Privacy Policy

1. Who is responsible

Slarti is operated by Andrii Ohniev, an individual developer based in Canada, referred to as “Slarti”, “we” or “us” in this notice. He is responsible for the personal data handled by Slarti. Mailing address: 10 North St, Barrie, ON L4M 2R9, Canada. Contact: [email protected].

This notice applies to the Slarti Apple apps and related backend services, and to slarti.ai. Features available to you depend on your beta version and the services you choose to connect.

2. Data we collect

• Account and profile: account identifiers, email, name and sign-in information; and the nickname, photo, description, occupation, interests, language, time zone and personalization preferences you provide. Optional profile fields include age, sex, height and weight.
• Goals and activity: goal descriptions, clarification answers, plans, schedules, tasks, completion history, feedback, progress, achievements and preferences for reminders or proactive help.
• Content you save or send: chat and direct messages, comments, diary entries, mood or energy information, personal knowledge and its links, and selected images, documents and other attachments. Content may contain sensitive information if you choose to include it.
• Connected services and permissions: authorized Gmail information described below; calendar and reminder information used for the integration you enable; microphone audio and speech-recognition results when you use voice input. Selecting a file or photo gives access to that selection, rather than automatically uploading your entire library.
• Purchases and communications: subscription status, product and transaction identifiers, purchase verification and billing records; waitlist or newsletter name and email, your subscription preferences, and messages you send to support.
• Technical information: network requests, IP address, app or browser version, device/platform information, request identifiers, errors, usage counts and AI cost/token records needed to operate, secure and troubleshoot the service. Website analytics are described in section 9.

We receive data from you, from your use of Slarti, from the sign-in or payment provider you use, and from services you explicitly connect. We do not obtain your Apple or Google password through social sign-in. Slarti does not currently read HealthKit records or continuously track precise device location.

3. Why we use data

We use data to authenticate you; save and synchronize your content; answer requests; create and adapt goals and plans; deliver reminders, notifications and proactive help; support collaboration and messaging; manage purchases; prevent abuse; and diagnose failures. Profile information and relevant history can personalize these features.

Your diary and personal knowledge are stored for their respective features. They are not automatically sent wholesale to AI providers or published to other users. Information you include in an AI message, goal or selected attachment can become part of that AI request.

We send beta-access and service messages to operate your account or waitlist request. Marketing messages use your newsletter preference and provide an unsubscribe option. We do not sell your personal content or use private app content to serve targeted advertising.

Where a legal basis is required, we rely on providing the service you request, your consent for optional processing, legitimate interests in security and reliable operation where permitted, and applicable legal obligations. Permission for one optional feature does not authorize unrelated uses.

4. AI providers and voice

AI features send relevant information outside Slarti to the providers below. This can include earlier context, rather than only your latest message. A request may use more than one provider.

Review the in-app AI data sharing disclosure before permitting these transfers. In app versions with the AI data sharing control, you can allow, decline or withdraw permission in account settings. Declining leaves features that do not require AI available. If your app version does not show that control, contact us and stop using AI features while a withdrawal is being handled.

Withdrawal stops new processing covered by that permission after it is confirmed; it cannot recall data already transmitted or a request already in progress. Removing AI permission is separate from deleting stored content or disconnecting Gmail.

Slarti does not train its own general-purpose AI models on your private content. Provider handling is governed by the applicable API/service terms and account settings, including security and abuse monitoring. We do not promise zero retention across all providers. The links above explain their practices; provider-held copies and legal retention may outlast a Slarti request or account.

5. Google and Gmail

Google sign-in and connecting Gmail are separate choices. When you connect Gmail, we receive the Google account identity, authorized scopes and access credentials. The stored refresh credential is encrypted. Depending on the permission you grant, Slarti can read message metadata and bodies, find messages, derive recent correspondents’ names/email addresses from your mail, and send email through the app’s explicit send action.

Relevant mail content may be passed to AI providers to answer your request, select relevant messages or draft email. Mail excerpts and generated drafts can remain in your Slarti chat history or saved draft records. Gmail access does not mean that your entire mailbox is copied into your personal knowledge or published.

Our use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements. We use Google data for the visible features you authorize, not for advertising, sale, credit decisions or training generalized AI models. Human access is limited to your specific permission or the security, legal and other exceptions permitted by that policy.

Use Disconnect Gmail in the Gmail menu to remove Slarti’s stored connection and request revocation, or revoke access in your Google Account connections. Disconnecting stops future access through that connection; it does not erase mail already quoted in Slarti, Slarti draft records, sent messages in Gmail or copies held by recipients. Request deletion of retained Slarti copies separately.

6. Sharing and service providers

• Infrastructure: Supabase provides account authentication, database and file storage; Google Cloud provides application hosting and task delivery. They process the account, content and technical data needed for these services.
• Apple and Google: sign-in providers authenticate your account. Apple also handles App Store purchases and push delivery. Notifications can reveal content on a device’s lock screen according to your device settings.
• Payments: Apple processes in-app payments; Stripe processes website payments. They receive payment and billing information directly. Slarti receives subscription/transaction information and applicable billing details, rather than your full payment-card number.
• Other users: your public profile and photo, shared-goal content, marketplace publications, comments and messages are visible to their intended audiences. Sharing a goal does not automatically share your private diary, personal knowledge or private account data. Recipients may keep copies of what you share.
• Conversation reports: if you submit a report, authorized Slarti moderators receive the reason, any details you provide and a saved copy of up to 20 recent messages from that conversation, including your own messages (up to 4,000 characters per message). We show this disclosure before submission. The report is not sent to the reported user. This evidence is kept separately from chat history for reviewing and addressing abuse and may remain after account deletion while needed for that purpose.
• Support and legal needs: the operator and people authorized to operate or support Slarti may access information needed for that work. We may disclose information when legally required, to address fraud/security or protect rights. A transfer of the service would remain subject to applicable privacy requirements and notice obligations.

We require providers processing personal data on our behalf to protect it consistently with this policy and applicable privacy requirements, limit use to authorized purposes and restrict access. Their linked policies do not replace our responsibility for Slarti’s handling of your data. We do not authorize a provider to publish your private Slarti content.

7. Storage and retention

Account content is stored in our hosted database and file storage so it remains available across sessions and devices. The app also holds local caches, pending changes and temporary media. Signing out or uninstalling the app does not delete the server account. Personal content does not have a universal automatic expiry while your account remains active.

• Account, goals, messages, diary, knowledge and attachments: kept to provide your saved history and ongoing features, until removed through available controls or a deletion request, subject to legal and shared-content exceptions.
• Connected-service credentials: kept while the connection is enabled; the stored Gmail connection is removed when you disconnect it.
• Support, security, consent and transaction records: kept for the purpose for which they are needed, including resolving a request, preventing abuse, documenting a choice, handling billing disputes or meeting applicable accounting/legal duties. This can require retention after account closure.
• AI error diagnostics: may include a failed generated response and error information. The current diagnostic store targets a 24-hour maximum age with bounded storage and periodic cleanup; this is not a promise that all operational logs or provider copies expire after 24 hours.

Deletion from an active system need not immediately remove every backup, operational record or recipient/provider copy. Where backups exist, residual copies may remain until the relevant backup is replaced or expires. We restrict retained copies to their remaining purpose. Contact us for information about a particular category or deletion request; we do not promise an unverified fixed deletion deadline for every system.

8. Your choices, access and deletion

• Edit your profile and use available controls to edit/delete saved content. Diary export is available in the diary; you can request access or an export of other personal data by email.
• Review or withdraw AI permission in supported app versions, disconnect Gmail, change notification preferences, and revoke microphone, speech, calendar or reminder access in system settings. Withdrawing a permission may disable the corresponding feature.
• Use Delete Account in account settings to request account removal. You can also email us about account deletion, profile-photo removal, content that has no in-app deletion control, or information that remains accessible after deletion.
• Unsubscribe from marketing using the email link or contact us. Unsubscribing does not by itself delete your account or waitlist record.

Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of data, restrict or object to processing, withdraw consent, or complain to your local privacy regulator. Send requests to [email protected]. We may verify account ownership without requesting your password, and will explain any applicable exception or information we must retain.

Account deletion is separate from canceling a subscription. Manage an Apple subscription in your Apple account and a website subscription through its billing controls. Deleting Slarti cannot erase messages already received by others or data in your own Google account.

9. Website and cookies

Google Analytics is off until you select Allow analytics in Privacy choices. Rejecting analytics does not prevent use of the site. You can reopen Privacy choices on any page to change or withdraw permission; we then disable collection by the tag and remove accessible Google Analytics cookies. Withdrawal does not erase data Google already received. Your browser stores the choice and time for up to 180 days before we ask again. If storage is unavailable or the saved choice is invalid, analytics remains off until a new choice.

When allowed, Google Analytics measures visits and page interactions. Google can receive cookie/online identifiers, browser/device and request information and derive approximate location from the network connection. See Google’s Privacy Policy and Analytics opt-out.

Browser storage and cookies can also support authentication and payment flows. You can block or clear cookies in your browser, although some features may stop working; this does not erase data already collected. The website’s analytics are separate from private app conversations.

Joining the free beta waitlist stores your name and email for beta invitations and related service messages. It does not subscribe you to the newsletter and does not require accepting purchase terms.

Newsletter details

The separate Subscribe to news form requests Slarti development news and offers by email from Andrii Ohniev (Slarti), 10 North St, Barrie, ON L4M 2R9, Canada. Contact: [email protected]. You can unsubscribe at any time using the link in a marketing email or by contacting us. Subscribing is optional and is not needed for beta invitations or purchases.

Submitting that form is your express request for the newsletter. We store your name, email, the form source, newsletter request, disclosure version and server time in private service records. A newsletter request is not recorded as acceptance of the Terms of Service. You can contact us to correct or delete a waitlist or newsletter record.

Website checkout records affirmative Terms acceptance and acknowledgement of this notice, document versions and server time with the Stripe Checkout Session and subscription. This purchase acknowledgement is not AI-sharing permission or marketing consent. Stripe receives the payment details you enter on its page.

10. Security and international processing

We use authenticated access, scoped authorization, encrypted network connections, protected credential storage and access restrictions. Service providers operate in multiple countries, including the United States and Canada, so information may be processed outside your country under different laws. Where required, transfers must use the relevant contractual or other legal safeguards.

No online system can guarantee absolute security. Slarti is not end-to-end encrypted: its servers and authorized providers must process readable information to deliver the features you use. Avoid including secrets or third-party personal information that is unnecessary for your request.

11. Children

Slarti is not directed to children and does not offer a child-account or parental-consent service. We do not knowingly collect personal information from children below the minimum age permitted by applicable law. If you believe a child has provided data without the required authorization, contact us so we can investigate and take appropriate action.

12. Changes and contact

We will update the date on this page when this notice changes. Material changes will be communicated through the app, website or email as appropriate. A new optional use or recipient requiring consent must be disclosed before that processing; publishing a revised policy alone does not replace required consent.

Privacy requests and questions: Andrii Ohniev, 10 North St, Barrie, ON L4M 2R9, Canada, [email protected].