Oats is built to keep your life on your phone. This policy explains, in plain language, what Oats does and doesn’t do with your information.
The short version: Oats runs on your device. Your captures — your voice, your transcripts, your notes and tasks — are processed and stored on your iPhone. Oats has no servers of its own, and we never receive a copy of your content. There is no advertising, no tracking, and no third-party analytics inside Oats.
What stays on your device
- Your voice. When you capture, your speech is transcribed on your iPhone using Apple’s on-device Speech framework. The raw audio is never written to disk — the microphone feeds live transcription only, and nothing is recorded or kept.
- Your words. The verbatim transcript, and the notes, tasks, lists and other items Oats creates from it, are stored on your device.
- Sorting and intelligence. Oats reads and sorts your captures using Apple Intelligence, running entirely on-device through Apple’s Foundation Models. Your content is not sent anywhere to be processed.
- Photos you attach. If you attach a photo or screenshot, Oats reads any text from it on-device (Apple’s Vision framework). The photo stays on your device.
Permissions Oats asks for
- Microphone — to capture what you say, so it can be transcribed on your device.
- Speech Recognition — to transcribe your voice on your device.
- Camera & Photos — only when you attach a photo to an item; the photo stays on your device.
- Calendar (add-only) — only when you tap to add a captured appointment to your calendar.
- Face ID — to unlock notes you’ve marked private, locally on your device.
You can change any of these in iOS Settings at any time.
What Oats does not do
- No advertising and no ad networks.
- No third-party analytics or tracking SDKs.
- No selling, renting, or sharing of your information.
- No profiles of you, and no use of your content to train models.
Bills and money
When you capture a bill, Oats extracts the details (such as a BPAY or biller reference) on-device to hand off to your banking app. Oats is never a payment processor — your bank is always the source of truth for who gets paid. Always check an amount before you pay it.
International users and your privacy rights
Oats is made in Australia and used by people all over the world. Wherever you are, the same thing is true: your captures, transcripts, and items live on your device and in your own iCloud account. You already hold and control your data — Oats runs no servers of its own and keeps no copy of your content.
Because of that, almost all of the rights described below are exercised directly: on your device, inside the app, or through your own Apple account. There is no data-rights portal to log into, because there is essentially nothing held by us to request. The sections below explain how this works under the laws that may apply to you.
What we receive, and why
The only personal data Oats itself ever receives is small and specific:
- Account identifier — if you use Sign in with Apple, Apple may pass us a name and an email address (which can be an Apple private-relay address). We use this only to run your account and to reply to you about support. No marketing.
- Support correspondence — anything you choose to include when you email hello@getoats.app.
That is all. Your captures, transcripts, photos, and items are never part of this — all processing (voice to transcript, sorting, reading photos) happens on your device using Apple's on-device technologies, and the results never reach us. We use no third-party analytics, ad networks, or trackers, and we never sell, share, or profile your data, or use your content to train models.
Who handles the rest
Apple provides the infrastructure underneath Oats and acts as the recipient or processor for these flows under Apple's own terms:
- Sign in with Apple — identifies your account.
- iCloud sync — optional, and into your own iCloud (Apple's CloudKit private database), which we cannot see.
- App Store payments — Apple handles any subscription and payment; we never see your card details.
How Apple handles this data is governed by Apple's Privacy Policy. If you share an item, that item is sent via iCloud to the people you choose — a disclosure you initiate and control; Oats is not the recipient.
No automated decisions about you
Oats uses on-device AI to sort and read your own captures, for you. It does not profile you and makes no automated decisions that produce legal or similarly significant effects. Your voice captures can contain anything you say — including sensitive details such as health or beliefs — but that content stays on your device; Oats never receives it and does not process special categories of personal data.
EU and EEA & UK (GDPR / UK GDPR)
For the small amount of personal data involved, the data controller is Oats, an independent app maker based in Australia. You can reach us at hello@getoats.app. Given our scale and the minimal data we hold, we are not required to appoint a Data Protection Officer; please contact us at the address above with any question.
The categories we may hold are the account identifier (name and email, which we obtain from Apple via Sign in with Apple, not directly from you) and any support correspondence. The lawful bases we rely on are:
- Performing our contract with you — to provide the app and run your account.
- Our legitimate interests — to keep the app working and to reply when you contact us.
- Your consent — for anything optional, such as granting a device permission (microphone, speech recognition, camera and photos, calendar, Face ID) or turning on iCloud sync. You can withdraw consent at any time in your device settings; this does not affect what Apple already processed under your direction.
You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing or withdraw consent. Because your content lives on your device and in your own iCloud, it is not ours to provide or erase — you exercise those rights directly, by viewing, editing, and deleting it in the app and managing it in your Apple and iCloud settings. For the small amount we actually hold (your account identifier and any support emails), contact us and we will access, correct, port, or delete it for you.
You also have the right to lodge a complaint with your local data-protection authority, though we hope you will come to us first.
International transfers. Your content stays on your device and in your own Apple iCloud account; it is not sent to any Oats server. Apple's infrastructure handles Sign in with Apple, iCloud sync, and App Store payments under Apple's own terms and safeguards. The only flow that reaches us — your account identifier and support emails — is received in Australia. Where required for EU or UK users, we rely on the appropriate transfer mechanism (such as the UK's adequacy decision for Australia where applicable, or Standard Contractual Clauses / the UK IDTA) for that limited transfer.
California and the United States (CCPA / CPRA)
The categories of personal information involved are minimal: identifiers such as the name and email (or Apple private-relay email) that Apple passes through Sign in with Apple, and any details you include when you email support. The purpose of both is the same — to run your account and respond to you. Your captures and content are not part of this; they never reach us. We collect no sensitive personal information, so there is nothing to limit, and we honour the right to limit the use of sensitive personal information in any event.
We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising. We have not done so at any point. Because we do neither, no "Do Not Sell or Share My Personal Information" link is provided — none is required. There are no third-party analytics, ad networks, or trackers in Oats.
You have the right to know what we hold, to delete it, to correct it, to opt out of sale or sharing (which we don't do), and not to be treated differently for exercising any of these rights. Since your data is on your device and in your iCloud, you can manage or delete most of it yourself. For the little we hold, email hello@getoats.app; we will verify your request (you may use an authorised agent), and respond within 45 days.
Australia (Privacy Act)
Oats is based in Australia, so the Australian Privacy Act and the Australian Privacy Principles are our home regime. We handle the minimal personal information described above in line with them, and you can contact us at hello@getoats.app to access or correct it. You may complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.
Other regions
If you are in Canada (PIPEDA), Brazil (LGPD), or another region with its own privacy law, the same principles apply, and we honour the local rights available to you. The heart of it doesn't change: your data stays with you, and you can access, correct, or delete it directly.
How to exercise any right
For the data you already hold — which is almost all of it — the fastest path is to manage or delete it yourself in the app, or in your Apple and iCloud settings. For the narrow data we receive (your account identifier and any support emails), email hello@getoats.app and we will help. That single address is the whole process; there is no portal, because there is almost nothing for us to hold.
Data retention and security
Your content is kept until you delete it. It lives on your device and in your own iCloud account, protected by your device security — your passcode and Face ID — and by Apple's platform protections. When you delete an item in the app, it is removed from your device and, if iCloud sync is on, from your iCloud. Deleting the app removes Oats and its on-device data from that device; content already in your own iCloud is managed through your Apple and iCloud settings. There is no Oats server holding a copy.
For the small amount we receive, we keep your account identifier for as long as you have an account, and support correspondence only as long as needed to handle your request and a reasonable period afterwards, after which it is deleted. Should an issue ever affect data we hold, we will act and notify as the law requires.
Children
Oats is not directed to children, and we do not knowingly collect personal information from them. The minimum age is the higher of 13 and the digital-consent age set by your country (16 in some places). The App Store age rating also helps gate access.
Changes to this policy
We may update this policy from time to time. We will change the "last updated" date below and, for material changes, make it clear in the app. Your continued use after an update means you accept the revised policy.
Last updated: 27 June 2026.