Your data, plainly explained

What we store: your name and email, what you share with us about your family, and the photos you add.

Who sees it: you, and the people you share an album with. Your family’s data is never sold, never used for advertising, and never shared beyond the services that run Otohpia and the people you share it with.

How to delete it: from Settings, any time. One photo, one album, or your whole account. Deleted means gone.

Payments: when paid plans open, our payment provider, acting as our reseller, handles them. We never see your card.

Your account: your name and email address, and when you accepted this policy.

Your conversations: what you share in them about your family, names, birthdays, the people who matter, the stories behind your photos. Otohpia remembers them so you never have to explain your family twice.

Your photos: the photos you add, and what’s embedded in them, like when and where they were taken. Photos our sorting rejects as screenshots or junk are not kept.

Your albums: the books we build together, their chapters, layouts, and text.

Your taste: your style choices, and which photos you keep or remove, so the curation gets better for your family.

To find the person an album is about, we match one reference photo you choose across the photos you gave us. This is face recognition, the smallest kind we know how to build: it runs on your photos only, for your album only. Faces are processed by AWS and deleted immediately after the matching finishes. We keep only the reference photo itself, so future albums can start from it.

There is no shared face database. Face data from your photos, biometric data in legal terms, is never kept after an album is built, never pooled with other families, and never used to train anything.

You give this consent separately, on the screen where you pick the reference photo. You can withdraw it in Settings, which blocks any future photo analysis. Albums already built stay as they are.

Most albums are about children. Everything about a child, their name, birthday, photos, and the stories you tell, is used for one purpose only: building your family’s albums. Never for training, never for analytics that could identify them, and never shared by us with anyone. Only the people you choose see an album: the people you share it with and, from the day paid plans open, anyone you give it to or who keeps it (on unless you switch it off for that album), as described below.

Your conversations and your photos are not used to train AI models. If that ever changes, it will be strictly opt-in, asked plainly, and off by default.

Otohpia runs on a small set of services, and your data goes to them only to do their job: Supabase stores your data in the United States, AWS matches faces and deletes them immediately, as described above, Anthropic’s Claude powers your conversations, writes your albums’ stories, and looks at small copies of some of your photos to name and place your album’s moments, Google Photos imports the photos you pick, Google’s Gemini helps judge photo quality, Vercel hosts the site, and Resend delivers our emails. None of them may use your data for their own purposes. When paid plans open, our payment provider, acting as our reseller, takes payments and handles sales tax, as described under “Payments”. We’ll name it here before then.

Otohpia’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we do not use Google Photos data to develop, improve, or train generalized AI or ML models, and we transfer it only to the service providers named in this section that process it to build your book, and to other people only when you share an album with them or, from the day paid plans open, when an album moves to them as described under “Albums that move to someone else”.

Paid plans aren’t on sale yet. When they open and you buy a plan or credits, our payment provider, acting as our reseller, is the seller. It collects your payment details (your card or wallet, email, and the country and postal code needed for sales tax) and processes them under its own privacy notice, because it has duties as the seller, such as tax and fraud prevention. Otohpia never sees or stores your card number.

From our payment provider we receive references for your customer account and subscription, your plan and billing period, and the dates and amounts of your payments, refunds and failed payments. We use them to run your plan and credits, to send you emails about your plan, and to keep our own accounts. We never use them for advertising and never sell them. If you ask us for a refund by email, we use your email and that payment’s details to check it against the refund rule in our Terms.

From the day paid plans open, an album can move to another person: when someone who saved your album keeps it in their own plan, or when you give an album to someone and they accept. You can switch keeping off for any album, and you choose who you give an album to.

Only the album moves: its pages, the photos and videos placed in it, its captions and its cover. Never your other photos, the photos the album didn’t use, your conversations, the people you’ve added or their reference photos, and never any face data (none is kept). Once it moves, the album is theirs: it lives in their account, and deleting your account no longer deletes it.

When you give an album, we use the email address you enter only to send that person the request and to match it to their account when they answer. The request ends after 14 days.

Your account, the people you’ve added and your preferences: until you delete your account. Photos our sorting rejects as screenshots or junk: not kept.

From the day paid plans open: albums on a paid plan are kept while the plan is active. On Free, up to 1 GB of albums stay open, each for 12 months. An album that doesn’t stay open locks for 60 days, with its photos still downloadable, and is then deleted; we email you 30, 7 and 1 days before. A locked album is kept so you can choose a plan or download its photos, and you can delete it yourself at any time. Payment records: while you have an account, and longer only where the law requires it.

Everything you send us travels over an encrypted connection (HTTPS). Your photos, videos and album details are stored in the United States with Supabase, encrypted at rest. Your photos sit in private storage that is never public: the app shows them only through signed links that expire within hours, and only to your account. Our database separates every family, so one family can never see another’s data.

When you connect Google Photos, the access Google gives us is encrypted before we store it, is never shown in your browser, and only reaches the photos you picked. Faces are matched and then deleted immediately, as described above. Only Otohpia’s founder can access our production systems. You can revoke Google access anytime in your Google Account, and deleting an album or your account deletes its photos from our storage.

You can delete any photo, any album, or your entire account from Settings. Deletion is immediate and permanent: the files, the conversations, the albums, and the account itself. There is no recycle bin and no “deactivated” state we quietly keep.

From the day paid plans open, if you have a paid plan, deleting your account cancels it first and refunds any payment that still qualifies under the refund rule. Our payment provider keeps its own record of your purchases, as the seller. Albums that have already moved to someone else are theirs and stay with them.

A downloadable export of your data is coming. Until it ships, email us and we’ll put one together for you by hand.

If you joined the waitlist, we have your name and email. If you took the survey, we have your answers, and your email only if you chose to leave one. We also record which page sent you here and how far you got through the survey, tied to a random session id, not to you. Every email we send has a one-click unsubscribe link. To have waitlist or survey data removed entirely, email us.

hello@otohpia.com