Privacy Policy
We collect what it takes to write your plans and run your account, and nothing for advertising. We don't sell personal information.
Last updated October 2, 2026
What we collect
- Account: your email address, username, optional name, and a password stored as a hash by our authentication provider.
- Plans: the prompts you write, the plans generated from them, your progress, supplies you mark as owned, and follow-up questions and answers.
- Location, only when you share it: the place you type, or your device's approximate position when you tap “use my current location”. We store the place name and coordinates on the plan so we can find nearby stores. We never track location in the background.
- Sharing: who you share a plan with and what access they have, including the email address of anyone you invite who doesn't have an account yet.
- Invites: if you signed up from a friend's link, that they referred you, so both of you can get bonus plans.
- Billing: your subscription status. Card details are handled by Stripe and never reach us.
- Operational data: IP addresses and request logs, kept briefly for security and rate limiting.
Who processes it
- Supabase — database and authentication.
- Vercel — hosting, and the AI Gateway that routes requests to model providers.
- AI model providers (currently OpenAI, Google, DeepSeek and TypeSafe AI, through Vercel AI Gateway) — they receive your prompt, the location you shared, and the plan when you ask a question about it. They do not receive your email address or name.
- OpenStreetMap services (Nominatim and Overpass) — receive place names or coordinates to find stores.
- Stripe — payments. Resend — email delivery. Cloudflare Turnstile — bot protection on sign-in.
- Have I Been Pwned — receives the first five characters of a hash of a new password, never the password.
Who can see your plans
Only you, unless you share a plan. People you invite see it with the access you chose. If you turn on view-only link access, anyone with the link can read the plan, but not who it's shared with or the questions asked on it. Your username and name are visible to people you share plans with.
Your choices
You can export everything we hold about you from Account → Export data, and delete your account from Account → Delete account, which deletes your plans and cancels any subscription. Backups are cycled within 30 days. To ask about your data, email support@oabba.com.
Children
oabba is not intended for children under 13, and we don't knowingly collect their information.
Changes
If we change this policy in a way that matters, we'll email you before it takes effect.