Privacy Policy

1. Summary

• We do not sell your data and we do not use it for advertising or advertising profiles.
• Text, voice, and photos you send for translation or correction are used only to produce that result, except for temporary Scan diagnostics (see How long we keep data).
• Usage data contains counts and technical details only, never what you type.
• You can delete your account and all synced data at any time inside the app.

2. Data we collect

Account (Sign in with Apple or Google)

The app requires an account. When you sign in, we receive and store: the account ID from Apple or Google (a unique identifier, not your password); your email address (with Apple this can be a private relay address if you choose Hide My Email); your name if provided (Apple shares it only the first time you sign in, Google from your Google profile); which provider you used; and when the account was created and last signed in. If Apple does not provide an email address at all, the app asks you to enter one yourself; we store it as your account's contact email, without verifying it. For Apple accounts we also keep a token issued by Apple so that Sign in with Apple access can be revoked when you delete your account. We never receive your Apple or Google password.

Data synced to your account

Your notes (title, content, color, and paper style), photos you add to notes, handwriting, likes, hidden items, checklist marks, and your app settings (for example languages, style, keyboard layout and theme, voice options, and chat profiles). We store these so you can restore them and use them on another phone.

Install identifier

The app creates a random token for each installation, stored in your device's Keychain and shared by the app and the keyboard. We use it to limit the number of requests, to link the installation to your account, and to group usage data under a pseudonymous (hashed) version of it, not your name or device number.

Usage data (analytics)

Screens opened, features used (for example how many translations were inserted or scans completed), target languages, session length, app and iOS version, iPhone model, device language setting, approximate country (derived from your network address), and errors. Our server also records technical details for each request: the feature used, size measures (such as token counts, seconds of audio, or characters), estimated cost, duration, and status. Usage data never includes the content of your messages, translations, voice, photos, or what you type.

You can turn off usage data sent by the app at any time in Settings › Advanced › Share usage data. The per-request technical records on our server are still created because we need them to run the service and prevent abuse. Once you sign in on an installation, all usage data from that installation (including from before you signed in and after you sign out) can be associated with your account and seen by our team together with your account email in internal tools, to help you when something goes wrong, keep the service secure, and understand how it is used. This association lasts until that installation signs in to a different account or your account is deleted, at which point it is removed.

Content you send for processing

• Text: text from the keyboard and the app is sent to our server when you press the translate button, or after a short pause in typing so the translation is ready. With the Japanese and Chinese keyboards, the characters you are composing may be sent for conversion. Nothing is sent from password fields.
• Voice: audio is sent when server speech recognition is used (Speak, Conversation, and Listen mode, depending on your settings). Otherwise, speech is recognized by Apple's speech recognition.
• Photos: in Scan, the photo, parts of it, or the text read from it on your device is sent for translation.
• Text to be spoken: text you want to hear is sent so that audio can be generated.
• The keyboard does not collect your typing history, contacts, or location. It only checks whether the clipboard contains text or a number, without reading it. The content is read only when you ask: when you choose to see the meaning of copied text (or press the round button while a new copy is waiting), that text is sent to be explained; when you paste a one-time code, the code is inserted directly and is not sent to our server.

Network address

Your IP address is visible to our servers when the app connects. We use it to deliver responses, to estimate your country (only the country code is stored with usage data), and to prevent abuse, for example by limiting excessive sign-in attempts. Counters kept for this are short-lived and deleted automatically.

Group Voice

This optional feature is available only with an access code from a partner (for example a travel agency). The guide's speech is turned into text, translated, and read aloud for group members, who can join from a web page without the app.

3. How we use data

• To provide the features you use: translation, correction and explanations, speech recognition, spoken translations, Scan, keyboard conversion, Group Voice, and sync.
• To run your account: sign-in, syncing between devices, and restoring your data.
• To email your account address (from Apple or Google, or the one you entered yourself when none was provided) about your account and the service, for example updates, announcements, and replies when you ask for help. To stop non-essential emails (updates and announcements), reply to the email or write to onative.app@gmail.com. We may still send important emails about your account and the service, such as security matters or changes to this policy, for as long as your account exists.
• To keep the service safe and available: rate limits, daily cost limits, and abuse prevention.
• To improve the app: usage data helps us understand which features are used and fix errors.

We do not sell personal data, we do not use it for advertising, and we do not track you across other companies' apps or websites.

4. Where data is processed

• Our servers run on third-party cloud infrastructure. Our database, the storage for note photos, caches, and server logs are hosted there.
• To produce translations, corrections, speech transcription, synthesized voice, and Scan results, the content of your request is sent to third-party AI service providers, and the result is sent back to you. We send only what the request needs (the content, plus settings such as target language, style, and the selected chat profile), not your account name, email, or account ID.
• These infrastructure and AI service providers process data only to provide their services to us. We share data only with third parties that provide the same or equal protection of user data as described in this policy.
• Apple and Google process your sign-in under their own privacy policies. Apple's speech recognition is used when selected or as a fallback, under Apple's privacy policy.
• These providers may process data in countries other than where you live, including outside Indonesia.

5. How long we keep data

• Account data: while your account exists.
• Synced data: until you delete it or delete your account. When you delete a note, photo, or handwriting, its content is removed from our server; a deletion marker without content is kept for 90 days so your other devices can apply the deletion. When a photo is replaced, the previous version is deleted.
• Sign-in sessions: stored on our server only as a hash, end when you sign out, and expire after 180 days without use.
• Result cache: translation results, Scan results, keyboard conversions, and generated voice audio are kept temporarily for at most 7 days, under a hashed key and without any identity, so the same request is not processed twice.
• Apart from what this section describes, we do not store the text, audio, and photos you send for processing.
• Usage data: raw events are deleted after 180 days. Summaries (such as daily counts per installation, totals per feature, and the latest app version and device model per installation) may be kept longer.
• Scan diagnostics: off by default. If we turn it on temporarily to investigate a Scan problem, processed photos, results, and the text read from them can be kept for up to 7 days and are then deleted automatically.
• Group Voice: the text of the latest segments is kept only while the group is running and is deleted when the group ends. Audio is never stored.
• Server logs contain technical numbers and identifiers, not the content of your text.

6. Deleting your account and data

• In the app: on the home screen, tap the Onative keyboard card to open Keyboard settings, then in the Account section choose Delete account.
• What is deleted: your email (including a contact email you entered yourself), name, and Apple or Google ID are removed from the account record right away, and your sessions, device links, settings, notes, photos, and handwriting are deleted. Stored files are removed right after, with an automatic follow-up cleanup during the next 3 days. The app also removes this data from your phone. Deletion cannot be undone; signing in again with the same Apple or Google account creates a new, empty account.
• What remains: an internal record without personal details (a random account ID and timestamps), usage data linked only to the pseudonymous install identifier, cached results that expire within 7 days and contain no identity, and, for Apple accounts whose access could not yet be revoked, the token issued by Apple (encrypted), kept only to retry the revocation for up to about 2.5 months.
• Sign in with Apple: when you delete an Apple account, we ask Apple to revoke Sign in with Apple access for Onative; Apple may ask you to confirm once more. If automatic revocation does not succeed, we keep retrying in the background, and you can also remove it yourself in iPhone Settings › your name › Sign-In & Security › Sign in with Apple. If you delete your Apple ID, Apple notifies us and your Onative account is deleted too. If you stop using Sign in with Apple for Onative, all your sessions end.
• Google: you can remove Onative's access in your Google Account, under third-party apps and services (myaccount.google.com/connections). Removing access in Google only stops future Google sign-ins; your account, data, and active sessions remain until you sign out or use Delete account. We do not store Google access tokens.
• Signing out ends the session on that phone; your data stays in your account.
• If you cannot open the app, contact us (see Contact).

7. Google user data

• When you choose Continue with Google, Onative requests only the basic sign-in scopes: openid, email, and profile. From the ID token we keep your Google account ID, your verified email address, and your name.
• We use this data only to create and sign you in to your Onative account, to show which account you are using, to email your account address about your account and the service (see How we use data), and to recognize your account in our internal tools when we support you, keep the service secure, and understand how it is used. We do not request access to Gmail, Google Drive, contacts, or any other Google data. The access token Google gives the app is discarded on your phone and never sent to our server.
• We do not sell Google user data, do not use it for advertising, and do not use it to develop, improve, or train AI or machine learning models. We do not share or transfer it, except to the infrastructure providers that run our service as needed to operate it, or when required by law. It is not sent to AI service providers.
• Your account email can be seen by our team in internal tools, together with the usage data of your installations, for the purposes above. Beyond that, this data is accessed only when required by law.
• Deleting your account removes your Google account ID, email, and name, as described in Deleting your account and data.

8. Children

Onative is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

9. Security

Connections between the app and our servers use HTTPS. Sign-in tokens from Apple and Google are verified against the provider's signature and can be used only once. Sessions are stored on our server only as a hash and are tied to the installation that signed in. Your session and install token are kept in your device's Keychain. Access to server data is limited to what is needed to run and support the service. No method of transmission or storage is completely secure, but we work to protect your data.

10. Your rights and choices

• See and change: your account details come from Apple or Google; a contact email you entered yourself can be changed in Keyboard settings, under Account; your notes and settings can be viewed and changed in the app.
• Delete: delete individual notes in the app, or delete your whole account (see Deleting your account and data).
• Usage data: turn it off in Settings › Advanced.
• Emails from us: to stop updates and announcements, reply to the email or write to onative.app@gmail.com.
• Withdraw: sign out at any time, or revoke Onative's access in your Apple or Google account settings. Revoking access does not delete your account or data; use Delete account for that.

You can also request a copy of your personal data or exercise other rights you have under applicable law, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022), by contacting us.

11. Changes to this policy

We may update this policy. We will change the effective date above, and for significant changes we will let you know in the app or in another reasonable way.

12. Contact

Questions or requests about privacy and your personal data: onative.app@gmail.com.