MoodOrbit Privacy Policy

What we collect

If you submit a form, we collect what you type into it plus your browser's user-agent, and we use it only to reply to you and to tell you when we launch.

What we do not do

The MoodOrbit website pages set no cookies, but the web app sets the install, session, and security cookies described below. We show no ads and never sell or share your details for anyone else's marketing.

Content from other companies

The Brothers Brunch pages show YouTube videos and the Wellbeing In Style page shows a map. Those companies receive your IP address when the page loads.

Your control

Write to the address under Contact to see or delete what we hold, or to stop hearing from us.

The short version

These are the facts of this policy in plain words. The sections below give the detail, and they are the ones that bind.

• We do not track you across other companies' apps or websites. No ad network and no data broker is involved.
• What you create is private to you unless you share it with people you name. A few other paths exist, such as an administrator reading a record type, and they are all listed under Where your data lives. There is no public feed, directory or profile.
• In the apps you install, the records you create have a storage location you choose. The default is the OOTech cloud, where it stays private rather than public, and Where your data lives lists everyone who can read it. A copy usually stays on the device as well, so the app works offline. The web app is always the cloud.
• Usage analytics is on when your account is created, and you can turn it off at any time in the app. Our marketing websites count visits without cookies and without keeping your network address.
• You delete your account from inside the app. Deletion is scheduled 30 days out, and signing in again during those days cancels it. Some staff accounts cannot use that route and need to write to us instead.
• No AI assistant ships in our apps today, and we do not use your content to train AI models.

Who is responsible

OOTech Inc., a company in Toronto, Canada, is responsible for the personal information this policy describes. In laws that use the word, we are the controller.

Our Privacy Officer is accountable for this policy and for answering requests about it. The mailbox is under Contact at the end of this page.

What this policy covers

It covers the OOTech websites, which are ootech.ai, moodorbit.ootech.ai, truealign.ootech.ai and the event pages under them. It covers the MoodOrbit and TrueAlign apps and web apps as we publish them, and the OOTech app our staff use.

Each product's own privacy page adds sections about that product. It adds to this policy. It never replaces or narrows what is here.

We offer our apps in Canada and the United States. We do not offer them in the European Union or the European Economic Area.

What we collect

Everything here is collected to run the service. Each app's App Store privacy label lists that app's own categories. This section is the floor that is common to all of them.

• We collect your email address to sign you in. If you choose to sign in with Apple or Google in MoodOrbit, we also receive a stable identifier and email address from Apple, which may be a private relay address, as well as your name if you choose to share it (Apple lets you share or hide it), or your name, email address, and profile picture from Google.
• An account identifier, and a per-install identifier for each device or browser you use.
• Your profile: a handle, a display name, an avatar, social handles you add, an anthem you pick, and any free text you add.
• What you create and attach in the apps: records, notes, files and photos, and the people and contact details you add.
• Demographic details you choose to enter, such as pronouns, gender, race, age range, education, religion, sexuality, marital status, professions and disabilities. These are optional and some are sensitive. While usage analytics is on, marital status is never sent in usage events, professions are sent only as the number entered, disabilities are sent only as the number chosen, and every other listed detail is sent as its value. See Why we use it and What we count.
• Your privacy choices, such as whether usage analytics is on.
• Where an app offers notifications and you turn them on, a push token for that device.
• Where one of our sites offers a form, what you type into it, your browser's user-agent string, the time you consented, and the campaign tags and referring site carried by the link you arrived from.
• Usage events, unless you have turned analytics off. It is on when your account is created. What they contain is under What we count.

We do not read or write Apple Health data. Our apps ask for a device permission, such as contacts, camera or location, only for the feature that needs it, and the reason is shown when they ask.

Why we use it

• To run the service you signed up for: to sign you in, to store and sync what you create, to show it to the people you chose, and to send the email the service needs. The basis is the agreement between us.
• Usage analytics, which is on when your account is created and which you can turn off at any time; the sensitive demographic details you choose to enter; and email about a waitlist or an event you asked about. You can withdraw each of these. See Your rights and how to use them.
• To keep the service secure: rate limits and logs that record what happened, written to the allowed list of fields described under How we protect it. The basis is our legitimate interest in running a safe service.
• To meet a legal duty, such as keeping a record the law requires or answering a lawful request.

We do not sell personal information, and we do not use it for advertising.

Where your data lives

Where a record lives depends on where you put it, and the system enforces that rather than this page promising it.

In the apps you install on a device, the records you create have a storage location. A few kinds the app keeps on your behalf, such as ratings, seat claims and App Store transaction records, are always in the OOTech cloud. This device keeps the record on that device only. OOTech cloud stores it on our servers. Cloud means the record lives on our servers as well, and who can read it there is decided by the rules below rather than by the word cloud.

Choosing the cloud does not mean the app keeps nothing locally. The apps hold a local copy of your records on the device so they work offline and open quickly, and that copy is what syncs to our servers.

For most records the default is the OOTech cloud. This device is offered for the record types that support it, and you can change the default in the app.

The web app stores your records in the OOTech cloud rather than on your device. It does use your browser's own storage for working state, such as a draft you have not saved yet, so an unsaved draft can sit in your browser until you send it or clear it.

In the OOTech cloud, the records you create carry who owns them and who may read or edit them, and that is enforced by the system itself, not by convention. That is the main way a record is reached and not the only one; the rest are in the next paragraph.

You can make something public, which is how anything public works. Besides the people you name, these can read a record: anything you have made public; for some record types, a small number of authorised OOTech staff accounts used for support, which can include contact details you have not shared with anyone; and, for a record that belongs to an organisation, the members of that organisation. Our own systems also access records in order to operate the service, for example to build an export you asked for or to finish a deletion.

Staff wellbeing entries are not part of the OOTech app yet. When they are, an entry a staff member writes under a staff account will be co-owned with OOTech, under an arrangement disclosed to staff before it starts.

Where an app offers a secret vault, the items in it sync through your iCloud Keychain to your other Apple devices.

What we count

There are two kinds, and they work differently.

On our websites we count page views, section views and clicks, with no cookies at all. The server refuses any request that arrives carrying a cookie. Each count contains only these fields:

• an event identifier
• the event type, which is one of page view, click or section view
• which page
• which button or section
• the referring site's host name, and nothing more of the address
• the utm source, medium and campaign tags, if the link you followed carried them

No full address, no account, device or session identifier and no user-agent is accepted. We do not store your network address: it is used only to limit request rates, as a one-way key that cannot be turned back into the address, and it is never passed on. The counts go to Google Cloud to be added up. There is nothing here for you to accept, because there is nothing being set.

In the apps and the signed-in web app, usage analytics is on from the moment your account is created, and the switch in the app turns it off. Five events are recorded even when usage analytics is off: first open, app open, session start, session end, and the moment you change that switch.

Usage events are linked to your install, and when you are signed in, to your account. These events record which screens you open, your device type, platform, language, theme, app state, and where you saved a record. They also record whether you used a search or filter, which fields were used, and the type of comparison made, but they do not record the words you typed or any filter values. If analytics is on, demographic details are sent as part of an event, except for marital status which is never sent, and professions and disabilities which are sent only as the number entered. For a journal entry we record only whether a feeling or a need was selected, how many items it carried, which kinds of item were attached, and the kind and size of each attachment, never the feeling, the score or the words.

We keep usage events for 90 days, and we use no third-party analytics or advertising SDK.

The web app is not the same as our marketing websites, and the difference matters. On the web app we set an install cookie that lasts a year, a session cookie that lasts a week, and a security cookie that lasts twelve hours and protects the forms you send. We set them whether or not you are signed in. A signed-out visit records only the five events above, with no account attached to them. If you sign in later in the same browser, the install identifier carries over, so the visits you made before signing in and the ones you made after carry the same install identifier. We do not currently join them into one record. Our marketing websites do none of this: they are the cookieless counting described above.

AI

No AI assistant, coach or chat ships in our apps today.

What stays on your device is decided by where you stored it.

If we ever send your content to an AI service we do not run, this policy and the table of companies that process data for us will say what is sent, before it starts.

We do not use your content to train AI models. If we ever offer that, it will be opt-in and you can withdraw.

Testing a beta version

If you test a beta version of one of our apps through Apple's TestFlight and send feedback or share a crash report, Apple passes us your comment, any screenshots, the crash log for a crash, the app build, and details about your device such as its model and operating system version. We do not copy your name or email address from Apple.

We keep the full report, including screenshots, privately with GitHub and delete it after 30 days. For each report we also add a short entry to our internal issue tracker with the app build, the device model, a link to that private copy, which part of the app we think your report is about, and for a crash the type of error and where in the app it happened. We keep that entry for as long as we track the issue.

Please leave personal information about yourself or others out of your comments and screenshots.

Companies that process data for us

Apart from the page content described below, we share personal information only with the companies in the table at the end of this policy, just before Contact, and only so that they can do a job for us. Each row says what the company does, what it receives and where. We do not sell personal information.

The table describes this release. A company our software could use but does not use today is not listed, and a company that starts receiving your data is added before that starts.

Some of our web pages also show content from others, such as a map or a video. Your browser fetches it from that provider directly, so the provider receives your network address when the page loads and may set its own cookies under its own policy. The privacy page of the site those pages belong to says which pages do this.

Where processing happens

Our servers run in Google Cloud's Toronto region.

Our database and our file storage are provided by Supabase, in Canada, under its own terms. The table states the region.

Some of the companies in the table process data outside Canada under their own published terms, including HubSpot, Resend, komoot, Open-Meteo, Spotify, Apple, Google and our software development services. Canadian privacy law applies to OOTech wherever the processing happens.

How long we keep things

• What you create, and your account: for as long as your account exists, and then as described under Deleting your account.
• Usage events: 90 days.
• Website visit counts: your network address is never stored. We use a one-way key made from your address to limit request rates, and a separate event reference to avoid counting the same event twice. Although it only counts for a short time, this key cannot be turned back into your address, is never written to disk, and can stay in memory until the server clears it or restarts.
• Counters keyed by network address, used only to limit abuse. Any that have not been used for 24 hours are deleted.
• Your privacy choices: kept as a record, and not removed when an account is deleted.
• A form you submitted on one of our sites: until you ask us to remove it.
• Beta feedback you send through TestFlight: the full report is deleted after 30 days, and the short entry in our internal issue tracker is kept for as long as we track the issue.
• Sign-in audit records kept by our authentication layer, which survive the deletion of an account.
• Anything the law requires us to keep.

How we protect it

• We sign you in with a link sent to your email address, and we never store a password. If you choose to sign in with Apple or Google in MoodOrbit, we never receive or store your Apple or Google password.
• A request that reaches your data is authenticated, and what it may read or change is checked against your permissions every time.
• Some operations need a second sign-in step.
• Our server logs carry a short allowed list of structured fields and write everything else as redacted. That list includes identifiers such as an account id or a row id, so a log line can point at an account. It does not carry your email address, your name, or the content you wrote. We try to exclude personal content, but cannot guarantee that it never appears in a log.
• Who may read or change a record is enforced by the system itself, not by convention. See Where your data lives.
• Our websites are served over HTTPS.

We do not describe here what our providers do inside their own systems. Their own security pages cover that.

Your rights and how to use them

You can see, correct, export and delete what we hold about you, withdraw a consent you gave, and complain. Here is how each one works in our products, rather than in the abstract.

• See and correct: your profile and your settings are editable in the app. For anything else, write to us.
• Export: ask us, and we will send an export of your key account data as a download link that works for 24 hours. It covers your account, the people and contact details you added, your entries, plans, messages, searches, demographic details, and the details of the files you have stored. It is data about your files rather than the files themselves, and it does not cover everything we hold, such as device tokens, your consent history or your profile record. Ask if you need any of those.
• Delete: from the account screen in the app. See Deleting your account.
• Withdraw consent: turn usage analytics off with the switch in the app, or ask us to stop waitlist and event email. Either takes effect from then on.
• Object or restrict: write to us and say what you object to.
• Complain: to us first. If you are not satisfied, to the Office of the Privacy Commissioner of Canada, to the Commission d'acces a l'information if you are in Quebec, or to the authority where you live.

We answer access and deletion requests within 30 days.

Deleting your account

You start deletion from the account screen in the app. Your account is marked for deletion 30 days from that moment. Some staff accounts are refused by that route, because ending one of those needs a person. Write to us and we will handle it.

During those 30 days, signing in again cancels the deletion, and the app tells you that it did.

After the 30 days we delete your sign-in identity, check that nothing of it remains, and then delete your account record and everything attached to it, including any files you uploaded. Deletion is not instant: it completes within a short time after the 30 days.

Some things are kept:

• Sign-in audit records kept by our authentication layer.
• Wellbeing entries that are co-owned with OOTech, once staff wellbeing entries are enabled. They are kept with the author's identity removed.
• Your record of privacy choices, and the record of any export you asked for. The deletion job does not remove these.
• Usage events. They are not deleted with your account and age out on the 90-day schedule described above.
• Reports you filed and reports filed about you. They are kept with no set time limit to ensure safety and prevent abuse, but your account is removed from reports you filed.
• Blocks other people placed on your account. These are kept until those people remove the block or delete their own account.
• Anything the law requires us to keep.

The companies in the table keep their own records under their own terms. Deleting your account removes the OOTech data described above from the services we use to store it.

When you delete a MoodOrbit account that uses Sign in with Apple, confirming the deletion with Apple ends the connection. If support deletes the account for you, the connection may remain, but you can remove it in your Apple Account settings. For Google, you can remove OOTech from the apps connected to your Google Account.

Children

Our apps are not for children under 13. In Quebec, a person under 14 needs the consent of a parent or guardian.

If we learn that we hold an account for a child below those ages, we delete it.

If something goes wrong

If a breach of security involving your personal information creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and the people affected, and we will keep a record of it.

Changes to this policy

When we make a material change, we announce it before it takes effect.

Every version is listed with its date under Versions at the end of this page, and the date currently in effect is under the title. A change to the wording always comes with a new version.

Contact

Privacy Officer, OOTech Inc., Toronto, Canada. Write to privacy@ootech.ai to reach us about anything on this page.

Versions

1. The general OOTech privacy policy, version 0.2.2, 2026-10-06, not yet in effect. Added Sign in with Apple and Google sign-in in MoodOrbit, what each gives us, and Google to the list of companies, and explained how deleting an account that uses Sign in with Apple ends the connection with Apple.
2. The general OOTech privacy policy, version 0.2.1, 2026-10-05. Removed a repeated sentence about who can read a record, and the retention line and security purpose for a sign-in check this release does not use. Stopped recording typed search or filter words in usage analytics. Clarified that reports you filed and reports filed about you are kept after you delete your account, and corrected usage analytics wording to state that marital status is never sent, and professions and disabilities are sent only as a count. Specified that blocks other people placed on your account are kept after deletion, corrected what deletion removes, and simplified the logging, retention and processor-table wording. Added what we receive and keep when you test a beta version of our apps through TestFlight, and the services we build our software with to the list of companies.
3. The general OOTech privacy policy, version 0.2, 2026-09-25. The first full policy, derived from the code and narrowed to what this release actually does.
4. The general OOTech privacy policy, version 0.1, 2026-08-07. A short notice, every sentence true of what the marketing profile did.
5. MoodOrbit additions, version 0.1.2, 2026-10-05. Updated the cookie sentence to clarify that website pages set no cookies and the web app does.
6. MoodOrbit additions, version 0.1.1, 2026-09-25. Removed the note saying a fuller policy was still to come.
7. MoodOrbit additions, version 0.1, 2026-08-07. First short policy, every sentence true of what the marketing profile does.