Service includes child care features that allow parents and legal guardians to enter, store, and manage information about their children. This section describes how children's data is collected, used, and protected.
Your Age Band (Adult or Under 18)
We ask each user once whether they are an adult or under 18 and store only that answer (adult or under 18), where it came from (for example the in-app question, Life setup or an invitation) and when it was given or changed — never your date of birth or age. We use it only to switch adult-only features on or off (Family Safety, letting others check on you, the Parent role, bank connections, purchases and calls made by Opti) and to keep a person who says they are under 18 from being a Parent. Changes are kept in a change log for security, and both are deleted with your account. If you close the question without answering, we remember that for a short time so we do not ask again straight away. We record only that the question was answered or dismissed in our product analytics, without your identity in the event details.
Data Collection by Parents
OptiAI does not let a child sign up. Children's data is either entered and managed by parent or legal guardian users on their behalf, or, where a parent has set up a child account under Section 10a (Child Accounts), collected from the child only after the parent's verified consent and only as described there. Data types may include child profiles, vaccination records, growth measurements, developmental milestones, health records, and educational information.
Parental Responsibility
As a parent or legal guardian using the child care features, you represent and warrant that:
- You have the legal authority to provide and manage your child's information
- All information you enter about your child is accurate and provided with proper consent
- You assume full responsibility for the accuracy, appropriateness, and management of your child's data
- If you share access to your child's data with other household members, you consent to their viewing of that information
How Children's Data Is Used
Children's data is used solely to provide the child care features of the Service, including tracking vaccinations, growth, milestones, and health records. We do not use children's data for advertising, marketing, or profiling purposes. Children's data is not sold to or shared with third parties except as necessary to operate the Service (e.g., cloud infrastructure providers) or as required by law.
Learning Studio (home learning records, the AI tutor, which is not available for now, and Circles) is described in Section 8o and applies additional protections to children's learning data.
Financial data: Kids' Money (Section 11b) lets a parent or guardian keep a teaching ledger for a child (allowance, chore pay, savings goals). It records amounts only, never moves money, is managed by the parent, is not sold or shared for advertising, and is deleted under Section 5 (Data Retention and Deletion).
Parental Rights
You may review, modify, or delete your child's data at any time through the Service. If you wish to request complete deletion of all children's data associated with your account, please contact us at support@optiai.me. We will process such requests in accordance with applicable law.
Compliance
Aspire Digital LLC is committed to complying with the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR) as it relates to children's data, and other applicable children's privacy laws. If we become aware that children's data has been collected without proper parental consent, we will take steps to delete such information promptly.
10a. Child Accounts (Accounts a Parent Sets Up for a Child)
Notice version 2026-11-02.d1b. This section is our direct notice to parents and guardians under the Children's Online Privacy Protection Act (COPPA) and our notice for the children's laws of other countries. It applies in addition to Sections 8o and 10 and, where stricter, it applies. The operator is Aspire Digital LLC; our contact details are at the end of this section.
Who Creates a Child Account
Only a parent or legal guardian can create a child account. They sign in to their own adult OptiAI account, confirm that they are 18 or older, choose a child in their household who has a date of birth on file, choose which areas the child may use, and give consent. A child cannot sign up, cannot create or change an account, and cannot add an email address, because the account has none. Creating or loosening a child account asks the parent to sign in again first, so someone holding an unlocked parent device cannot do it. Each child account belongs to exactly one household, and a parent of that child in the household manages it.
What We Collect From a Child, and What We Do Not
- What we collect: the child's first name, date of birth and avatar, a username if the parent chooses password sign-in, the learning work and records the child produces, the chores and routines the child marks complete, game plays in the games available to a child, a notification token if the parent allows reminders on the child's device, and session and device details used only to keep the account secure. The AI tutor is not available for now, so no tutor conversation is collected.
- What we do not collect: an email address or phone number, a postal address, contacts, precise location, photos, videos or audio, free-text profile information, payment details or a payment identifier belonging to the child. A child account is not given a real email address; the sign-in identity we create for it cannot receive email, and we do not send any email to it.
- No ads, no marketing, no tracking: we show no advertising to a child, we do not send a child marketing or promotional messages, we do not build a profile of a child, we do not use a child's data to train AI models, and the usage-analytics and advertising measurement described in Section 9 are switched off while a child is signed in. Reminders to a child are limited to chores, routines, learning and game turns, are set by the parent, and are never sent during quiet hours.
- Limited areas only: a child account can reach only Learning Studio, family games, chores and routines (marking them complete). Everything else in OptiAI, including Opti chat, health, money, documents, messages, Circles and sharing, is refused by the server for a child account, not merely hidden on screen. A child account does not give or receive Data Sharing grants, and it has no subscription or purchase of its own.
Parental Consent and How We Verify It
Before we collect anything from a child, the parent reads this notice and gives consent for that child. We keep a record of the consent: which parent gave it, for which child, the notice version, the date, and how it was verified. How we verify depends on the child's age and where the household is:
- United States, child under 13 (COPPA): we verify that the person consenting is an adult with a payment card check. The parent makes a small card payment that we refund at once; the amount is shown before you pay. The check is done once per parent and covers that parent's other children, with a fresh consent record for each child. It is skipped where the parent already pays us by card, because that existing payment is the verification. A prepaid card does not count for either. If the refund of the check later fails, or the card payment we relied on is later refunded or disputed, the check stops counting: we tell you, and the next child account you open asks you to check again. We keep the payment and refund references as proof of consent, stripped of anything else that identifies you, for the period the law and our retention policy require.
- India, child under 18 (DPDP Act): we require verifiable parental consent for every child under 18 and use the same card check.
- European Economic Area and United Kingdom: we rely on consent given by the parent through their signed-in account with a confirmed email address, plus an emailed confirmation for each child: we send a link to that address, and the child account is opened only after the parent taps it. The link works once and only for a short time. As proof of consent we record when it was confirmed, keeping a one-way fingerprint of the address rather than the address itself. The age at which a child can consent for themselves differs by country; until that age the parent remains the consenting party. Child accounts apply the UK Age Appropriate Design Code defaults: high privacy, no profiling, no nudges to share more, no location tracking and notices written for the child's age.
- Elsewhere (including Brazil): unless a stricter rule above applies, we use the same signed-in account plus emailed confirmation. The household's country, which we take from the household's settings and not from an IP address, decides which rule applies, and where several could apply we use the strictest. If a child's country needs more than the above, we will not open the account until it is done.
Your Rights as a Parent or Guardian
- Review: see what a child account holds, in the app under Settings, Household, Child accounts.
- Export: download a copy of the child account's data. It contains the child's completions, game plays and learning work, and for the AI tutor it does not include the message text of a teen's conversations, which stay with the teen.
- Refuse further collection and pause: pause or resume the account, narrow the allowed areas, turn off reminders or the AI tutor, reset a password or issue a new sign-in code. Pausing stops the child from signing in immediately.
- Withdraw consent: withdraw consent at any time in the app. The account is paused at once, and the child's account data is deleted within 30 days unless you give consent again.
- Delete: delete the child account at any time after confirming by typing the child's name. We also delete it within 30 days of a request sent to support@optiai.me. Your own records about your child (for example the child's profile and learning records that you hold) are your data and stay until you delete them.
- If a parent leaves: only a current parent of the child in the household can manage a child account. A parent who leaves the household, or is no longer marked as a parent, loses access to it at once, and the remaining parents are told. If no parent remains, the account is paused until a parent in the household resumes it.
- Date of birth and turning 18: once a child account exists, only a parent of the child in the household can change the child's date of birth, and every change is recorded and shown to the parents. At 18, the move to a full account needs a parent's confirmation; every parent is told, and if no parent confirms or disputes it, it opens 14 days after the notice reached at least one parent (if no parent can be reached, it does not open until one is). If the date of birth was changed in the last 90 days, a parent must confirm.
- Email alerts: we tell parents when something tries to change how a child account signs in, when a child reaches the ages at which the account changes (13 and 18), and when a young adult asks to move to a full account.
Retention
This is our written retention policy for child accounts. We keep a child account's data only while the account is active and consent stands. It is deleted within 30 days of withdrawal of consent or a deletion request, and when the parent or the household deletes their own account. When a child turns 18 the parent and the young adult are offered conversion to a full adult account, and the young adult can download their records. A child account that is not converted is paused shortly after the 18th birthday because the basis of parental consent has lapsed, and is deleted after a further retention period, with notice to the parent beforehand. A child account that has not been used for 24 months is deleted, and we tell the parent at least 30 days before; if the child signs in before then, nothing changes. Consent evidence (the consent record, the card-check references and the emailed-confirmation fingerprints) is kept de-identified for 3 years after the child account is deleted, then deleted. Tutor conversation text follows Section 8o. Backups are overwritten on their normal cycle, as described in Section 5. We never keep a child's data for a purpose other than running the account.
Sharing
- AI tutor provider (not available for now): the AI tutor is switched off, so no child's or teen's tutor messages or lesson context are sent to any AI provider today. If a teen tutor returns (ages 13 and up, only if a parent turns it on), we will first update this policy and the parent notice and name the provider and its data-processing terms. There is no AI chat for a child under 13, and nothing else about a child account is sent to an AI provider.
- Other service providers: infrastructure, payment-card verification and security providers acting on our instructions, and no one else, except where the law requires.
- Circles stay parent-only: a child account cannot join, post in or see Circles. Parents who attach a child to a Circle show other members only the child's first name and age band, as described in Section 8o.
- Consent covers collection and use only: your consent to a child account covers collection and use only. We do not disclose a child's information to any third party other than the service providers listed here, which act on our instructions under written contracts that require them to keep it confidential and secure and not use it for any other purpose. If we ever wanted to disclose it to anyone else, we would ask you for a separate consent first, and you could say no without losing the child account.
- We never sell or share a child's data for advertising, and a child has no public profile.
Security
We run a written information-security program for children's data: access controls enforced on the server for every table and function, encryption in transit and at rest, step-up sign-in for sensitive parent actions, and one-time, short-lived hand-off codes for signing a child in.
Your Legal Rights by Region
- United States (COPPA): you may review the information we hold about your child, ask us to delete it, and refuse any further collection or use, at any time, without having to give a reason.
- European Economic Area and United Kingdom (GDPR Article 8 and the UK Age Appropriate Design Code): consent for a child under the national age of digital consent is given by the holder of parental responsibility. You also have the rights in Section 6 for your child, including access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority.
- India (Digital Personal Data Protection Act): we obtain verifiable parental consent before processing a child's personal data, we do not track or monitor a child's behaviour or direct advertising at a child, and you may withdraw consent, request access and erasure, and use our grievance contact below.
- Other countries: where your country's law gives parents more rights, you have them.
Contact
Aspire Digital LLC, 9600 Great Hills Trail, Suite 150W, Austin, TX 78759, USA. Telephone +1 512-231-2218. Email support@optiai.me (privacy@optiai.me for privacy requests). Write to us to review, export or delete a child's data, to withdraw consent, or about anything in this section. We will respond within the period the law requires.
11. Household Features and Shared Data
The Service includes household features that allow multiple users to share data and collaborate within a shared household. This section describes how shared data is handled from a privacy perspective.
What Data Is Shared
When you join or create a household, certain data may be visible to other household members with appropriate permissions. This may include grocery lists, meal plans, tasks, health data (when sharing is enabled), childcare data, and other information you choose to share. You are responsible for reviewing what data is shared before enabling household sharing features.
Data Ownership
Each user retains ownership of the data they contribute to a household. Shared views are provided as a convenience and do not transfer ownership. When you share data with household members, you grant them a limited, revocable right to view and interact with that data within the Service.
Private and Surprise Calendar Items
You can mark a calendar item as private (only you see it) or hide it from specific people (for example, to plan a surprise) while everyone else who shares the calendar still sees it. You can also choose to show it to others as a "Busy" block, which shows only the time, never the title, notes, place, people or attachments. These choices are enforced on our servers for every way the item can be read, including household owners and administrators, shared calendars, search, reminders, notifications, digests, calls, connected assistants and Opti's answers: a person an item is hidden from is not sent its details, and Opti does not mention it to them. A private item cannot be assigned to someone it is hidden from. Only the person who created an item can change who sees it.
Leaving a Household
When a member leaves or is removed from a household, their access to shared household data ceases immediately. Data contributed by the departing member may remain visible to other household members. The departing member retains their own personal data and account.
Consent
By sharing data within a household, you consent to other household members viewing that information. If you enter information about another person (such as a family member's health data), you represent that you have obtained their consent to do so.
11a. Family Games & Social Features
The Service includes family games and related social features. Some games can be played with other households that you invite by email. When you connect with another household or join a league:
- What is shared: Your game participation, scores, and a curated set of positive reactions are shared with the families and leagues you are connected to. Competitive standings are shown at the family level — not as a per-child ranking across households.
- Your control: You can block, report, and leave connections at any time. Connections are only formed by an explicit email invitation and acceptance; there is no public discovery or open join code.
- Children: Games may involve children in your household. The game engine uses only coarse age bands to tailor gameplay — never an exact date of birth or age — and no child's data leaves your trusted circle without your action. We do not knowingly enable children to connect with people outside the households you invite. Children's data is handled consistent with Section 10 (Children's Privacy and Parental Data) and applicable children's privacy laws, including COPPA.
Game and social data is not sold and is not used for advertising. It is shared only with the households and leagues you choose to join and with the infrastructure providers (Section 7) that operate the Service on our behalf.
11b. Financial Data and Household Visibility (Wealth 360)
The Service includes a wealth module for manually tracking financial accounts, transactions, budgets, and income. This section describes who can see that data and how it is handled.
- Household visibility: Financial records you create may be visible to other adults in your household — automatically to a household member marked as a parent, and to anyone you have granted access under Settings → Data Sharing. A household member's account marked as a minor does not have access to any financial record. The Money In, Money Limits, and Money Out sections can each be shared separately, so a household member's visibility can be scoped to just one of them.
- Statement and receipt import: A bank statement or receipt photo you upload is sent to our AI provider to extract transaction data for your review; we do not keep the original file after that processing unless you attach it to a record yourself, and nothing extracted is saved until you confirm it.
- AI budget suggestions: A suggested budget or spending limit is generated from information already in your account (such as household size and past spending) and is informational only, not financial advice.
- Loan details: The loan terms you enter (amount borrowed, interest rate, term, start date, payments and any statement balance) are stored with the liability and used only to estimate its current balance inside the Service. The estimate is calculated on our servers and in the app from your own data; it is not shared with lenders or any third party, and it is visible only to the household members who can already see that liability.
- Accounts and Net Worth: An account added in the wealth module may be mirrored as an asset or liability in your Net Worth summary and retirement plan elsewhere in the Service, so the same account is not entered twice. Like any other asset or liability, that mirrored entry is visible only to household members you have shared Net Worth with.
- Multiple currencies: An account or transaction recorded in a currency other than your household's default is converted for display using a published exchange rate; the currency and amount you originally entered are kept unchanged.
- Not sold: We do not sell financial data you enter, and do not use it for advertising.
- Not financial advice: Budget totals, spending runway, surplus calculations, and any AI-generated commentary about your finances are informational only. See Section 8 (AI and Data Processing) for how this data may be processed by our AI provider.
- Kids' Money: If a parent or guardian uses Kids' Money, we store the child's jar records (amounts entered, allowance schedule, chore pay, savings goals, spend requests and the parent's decision, and which money lessons were completed with the quiz score). It is a record only; no money passes through OptiAI and no bank or payment details are collected. The record is visible to the household owner, household members marked as a parent, anyone the household owner grants Kids' Money access to under Settings → Data Sharing, and the child themself if they have their own login — never to another child in the household. A child can see only their own jars and can only ask to spend or log a gift for a parent to approve. We do not use children's records for advertising and do not share them with OneSignal. The record is deleted with the child's profile or the household, and a parent can ask us to delete it at any time; when a parent closes their own account, the child's record stays with the household and that parent's name is removed from it. When you ask Opti about Kids' Money in chat, the balances and entries are read on demand to answer you and are not copied into Opti's long-term memory.
- Chore Stars and pocket money: If a parent switches on pocket money, we also store the star rate they set (stars per amount, minimum, weekly limit, chosen jar, approval setting), each cash-in (stars, amount, status, the kind reason a parent picked if they said "not now", and who decided) and any routine money values. A cash-in is recorded against the child's Chore Stars and their Kids' Money jars together; it uses the same access rules as Kids' Money above, and a child can only cash in their own stars. Suggested templates are worked out from the child's age and the household's currency and country settings; nothing is sent to third parties to make them. When a parent approves a cash-in from WhatsApp, Telegram or another connected chat app, only the button choice is processed — the child's records stay in OptiAI. Stars and jar amounts are never Opti Points.
- Adding a logged cost to Money: When you choose to add a cost you logged elsewhere in OptiAI (a pet's vet visit, a medicine refill, home maintenance, a home item or hobby gear, or a donation) to Money, we create one expense in your own Money and remember which item it came from, so the same cost is not added twice. A medicine refill is saved as "Pharmacy copay" without the medicine's name. If a bank account you connected through Plaid has already imported the same payment, we use that imported transaction instead of adding a second one, and a later matching import is counted once; we compare only your own transactions, never another person's. The link is visible only to you, and the expense follows your Money sharing choices in Data Sharing. Only the owner can add their own medicines and donations. You can undo it at any time.
- Handing a home job or a meal to someone: When you assign a maintenance job or a meal to a Household Team member, we create one ordinary task for that person (its title and day) and remember which job or meal it came from, so it is not assigned twice. They see only that task, never the rest of your home. If you assign a meal to a cook, the cook is shown only the first names and allergies of your family, and only while you keep Diet on for that cook; no health records, notes or medication are ever shared. When you plan the week's shopping, we read your meal plan, pantry and shopping list to propose items, and add only the ones you tick.
- Trip links (cover while you are away): When you choose to arrange cover for a trip, we store, for your household, the person from your Care Team or Household Team, the dates, what they look after (a child, a pet, a family elder or the home) and any note you write, together with the name we show for that person. We do not copy the trip's name, destination, itinerary or travellers into that record. The sitter or helper sees only the dates, the child or pet they already look after and your note, never the trip itself; people on your Care Team or Household Team are never members of your household. Chores you list for house staff become ordinary tasks on their list. The travel documents checklist on a trip reads only your own Document Vault, shows a status and an expiry date only, never a document number, and is shown only to you. Cover appears on your family calendar and weekly digest for household members. You can remove cover at any time, which also removes the chores it created that nobody has completed.
- Linking a provider (vet, doctor, pharmacy, plumber, nanny agency, school): When you link a saved provider to a pet, a child, a trip, a home item or job, or one of your medicines, we store which provider is linked to which item, the role (for example "vet" or "pharmacy") and who made the link. To bring everything into one place, we also copied the providers you had already recorded (a pet's vet, a child's doctors and school, the pharmacy written on a medicine) into these links; the original records stay where they were. A link is shown only to people who can already see both the provider and the item. A pharmacy linked to a medicine is shown only to the person the medicine belongs to, never to other family members, and medicines related to a pregnancy are never linked. People on your Care Team or Household Team never see your providers; a helper given a home job sees only the name, phone number and role of the provider linked to that job.
- A child's linked bank account: A parent can assign one of their own connected bank accounts (connected through our bank-data provider, Plaid) to a child in Kids' Money. We then use that account's balances and transactions — which we already hold for the parent's connection — to sort the child's spending into their jars, to show parents spending by category and shop, allowance compared with actual spending and saving, and to keep a short list of payments for a parent to check. We also store which account is linked, the sorting choices a parent makes and any shop a parent asked us to remember. Parents (and adults the household owner has shared Kids' Money with in Data Sharing) can see a linked account; the child can see it only if a parent turns that on, never a sibling's account, and children aged 13 to 17 are always told in the app that a parent can see it. A child cannot sort payments or change the link. We only read the account: nothing is paid, moved or held, and unlinking keeps the jar history. Spending answers given in WhatsApp, Telegram or another connected chat app are generated in OptiAI and sent as a message to the person who asked.
11c. Inbox, App Lock, Ratings & Feedback, AI Usage Records, and Access Requests
- Email forwarding (Inbox): If you turn on the Inbox feature, you get a personal OptiAI email address. Emails you forward to it, and any image or PDF attachments (for example a school flyer), are read by AI (Google Gemini) to find events and tasks and add them to your calendar and task list. Emails from a sender you have not approved are not read: we ask you to approve the sender first, and while you decide we hold only a reference to that one email — not its subject, body, or attachments — for up to 7 days, then discard it. For senders you have approved, items are added automatically and every one comes with an Undo option. We keep the items extracted (such as a title, date, and time) and minimal technical details such as the sender address and when it arrived. We do not keep the email body or its attachments; they are used only while the email is being processed. Confirmation emails about what was added are sent only to the email address of your own account, never to anyone named in a forwarded message. Email delivery is handled by Resend and AI processing by Google Gemini (Sections 7 and 8). You can block a sender or turn Inbox off at any time in Settings.
- Face ID / fingerprint app lock: On the mobile app we may require Face ID, fingerprint, or your device passcode to open the app. This check is performed entirely by your phone's operating system. Your biometric data never leaves your device, is never sent to us, and is never stored by OptiAI — we only learn whether your device says "yes" or "no".
- App ratings: After a success moment (for example, approving a child's chore) the iOS and Android apps may ask the operating system to show the store's own rating sheet; Apple and Google decide whether it appears, and any rating or review you give there is governed by that store's terms. We only record, without personal content, that we asked (the trigger, platform and app version) so we do not ask too often. We never ask a child account, never ask on the web, and never give rewards in exchange for a rating. You can also rate the app any time from Settings › Support.
- Feedback and bug reports: When you send feedback in Settings or report a problem, we create a support ticket containing what you wrote and, where relevant, the screen you were on. By default the ticket is not linked to your account. If you tick the optional box "You can contact me about this", we link it to your account so our team can follow up with you; you choose this each time.
- Thumbs-down on an AI reply: When you tap thumbs-down on one of Opti's replies, we create an internal quality ticket that is linked to your account and contains the reasons you picked, any comment you add, and up to the first 600 characters of the Opti reply you rated. It never contains the message you sent to Opti. Only the small team that reviews AI quality can see these tickets. A thumbs-down is not a request to be contacted, and we will not contact you about it. If you delete your account, the ticket is detached from it.
- AI usage records: We keep records of how AI features are used — counts, an estimate of cost, which feature, and whether the request worked — but not the content of your messages. We use these records to apply fair-use limits, to keep costs sustainable, and to improve quality and reliability.
- Data access requests between household members: If you try to view household data that someone has not shared with you, you can ask them for access. The request records who asked, who owns the data, the area requested, and the answer. The person whose data it is receives a notification and decides whether to say no or to grant View only, View & Edit, or Full access; nothing is shared unless they approve it.
- Home Map (where things live): If you use Home Map, we store the names of the rooms, storage spots, and drawers or shelves you create, and for each item which place it is in, how many there are, who last moved it, when, and a history of those moves. Members of your household who can see your Inventory can see this, except items you mark private, which only you can see (this is enforced in our database, so it also applies to Opti and to connected AI assistants acting for another household member). Storage spots you mark sensitive are not described over chat channels such as WhatsApp or Telegram. Household members recorded as children can view but not change it. We do not read health, cycle, pregnancy, mood, or mindfulness information into Home Map; item names that look like such information are refused. Deleting a place keeps your items; deleting an item or your account removes its placement data.
- Bank linking: Connecting an account through Plaid is optional and available in the United States and Canada only. See Section 7 and Section 11b.
- Service providers and contracts: If you save the people and businesses your household uses (for example a plumber, a tutor, a vet or an accountant), we store the contact details you enter (names, phone numbers, email, website, address, account or membership numbers, notes and type-specific details such as a class schedule) and any contract, membership or session-package details you add (dates, cost and currency, what is included, visits used, notice period, and a document link). These records are visible to other household members only through the Data Sharing settings for that area. Doctors, dentists and other clinical care are kept separately in Health › Care Providers. If you add providers from your contacts, only the contacts you select (or the entries you tick in a contacts file you import) are saved; the rest of your address book is never read by us or uploaded, and an imported file is processed on your device. We use these details to show them to you, to remind you before a contract renews, and to answer your questions in Ask Opti; in the future, an assistant feature may use them to contact a provider you choose, only when you ask it to. If you upload a contract document (PDF or photo), it is stored in a private storage area that only you can open; it is never shared with other household members, even if you share the provider. If you tap Read this contract, the document is sent to an AI service to suggest agreement details for you to confirm. If you enter a class schedule, we create matching entries on your family calendar. Insurance renewal reviews and agent emails are drafted from the details you saved and what you tell us, and are only ever opened in your own email app for you to review and send — we never send them.
- Protection and weekly check-ins: If you use Protection, we store which insurance lines you marked not applicable or dismissed, your emergency-fund target and the accounts you chose for it, and for each important document only a status, a review date and a short note about where it is kept (never the document). If you turn on the weekly check-in we store your chosen day and time, and for each week a short summary made of counts and category names (for example how many limits you kept) that never contains a merchant, description or free text. These are visible only to you unless you share Protection through Data Sharing, and are not used for advertising, sold, or used to train any AI model. We do not recommend or sell financial products. You can delete this information at any time by turning features off or deleting your account.
12. Pet Data
The Service includes a pet care module that lets you record information about pets in your household. Pet data may include profile fields (name, species, breed, date of birth), vaccinations, weight logs, feeding and activity logs, health events, and milestones.
Pet data is treated like other personal data you enter: it is stored under your account, accessible to household members you share with, and subject to deletion when you delete the relevant record or your account. We do not sell pet data and do not use it for advertising.
When a pet is marked as deceased ("Rainbow Bridge"), the underlying records remain associated with your account so you can keep memorial entries; you can permanently delete a deceased pet at any time from the Pets module.
13. Community Activity Data
The Service includes a community module where you can optionally log volunteering hours, charitable giving, acts of kindness, and other civic engagement activities. By default, every community entry is marked private to your account — these entries are never displayed on a leaderboard, public profile, or shared feed.
Donation amounts are always optional; the Service is designed so that the act of giving is what is recorded, not the dollar figure. If you do enter an amount, it is stored only under your account and used only for your own tracking and Opti Score computation (Section 14).
14. Opti Score and Engagement Metrics
The Service computes an "Opti Score" for each user — a numerical engagement metric derived from how many features across the modules (Home, Health, Wealth, Activities, Childcare, Pets, Community, Settings) you have set up and used. The score and its module breakdown are visible only to you and (where you have explicitly enabled household sharing) to household members.
The Opti Score is an in-product engagement signal. It is not a credit score, health score, fitness score, financial rating, insurance risk score, or any other regulated rating. It is never sold, shared with advertisers, used to gate access to outside services, or used to make decisions that produce legal or similarly significant effects about you. Modules that do not apply to you (e.g., Childcare if you have no children registered, Pets if you have no pets registered) can be opted out so they do not count toward your score.
Historical Opti Score snapshots may be stored to display trend lines, milestones, badges, and streaks. You can request deletion of this history through the Service or by contacting support@optiai.me.
14a. Home-Screen Widgets
OptiAI offers optional home-screen widgets on mobile. These widgets display only non-sensitive summaries — for example, upcoming tasks, item counts, an aggregate Opti Score, and family reward stars. No health or financial data is exposed to widgets. Widget content is derived on your device from data you already see in the app and is not used for any other purpose.
15. Authorized Personnel Access
A small number of authorized Aspire Digital LLC personnel hold administrative roles inside the Service in order to operate it. These roles are governed by an internal access-control list and are scoped as follows:
- Super Admin / Admin: Required for incident response, customer support escalations, security investigations, and database operations. These personnel may access your account data when responding to a support request you have filed, when investigating a security or abuse signal, or when required by law. All such access is logged.
- Support: May view feedback, support tickets, and account state needed to answer the question you sent in.
- Marketing: May view influencer / referral program data — including referred account email addresses and display names — only as needed to operate the affiliate program (Section 16), validate attributions, and pay commissions. Marketing personnel cannot edit user content, change roles, manage subscriptions, or access health/financial records outside the influencer dashboards.
- Security: Read-only access to security logs and incident reports.
Every administrative write action (role assignment, statement approval, feature flag flip, etc.) is recorded in an internal audit log. Administrative access to customer data is additionally monitored by automated, near-real-time alerting and an independent daily integrity check, so that access by one administrator is visible to another. We use these logs to detect misuse and to comply with our obligations under applicable data protection law.
16. Influencer / Affiliate Referral Program
The Service operates an influencer referral program. If you apply a referral code at signup or later in the Service, we record:
- Which code was applied to your account (first-touch: only the first valid code is recorded)
- The timestamp at which the code was applied
- Whether the referred account became a paid subscriber, and the normalized USD value of that subscription, for the purpose of calculating the commission owed to the influencer who shared the code
We do not share your name, email address, health data, financial data, or any other personal content with the influencer themselves. Influencers see aggregate counts of attributed signups and paid conversions and the commission earned. Authorized marketing personnel internally may view individual attributed accounts in order to validate the integrity of the program and resolve disputes (see Section 15).
You may not change or remove a referral code once applied; we keep the attribution intact for the duration of the configured commission window. After that window, the attribution becomes irrelevant to active commissions and is retained only for historical reporting.
Referring a friend (free month)
If you join using another member's referral code, we record that referral and, when you first pay for a subscription, that a payment occurred (not its details), so that we can reward the person who referred you, for example with a free month of the paid plan or Opti Points. We do not share your payment information, name or email address with them.
Partner agency codes
If you enter a partner code (it starts with "PA-") given to you by one of our partner agencies, such as a nanny, doula or newborn-care agency, we record which code you used, when, the household that was active at the time, and the date your free months end. We use this to give you the free months and to credit the agency for the referral. The agency sees only how many families used its code. We never share your name, email address or anything you keep in OptiAI with the agency. Our staff see a masked form of your email (for example j***@example.com) alongside the code. The record is deleted when you delete your account.
17. International Data Transfers
We are based in the United States and our main providers (listed in Section 7) process data in the United States and other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our contracts with those providers, or on a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of the relevant safeguards at privacy@optiai.me.
18. Changes to Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.
19. Contact Us
If you have any questions about this Privacy Policy, please contact us:
Aspire Digital LLC
9600 Great Hills Trail, Suite 150W, Austin, TX 78759, USA
Telephone: +1 512-231-2218
Email: privacy@optiai.me
Support: support@optiai.me
Website: https://myoptiai.com