Privacy policy

Updated August 2026 · Effective July 3, 2026

The short version: we collect only what OnOtto needs to work, we store it with reputable providers in the United States, we never sell your data, and you can have all of it deleted by emailing hello@onotto.com. The long version below is written to be actually readable.

What we collect, and where it lives

Your account

When you create an account we collect your email address and name. Sign-in and account credentials are managed by Amazon Cognito (part of Amazon Web Services). We never see or store your password; Cognito handles it with standard cryptographic hashing.

Your household and task data

The tasks you create, their schedules and history, your household's members and their assignments, and streak/leaderboard activity are stored in Amazon DynamoDB, in AWS data centers in the United States. This data exists so the app can do its job; we don't mine it for advertising and we don't sell it.

Documents you upload

Appliance manuals, inspection reports, and other documents you upload are stored in Amazon S3 (US), private to your household. When you use AI scanning, the document is processed to extract maintenance tasks; the document itself stays in your vault until you delete it or your account.

Payments

Billing is handled entirely by Stripe. We never see, receive, or store your card number; Stripe sends us only what we need to run your subscription: which plan you're on, its status, and the last four digits of your card so you can recognize it in your billing settings.

Email

Reminder emails, account emails, and (if you subscribed) the newsletter are sent via Amazon SES. Newsletter signups store your email address and the page you subscribed from, used only to send you the newsletter. Every newsletter includes an unsubscribe link that works immediately.

Analytics (this website)

On this marketing website we use PostHog and Google Analytics to understand which pages and features are useful: page views, button clicks, and feature usage, tied to a random identifier rather than your name. We configure analytics to be as anonymous as practical, and we honor browser opt-out signals: if your browser sends Global Privacy Control or Do Not Track, our sites load no analytics at all: no scripts, no requests, no cookies. Google Analytics runs on the website only, never inside the app.

Analytics and session replay (the iOS app)

Inside the OnOtto iOS app we use PostHog to understand how the app is used so we can improve it and help you when you contact support. This includes:

• Usage events: which screens you open and which features you use (for example scanning a receipt or completing a task), tied to your account so we can support you and measure whether features work.
• Session replay: a reconstruction of your on-screen activity, the screens you moved through and where you tapped, so we can see where the app is confusing or broken. Text you type is masked before it ever leaves your device: PostHog records that a field was filled, not the characters you entered. We use this only for product improvement and support, never to build an advertising profile.
• Device information: basic details like device model and operating system version, used to reproduce and fix problems.

We keep session recordings for 30 days (our current PostHog retention setting), after which they age out automatically. Usage events are retained while your account is active and deleted when your account is deleted.

Crash reporting

When the app crashes we collect a crash report (what the app was doing, the error, and device and operating system details) so we can find and fix the bug. Crash reports are used only to keep the app stable and are never sold or used for advertising.

Data we collect and link to your account

To summarize, the data below is collected and linked to your OnOtto account: your email address, name, and user ID; the household data you enter (systems, appliances, tasks, schedules, service history, documents, supplies, and members you invite); device information; usage analytics and session recordings; and crash data. We do not show ads, do not sell your data, and do not track you across other companies' apps or websites.

What we don't do

• We don't sell your data. Not to advertisers, not to data brokers, not "anonymized," not ever.
• We don't run third-party advertising or ad trackers on our sites or in the app.
• We don't track you across other companies' apps or websites.
• We don't read your documents for any purpose except the scanning you explicitly request.
• We don't send marketing email to app users who haven't opted in to the newsletter.

Who else touches your data

Only the processors named above: AWS (Cognito, DynamoDB, S3, SES), Stripe, PostHog, and Google Analytics. Each of them processes data solely to provide their service to us under their own privacy and security commitments. Beyond that, we'd disclose data only if legally compelled to, and where permitted we'd tell you first.

How long we keep it

As long as your account exists, so the app can work. If you cancel a paid plan, your data stays intact on the free tier. Session recordings are kept for 30 days and then age out automatically. If you delete your account, or ask us to, we delete your personal data, household data, and uploaded documents from live systems promptly, with residual copies aging out of encrypted backups on a fixed schedule. Records we're legally required to keep (like payment records held by Stripe) are kept only as long as the law requires.

Deleting your account

You can delete your account and its data at any time. In the iOS app, go to Settings > Delete account and confirm; this removes your personal data, household data, and uploaded documents. You can also email support@onotto.com from the address on your account and we'll handle the deletion for you and confirm when it's complete.

Your rights

Wherever you live, we extend the same rights to everyone: ask us what we hold about you, ask for a copy, correct it, or delete it entirely. For app and account requests, email support@onotto.com (or use Settings > Delete account in the iOS app); for anything else, hello@onotto.com also works. Send it from the address on your account and we'll handle it; deletion requests are confirmed when complete.

Children

OnOtto is not directed at children under 13, and we don't knowingly collect their data. Household members you invite should be old enough to hold the account under the terms of our service.

Changes to this policy

If we change this policy in any way that matters, we'll update the date at the top and notify account holders by email before the change takes effect. We won't quietly weaken it.

Contact

Questions, requests, or concerns: hello@onotto.com.