This Privacy Policy explains how OldMate ("OldMate", "we", "us", or "our") handles personal information in the OldMate mobile app and on askoldmate.com. OldMate is operated from Australia by [EXACT LEGAL OPERATOR], at [PUBLIC BUSINESS ADDRESS].
Privacy questions can be sent to privacy@askoldmate.com. General product support is available at askoldmate.com/support.
1. What OldMate handles
| Information | What happens to it | Why |
|---|---|---|
| Account information | Your email address, password, account identifier, encrypted session, and authentication/security records are processed using Supabase Auth. Supabase handles the password credential; OldMate does not store a readable password in its own database. | To create and secure your account and protect access to online processing. |
| Voice recordings | Audio is recorded on your device. When you stop recording, a temporary copy is sent through a Supabase Edge Function to OpenAI's audio-transcription service. A relationship-memory recording is then saved in the app on your iPhone, and copied to your OldMate account if you have turned on backup and left recordings included. Short voice-dictation audio used to fill a text note is deleted after transcription and is never backed up. | To turn your recording into text, let you replay it, and — if you ask for backup — let a new iPhone replay it too. |
| Typed notes | Text you type into the note-capture screen is sent through Supabase to OpenAI for the same enrichment step as a voice transcript. The resulting note and structured fields are saved in the app on your iPhone, and copied to your OldMate account if you have turned on backup. | To organise a note when you choose to type instead of keeping a saved recording. |
| Transcripts and relationship context | The transcript is sent through Supabase to OpenAI for enrichment. When updating an existing person, their name and existing summary may also be sent. OpenAI returns structured context, tags, follow-up ideas, commitments, and questions. | To organise the information you asked OldMate to remember. |
| Saved relationship memory | Contact names, notes, transcripts, summaries, tags, commitments, suggestions, questions, and saved audio are stored in the app's own database and files on your iPhone. This is the copy OldMate reads and writes as you use it, whether or not backup is on. | To provide search, recall, playback, and follow-up features. |
| Backed-up copy (only when you turn backup on) | Backup is off until you turn it on. With it on, OldMate copies to your OldMate account: your contacts and the fields OldMate generated for them; your notes and transcripts, including the names of other people a note mentions and which note a mention came from; which phone contacts you imported and which you deliberately left out; the people you have told OldMate are not the same person; your feed history, meaning which prompts are muted, snoozed, dismissed or done and which cards were shown on which day and what you did with them; and a short list of app preferences (onboarding finished, whether address-book links are included, whether the feed introduction has been seen). Unless you turn recording backup off, saved recordings are also copied to a private storage folder that only your account can read. Phone numbers and email addresses are replaced with salted digests before they leave your iPhone, and the name of anyone you chose not to import is never sent. | So that signing in on a new iPhone restores the memory you have built. |
| Technical records | Our service providers may process IP address, request headers, account ID, timestamps, status codes, and similar security or invocation logs. | To authenticate requests, limit abuse, diagnose faults, and keep the service available. |
| Support messages | We receive the contact details and information you choose to include when asking for help. Please do not email recordings, passwords, or other people's sensitive information. | To respond to your request and improve support. |
| Website analytics | If you choose “Sounds good” on the website banner, Google Analytics may process browser/device information, approximate location derived from IP address, pages viewed, referrer, and interaction data. The Google script is not loaded before that opt-in. Your choice is stored locally in your browser. | To understand website use and improve our public information. |
OldMate reads your iPhone address book only when you open the contact-import screen, only on the device, and only to build the list you choose from. Nobody is added to OldMate until you tick them. The address book itself is never transmitted: what leaves your iPhone, and only when backup is on, is a record of which cards you imported or skipped, with phone numbers and email addresses replaced by salted digests and no name kept for anyone you skipped. A name mentioned in a recording is treated as content you chose to provide, not as access to the device Contacts database.
2. Where your memory is kept, and the two permissions
The working copy of your relationship memory is the one in the app on your iPhone, and OldMate reads and writes that copy whether or not anything else is switched on. Two separate permissions govern what leaves the device. Neither is on by default, and neither turns the other on.
Online AI processing. Before the first transfer, OldMate names OpenAI, explains the data and the purpose, and asks you to allow the processing. Audio, transcripts, typed notes, and — where relevant — an existing contact name and summary leave your device only after you allow that processing.
Backup to your OldMate account. This is a separate decision, asked separately, and off until you turn it on. Allowing OpenAI processing does not turn backup on, and turning backup off does not affect transcription. With backup on you can also choose whether recordings are included, whether address-book links are included, and whether recordings are fetched before you ask for them. Backup catches up when you open or leave the app, and when you pull to refresh; it is not instant replication. A restored iPhone brings text back straight away, while recordings arrive as you tap them — and, if you switch background fetching on, ahead of you as well, up to a cap. OldMate cannot tell Wi-Fi from mobile data, which is why background fetching is off until you choose it.
Neither permission is itself backed up. Each one is a decision about a single device, so a new iPhone asks you again rather than inheriting an answer you gave on the old one. Turning backup off in OldMate's settings stops further transfers and, unless you untick the option offered at the time, deletes the copy OldMate is holding; nothing on your iPhone is touched. If you have never turned backup on, or you take that deletion when you turn it off, the only durable copy of your relationship memory is the one on your device.
OldMate sends enrichment requests with OpenAI's store setting disabled, so the Responses API does not keep application state for later retrieval. Under OpenAI's standard controls, enrichment content may still appear in abuse-monitoring logs for up to 30 days. OpenAI states that audio sent to its audio-transcription endpoint has no application-state or abuse-monitoring content retention, and that API content is not used to train its models unless the API customer explicitly opts in. These settings and statements must be rechecked before launch and whenever the integration changes.
Your device's operating system may include app data in an encrypted device or iCloud backup if you enable those Apple services. Those backups are controlled through your Apple account and Apple settings, not by OldMate, and they are separate from OldMate's own backup.
3. How we use information
We use personal information only as reasonably necessary to:
- create, authenticate, protect, and delete accounts;
- transcribe recordings and generate the structured memory you request;
- provide search, playback, editing, deletion, and other app features;
- hold and restore the backed-up copy of your relationship memory while you have backup on;
- prevent abuse, enforce rate limits, secure the service, and troubleshoot faults;
- answer support, privacy, and legal requests; and
- understand use of the public website where analytics is permitted.
We do not sell app personal information, use it for targeted advertising, or combine it with data from other companies to track you across apps or websites.
4. Service providers and disclosures
OldMate uses the following categories of recipient:
- Supabase for email/password authentication, Edge Function hosting, operational and security logs, and — while you have backup on — the database and private file storage that hold your backed-up relationship memory and recordings. With backup on, Supabase is not only an authentication and compute provider but the custodian of that content at rest;
- OpenAI for audio transcription and AI enrichment;
- Google Analytics for consented website analytics and Google Fonts to deliver website typography (font requests expose ordinary network metadata such as IP address and user agent);
- our website host and domain/DNS providers to deliver askoldmate.com; and
- Apple when it independently provides App Store distribution, device permissions, or backups you enable.
We select providers that publish privacy and security commitments and require them to process information under applicable contractual and data-protection terms. Before publication, we must verify those terms and then confirm here that every third party receiving personal information provides the same or equal protection described in this policy. We may also disclose information where required by law, to protect rights or safety, or in connection with a business transfer subject to appropriate safeguards. We do not give service providers permission to use app content for their own advertising.
5. International processing
OldMate's Supabase project runs in the ap-southeast-1 region, in Singapore. The database rows and recording files of a backed-up account are therefore held in Singapore, outside Australia, for as long as OldMate holds that copy. The production project's region must be reconfirmed against this statement before publication and whenever the hosting arrangement changes.
OpenAI, Google, and other providers may process information outside Australia as well, including in the United States and other locations where they or their subprocessors operate. Where required, we rely on contractual and other safeguards for international transfers.
6. Retention and deletion
- On-device content: kept until you delete the note/contact, use the account-deletion flow, erase app data, or uninstall the app, subject to any device backup you control. Signing out ends the session and hides that user's library, but does not erase its SQLite rows or recording files.
- Backed-up relationship memory: kept in your OldMate account until you delete the note or contact in the app, turn backup off and accept the deletion offered with it, or delete your account. Deleting a note or contact in the app removes it from the backed-up copy on the next catch-up. A record that a row was deleted is kept for up to 180 days so that another device you sign in to learns about the deletion rather than restoring it.
- Backed-up recordings: the audio files in your account's private storage folder are kept on the same basis as the notes that own them, and are removed when you delete the note, turn recording backup off, turn backup off and accept the deletion, or delete your account. A scheduled server job removes any recording left behind by an interrupted deletion.
- Supabase account: kept until the account is deleted, except for limited records that must be retained for security or legal reasons.
- OpenAI audio transcription: no content retention is currently documented for the endpoint OldMate uses.
- OpenAI enrichment: application-state storage is disabled in OldMate's request; standard abuse-monitoring logs may still retain content for up to 30 days unless different approved controls apply.
- Operational and authentication logs: kept only for the security, troubleshooting, and compliance period configured with the production provider. The exact maximum period must be inserted before publication.
- Support records: normally kept for up to 24 months after the request closes, unless longer retention is reasonably required.
- Website analytics: retained according to the production Google Analytics property setting, which must be inserted before publication.
Use Settings → Delete account to initiate full deletion. After confirmation and password reauthentication for email accounts, OldMate removes that user's locally stored contacts, notes, generated fields, caches, recordings, and permission records; then every recording held in the account's storage folder; then the Supabase Auth account itself, which takes the backed-up contacts, notes, address-book links, identity decisions, feed history, preferences, and any developer feedback with it. If a step fails part way, what is left is finished by a scheduled server job rather than left half-done. Processing copies and operational logs expire under the periods above. If you can no longer access the app, use the access-recovery guidance at askoldmate.com/privacy-choices.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, receive a portable copy, withdraw consent, or complain to a regulator. Some of these rights apply only in particular circumstances.
- Edit a contact name or delete notes and contacts inside the app.
- Stop future microphone access in iOS Settings.
- Review or withdraw permission at Settings → Privacy & AI. Withdrawing permission stops requests and later pipeline stages started after withdrawal; it cannot recall a request already transmitted for processing. Voice/typed capture and enrichment are then unavailable, while local viewing, editing, deletion, support, and account controls remain available.
- Turn backup on or off in OldMate's settings, and choose whether recordings and address-book links are included. Turning backup off offers to delete the copy OldMate is holding, and that offer is ticked by default.
- Delete your account, its backed-up copy, and current-user local data from Settings → Delete account.
- Change website analytics consent on our Privacy Choices page.
- Email privacy@askoldmate.com for a privacy request or complaint.
8. Information about other people
OldMate is designed to help you remember people, so your recordings and notes may contain someone else's personal information. You are responsible for having a lawful basis and any permission required to record, store, and submit that information for AI processing, and to back it up if you turn backup on. Recording laws differ by location. Do not use OldMate for covert or unlawful surveillance, and avoid recording highly sensitive information that is not necessary for your purpose.
9. Security
We use safeguards appropriate to the service, including authenticated API requests, encrypted network transport in production, a locally encrypted authentication session, access controls, and rate limiting. Everything OldMate sends or receives, including a backup, travels over TLS. Content held in your OldMate account is encrypted at rest by the hosting provider, and row-level access rules mean only your signed-in account can read your rows and your recordings.
Backup is not end-to-end encrypted. OldMate holds the keys its provider gives it, so OldMate can technically read what it stores for you. If that matters to you, leave backup off. Saved contact data and audio files on the device do not have separate application-layer encryption beyond the protections supplied by iOS and the device. No system is perfectly secure, so keep your device locked and up to date.
10. Children
OldMate is not directed to children and should not be used by anyone who cannot lawfully consent to the handling described here without a parent or guardian. The minimum-age and parental-consent position must be finalised consistently across this policy, the Terms, the OpenAI service configuration, and the App Store age-rating answers before launch.
11. Changes and contact
We may update this policy when the product, providers, or law changes. We will update the date above and provide additional notice where required. Contact privacy@askoldmate.com or phone [PUBLIC SUPPORT PHONE] with a question, request, or complaint. We will acknowledge privacy complaints and explain the next steps within a reasonable period.