Privacy Policy

1. Who we are and how to contact us

Otto Technologies Limited, registered in England and Wales with company number 17480128 and its registered office at Unit 9, Wilderbrook Way, EX34 8FN ("Otto", "we", "us") provides language learning applications and related services (the "Service"). We are the controller of your personal information unless this Policy says otherwise. You can reach us at privacy@otto-app.com, or by post at Otto Technologies Limited (company number 17480128, registered in England and Wales), Unit 9 Wilderbrook Way, Ilfracombe, EX34 8FN, United Kingdom.

Otto is based in the United Kingdom. Email is the quickest way to reach us and it gets to a person. The same address and email address serve readers in the United Kingdom, the European Economic Area and everywhere else.

2. What this Policy covers

This Policy applies to every part of Otto:

• the website at otto-app.com and its subdomains;
• the Otto app for iPhone and iPad;
• the Otto app for Mac;
• the Otto browser extension for Chrome and for Safari;
• the tutor portal at tutors.otto-app.com.

Some features launch to limited users or regions and may not be available to you.

3. Information we collect

3.1 Information you provide

• Account data. Your phone number or your email address, whichever you sign in with; a password, or the identifier returned by Sign in with Apple or Google if you use one; your age; and optional profile fields such as a display name. If you sign in with a phone number we send a one-time code by SMS, which is delivered for us by Google (Firebase Authentication) and, in turn, by mobile networks.
• Learning data. Language choices, level, reading history, saved words, scores, streaks, goals, tests, placement results and feedback.
• Content and messages. Anything you write or say in the Service, including text and audio you submit to a learning feature, questions you ask about an article, and messages you send to support or through the feedback box in the extension.
• Payment and subscription data. What we receive depends on where you bought, and is set out in section 9. We never receive or store a full card number.
• Tutor and school links. If you link with a tutor, or a school enrols you, we record the link and what is shared under it. See section 10.
• Preferences. App language, learning and native language, level, notification choices, accessibility settings, and the sites you have chosen not to weave ("Skip this site"), which are kept on your Otto account as a list of site names so that the app and the extension share one list.

3.2 Information collected automatically

• Device and usage data. App version, operating system, device model, device identifiers, IP address, time zone, crash logs, diagnostics and interaction events.
• Approximate location. Derived from your IP address, or from your browser's time zone on the website, to localise content, prices and features. We do not ask for or use precise device location.
• Integrity signals. We use Apple's DeviceCheck and App Attest, and Google Play Integrity, through Firebase App Check, to confirm that a request comes from a genuine copy of Otto rather than a script. This tells us nothing about you personally.
• Where you use Otto. Your account records which platforms you have used Otto on (the iPhone app, the Mac app, the website, and which browser the extension runs in), when each was first and last seen, the version of the app or extension, and the platform you created the account on. We use this to understand how Otto is used and to help you when you contact support.
• Words swapped. A running count of the words Otto has swapped for you, in total and separately for the app and the extension, is kept on your account and shown to you in Settings.
• Automatic error reports. When a weave fails with an error you cannot do anything about, the app sends an error report to our support queue, linked to your account. It contains a short error code, the site's host name (the part of the address such as www.example.com), the technical error message and the platform.
• Sign-up steps. Before you have an account, the app uses an identifier for that installation to record which steps of sign-up were reached, so that we can improve sign-up. It is not linked to you unless you go on to sign up.
• Offers and promotions. When we show you an offer or a promotion (a banner on a page, a short message when you open the app, a reminder you open, or the card in the extension's corner), we record against your account which one it was, whether it was shown, pressed or closed, the day, the platform and the app's language: at most one record for each promotion, kind and day. We use these to see whether a promotion is worth running and to avoid showing you the same one too often. They are deleted automatically after about 13 months, and at once if you delete your account. Which promotions you have already seen is also kept on your device, so that it can show each one only as often as it should.
• Time zone, for time-limited offers. The app and the extension send your device's time zone offset (the number of minutes it is ahead of or behind UTC, not your location) with each weaving request, so that an offer such as a free evening opens at your local time. Our server keeps the last offset it saw for your account in memory for up to a day, so that one offer cannot be claimed in several time zones in turn; it is not written to disk.
• Promotional notifications. If you turn on Promotional notifications, the app subscribes your device, through Firebase Cloud Messaging, to topics named for your app language, your plan and promotions, so that an announcement reaches you once and in your language. Reminders about an offer (for example, half an hour before it starts) are scheduled on your device itself, and nothing about them is sent to us. Turning Promotional notifications off leaves the promotions topic and cancels the reminders.

3.3 Information from third parties

• Apple and Google, when you sign in with them or buy through their stores: a basic profile and whether a subscription is active.
• Stripe, when you buy on otto-app.com: see section 9.
• A tutor or school that invites or enrols you.
• Crash reporting and diagnostics partners.

3.4 Sensitive information

We do not ask for and do not need sensitive information. If you use a speaking or listening feature, we process your voice input in order to provide it. Please do not submit anything you would not want processed, and see section 11 before putting anything confidential through Otto.

3.5 What we do not collect

This is as much a part of the Policy as the rest of it.

• We do not collect your browsing history: the history kept by the browser in the Otto app stays on your device. When the extension or that browser weaves a page, it sends us the sentences being woven but not the page's address or the site it is on. We learn a page's address or a site's name only when you rate a weave in the extension, choose Skip this site or save a favourite, or when an automatic error report is sent. Sections 3.2, 4 and 5 set out exactly what each of these includes.
• We do not receive or store card numbers, anywhere, from any purchase route.
• We do not use precise device location.
• We do not buy personal information from data brokers.
• We do not run third-party advertising, analytics or tracking networks in the apps, on the website or in the extension.
• We do not allow the providers behind our reading features to use what you write to train their general-purpose models. Section 11 explains the one place where translation works differently.
• We do not sell personal information.

4. The browser extension

The Otto extension asks permission to run on every site you visit. That is a broad permission and it deserves a plain explanation, so here is exactly what it is for.

4.1 What happens on your device

• Finding and swapping the words. The extension reads the words on the page, works out where the swapped ones go, and puts them there.
• Meanings. The vocabulary and the definitions are downloaded once and held in your browser, so tapping a word for its meaning is answered from your own device.
• Your settings. Languages and level live in the browser's own extension storage. The websites you visit cannot read it. The sites you have switched Otto off for ("Skip this site") are also kept on your Otto account as a list of site names, so that the app and the extension share one list.

4.2 What we receive

Choosing which words can be swapped, and matching them to the right place in the sentence, is done by our server rather than in your browser. So that it can, the extension sends it the sentences it is about to weave. What that request contains, in full:

• the sentences from the part of the page you are reading, as they are written;
• the language of the page and the language you are learning;
• a token identifying your Otto account, so that we can check your plan and count your usage against it. If you are not signed in, a random identifier for that browser stands in; your browser's time zone offset (minutes from UTC), so that a time-limited offer opens at your local time (section 3.2).

Separately, and only when you do something:

• a word you tap to save goes to your Otto account, exactly as it would if you saved it in the app;
• a count of how many words have been swapped adds to a single public number on our website, with no page, no language and no account attached to it;
• the number of words swapped for you is also added to the running count on your Otto account, which you can see in Settings (section 3.2);
• a thumbs up or thumbs down you give a weave is sent, together with the address of the page, to our feedback store, which is hosted by Supabase;
• choosing Skip this site adds the site's name to the list on your Otto account (section 4.1);
• anything you type into the feedback box is sent when you send it.

4.3 What we do not receive

• The address of the page, its title, and the site it is on. None of it is sent with the text being woven. We cannot tell whether you were reading a newspaper, a forum or your own webmail, because nothing in the request says. The only exceptions are the two you start yourself, listed in section 4.2: a rating sends the page's address, and Skip this site sends the site's name.
• Anything on the page other than the text being woven: no images, no links, no form fields, and nothing you type into the page.
• Your browsing history, and any page where Otto is switched off or paused. Nothing at all leaves your browser for those.
• Sensitive pages. Otto never weaves bank websites, payment pages, password managers, health records, tax sites, or any page showing a password or card field, so their text is never sent. This applies in the browser in the Otto app as well as in the extension.

We use what we do receive to produce the weave and return it, and for nothing else. We do not build a profile of what you read, we do not advertise, and we do not sell or share the text with anyone.

4.4 Your control over it

The extension weaves by default once you have installed it. You can switch it off for a site from its menu ("Skip this site"), pause it for five minutes, or turn it off altogether, and while it is off nothing is sent. Removing the extension clears everything it kept.

4.5 Chrome and Safari

Both versions work the same way. Our collection and use of information through the Chrome extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. The Safari extension is distributed inside the Otto Mac app and is governed by this same Policy.

5. The browser in the Otto app

The Otto app includes a web browser that weaves the pages you open in it, as the extension does. The list of sites you have chosen not to weave is shared with the extension (section 4.1), and sensitive pages are never woven (section 4.3). This section sets out what the browser keeps and what it sends.

5.1 What stays on your device

• Your history (up to 300 entries), your open tabs and your page notes.
• A list of the sites you have visited in the last 21 days, used for the suggestions on the browser's home page.

None of this is sent to us.

5.2 What is sent, and to whom

• Favourites. The address and title of each page you add to your favourites are saved to your Otto account.
• The text being woven. The sentences being woven go to the same server the extension uses, hosted by Fly.io (section 13), with the language of the page and the language you are learning. The address of the page is not sent.
• Site icons. To show a site's icon, the browser sends the site's host name (such as www.example.com) to Google's favicon service.
• Search suggestions. What you type into the address bar is sent to Google's search suggestion service so that it can offer suggestions.
• Searches. A search goes to the search engine you choose in Settings: Google, Bing, Yahoo, DuckDuckGo, Yandex, Baidu, Ecosia, Brave Search, Startpage, Naver, or an address of your own. That engine handles it under its own privacy policy.

5.3 Ad and tracker blocking

The browser blocks ads and trackers using public filter lists (EasyList and EasyPrivacy), which it downloads to your device. The blocking happens on your device.

5.4 Streaming services you sign in to

If you sign in to a streaming service (such as Netflix, Prime Video, Disney+ or Apple TV) in Otto's browser, the service's sign-in stays on your device, kept with the Otto account you were using. When you sign out of Otto it is put away on your device, and it is put back only when that same Otto account signs in again on that device. What you watch there may be noted on your device to show Continue watching; it is not sent to us. Otto does not download, copy or re-host anything you watch, and the service handles your viewing under its own terms and privacy policy.

6. Cookies and similar technologies

We and our service providers use cookies and software development kits to operate the Service, measure performance, remember your preferences and personalise learning content.

• Controls. You can disable cookies in your browser and reset advertising identifiers in your device settings.
• EU and UK. We use non-essential technologies only after you give opt-in consent through the banner on the website or a prompt in the app. You can change your answer at any time using the Cookies link in the site footer, in Settings, or by emailing privacy@otto-app.com.

6.1 Cookies on otto-app.com

This website sets no third-party cookies and runs no advertising or tracking networks. Nothing below is shared with anyone else, and none of it is used to build a profile or to target advertising.

One cookie is set whether or not you accept, because it is what records your answer:

• otto_consent (12 months): remembers whether you accepted or declined, so we do not ask again on every page.

These are set only if you accept, and are removed if you later decline:

• otto_vid (12 months): a random identifier with no name, email, or account attached. It lets us tell a returning reader from a new one.
• otto_visits (12 months): how many separate visits you have made.
• otto_first (12 months): the first page of the site you ever arrived on.
• otto_src (12 months): the campaign or link that first brought you here, kept so we can tell first contact apart from the most recent one.
• otto_t0 (12 months): the date of your first visit, used only to work out how long people take to come back.

Whether or not you accept, we count anonymous page views, time on page, scroll depth, clicks on links and buttons (with the label of the one you clicked), the full address of the page that linked you to us, a search term if the search engine chooses to pass one on, your browser's user-agent string (which names your browser and operating system), your browser language, your screen size, your connection type, your browser's time zone, and whether you are on a phone or a desktop. That measurement uses no cookie and no identifier that outlives the visit, and we never store your IP address.

We infer an approximate country from your browser's time zone. This is a guess from a setting your browser already sends, not a location lookup, and it is wrong for anyone using a VPN or travelling. We cannot see, and do not try to see, any other website you visit. Nothing here follows you across the web.

If your browser sends a Do Not Track signal we do not measure anything at all and you are not asked about cookies.

If you go on to buy a subscription, Stripe sets its own cookies on its checkout pages, which are necessary for the payment and for fraud prevention. Those are governed by Stripe's privacy policy.

6.2 The extension's storage

The extension keeps your settings, your signed-in session and which offers it has already shown you that day in the browser's extension storage, not in cookies. When it shows you an offer, its picture is loaded from otto-app.com. It is local to that browser, it is not readable by the websites you visit, and it is cleared when you remove the extension.

7. Why we process personal information, and our legal bases

For readers in the EU and UK, the legal basis for each purpose is given in parentheses.

• Provide and operate the Service: create and run your account, deliver reading and lessons, track progress, take payment, and answer support requests (contract; legitimate interests for diagnostics; legal obligation for receipts and tax records).
• Personalise and improve: adapt difficulty, recommend reading, run product research and A/B tests, and fix faults (legitimate interests; consent where required for non-essential cookies or similar technologies).
• Safety, security and integrity: detect and prevent fraud, abuse and spam, verify that a request comes from a genuine copy of Otto, and enforce our terms, which may involve automated and human review of content (legitimate interests; legal obligation where applicable).
• Tutor and school features, where you have asked for them or a school has enrolled you (contract; consent; the school's own basis where it is the controller).
• Communicate with you about your subscription, service changes and support; send optional surveys; send marketing only where permitted (contract or legitimate interests for service messages; consent for marketing).
• Analytics and measurement (legitimate interests; consent where required).
• Run time-limited offers: open them at your local time, apply them to your usage, show them to you in the app and the extension, and measure and limit our promotions (contract for applying an offer to your usage; legitimate interests for showing and measuring them).
• Promotional notifications and offer reminders (consent, given by turning on Promotional notifications, which you can withdraw in Settings at any time).
• Comply with law, respond to lawful requests, keep tax and accounting records, and establish or defend legal claims (legal obligation; legitimate interests).

8. Automated decision-making and profiling

We profile your reading in order to set the difficulty of what we show you and to recommend what to read next. This produces no legal or similarly significant effect. You can object to profiling for marketing, and you can turn off personalised recommendations where that option is offered in Settings.

Your recommendations ("your algorithm"). Otto learns what you like from what you do in the app: the videos and stories you watch and for how long, the ones you skip or hide, the topics and creators you come back to, and the articles, podcasts, books, films and series you open, save or turn down. It uses this to choose the stories, picks and articles on your home. It is kept on your device and with your Otto account, so it is there when you sign in on another device or after reinstalling the app, and it is deleted with your account. We also use it, together with other people's in aggregated or de-identified form, to improve Otto's recommendations and the app itself. It is not sold, not shared with advertisers and not shown to anyone else, and you can see and change it in the app (Settings, Edit algorithm).

To suggest new video creators, the app sends the YouTube channel identifiers of the creators you watch most to our server, which looks up the channels they feature using the YouTube Data API (Google) and returns suggestions. These identifiers are not stored against your account. The channel information our server receives from YouTube is cached for up to a week.

Content from other sources. The home shows headlines, short summaries and images from publishers' public feeds (such as magazines and Reddit) and from Wikipedia, credited to their source; opening one takes you to the publisher's own page. Video stories play in YouTube's embedded player, under YouTube's terms. We do not send these sources anything about you beyond what any visit to their site involves.

9. Payments and subscriptions

There are three ways to subscribe, and they differ in who takes the money.

9.1 Through the Apple App Store

If you subscribe inside the iPhone, iPad or Mac app, Apple is the seller. Apple takes the payment and holds your payment details. We are told only that a subscription exists, which plan it is, and when it renews or lapses. That status reaches us through RevenueCat, which we use to read App Store receipts. We never see your card.

9.2 Through Google Play

The same, with Google in Apple's place.

9.3 Directly on otto-app.com

If you subscribe on the website, we are the seller and Stripe processes the payment. You enter your card on a page hosted by Stripe. Stripe collects and holds your card details; they never pass through our systems and we never store them.

From Stripe we receive and keep against your account only: the plan, Stripe's customer and subscription identifiers, the status of the subscription, whether it is set to cancel at the end of the period, and the renewal date. We need these so the apps know what you are entitled to and so you can manage the subscription. Your card details, the email address you give at checkout and your billing country are held by Stripe, not by us.

Stripe is an independent controller of the payment data it collects, for its own fraud prevention and regulatory obligations. Its privacy policy is at stripe.com/privacy.

9.4 How your plan reaches your devices

Whichever route you used, your plan is recorded once against your account and is included in the sign-in token your device holds. That is how the app and the extension know what you are entitled to without asking us again on every action. The token carries your plan and your account identifier and nothing else about you.

10. Tutors, schools and shared progress

10.1 Linking with a tutor

Nothing is shared with anyone until a link exists, and a link is always something you start or accept.

Once you are linked, your tutor can see: your display name, your learning and native languages, your level, your streak, how much you have read and when you last read, your saved words, your work on anything they have set you and its results, summaries of your learning activity (your sessions, the words you tap and save, and how well you know each word), and which article you are reading, while you are reading it. They cannot see your email address, your phone number, your password, your payment details or your date of birth.

You can unlink at any time in Settings. Unlinking stops all further sharing at once. Work your tutor has already been shown, such as a test result they have marked, may remain in their records.

10.2 If you are a tutor

We process your name, email address, the learners linked to you, and what you set and mark. You may use a learner's information only to teach that learner, and you must not disclose it to anyone else.

10.3 Schools and organisations

Where a school or other organisation arranges Otto for its learners, that organisation decides who is enrolled and what its staff can see. In that arrangement the school is the controller of its learners' information and we act on its written instructions as its processor. If you are a learner or a parent, please contact the school first to exercise your rights; we will help the school answer you.

10.4 Children in a school setting

Where a school enrols learners below the age at which they can consent for themselves, we rely on the school to have obtained any parental consent or other authority its own law requires, and our agreement with the school says so.

11. AI features and what happens to what you write

Otto uses artificial intelligence to adapt articles to your level, to translate, to choose which words to swap into what you read, and to build exercises and tests.

• To do that, we send the relevant text to the provider of the model. We send what the feature needs and no more, identified by an account reference rather than by your name or email address.
• We require the providers of the models behind adaptation, exercises and answers not to use your content to train their general-purpose models.
• Providers may hold content briefly for abuse monitoring, after which it is deleted.
• A small number of interactions may be reviewed by a person at Otto to check quality and safety.
• Translation of an individual word or passage is carried out by DeepL. It is sent the text and the two languages and nothing that identifies you. We currently use DeepL's free API tier, under which DeepL may use text submitted to it to improve its own translation service. That is the one place where the line above does not hold, which is why we are saying so here.
• Please do not put anything confidential through Otto. It is a reading tool, not a private channel.

12. Advertising and affiliate links

As at the effective date of this Policy, Otto shows no advertising and operates no affiliate tracking in the apps, on the website or in the extension. The rest of this section sets out the rules we would follow if that ever changed, and the choices you would have. None of it is happening today, and we will update the effective date above and tell you before any of it does.

• No personalised advertising without opt-in. We would never use your profile to target advertising unless you had switched it on yourself, and you could switch it off again at any time in Settings.
• Affiliate links. If we ever earn commission on a link, tracking would run only with your opt-in consent. Without it, we would use non-identifying methods such as promotional codes or aggregate reports.
• Apple's App Tracking Transparency. If you chose "Ask App Not to Track", we would not use identifiers for cross-app tracking, whatever else you had agreed to. This choice is separate from EU and UK consent, which we would also ask for.
• Never in these categories. We would not include health, ethnicity, religious belief or any other sensitive category in an advertising profile, and we would not profile anyone we know to be below the relevant age.

13. Who we share personal information with

These companies process personal information on our behalf, under contract, for the purposes given and nothing else.

• Google (Firebase and Google Cloud): sign-in including delivery of the SMS one-time code, the database that holds your account and learning data, our server functions, website hosting, crash reporting, push notifications, and App Check. The browser in the Otto app also sends site host names to Google's favicon service and what you type into its address bar to Google's search suggestion service (section 5).
• Apple: purchases made in the apps, Sign in with Apple, and push notifications.
• Stripe: payments made on otto-app.com. See section 9.
• RevenueCat: reads App Store and Play receipts and tells us whether a subscription is active.
• Fly.io: hosts the alignment server that chooses which words to swap and where they go. It receives the sentences being woven, as described in sections 4 and 5.
• DeepL: translation of a word or passage. It receives the text and the language pair only.
• The providers of the large language models behind the reading and answer features. See section 11.
• Supabase: stores feedback you send from the extension, including a thumbs up or thumbs down you give a weave and the address of the page it was on.
• Salesforce (Heroku): hosts the pipeline that writes and adapts the articles in Otto. It is not sent anything about you.

We also disclose personal information to authorities, auditors and professional advisers where the law requires it or where it is necessary to protect people, and to an acquirer in connection with a merger, acquisition or reorganisation, subject to notice where required.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

14. International data transfers

We are based in the United Kingdom. Your account and learning data are held in Google Cloud, principally in Europe. Some of our services, including the alignment server and the article pipeline, run elsewhere, including in the United States. Where personal information leaves the UK or the EEA we rely on an adequacy decision where one applies, and otherwise on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by an assessment of the recipient. Write to privacy@otto-app.com for details of the safeguards used for a particular transfer.

15. Retention

• Account and learning data: kept while your account is active. When you delete your account, we delete at once your profile and everything stored under it (your word bank, progress, recent searches, favourites, coin history and similar), the learning backups and live session record kept under your account's ID, support messages and reports linked to your account, your promotion records (section 3.2), and your sign-in.
• Deletion record: when an account is deleted we keep a minimal record of it (the email address, display name, sign-up and deletion dates, referral code, and whether the account had a paid plan or was a registered tutor) for fraud prevention, support and accounting.
• Transaction and tax records: 6 years, as UK law requires.
• Promotion records (section 3.2): about 13 months, then deleted automatically; at once if you delete your account.
• Logs and diagnostics: 12 to 24 months, longer only where needed for a security or fraud investigation.
• Consent records: as long as needed to show we complied.
• Tutor links: the link and what was shared under it are removed when you unlink; the tutor's own records of work they marked are theirs.
• Data on your device: what the Otto app keeps on your device, such as its browser's history, tabs and notes, stays on your device until you delete the app.
• Extension storage: held in your browser until you clear it or remove the extension.

Aggregated or de-identified information, which cannot be traced to you, may be kept indefinitely.

16. Your choices

• Delete your account. In the app, Settings, then Account, then Delete account; or on your account page on otto-app.com. This deletes your account and what is stored under it at once, as section 15 describes, and cannot be undone. A subscription you bought on the website is cancelled at once. A subscription bought through the App Store or Play is not: cancel it yourself with Apple or Google.
• Settings. Manage languages, notifications (including Promotional notifications, which carry offers and their reminders), analytics and cookie choices, and tutor links.
• Device and browser. Control cookies, reset advertising identifiers, and manage microphone and notification permissions in your operating system.
• Email us. privacy@otto-app.com, for anything you cannot do yourself.

17. Your rights

Depending on where you live, you may have the right to access your information, correct it, delete it, restrict or object to how we use it, take a copy elsewhere, withdraw consent, and opt out of targeted advertising, sale or sharing, or significant automated decisions.

• How to exercise them. Use Settings where the option exists, or email privacy@otto-app.com telling us what you want and where you live. We answer within one month, and will tell you if we need longer.
• Verification. We may need to confirm who you are before acting, and we may refuse a request we cannot tie to an account.
• No charge, no penalty. Exercising a right is free unless a request is manifestly unfounded or excessive, and we will never treat you worse for making one.
• Appeals. If we refuse a request, you may appeal by replying to our decision. Residents of Virginia, Colorado and other US states with an appeal right will receive a written outcome within the period their law sets.
• Complaints. In the UK you may complain to the Information Commissioner's Office (ico.org.uk). In the EEA you may complain to your national supervisory authority. We would rather you came to us first, and we will try to put it right.

18. Children

Otto is not directed at children under 13, and a child under 13 may not create an account. In the EEA and the UK the age at which a child can consent to online services is between 13 and 16 depending on the country, and we apply the higher age where local law sets one. We do not knowingly collect personal information from a child below the applicable age without authority from a parent or a school. If you believe a child has given us information, write to privacy@otto-app.com and we will deal with it. Section 10 covers learners enrolled by a school.

19. Security

We use technical and organisational measures appropriate to the risk: encryption in transit, access controls on a least-privilege basis, attestation of the apps through App Check so that our servers refuse requests from anything that is not a genuine copy of Otto, and regular review. We never hold card numbers. No system is completely secure, and if a breach affects your personal information we will notify you and the regulators as the law requires.

20. Third-party links and services

The Service links to other websites and services, including the app stores, Stripe, the pages you choose to read with the extension or in the Otto app's browser, and the search engine you choose there. Their own policies govern what they do with your information. Reading a page with the extension switched on does not involve us in any way in your relationship with that site.

21. Disclosures for California and other US states

21.1 Notice at collection

• Categories collected in the last 12 months: identifiers (such as an email address, a phone number and device identifiers), internet and usage activity within Otto, approximate location inferred from IP address, commercial information such as your subscription, audio if you use a speaking feature, and inferences such as your reading level.
• Purposes: as set out in sections 7, 9, 10 and 11.
• Sale or sharing: we do not sell personal information and we do not share it for cross-context behavioural advertising. We honour legally recognised opt-out preference signals, including Global Privacy Control.
• Sensitive personal information: we do not collect it beyond the account credentials you create, and we do not use or disclose it for any purpose that would give you a right to limit that use.
• Retention: as set out in section 15.
• Rights: access, delete, correct, portability, opt out of sale or sharing, limit the use of sensitive personal information, and non-discrimination. Exercise them as described in section 17.

21.2 Authorised agents and appeals

You may use an authorised agent, who must provide written permission that we can verify. If we deny a request you may appeal by replying to our decision, and we will respond within the period your state's law sets.

22. Changes to this Policy

We will post any change here and update the effective date. If a change is material we will tell you in the Service or by email before it takes effect. Continuing to use Otto after the effective date means you accept the updated Policy.

23. Contact

privacy@otto-app.com, or Otto Technologies Limited (company number 17480128, registered in England and Wales), Unit 9 Wilderbrook Way, Ilfracombe, EX34 8FN, United Kingdom.