Privacy Policy

This Privacy Policy explains how Ozzy (“we”, “us”, “our”) collects, uses, stores, and shares information when you use the Ozzy mobile application and related services at tryozzy.xyz (collectively, the “Service”).

Ozzy is operated by Soham Goswami, an individual developer based in India.

General contact: soham.sg@gmail.com. Privacy requests: soham.sg@gmail.com.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2.1 Information you provide

• Account information: email address, password (stored securely by our auth provider), display name, profile photo.
• Profile & business card: job title, company, phone number, website, social links, address, onboarding preferences (e.g. role, goals).
• Contact & CRM data: names, emails, phone numbers, addresses, employers, notes, tags, relationship details, and other information you enter or import about your contacts.
• Interactions & follow-ups: logs, reminders, notes, and scheduling details you create.
• Communications: messages you send us (e.g. support email).

2.2 Information from integrations (with your permission)

• Google Sign-In & Google Contacts: basic profile (name, email, photo) and contacts you choose to import (readonly scope).
• LinkedIn: basic profile if you sign in (name, email, photo). Connections may be imported via CSV upload or, if you enable in-app sync, collected periodically (names, headlines, public profile IDs) through a session you authorize. Sync is not an official LinkedIn integration; you can disconnect it in the app.
• Device contacts: contacts you explicitly choose to import from your phone.

2.3 Information collected automatically

• Usage & analytics: app events such as screens viewed, feature usage, and success/failure buckets. We do not intentionally send raw contact names, emails, phone numbers, note text, or passwords to analytics. See Section 6.
• Device & app data: device type, OS version, app version, language, and general diagnostic information.
• AI usage metadata: task type, token counts, latency, and error codes for cloud AI requests (not full conversation storage unless required for the feature).

2.4 Information from device permissions

With your consent, we may access:

• Contacts — to import into Ozzy
• Camera — to scan business cards
• Microphone / speech recognition — for voice input
• Notifications — for reminders and follow-ups

You can revoke permissions in your device settings; some features may stop working.

We use information to:

• Provide, maintain, and improve the Service
• Authenticate you and manage your account
• Store and sync your contacts data
• Run AI features
• Show reminders and notifications
• Analyze aggregated usage to improve the product
• Enforce our Terms, prevent abuse, and comply with law
• Process premium subscriptions via payment providers

We do not sell your personal information.

Where GDPR applies, we rely on:

Cloud AI (Premium): For premium users, selected prompts and redacted contact context are sent to our servers and then to third-party AI inference providers to generate responses. We do not route AI requests through third-party AI aggregators or model routers. Content you provide is not used to train or improve any third-party models. We do not use your data, including data obtained from Google APIs, to train AI models.

Before sending data to AI providers:

• Email addresses and phone numbers in context are replaced with hashed tokens
• Other contacts mentioned in notes may be replaced with anonymous tokens
• Google Contacts data is filtered out before any optional web-search enrichment requests

Full unredacted contacts data is not sent to the AI provider by design. AI outputs may be inaccurate; do not solely rely on them as professional advice. Personal discretion is advised.

Ozzy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use PostHog for product analytics. We configure the app to avoid sending sensitive fields (names, emails, phones, note text, search queries, tokens). Events may include internal UUIDs and coarse metadata (e.g. screen name, success/fail).

You may request information about analytics or opt out where applicable by contacting us at soham.sg@gmail.com.

We share information only with service providers who process data on our behalf, as needed to operate the Service:

We require service providers to handle data consistent with this Policy and applicable law.

We operate from India and use providers that may process data in India, the United States, the European Union, or other countries. Where required, we rely on appropriate safeguards (e.g. standard contractual clauses, provider certifications, or your consent).

• Account & CRM data: kept while your account is active.
• Deleted contacts: removed from active use; backups may persist for a limited period.
• Analytics: retained per PostHog settings (typically months, not indefinitely).
• AI usage logs: retained for operational and billing purposes, then deleted or aggregated.

After account deletion: your account is marked deleted and app access is removed. Data may be kept up to 30 days during a grace period; signing back in may reactivate your account. After that, we delete or anonymize personal data except where law requires longer retention. Backups may take additional time to clear.

Depending on where you live, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data / account
• Export your data (portability)
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Opt out of sale/sharing (we do not sell data; California residents may still have related rights)

India (DPDP Act): You may contact us to exercise rights as a Data Principal, including correction, erasure, and grievance redressal.

How to exercise rights: Email soham.sg@gmail.com with subject "Privacy Request". We may verify your identity. We respond within 30 days (or as required by law).

Delete your account in the app (Profile/Settings) or email soham.sg@gmail.com with subject "Privacy Request".

We mark your account deleted and remove app access. Your contacts, notes, and profile may remain during a grace period of up to 30 days; signing back in may reactivate your account. After the grace period, we delete or anonymize your data per Section 9, except where law, security, or fraud prevention requires retention.

Some data may persist in backups or disaster-recovery systems for a limited period after deletion completes.

The Service is not intended for users under 16 (or 13 where local law allows with parental consent). We do not knowingly collect data from children. Contact us if you believe a child has provided data.

We use industry-standard measures including encrypted connections (HTTPS/TLS), secure token storage, row-level database security, and access controls. No method is 100% secure; use a strong password and protect your device.

The Service may link to third-party sites or use third-party APIs (Google, LinkedIn, etc.). Their privacy practices are governed by their own policies. We are not responsible for third-party services you choose to connect.

We may update this Policy. We will post the new version at tryozzy.xyz/privacy and update the "Last updated" date. Material changes may be notified in-app or by email. Continued use after changes means acceptance.

Data Fiduciary / Operator: Soham Goswami

Email: soham.sg@gmail.com

Address: Bengaluru, Karnataka, India

For privacy questions or complaints, contact us at the email above.