Oxstory Privacy Policy
Last updated:
Oxstory is a personal development application that offers practical exercises, personalized exercise suggestions, progress tracking, and success stories. This Privacy Policy explains what personal data we collect, how we use it, and the choices and rights available to you.
1. Data Controller
Responsible for the service and the processing described in this policy: Oxstory
Contact email: [email protected]
2. Scope of This Policy
This policy applies to the Oxstory mobile application, website, APIs, and related services. It applies both to registered users and to people who use Oxstory as guests.
3. What Data We Collect
Information associated with an account, guest identifier, or device may be personal data even when it does not include your name or email address. We group the personal data we collect into broad categories necessary to operate and improve the app:
| Category | Data | Source |
|---|---|---|
| Account and authentication information | Name, email address, account identifiers, and information needed to authenticate you, verify your account, or recover access | Information you provide when creating or accessing your account |
| Google sign-in information | Google account identifier, email address, and name | Google, when you choose Google sign-in and sign-up |
| Guest information | Guest identifier and data associated with your use of connected app features | Created or collected when you use Oxstory without registering. |
| Onboarding and companion preferences | Your name, answers to onboarding questions you choose to answer, and your selected companion | Information you provide during onboarding |
| Exercise and progress information | Daily targets, selected exercises, reported repetitions, practice history, exercise-card reading progress, exercise feedback, accumulated energy, and exercise details used to customize exercise suggestions and steps | Your actions and reports in the app |
| Notification information | Notification settings and identifiers used to deliver notifications, including push registration tokens and Firebase installation IDs | Your settings, device, and Firebase Cloud Messaging |
| Feedback | Responses about exercises, content, and your experience | Feedback you optionally provide |
| Product analytics | Events describing how you use the app and associated user, guest, device, or session identifiers | Analytics tools integrated into the service, including PostHog |
The current version does not include payments. We do not use your personal data for advertising.
Guest use
You can start using Oxstory without signing up. Guest use does not mean that all information remains on your device. Oxstory creates a guest identifier and stores data from connected app features on its servers before registration.
Guests can delete their guest data directly using the profile deletion option available in the app. Guest data is also subject to automatic deletion after six consecutive months of inactivity.
4. Why We Use Your Data and the Legal Basis
We use your information for the following purposes and legal bases:
To provide and manage the service, including guest access, account creation and management, and maintaining your settings and progress
To personalize suggestions, exercise steps, and your overall experience based on your initial responses, preferences, activities, and exercise-related feedback.
To evaluate and improve content, exercises, and user experience using feedback you optionally provide.
To analyze how app features are used in order to identify issues and guide product improvements through PostHog.
These purposes are distinct. Processing necessary to provide a requested service does not automatically include product analytics or general service improvement.
5. Email Communications and Push Notifications
Email communications
We use your email address for account sign-up and sign-in flows, account verification, password recovery (forget password), and important service or legal communications. Account-security communications are separate from optional reminders.
Push notifications
Notification-related identifiers enable us to send push notifications to your app installation. We use your in-app notification preferences and the device permission status last synchronized with our servers to determine whether to send notifications.
Where your device requires permission, you can choose whether to allow notifications. You can disable notifications in the app or through your device settings. Changes made through device settings are synchronized with our servers when you return to the app, and it successfully connects to our service. Disabling notifications does not itself delete your Oxstory account or previously stored data.
6. Analytics and Tracking Technologies
We use analytics tools, including PostHog, to process usage events and associated identifiers so we can understand how people use Oxstory, identify problems, and improve the service. This processing may involve registered users and guests. Data linked to a user, guest, device, or session identifier is not automatically anonymous.
By using Oxstory’s website, mobile application, or related services, you acknowledge that you have read and understood this Privacy Policy and accept its terms.
7. Visibility of Your Information
The current service provides success stories for users to read. It does not include the user-published stories, comments, direct messages, followers, or public profiles described in the previous policy.
Your selected companion, onboarding answers, exercise reports, progress, and energy are used to provide your experience in Oxstory; they are not described as public social content.
8. Sharing Your Data
We do not sell your personal data.
We share personal data with service providers as needed for the following purposes:
Google: to authenticate you when you choose Google sign-in.
Firebase Cloud Messaging: to deliver push notifications.
Mailgun: to deliver sign-up, sign-in, account verification, password recovery, and other service emails.
PostHog: to analyze app usage, identify problems, and guide product improvements, as described in Sections 4 and 6.
We use artificial intelligence technologies, including third-party AI service providers, to support personalization and the evaluation and improvement of exercises and content. Where these activities involve personal data, we use relevant information from the categories described in Section 3, such as initial responses, preferences, activity, and feedback, for the purposes explained in Section 4.
9. Account Deletion and Data Retention
You can initiate account deletion from inside the Oxstory app. You can also contact [email protected] with questions or requests about your personal data.
We retain account information and personal exercise history for as long as needed to provide your requested services while your account remains active. We delete registered accounts and guest data, together with all associated personal and server-stored data, after six consecutive months without activity in the app, or earlier if you request deletion via profile deletion or email.
When you request deletion, we delete your account (including guest data) and associated personal data from our active systems without undue delay and instruct service providers processing that data on our behalf to delete it where applicable. Residual copies may remain in restricted backups for up to 30 days before being overwritten or deleted. If a backup is restored, previous deletion requests are reapplied before the restored data is put back into use. We may retain aggregated statistics that have been anonymised so that individuals can no longer reasonably be identified. Where retention of specific records is required by law, we retain only the necessary records for the required period and restrict their use to that purpose.
Turning off notifications, logging out, or uninstalling the app should not be described as deleting server-stored data unless that behavior is verified.
10. Data Storage and International Transfers
Although our application is available internationally, all user data is stored and processed exclusively within the European Union.
11. Data Security
No method of electronic transmission or storage can guarantee absolute security.
12. Your Rights
Depending on applicable law and your jurisdiction, you may have rights to access your personal data, correct inaccurate information, request deletion, restrict or object to processing, receive data in a portable format, and withdraw consent where processing relies on consent.
To make a request, email [email protected]. Account deletion can also be initiated inside the app. We may need to verify your identity before fulfilling a request.
13. Your Right to Object and Withdraw Consent
Where applicable law gives you the right to object to processing based on legitimate interests, you can contact [email protected]. Where processing relies on consent, you may withdraw that consent.
14. Age Requirements
Oxstory is intended for individuals aged 18 or older. Individuals under 18 are not permitted to use the service.
If you believe that someone under 18 has provided personal data to Oxstory, contact [email protected] so that we can investigate and take appropriate action.
15. Third-Party Services and Links
Third-party services and external websites may have their own privacy policies. Review those policies when using them. Third-party providers integrated into Oxstory are described in Section 8.
16. Changes to This Policy
We may update this policy as the service or its data practices change. The “Last updated” date will reflect the latest revision. For significant changes, we will notify you by email or in-app notification. Before introducing a new purpose for processing your personal data, we will update the relevant privacy information and obtain consent where required by applicable law.
17. Contact Us
For questions or requests about this policy or your personal data, contact [email protected].