Privacy Policy
Effective 16 September 2026 · Last updated 16 September 2026
OVIO is an app for finding calm places to be. This policy describes what the app collects, why, who else sees it, how long it is kept, and how to have it erased. It is written to be read, not to be survived.
The short version. The OVIO app has no account, password, name, or email-address requirement. Your location is used to answer the request you just made and is not stored on our servers. Your requests to the in-app concierge are sent to an AI provider, and the app asks your permission before that happens for the first time. We show no ads, use no advertising or analytics SDKs, and sell nothing to anyone. If you choose to join the launch list on this website, the email address you provide is sent to Brevo, our email-list provider, so we can send OVIO launch and product-availability updates. That website email is separate from your app identity and location data.
1. Who we are
OVIO is operated by Ovio Labs LLC. You can reach us at info@oviolab.org. This policy covers the OVIO iOS app, the OVIO backend service that supports it, and the optional launch-list form on this website.
Website launch list
If you enter an email address on this website to receive launch updates, that address is submitted to Brevo, our email-list provider, and used only for OVIO launch and product-availability updates. We do not connect it to your app identity, location, saved places, or preference profile. We do not sell it. You can unsubscribe from a marketing email or ask us to remove it at any time by writing to info@oviolab.org.
2. There is no account
You never create an account, choose a password, or give us an email address. So that your saved places and preferences survive between launches, the app holds three identifiers:
- A user ID. A random identifier our server generates on first launch. It is stored in the iOS Keychain.
- A device ID. Derived from the identifier iOS gives apps from the same vendor. It is what venue feedback is filed under.
- An anonymous sign-in ID from Firebase Authentication, which lets our server confirm requests come from a real installation of the app rather than from someone poking at our API. It is anonymous in the technical sense as well as the ordinary one: no name, no email, no profile.
The Keychain ID outlives the app. Deleting OVIO from your phone does not delete the user ID, that is deliberate, so that reinstalling restores your saved places instead of starting you from nothing. It also means uninstalling is not the same as being forgotten, which is exactly why the app has a Delete my data control. See section 8.
3. What we collect
Location
When you allow it, the app reads your location and sends it to our server so we can find places near you and work out how far away they are. It is also sent to our maps provider for the same purpose.
We do not store your location. It is used to answer the request and then it is gone. No table in our database holds a coordinate that came from your device. The coordinates we do keep belong to venues - the cafés and libraries themselves, not to you.
OVIO only ever asks for location while you are using the app. It does not ask for background or "always" location access and cannot track you when the app is closed. If you decline, most of the app still works; the parts that are inherently about "near me" will tell you what they need.
What you type
Searches you type on the home screen, and requests you make to the concierge, are sent to our server. Concierge requests are also sent to an AI provider - see section 4, which is about exactly that.
How you use the app
We record the things you do that teach the app what you like: places you save, places you open, places you skip, check-ins, and the persona settings you choose. Each record is stored against your user ID with a timestamp and the venue it refers to. This is what builds your preference profile, which is the product.
Venue feedback
When you vouch for a place, we store your rating and the six fine-tune values (seating privacy, noise, lighting, staff interaction, how long you can linger, and personal space) against the venue's address and your device ID. This feedback is pooled with other people's to produce the venue-level scores everyone sees. The pooled scores are not personal data and are not linked back to you.
Subscription status
If you subscribe, we store whether you are on the free or paid tier, when that access expires, and Apple's transaction identifier, which we need in order to honour a refund or cancellation. We never see your payment details. Apple handles the payment; we are only told the result.
Diagnostics
Our server keeps ordinary operational logs, request paths, response codes, timing, and the IP address the request arrived from, for security and debugging. We do not use them to build a profile of you.
4. Artificial intelligence
The OVIO concierge is powered by a large language model operated by Anthropic. When you use it, the following leaves our servers and goes to Anthropic's API:
- the request you typed;
- the context needed to answer it, candidate venues and their attributes (name, opening hours, busy-ness forecast, sensory notes, and how far each one is from you, expressed as a distance such as "0.3 miles"), and the running thread of the current conversation.
If you use the profile readout, the written summary of what the app has learned about you, that summary is also composed with Anthropic's help.
Your name is not sent, because we do not have it. Your user ID, device ID and sign-in ID are not sent. Anthropic never receives your coordinates , only the distances described above.
The app asks first. Before your first concierge request, OVIO shows a consent screen naming Anthropic and describing what is sent. If you decline, the concierge stays off and the rest of the app works normally. You can change your mind either way at any time, and your choice is recorded on our server, not just on your phone.
Under Anthropic's commercial terms, material submitted through their API is not used to train their models. Their handling of it is governed by their own privacy policy at anthropic.com/legal/privacy.
AI-generated suggestions can be wrong. Every answer carries a notice saying so and a control for reporting a bad one. Please use it, reports are how we find the failures.
5. Who else receives data
We use the following providers to run OVIO. Each one receives only what its job requires, and none of them is permitted to use it for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic | Powers the concierge | Your typed request and venue context (see section 4) |
| Google (Places & Maps) | Finds and describes venues | Your location and search terms |
| Google (Firebase) | Anonymous sign-in | An anonymous ID and basic device information |
| BestTime | Busy-ness forecasts | Venue addresses only, nothing about you |
| OpenWeatherMap | Weather for the area you are searching | Approximate coordinates of the search area |
| Apple | Payments and subscriptions | Handled entirely by Apple; we receive only your subscription status |
| Render, and our database and cache providers | Hosting and storage | Store the data described in section 3 on our behalf |
Venue enrichment also draws on OpenStreetMap, Wikipedia and Wikidata. Those requests concern places, never people, and carry nothing about you.
We do not sell your data, and we do not share it for advertising. OVIO contains no advertising SDK, no attribution SDK and no third-party analytics SDK. We do not track you across other companies' apps or websites. We would disclose data if a valid legal process compelled us to, or to protect someone's safety, and nothing in that sentence has yet been necessary.
6. How long we keep things
| What | Kept for |
|---|---|
| Your location | Not stored at all |
| App usage records (saves, opens, skips, check-ins) | Until you delete your data |
| Concierge conversation threads | Until you delete your data; the live thread expires after 6 hours of inactivity |
| Your preference profile | Until you delete your data; built from your recent activity |
| Venue feedback you submitted | Until you delete your data |
| Subscription status | Until you delete your data, or as long as tax and accounting rules require |
| Server logs | Kept by our hosting provider on a rolling short-term basis |
| Website launch-list email | Until you ask us to remove it or the launch-update list is closed |
| Pooled venue scores | Indefinitely, they describe places, not people, and are not linked to you |
7. Children
OVIO is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has used the app and left data with us, write to info@oviolab.org and we will remove it.
8. Deleting your data
In the app: Profile → Settings → Delete my data. You will be asked to confirm. When you do, we erase, permanently:
- your user record and anonymous sign-in;
- your subscription record;
- your preference profile;
- every usage record we hold;
- your concierge conversation history;
- your venue feedback;
- your saved-place notifications;
- the identifier stored in your phone's Keychain.
This is not reversible and we cannot restore it afterwards. If the deletion fails, the app tells you it failed rather than pretending it worked, if that happens, please write to us.
Deleting your data does not cancel a paid subscription, because Apple, not us, holds the subscription. Cancel it in Settings → your name → Subscriptions on your iPhone.
Pooled venue scores that your feedback already contributed to remain, because they have been combined with other people's and no longer identify you.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, to object to how it is used, and to complain to a data protection authority. Because OVIO has no accounts, the app's own Delete my data control is the fastest route to erasure. For anything else, write to info@oviolab.org and we will respond within 30 days.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any privacy right.
10. Security
Traffic between the app and our servers is encrypted in transit. Your Keychain identifier is stored using iOS protection that keeps it on your device and out of iCloud backups. Access to our production database is restricted. No system is perfect, and we do not claim otherwise, but we hold no passwords and no payment details, which removes the two things most worth stealing.
11. Changes
If this policy changes in a way that materially affects you, we will update the date at the top and note the change in the app. Continuing to use OVIO after a change means you accept the revised policy.
12. Contact
Ovio Labs LLC
info@oviolab.org