Privacy

Who is responsible

The operator of Oyvo is responsible for the processing described on this page. Questions about your data, and every request under the GDPR (access, correction, deletion, objection), go to hello@oyvo.app.

Your account

You sign in with Apple or Google. Oyvo's server keeps the account it made for you, the name and email address that sign-in gave it, and whether your Oyvo Plus subscription is active, which Apple's App Store server reports as a subscription id and an expiry date; no payment details reach Oyvo. Without an account the app answers a question without any of this. Deleting your account in Settings deletes the account and everything stored under it, and signing in again afterwards starts a new one.

What stays on your phone

Conversations, reminders, errands, your preferences and the day plans of your trips are stored on the device. The facts and moments Oyvo remembers are shown as they are kept and can be deleted in Settings, one at a time or all at once; a copy is stored encrypted on Oyvo's server so that they follow you to your next phone, and the server opens that copy only to write your feed. A deleted line is deleted everywhere.

What goes to Oyvo's server

Questions are relayed to the language-model provider through Oyvo's own server, so no provider key ever ships inside the app. Facts the answer may need travel with the question: your preferences, what Oyvo remembers, open errands, and, while a booked trip is within four months, that trip (where, when, what was booked and its state, with its day plan) so that “pack me a list for Dubai” is about your Dubai. Never a booking reference and never a price. Drawn ingredient icons and step illustrations are generated once and stored on the server for every user.

What the server keeps of your questions

Questions and answers pass through Oyvo's server on their way to the model provider and are not stored there. One exception: each answer is also kept on the server, encrypted with a key that only your phone keeps, until your phone confirms it arrived and for at most ten minutes after it ends, so that one still being written when you leave Oyvo or its conversation is finished and waits for you; Erase all my data removes it at once. What is kept is a record of how the turn went: timings, which capabilities were loaded, what it was for (a chat turn, a browser step, a research run) and whether it failed and where, with a one-way digest and a character count in place of the text. The text itself is stored only if you switch on sharing conversations for training, which is off unless you turn it on; a turn that read your health data, a mailbox, a calendar or your contacts is left out of that even with sharing on. Usage records older than ninety days are deleted.

What Oyvo did for you, every mail sent, entry changed, booking made, line forgotten, and every yes or no you gave, is kept with the date on your phone and on Oyvo's server for a year. It cannot be edited, only erased, and it is under Data & privacy in Settings.

The morning brief and routines

When you switch the morning brief on, the app sends the server a coarse location (rounded to about one kilometre), the next 36 hours of your calendar, reminders that are due and errands still open. Switching it off deletes that snapshot. Routines run with exactly the tools you granted them.

The For you feed

If you switch the feed on, Oyvo's server writes it from the sources you allow, each behind its own switch: what Oyvo remembers (the encrypted copy above), your day (calendar, reminders, errands) and connected accounts. Interests you name, and what you exclude, are stored encrypted. A reaction you give a post is kept to shape the next ones. Switching a source off ends its use and drops what the feed kept from it; deleting your account deletes the feed.

Mail

Oyvo reads the mail that arrives in a mailbox you connected: the message, not only its subject line. An assistant cannot tell you which email needs you this morning without reading what is in it. The morning brief and the mail alert read what landed in the last day on Oyvo's server, using the mailbox access you granted and can revoke at any time. Nothing is stored: the text is read to write the brief and is gone with the request. Nothing is searched in bulk, no archive is built, and older mail is not touched. Before the model sees a mail, one-time codes and sign-in links in it are removed. Disconnecting the mailbox ends all of it and deletes the stored access. The morning brief and the mail alert read Gmail or an IMAP mailbox, not Outlook: an Outlook mailbox, connected with a Microsoft account, is read only for what you ask in a chat or grant a routine (see Connected accounts). In a chat, Gmail is read from your phone; an IMAP mailbox and an Outlook mailbox are read through Oyvo's server.

When you set up a mailbox by its address and Oyvo's own checked list of mail providers does not know its domain, Oyvo's server asks Mozilla's public mail directory (autoconfig.thunderbird.net) and DNS, through Cloudflare's resolver, which mail servers belong to that domain. Only the domain is sent there, never the address and never a password.

Pages Oyvo opens for you

When an answer turns on something only a web page can say, or when you hand Oyvo an errand on a website, Oyvo opens that page on its own server and reads it. The request goes out from Cloudflare's network, not from your phone and not from your home connection; the site sees their address, never yours. Before a page is opened, the site is checked against Cloudflare's domain categories and refused if it is pornographic, exists to break the law, or is a site nobody has categorised at all.

Each page opened is logged: the time, your account, the site's hostname (never the full address, which would carry what you were looking for) and whether it was read or refused. A page that was read is kept in that log for thirty days, a refused one for six months, and then it is deleted. Deleting your account deletes it with everything else. If we are ever required by law to answer a question about a specific site, this is what we would have to give: an account, and the name and email address your Apple or Google sign-in gave us.

Errands on websites

An errand you hand over, such as putting something in the basket or finding something on a site, runs as a task on Oyvo's server, bound to the sites it was given, until it is done or needs you. It stops and asks before anything that pays, orders, subscribes, sends or agrees; at a bank, a health or a government site; at a sign-in, a one-time code or a bot check. While it waits, it holds the page for a limited time and you can look at it and act on it yourself. The final button that orders or pays is pressed only after you said yes to that press, with the total the page shows; Oyvo never types card or account details.

One exception you start yourself: when you ask Oyvo to buy something (“buy me …”), the task goes through that shop's checkout steps, such as the basket, delivery and the choice of payment, without asking at each one. Before each of those presses it asks a second opinion whether the press is only a step towards the order (see below), and when in doubt it asks you. It still stops at the button that orders, shows you the items, delivery, payment and total, and presses it only on your yes. It reports the order as placed only when the shop confirms it with an order number. You can switch this off for a task on its card.

When the page after the order button does not show that confirmation, the task tells you it is unclear whether the order went through, and its card offers to look for the shop's confirmation mail. Only when you tap “Look for the confirmation mail” does Oyvo's server read mail sent from that shop's own address: from the mailbox connected to the server, the shop's mail from the day of the order on (a mail server searches by date), and, if you connected Gmail, the shop's mail since the order button was pressed, from Gmail through your phone. Only mail that arrived after the press counts, and only to find the order confirmation and its order number. The mail is read for that one request and not stored. Only the order number is kept, on the task's receipt; nothing of a mail reaches the model except that number. Nothing on the shop's page is pressed by it.

Before the model reads a page, account numbers and card numbers are removed from it. The model sees the page's text and a numbered list of its controls; it never sees the contents of a password, card or code field, and it has no way to type into one.

Five permissions govern what a task may do: visit websites, submit forms, download, upload and use saved logins, each set to allow, ask or never in the app. What you set to never is refused on the server, whatever a page or an errand says.

Second opinions from TypeSafe

For three narrow decisions Oyvo's server asks a second model, run by TypeSafe (typesafe.ai), which answers with a likelihood for each option and nothing else.

During a purchase you started (see above), before each checkout step is pressed without asking you: what is sent is the path of the page's address, its title unless it reads as personal, what kind of page it is, and the labels of the button and of the other buttons on the page, with every number removed except amounts of money. No account, no name from your sign-in and nothing typed into a field is sent.

While a browser task of yours is working and you say something in the same conversation, whether that sentence is meant for the task or for Oyvo: what is sent is the website's address, the task as you asked for it, what the task is doing at that moment, and your sentence, with every number removed except amounts of money. Unless the answer is clearly “for the task”, the sentence is an ordinary question to Oyvo. Oyvo records that a sentence went to the task, with the site and the likelihood, not its text.

When the phone cannot tell from a question's words alone which of Oyvo's abilities it needs, for example whether “has the invoice arrived yet?” is about your mail, the text of that one question may be sent, and nothing else about you. Oyvo does not store, log or count that text.

Saved logins

If you save a login for a site, it is encrypted on your phone with a key that exists only in your phone's keychain. Oyvo's server stores the encrypted form so that a second device of yours can fetch it; it cannot read it. When a task reaches a sign-in and you approve it, your phone decrypts the login and sends it once, over an encrypted connection, to be typed into that one site's own fields, and only after the server has checked that the page the browser stands on is the site you approved, over HTTPS. The values are not stored, not logged, not metered and never shown to the model; what is recorded is which fields were filled. You can delete any saved login, or all of them, in the app, and the server copy goes with it.

Research

A research task reads the public web the way anyone would: it runs without your profile, without saved logins and without your memory. Its report is written into your files and lists as sources only pages the task actually opened.

Files and browser profile

Files you keep in Oyvo, and reports a task writes for you, are stored under your account on Oyvo's server (up to one gigabyte) and deleted when you delete them or your account. Cookies a task collects on a site, so that a sign-in holds from one errand to the next, are stored encrypted per account and site, dropped after ninety days without use, and can be forgotten per site in the app. A browser task itself runs on a machine of Oyvo's sandbox provider in the United States: while it works, the page it has open, what it types and what it downloads are on that machine, which is deleted at the latest four hours after the task stops. The cookies it keeps between errands and the files it brings back are stored in the EU.

Shared answers

When you share an answer as a link, the picture your phone drew of it, and its text when you share it as a document, is stored under your account on Oyvo's server and shown at oyvo.app/s/… to anyone who has the link. The link is a random id that cannot be guessed from another. It works for seven days unless you chose up to thirty, you can revoke it in the app before then, and it is deleted with your account. Up to twenty links a day.

Bookings and trips

Hotels, flights and eSIMs are booked through LiteAPI (liteapi.travel), Oyvo's booking partner, with the hotel, airline or carrier it works with. The booking data you enter, names, contact details and for a flight the traveller's passport details, is passed to the partner to make the booking and kept with your confirmation under your account on Oyvo's server, so that the trip shows in My trips on every device of yours. Passport details you choose to keep for the next flight stay in your phone's Keychain only. A booking can be cancelled from a chat only while the provider's terms make that free at that moment; otherwise its own page shows the cost first.

A booked trip gets a day plan. When you open the trip's page, the phone sends the trip's facts to Oyvo's server, the destination, the dates, the hotel's name, address and check-in time, the flight's airports and times and your language, and the server asks the language model for a plan, which is kept on your phone only. The server records that a plan was asked for and whether it came back, not the plan. Changes you ask for in a chat (“the beach instead of tennis on day three”) change the plan on your phone. A price watch you set replays the same flight or hotel search on Oyvo's server, with the route, the dates and the party the search carried and nothing else, and notifies you when the price moves; you stop it on the Tasks screen.

Connected accounts

Jira, Notion, Slack, Linear, Asana, GitHub, Canva and a Microsoft account (Outlook mail, calendar and contacts) connect through Oyvo's server: the access the service issues is stored encrypted there and used only for what you ask in a chat or grant a routine. What each reads is what its tools name, issues, tasks, pages, channels, designs, mail, events and contacts; what each writes, an issue filed or commented, a task completed, a page or design created, a mail sent from Outlook, an event added, happens only after you tap the button in the answer that carries it. Disconnecting removes the stored access and withdraws Oyvo's access at Google, Slack, Notion, Linear, Asana, GitHub and Canva themselves; Jira and Microsoft offer no such call, so Oyvo shows you the page where you withdraw it. Deleting your Oyvo account does all of this at once.

Google (Gmail, Google Calendar, Google Contacts, Google Tasks) and an IMAP mailbox connect from the phone; for a routine you arm, a copy of that access is stored encrypted on the server. Oyvo asks for each Google permission only when a request first needs it, reads contacts only, and uses only the permissions you actually granted. A tool server you add yourself (an MCP server) receives the arguments the model writes for its tools and nothing else from your conversation; what it does with them is its operator's business.

Apple Home

If you allow it, Oyvo reads the accessories in your Home and switches lights, plugs and thermostats or runs a scene when you ask, on your phone through HomeKit. It never unlocks a door, opens a garage or disarms an alarm, and refuses a scene that would. Nothing about your Home is sent to Oyvo's server by itself; the names and states of accessories appear in the answer that asked for them and, like anything in a conversation, can travel to the model with your next question.

Your position and your phone's data

Your position is used when you ask for what is near you, for the weather where you are, to trace a run or a walk, and on a tour, where the phone asks Wikipedia for what it records near where you stand and the stories are written from those articles. Errand reminders ask iOS to watch a few small circles around the stores where your open errands can be done; iOS does the watching, on the phone. Calendar, reminders, contacts, Health, your photos, the camera, motion and the microphone are read on the phone when a request needs them and only after you allowed each one in iOS; what you say is turned into text on the phone. Health readings and what you log are written to Health only when you switch that on, and are never indexed for search.

Pictures

The photographs on cards in an answer are looked up by your phone: the place, dish or scene the answer names is sent as a short English phrase to Unsplash, Wikipedia and Wikimedia Commons, which answer with a picture and see that phrase and your phone's address, not your question. Illustrations drawn on the server are the same for everyone.

The About you page

The About you page is written from a snapshot your phone puts together, what is on your calendar, your reminders, your trips, your trackers and which accounts are connected, and sends to the model through Oyvo's server once, when you open the page. The server keeps nothing of it; the phone keeps the page it got back.

Contact

Questions about your data: hello@oyvo.app. You can erase everything, on your phone and on Oyvo's server, under Data & privacy in Settings.