On this page
Otto Privacy Policy
Last updated: November 11, 2026
This Privacy Policy explains how Greenflag Tech, Inc. (“Greenflag Tech,” “we,” “us,” or “our”) handles information when you use Otto, our camera app for iPhone, and the Otto website at ottocam.ai (together, “Otto” or the “App”). It is part of the Otto Terms of Use at ottocam.ai/terms. Where Otto runs on an iPad or an iPhone Duo, “iPhone” in this Policy also means that device, and “iOS” also means iPadOS.
Otto takes and finishes photographs on your iPhone, and keeps doing so without an internet connection. There is no Otto account or login. While Otto is on, it sends what the camera sees and, in voice mode, the things you say to Otto, to Google through our servers, so Otto can plan the photo and talk you through it; you can turn that off in Settings. This Policy explains the limited information that leaves your iPhone, why, who receives it, how long it is kept, and the choices you have.
1. Who We Are
Greenflag Tech, Inc., a Delaware corporation, is responsible for the personal information described in this Policy.
Greenflag Tech, Inc., 1401 21st Street #4114, Sacramento, CA 95811, United States.
- Privacy questions and requests: privacy@trygreenflag.com
- Support: support@trygreenflag.com
- Legal notices: legal@trygreenflag.com
2. Summary
- Photography works on your iPhone. Otto analyzes the scene, takes photos, marks the best ones as highlights, and finishes photos on your device, with or without a connection. Nothing goes to your Photos library unless you save it or turn on “Auto save” in Settings. Your original files stay on your iPhone.
- While Otto is on, what the camera sees goes to Google. From the moment you tap Start until Otto stops, Otto sends reduced-size views of what the camera sees (now and then, such as when the scene changes, never a video recording) and a short description of the shot through our servers to Google’s Gemini service, so Otto can plan the photo, work the camera and talk you through it. Otto asks first: nothing goes to Google until you tap “Turn on Otto Intelligence” on the screen that explains it, and “Otto Intelligence” in Settings turns it off again at any time; without it Otto runs on your iPhone alone. Nothing from the camera is sent while Otto is off. Otto is for people 18 and older.
- Private mode keeps the camera on your iPhone. When you ask, or when Otto’s checks on your iPhone find a scene that should stay private, Otto sends no camera views or photos to Google until you let it see again, and keeps talking with you.
- Voice mode is optional and starts with Otto unless you turn it off. After the permission screen, Otto asks whether voice should start each time you tap Start; it is on unless you turn it off there or later in Settings. While voice mode is on and you allow the microphone, your iPhone sends each thing you say to Otto as a short recording once you stop speaking, and nothing in between, so Otto can hear you. Otto does not store what the camera sent, your voice, or what you say, apart from the short notes you let it keep in Memory and, only if you turn on “Share voice recordings,” your voice and your conversations with Otto, kept 30 days so our team can fix problems and improve Otto (Section 5).
- Otto remembers only what you let it. Otto can keep short notes about the people and pets you photograph, the places you like and how you like to shoot and edit, so your next session feels like picking up with a friend. Otto asks before keeping anyone’s name, shows each new note with an Undo, and keeps them only on your iPhone, where you can read, change or delete every one in Settings under Memory. While Otto Intelligence is on, they go with the conversation, and Google helps Otto write and check each new one.
- Your exact location stays on your iPhone. If you allow location, Otto adds where each photo was taken when you save it to your Photos library, and uses your area to know where the sun is. Otto never sends your exact location to us or Google. Two exceptions: when you add a frame that shows the place to a photo, Otto asks Apple’s location service for the name of that photo’s city; and while Otto Intelligence and “Places you visit” are on, Otto asks Apple for your city and state and sends your location, rounded to about 100 meters, to our servers to find the park, zoo or attraction you are in, which we use only for that lookup and never keep. Only the state, the city and the place’s name go to Google.
- No account. We do not require your email address, phone number, or contacts to use the camera. You may choose to provide contact details when sending feedback. If you type your name on a photo frame, it stays on your iPhone and in the photos you make. If you tell Otto what to call you, that name stays on your iPhone and goes with the conversation while Otto is on, and once when you first meet Otto with Otto Intelligence on, only so Otto can greet you; we do not log or keep it.
- What we do receive is limited: usage analytics, crash reports and diagnostic logs without content (you can turn them off), requests for app settings, security checks, cloud usage and smart session records (numbers only, such as how many photos a run kept, never scene content or what was said), records of the kinds of requests Otto declined (a category only, kept 30 days), and purchase and subscription information from Apple.
- The App counts how it is used. Otto sends usage analytics to Mixpanel: which screens and features you use, never what you photograph or say. They are tied to a random identifier, not to you, and you can turn them off in Settings with “Share usage analytics.”
- The website counts visits. ottocam.ai uses Google Analytics to count visits and see which pages people read, with Google’s advertising features turned off. It does not load if your browser sends a Global Privacy Control or Do Not Track signal.
- No advertising, no tracking, no sale of personal information.
- You are in control. “Delete all Otto data” in the App’s Settings erases what Otto stored on your iPhone and any voice recordings you shared.
3. Information That Stays on Your iPhone
Your original photos, detailed scene analysis and photographic history are stored on your iPhone. Section 5 describes what Otto sends to Google while it is on and how to turn that off.
- Camera view and scene analysis. Otto uses Apple’s on-device frameworks to understand what the camera sees (for example the kind of scene, where the subject is, whether a face is in the frame and whether eyes are open, light, steadiness, and the horizon) so it can decide how and when to take the photo and which photos are highlights. Otto keeps this analysis with the session on your iPhone so it can show and compare the photos. Otto also checks on your iPhone whether a scene should stay private (Section 14); those checks never leave your iPhone.
- Your photos. Each smart session can capture many photos, which Otto keeps in the App’s private storage. Otto marks the best of them as highlights and finishes them; depending on “Auto edit” in Settings it also finishes the other photos, or none. The original always stays. You can also edit any photo yourself; Otto keeps your edit with the photo and never changes the original, so you can go back to it at any time. A photo goes to your Photos library only when you save it, when you turn on “Auto save” in Settings (Otto then saves the highlights, or every photo, when a session ends), or when you take a photo with a camera button while Otto is off, which goes straight to Photos like any camera. Highlights, photos you edited and the session’s history stay in the App until you delete them, delete the session, or use “Delete all Otto data.” The other photos are deleted automatically after the period you choose in Settings under “Keep photos” (7, 30, or 90 days, or Unlimited, which keeps them until you delete them; 30 days by default). Deleting a photo or a session in the App never removes a copy you saved to your Photos library. Photos taken while private mode is on (Section 5), including with a camera button, stay in the App until you save them, even with “Auto save” on, and never leave your iPhone through Otto.
- On-screen guidance. The short directions Otto shows on screen come from Otto Intelligence while it is on (Section 5) and otherwise from your iPhone. Otto shows them and does not keep them.
- Frames. If you add a frame to a photo, the frame can print your name, the date, the camera details and, if the frame’s Location switch is on, the city where the photo was taken. The name you type is remembered on your iPhone for your next frame. Otto keeps this text with your edit in the App’s private storage, and it appears in the framed photo when you save or share it.
- Your location, if you allow it. If you allow location (on the permission screen before your first photo, or later with “Location” in Settings), Otto reads your iPhone’s location while the camera is open. It keeps where each photo was taken with that photo in the App’s private storage, and when you save the photo to your Photos library, Otto adds that place to it, as the iPhone camera does, so you can see it on a map in Photos. A photo you take with a camera button while Otto is off goes straight to Photos with its place. Otto also uses your general area, rounded to about 10 kilometers and kept only in memory, to work out where the sun is, so it knows when the light is golden or fading. Otto never includes your location in analytics or crash reports, and never sends your exact location to us or Google. Two exceptions follow. The first is the place you are in: while the camera is open, “Otto Intelligence” is on, “Places you visit” is on (in Settings, on the Location screen) and private mode is off, Otto asks Apple’s location service for your city and state, and, with precise location on, sends your location rounded to about 100 meters to our servers, which look up in memory whether you are in a named park, nature reserve, garden, zoo, aquarium, theme park or attraction and answer with its name. Our servers do not log or keep your location or the answer; they keep only a count of lookups for your pseudonymous customer identifier, to limit how often the App can ask. Your iPhone keeps the last answer, so it rarely needs to ask again. Otto then tells Google’s Gemini service only the state, the city and the place’s name (Section 5), never your location. The second is a frame that shows the place: when you add such a frame to a photo while your iPhone is online, Otto sends that photo’s location to Apple’s location service once to find the name of the city, and keeps the city (never the coordinates) with your edit. The city then appears in that framed photo, including when you save or share it; turn off the frame’s Location switch to leave the place out. Otherwise Otto never includes the place in photos you share from the App. If you turn off precise location for Otto in iOS, photos get no place and only the light uses your approximate area. You can turn “Location” off in Settings, or turn off location for Otto in the iOS Settings app, at any time; “Delete all Otto data” deletes the places stored with photos in the App. Photos you saved keep their place in your Photos library, where Photos lets you remove it.
- Your settings, such as voice mode preferences (whether voice starts with Otto, the voice and the language Otto speaks), look, auto edit and auto save, how long to keep photos that are not highlights, what the volume buttons do, and your usage analytics and crash reporting choices.
- The name you asked Otto to call you, if you gave one on the “What should Otto call you?” screen or under “Otto calls you” in Settings. It is optional, you can change or clear it at any time, and “Delete all Otto data” removes it. Section 5 describes where it goes: the conversation while Otto is on, and Otto’s greeting when you first meet Otto.
- The pronouns you chose, if you chose any under “Pronouns” in Settings (Otto never asks for them when you meet it, and never changes them because of something you say). They are optional and start as Not set; you can change them or set them back to Not set at any time, and “Delete all Otto data” removes them. Section 5 describes where they go: the conversation while Otto is on, nowhere else.
- Your answers when you met Otto, if you gave them: how you feel about taking photos, what you love to photograph and how Otto can help most. They are optional, you can change them at any time in Settings under “You and Otto”, and “Delete all Otto data” removes them. Section 5 describes where they go.
- What Otto remembers, if you let it (“Let Otto remember” in Settings under Memory, on unless you turn it off): short notes of four kinds, people and pets (the names you use for them, who they are to you and how they like to be photographed; for a pet, also its kind, look and age), places (the name you use for a place and what is good there for photos, never its address or position), how you like to take photos, and how you like your edits. Otto makes them from what you tell it and from how you use the App (for example the subjects of the photos you save, the crops and looks you choose, and whether you take Otto’s ideas). It asks before keeping a person, a pet or a place, and shows each new note with an Undo. Otto never keeps payment, account or identity numbers, passwords or codes, phone numbers, email or street addresses, health information, or a person’s looks, age, birthday, ethnicity, religion, politics, sexual orientation or immigration status. You can read, change and delete every note in Settings under Memory; “Delete all memories” and “Delete all Otto data” delete them all. Section 5 describes where they go.
Photos you save to your Photos library, or share using the iOS share sheet, are then handled by Apple (including iCloud Photos, if you use it) or by the app or service you share them with, under their own terms. Otto asks for permission only to add photos to your library, never to read it.
4. Information That Leaves Your iPhone
| What | What it includes | Why | Who receives it |
|---|---|---|---|
| Place lookup for a frame (only when you add a frame that shows the place) | The location stored with that photo | To find the name of the city the frame prints | Apple, through its location service on your iPhone |
| The place you are in (only while the camera is open, “Otto Intelligence” and “Places you visit” are on and private mode is off) | Your current location, for Apple’s location service; and, with precise location on, your location rounded to about 100 meters, how precise it is as a range, and the App’s language, for our servers, which do not log or keep them | To find your city and state and whether you are in a named park, nature reserve, garden, zoo, aquarium, theme park or attraction, so Otto can talk about it | Apple, through its location service on your iPhone; us |
| Otto Intelligence (only while Otto is on, your iPhone is online and “Otto Intelligence” is on in Settings) | Reduced-size views of what the camera sees, now and then (when the scene changes, when you ask about it, and about once a minute while you talk); a short description of the shot (the kind of subject, where it is, whether eyes are open, how steady and ready the camera is, how many photos Otto has taken, the camera and zoom in use, how long Otto has been on, and the time of day as a rough band); what the camera can do and its current settings; where each person in the frame is, under a temporary number for the run; what you asked Otto for; the conversation so far (what you and Otto said, and what Otto did with the camera), sent with each exchange so Otto can follow it; reduced-size copies of photos Otto just took and previews of the original and finished photo; in private mode, a summary of the scene in fixed categories instead of views and photos; your language; the name you asked Otto to call you and the pronouns you chose, if any; up to ten of the notes Otto remembers, if you let it; your device’s IP address | To plan the photo, work the camera, write Otto’s on-screen directions and suggestions, greet you and word what it says about you as you chose, and finish photos | Us in transit, and Google as our service provider (see Section 5) |
| Meeting Otto (only once, during Otto’s introduction after the permission screen and “Make Otto smarter”, while your iPhone is online and Otto Intelligence is on) | The part of your name Otto greets you with, if you gave one; the subjects you said you love to photograph; your answer about how Otto can help; the language Otto speaks | To let Otto say its greeting, its reaction to what you love to photograph and its summary of your answers in its own voice | Us in transit, and Google as our service provider (see Section 5) |
| Otto’s memory (only while “Otto Intelligence” and “Let Otto remember” are on, when Otto keeps or changes a note) | What you asked Otto to remember, typed in Memory or said while Otto is on, after the App removes numbers, contact details, addresses and codes from it; the notes Otto already keeps, so the new one is filed with them | To turn your words into a short note and check it before Otto keeps it | Us in transit, and Google as our service provider (see Section 5) |
| Misuse records (only when Otto declines certain requests, see Section 5) | The kind of request Otto declined, as a category, the day and how much it counts, tied to the pseudonymous customer identifier used for smart sessions; whether and until when Otto Intelligence is paused; for the check, your last sentence and the category, sent once to Google | To pause Otto Intelligence after repeated declined requests and prevent abuse | Us, hosted by Google Cloud; Google as our service provider for the check |
| Voice mode conversation (only while voice mode is on) | Each thing you say to Otto, as a short recording cut on your iPhone when you stop speaking, with the words your iPhone heard where it can write them down; Otto’s replies as text, so Google can speak them in Otto’s voice | To let you talk with Otto and have Otto answer out loud | Google, as our service provider (see Section 5) |
| Smart sessions and purchase records | A pseudonymous customer identifier derived from Apple purchase information; purchases, refunds, allowance periods, the plan and App Store price tier (never your country), the free week’s smart sessions left, numeric cloud costs, how much Otto Intelligence you used in your local day and week, and how many runs counted each day; and, at the end of each run with Otto Intelligence, a few counts about that run (how many photos Otto kept and how many highlights, how many times you spoke, and how long Otto was on), never its content | To verify subscription access, apply the free week’s smart sessions and Otto Intelligence’s fair use, and decide whether a run counts as a smart session | Us, hosted by Google Cloud; Apple verifies purchases |
| Voice previews, Otto’s introduction in another voice, Otto’s camera lines and countdown voice, and story photos (only when you choose a voice or play Otto’s introduction again in Settings, when the App gets Otto’s lines and countdown words ready for the voice and language in use, at most once a day to see whether one was re-recorded, or when you open a Learn about Otto story) | A request to our website for short recordings in that voice and in Otto’s language, or for that story’s photos | To let you hear each voice before you choose, to play Otto’s introduction in the voice you chose, to say Otto’s short camera lines and count you down in Otto’s voice, and to show a story’s photos | Us, through Google Firebase Hosting (standard server logs, as for website visits) |
| Voice mode usage records from earlier versions (no longer created) | A random identifier that Otto created for your installation; for each voice session, how long it lasted, how many exchanges it had, technical performance measurements, how it ended, the language, settings, and App version it used; whether you were on Free or Pro | Were used to enforce a daily voice mode allowance that no longer exists; kept only until they expire (Section 8) | Us, hosted by Google Cloud |
| Usage analytics (only while “Share usage analytics” is on) | A random analytics identifier that Otto creates for your installation, separate from the App’s other identifiers; which screens you open and which features you use, such as starting a session, taking or saving a photo, changing a setting, or seeing the subscription offer; coarse measurements, always grouped into ranges, such as how long something took or how many photos a session took; your iPhone generation, iOS and App version, the App’s language, your subscription access state, the price tier of your App Store country (never the country itself), and the state of Otto’s permissions and settings; the time of each event; your device’s IP address, which Mixpanel receives when the App connects but which Otto tells it not to use to work out your location | To understand how Otto is used, find where people get stuck, and decide what to improve | Us, through Mixpanel, Inc. |
| Crash and error reports | Device model, iOS and App version, available memory and storage, a technical record of what the App was doing, a few technical labels about the App’s state (such as the camera lens in use or your subscription access state), and an identifier for crash reporting | To find and fix crashes and errors | Us, through Google Firebase Crashlytics |
| App settings requests | An identifier for the App installation, device and App version, language, country or region setting, time zone, and IP address | To deliver App settings without an App update | Google Firebase |
| Security checks | Information that Apple and Google use to confirm a request comes from a genuine copy of Otto on a real Apple device | To protect our services from abuse and fraud | Apple and Google |
| Subscription information | Apple’s transaction and subscription identifiers, product, status, renewal and expiration dates, and refunds or revocations | To provide, verify, and reconcile Otto subscriptions | Us, from Apple |
| Diagnostic logs (while “Share crash reports” or “Share voice recordings” is on; always in pre-release builds and our testing environment) | A random identifier for each time the App opens, technical event and component names, severity, timings, counts, error codes and success or failure | To understand and fix problems across the App and our servers; never photos, audio, words from a scene or conversation, names or precise location | Us, through Grafana Labs in the United States |
| Voice recordings (only while “Share voice recordings” is on) | The recordings of what you say that our servers receive while voice mode is on, the words Otto heard and Otto’s replies as shown to you, how the conversation went (such as turns, interruptions and errors), and the App and Otto versions, tied to the pseudonymous identifier derived from your Apple purchase information; never camera views, photos, location, the notes in Memory or Otto’s instructions | So Greenflag Tech’s team can find where Otto misunderstood you or did not do what you asked, fix it, and improve Otto and its AI; never used to train any AI model | Us, hosted by Google Cloud in the United States |
| Server request logs | IP address, time, and technical details of each request to our servers | Security, troubleshooting, and preventing abuse | Us, hosted by Google Cloud |
| Support messages | Your email address and whatever you choose to include | To answer you | Us |
| Website visits | IP address, browser, and pages requested, in standard server logs | To deliver and secure ottocam.ai | Us, through Google Firebase Hosting |
| Website analytics (ottocam.ai only) | Pages you view, the site that referred you, links you click (such as the App Store button) and how far you scroll; your device type, browser, language, and screen size; and an approximate location (country, region, and city) that Google derives from your IP address. Google Analytics does not store IP addresses. Outside the European Economic Area, the United Kingdom, and Switzerland, a Google Analytics cookie with a random identifier lets it recognize a return visit; in those regions it sets no cookie and does not recognize return visits | To count visits and learn which pages and links help people understand Otto | Google, through Google Analytics |
In our internal testing environment, detailed diagnostics may also include test content and technical context needed to reproduce a problem. This applies to internal testing only. Pre-release production builds keep content out of these diagnostics.
Camera views, audio, photographic context and Otto’s replies pass through our servers only in memory. We do not put them in our logs, analytics, crash reports or cloud storage, except your voice and the conversation if you turn on “Share voice recordings” (Section 5). While Otto is on, our servers keep the conversation so far in memory only, to send it to Google with each exchange, and drop it soon after Otto stops. Your iPhone and our servers also keep a short working memory of the session (what you asked for, your and Otto’s last few lines, Otto’s plan) in memory only; after Otto stops, your iPhone keeps it, never stored, for up to 30 minutes so your next session can pick up where you left off. Images may incidentally include people or visible text. We do not identify people or send precise location or face templates. Crash reports and analytics never include this content.
We do not ask Apple for your name, email address, payment details, or Apple Account, and we do not connect cloud purchase records to usage analytics. Apple purchase identifiers allow us to verify your subscription and keep the free week’s smart sessions and fair use totals without asking you to create an Otto account.
Usage analytics. Unless you turn off “Share usage analytics” in Settings, Otto sends usage analytics to Mixpanel, Inc., which stores them for us in the United States. They describe what you do in the App, never what you photograph: never photos, camera images, your voice or what you say, text, faces, or your location, and never free-form text of any kind. Each installation gets a random analytics identifier that is separate from the App’s other identifiers and is not connected to your name, your Apple Account, or your subscription. When analytics volume is high, we may collect usage analytics from only some installations, chosen at random. When you turn the setting off, Otto stops sending usage analytics, discards any it has not sent yet, and replaces the analytics identifier, so anything sent after you turn it back on cannot be connected to what was sent before. Mixpanel does not use this information for advertising, and we do not use it to track you across other companies’ apps or websites.
4.1 Optional Feedback
Feedback you choose to send. Where available, you can send a message, optional contact details and up to three screenshots that you select. These go to our private support storage hosted by Google Cloud so Otto staff can review and respond to your feedback. Review screenshots before sending them, since their visible content is shared. Otto removes image metadata before storing screenshots; the message and visible image content are not anonymous. Feedback and attachments do not go to usage analytics, crash reports or Otto’s conversational AI. Submitted feedback is kept for up to 180 days; abandoned uploads are removed within 48 hours. “Delete all Otto data” requests removal of feedback associated with your installation. You can also contact privacy@trygreenflag.com with information that helps us locate a submission.
5. Otto Intelligence and Voice Mode
While Otto is on, Google’s Gemini service helps Otto photograph: it looks at what the camera sees, plans the photo, works the camera and talks you through it, in short lines on screen and, in voice mode, out loud. This section explains what is sent, what Google does with it, what Otto keeps, and how to turn it off. Otto is for people 18 and older.
Your permission. Otto Intelligence is off until you turn it on. After the permission screen, Otto shows a screen called “Make Otto smarter” that says what Otto Intelligence sends (small views of what the camera sees while Otto is on, what you say in voice mode, the name Otto greets you by and the pronouns you chose, your answers when you meet Otto and the notes Otto remembers), that it goes through our servers to Google Gemini, and what happens to it, with links to this Policy and the Terms of Use. Nothing is sent until you tap “Turn on Otto Intelligence”; “Not now” keeps Otto on your iPhone alone. If you installed Otto before this screen existed, Otto asks with the same screen the first time you tap Start, and nothing is sent before you answer. You can turn Otto Intelligence on or off at any time with “Otto Intelligence” in Settings; with it off, Otto runs on your iPhone alone, its on-screen directions come from your device, and nothing from the camera leaves it. Voice mode is separate. The switch “Start voice with Otto” is on, so voice mode starts each time you tap Start; you can turn it off in Settings, under Voice mode, and voice mode then runs only while you turn it on from the camera. iOS asks for the microphone the first time voice starts, and its prompt says that what you say goes to Google Gemini. If you do not allow the microphone, voice mode still works one way: Otto speaks out loud but cannot hear you, and no audio from your iPhone is sent. You can allow the microphone later from the voice mode controls or in the iOS Settings app, and turn it off there at any time.
When it runs. Otto Intelligence runs only while Otto is on (after you tap Start on the camera screen, until you tap Stop or Otto stops on its own) and only while your iPhone is online. While the camera is open with Otto off and Otto Intelligence on, the App may keep a connection to our servers ready so that Otto’s first line comes quickly; that connection carries only what is needed to sign in, Otto’s settings (including your answers when you met Otto and, if you let it, what Otto remembers) and a regular heartbeat, never anything from the camera or the microphone. The Lock Screen camera never uses the internet. Voice mode starts each time you tap Start while “Start voice with Otto” is on (it is on unless you turned it off), or when you tap the voice button; Otto then greets you out loud. With voice mode off, Otto’s greeting and its words show on screen instead. While voice mode is on, the voice button stays lit. It ends when you tap the voice button again, when Otto stops, when you leave the camera screen, or when you switch to another app, and it can end on its own after a period of silence. Otto does not listen when voice mode is off. While voice mode is on, your iPhone sends what you say only once you stop speaking, as a short recording of that sentence; nothing is sent while you are silent or while the microphone is muted. When the connection drops, Otto carries on from your iPhone and picks the conversation back up when the connection returns; when the free week’s smart sessions run out or fair use applies, Otto finishes the run on your iPhone alone.
Meeting Otto. After the permission screen and “Make Otto smarter”, Otto introduces itself out loud, with its words on screen, and may ask you three quick questions you answer with a tap: how you feel about taking photos, what you love to photograph and what would help you most. Otto does not listen during its introduction, and nothing you say is recorded. Its introduction is recorded in the App and plays without a connection. While your iPhone is online and Otto Intelligence is on, three of its lines are spoken for you: Otto sends through our servers to Google, once each, the part of your name it greets you with (if you gave one, and only after you tap Continue), the subjects you picked, and your answer about how Otto can help, with the language Otto speaks, and Google returns those lines in Otto’s voice. The App plays them and keeps the greeting on your iPhone so it can play it again, until you use “Delete all Otto data”. We do not log or keep what is sent, and the retention rules below apply at Google. With Otto Intelligence off (for example after “Not now”) or without a connection, Otto plays recorded lines that leave out your name and answers, and nothing is sent; your name and answers stay on your iPhone and are used only on it until you turn Otto Intelligence on.
What Google receives. While Otto is on and “Otto Intelligence” is on, Otto sends through our servers to Google’s Gemini service: reduced-size views of what the camera sees, sent when Otto starts, when the scene changes, when you ask about it and about once a minute while you talk (never a video recording, and never your photo library); a short description of the shot produced by Otto’s on-device analysis (for example what kind of subject is in the frame, such as a person, a pet or food, where it is, how many people are in the frame and whether their eyes are open, whether the shot is steady and ready, how many photos Otto has taken, which camera and zoom are in use, how long Otto has been on, the time of day as a rough band such as morning or dusk, and, when only a few are left, how many smart sessions you have left); what the camera can do (such as its lenses, zoom range and flash), its current settings and those you asked Otto to keep, so Otto can follow your requests and say truthfully what it changed; where each person in the frame is, how big and which way they face, under a temporary number for the run, so you can ask Otto to focus on one (never who they are); what you asked Otto for; reduced-size copies of photos Otto just took and previews of the original and finished photo when Otto finishes one; the language Otto should use (the App’s language, or the one you chose under “Otto speaks”); and your answers when you met Otto (how you feel about taking photos, what you love to photograph and how Otto can help), if you gave them, so Otto can choose its words, what to look out for and how much to say; and, if you let Otto remember, up to ten of the notes it keeps (Section 3), so Otto can use them the way a friend would. If you told Otto what to call you (on the “What should Otto call you?” screen or under “Otto calls you” in Settings), Otto sends that name once, at the start of the conversation, so Otto can greet you by it; it is used only to address you, and we do not log or keep it. If you chose pronouns under “Pronouns” in Settings, Otto sends them with the conversation so that, in languages where words change with gender, Otto’s words about you match them; without them Otto uses neutral words. They are used only for that, never to identify you or anyone else, and we do not log or keep them. While voice mode is on and you allow the microphone, your iPhone sends each thing you say as a short recording, cut when you stop speaking, with the words it heard where it can write them down, and Otto sends Google the recording or those words; nothing is sent while you are silent. With each exchange Otto also sends the conversation so far, and Otto’s words go to Google’s speech service so they are spoken in Otto’s voice. The images may incidentally contain people or visible text. If “Places you visit” is on, Otto also sends the state and the city you are in and, when it is fairly sure, the name and kind of the park, zoo or attraction you are in, and whether you welcomed or declined talking about it, so Otto can mention it the way a friend would; never your location or an address. This conversation does not include your location or face templates, or any name other than the one you asked Otto to use and the names in what Otto remembers. Our servers receive your IP address when your iPhone connects.
Private mode. Otto switches to private mode when you ask it to stop looking or say a photo is just for you, when Otto judges a moment should stay private, when its checks on your iPhone (Section 14) find a scene that should, such as nudity or a child in the bath, or when Google’s safety systems block something Otto sent. While it is on, no camera views, photos or previews go to Google, and Otto keeps no new notes in Memory. Instead, at most every six seconds and only on a change, your iPhone sends a short summary of the scene in fixed categories (such as the light, how many people are in the frame and where, the framing and up to three everyday objects) with a score of how private it looks, never an image or free text. In voice mode your voice still joins the conversation, quick replies keep working, and the camera and Otto’s photos keep working on your iPhone. Otto tells you when it starts and shows “Private: stays on your iPhone” until you tap “Let Otto see” or tell it to look again, which it allows only once the scene no longer looks private. With a child and a bath, a shower or a diaper in the frame, private mode starts before anything leaves your iPhone, and Otto stops taking photos by itself in that scene. Photos taken in private mode, or in the few seconds before the checks turned it on, are marked so they never leave your iPhone through Otto, even later. After a block from Google, private mode lasts for the rest of the run. Starting Otto again within 10 minutes starts it in private mode. Otto’s checks can miss things, especially without Apple Intelligence or with Sensitive Content Warning off, so a first view may still reach Google; if a photo must stay private, tell Otto first or turn off Otto Intelligence.
What Otto remembers. When you tell Otto something to remember in Settings under Memory, or say yes when Otto asks to remember someone, Otto sends your words through our servers to Google, with the notes it already keeps so the new one is filed with them; the App first removes numbers, contact details, addresses and codes from what you typed. Google writes the short note, and a second, separate request checks it before Otto keeps it; Otto keeps nothing that breaks the rules in Section 3 and does not tell you why a note was not kept. While Otto is on, your iPhone holds your last few sentences in memory only, to confirm that a name Otto wants to keep came from you, and drops them when Otto stops. We do not log or keep what is sent, and the retention rules below apply at Google. Turn off “Let Otto remember” and Otto keeps no new notes and sends none.
What Google does with it. Google processes this information as our service provider to run the conversation: it reads the camera views and the description, generates Otto’s directions, replies and camera instructions, converts what you say into text and, in voice mode, speaks Otto’s replies. Otto shows Otto’s words on screen. We use the Gemini service through Google Cloud, under Google Cloud’s terms for business customers. Under those terms, Google does not use this information to train its AI models, and it keeps it only as long as it needs to reply, with two exceptions. To reply faster, Google may hold recent requests in memory for up to 24 hours, separated from other customers and never written to disk. If Google’s automated safety systems flag a request as possible abuse, Google may keep that request for up to 90 days to check it, and authorized Google staff may review it. Otto’s own standing instructions for the conversation, which contain nothing about you, are kept ready at Google for up to an hour at a time so replies come faster. Google describes this in its abuse-monitoring and data retention pages; its terms are at cloud.google.com/terms and cloud.google.com/terms/service-terms.
What Otto keeps. Otto does not store the camera views it sent, your audio, transcripts of what you say, or Otto’s directions and replies, unless you turn on “Share voice recordings” (below), and never sends them to crash reporting or analytics. There are two exceptions, both kept only on your iPhone: a short title Otto may suggest for a session (for example “A night of beers”), which the App keeps with that session until you delete the session or use “Delete all Otto data”; and the notes in Memory you let Otto keep (above). While Otto is on, our servers keep the conversation so far in memory only, so Otto can follow it and carry on after a dropped connection, and drop it soon after Otto stops; your iPhone keeps a short working memory of it, in memory only, while Otto is on and for up to 30 minutes after it stops so your next session can pick up where you left off. If you speak another language, Otto may offer once to speak it from now on; your answer (the language you chose or declined) is kept only on your iPhone, and “Delete all Otto data” removes it. The name you asked Otto to call you and your answers when you met Otto are kept only on your iPhone too; clear or change them in Settings or use “Delete all Otto data”, and Otto sends no name and no answers. Before Otto Intelligence starts, the App checks availability and your smart sessions left with our servers. At the end of a run, the App sends our servers a few counts about it (how many photos Otto kept and how many highlights, how many times you spoke, and how long Otto was on), never its content, so we can decide whether the run counts as a smart session; our servers also count, from what passes through them, how long the run lasted, what it cost, the photos taken and how many times you spoke, without keeping what you said. We retain numeric usage and financial records described in Section 4. Apple purchase information verifies your subscription and the free week’s smart sessions without an Otto login.
Voice recordings you choose to share. “Share voice recordings” is off unless you turn it on, with the small switch on the “What should Otto call you?” screen or in Settings under Data sharing. While it is on, voice mode is on and private mode is off, our servers keep the recordings of what you say that they receive, the words Otto heard and Otto’s replies as shown to you, and how the conversation went, for 30 days, so Greenflag Tech’s team can find where Otto misunderstood you or did not do what you asked, fix it, and improve Otto and its AI. People who bring the iPhone close may be heard too. They never include camera views, photos, your location, the notes in Memory or Otto’s instructions, and they never go to analytics or crash reports. Only our team reviews them, and they are never used to train any AI model. Turn it off at any time: sharing stops at once and what was kept is deleted.
Requests Otto declines. Otto may decline a request, such as a photo of someone in secret (Terms of Use, Sections 7 and 10). When it declines, in response to your own words, a kind of request the Terms count toward a pause, our servers send your last sentence and that kind once to Google, in a separate request that only answers whether they match. If they do, we keep a misuse record: the kind as a category from a fixed list, the day and how much it counts, tied to the pseudonymous identifier derived from your Apple purchase information; never your words, images or audio, and we do not keep the sentence. A block by Google’s safety systems never creates one. Several records in a day pause Otto Intelligence and voice mode for a period (Terms of Use, Section 7); the App shows when they will be back, and Otto keeps working on your iPhone. Records, and the pauses they led to, are deleted 30 days after they were made, or when a pause ends if that is later, and are kept for that time even after “Delete all Otto data”, to prevent abuse. They are used only for pauses and abuse prevention, never in analytics or crash reports.
Smart sessions and availability. Active Monthly and Yearly subscriptions include Otto Intelligence and voice mode with no monthly count, subject to the fair use in the Terms of Use: after very heavy use in one local day or week, at unusually high demand, or after many requests in a row, Otto may use the iPhone’s own intelligence for a while. Eligible Yearly subscriptions begin with a seven-day free week that includes a number of smart sessions, shown in Settings. A smart session is one run of Otto with Otto Intelligence, from Start to Stop. A run uses one when it gives you something (a highlight, a few photos, a conversation) or keeps Otto Intelligence busy, for example for more than two minutes; a quick start and stop that gives you nothing does not count (the Terms of Use give the details). No welcome pack is granted. Active subscribers can keep taking photos on the iPhone whenever Otto Intelligence is unavailable. Offline photography and editing require previously verified access through its expiry or confirmed Apple grace deadline. After access ends, existing photos remain available to view, save, share and delete, and privacy/deletion controls remain accessible. Automatic photo cleanup pauses while access is inactive or unresolved and existing photos receive a fresh configured retention interval on resubscription.
6. How We Use Information
We use the information described in Sections 4 and 5 to:
- provide the App and the features you choose, including voice mode and Otto subscriptions;
- understand how the App is used, find where people get stuck, and decide what to improve;
- find and fix crashes, errors, and performance problems;
- review the voice recordings you chose to share, to find where Otto misunderstood you or did not do what you asked, fix it, and improve Otto and its AI (never to train an AI model);
- deliver setting changes without an App update;
- apply the free week’s smart sessions and Otto Intelligence’s fair use (how much of it an account used in its local day and week, kept as totals for at most 15 days), and decide whether a run counts as a smart session;
- count visits to ottocam.ai and learn which pages and links are useful;
- protect our services, you, and others from fraud, abuse, and security threats, including pausing Otto Intelligence after repeated requests Otto declines (Section 5);
- answer your messages; and
- comply with law and enforce our Terms of Use.
We do not use information to show you advertising, to build advertising profiles, to recognize or identify people, or to train AI models on your photos or voice. Otto does not make decisions about you that have legal or similarly significant effects.
7. How We Share Information
We share information only with:
- Service providers that process it on our instructions: Google LLC (Firebase services for crash reporting, App settings, security checks, and website hosting; Google Analytics for counting website visits; Google Cloud, which hosts our servers in the United States; and the Gemini service for Otto Intelligence and voice mode), Mixpanel, Inc. (usage analytics about how the App is used, stored in the United States), Grafana Labs (diagnostic logs, stored in the United States), and Apple Inc. (the App Store, subscription notifications, security checks, and the location service that names the city on a frame that shows the place and your city and state for “Places you visit”). Apple frameworks that run on your iPhone are governed by Apple’s own terms.
- Authorities and others, when required by law or legal process, or when needed to protect the rights, safety, or security of our users, the public, or Greenflag Tech.
- A successor, if Greenflag Tech is involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Otto does not use advertising identifiers and does not track you across other companies’ apps or websites.
8. How Long We Keep Information
| Information | How long |
|---|---|
| Photos that are not highlights and that you did not edit (in the App, on your iPhone) | Deleted automatically after 7, 30, or 90 days, as you choose (30 by default), or kept until you delete them if you choose Unlimited. A copy you saved to your Photos library is not affected |
| Highlights, photos you edited, your edits and session history, including a title Otto suggested for a session (in the App, on your iPhone) | Until you delete them or the session, use “Delete all Otto data,” or delete the App |
| Camera views, audio, photographic context, transcripts and Otto’s replies (unless you share voice recordings) | Not kept by us. Google may hold them in memory for up to 24 hours and keeps requests its safety systems flag for up to 90 days, as described in Section 5 |
| The conversation so far, and the session’s working memory (what you asked for, your and Otto’s last few lines, Otto’s plan) | In memory on our servers while Otto is on; the working memory also on your iPhone, in memory only, up to 30 minutes after Otto stops |
| The place you are in | Your rounded location and the answer: not kept by us, used only for the lookup. A count of lookups per pseudonymous customer identifier, to limit how often the App asks: up to 35 days. On your iPhone, the last answer and, if you declined talking about places, until when: until it no longer applies, you turn “Places you visit” or “Location” off, or use “Delete all Otto data” |
| Misuse records and pauses | 30 days after each record, or until a pause ends if that is later, also after “Delete all Otto data”; the sentence checked with Google is not kept |
| The name you asked Otto to call you | On your iPhone until you clear it in Settings or use “Delete all Otto data”; sent at the start of each conversation while Otto is on, and once when you meet Otto, and not kept by us or in our logs |
| The pronouns you chose | On your iPhone until you set them back to Not set in Settings or use “Delete all Otto data”; sent at the start of each conversation while Otto is on, and not kept by us or in our logs |
| Your answers when you met Otto, and the recording of Otto’s greeting | On your iPhone until you change them in Settings or use “Delete all Otto data”; the answers are sent with the conversation while Otto is on and once when you meet Otto, and are not kept by us or in our logs |
| What Otto remembers | On your iPhone until you delete a note or all of them in Settings under Memory, use “Delete all Otto data”, or delete the App; sent with the conversation while Otto is on and with a request to keep or change a note, and not kept by us or in our logs |
| Smart session grants and balances, and refund records | Retained to keep the free week’s smart sessions and prevent duplicate grants, and as needed for accounting, refunds and legal obligations. Contact us to exercise your privacy rights |
| Cloud usage reservations, cost records and the counts sent at the end of a run | Retained for financial reconciliation and dispute handling; numbers only, no images, audio, scene descriptions or transcripts |
| Otto Intelligence day and week usage totals, per account (numbers only) | Up to 15 days |
| Voice mode usage records from earlier versions, per session (no longer created) | 90 days |
| Daily voice mode totals from earlier versions, per installation (no longer created) | 35 days |
| Usage analytics | 2 years, then deleted automatically by Mixpanel |
| Crash and error reports | 90 days |
| Diagnostic logs | Up to 30 days |
| Voice recordings you chose to share | 30 days, then deleted; deleted sooner when you turn off “Share voice recordings” or use “Delete all Otto data” |
| Server request logs | 30 days |
| Website analytics | Detailed visit records for 2 months in Google Analytics; totals such as page view counts are kept longer. Where Google Analytics sets its cookie, it expires after up to 2 years unless you delete it |
| Records of Apple subscription notifications | 13 months |
| Subscription records | While the subscription is active, then 24 months after it ends, for accounting, refunds, and restores |
| Submitted feedback and selected screenshots | Up to 180 days, or until an associated deletion request; abandoned uploads expire within 48 hours |
| Support emails | As long as needed to resolve your request, and a reasonable period afterward |
Records are deleted at the end of these periods, although deletion from backups and logs can take a short additional time.
9. Your Choices and Controls
- Device permissions. Camera, microphone, Photos, and location access are controlled in the iOS Settings app. Only the camera is required. Without the microphone, voice mode speaks but cannot hear you. Without location, saved photos get no place and the light is read from the clock and the camera.
- Location. Turn off “Location” in Settings to stop adding places to photos you save, to stop using your area for the light, to leave the place off frames and to stop Otto from knowing the place you are in. Turn off “Places you visit” on the same screen to stop only the last: Otto then neither looks up nor mentions the place you are in. A frame’s own Location switch leaves the place off that photo. Turning it off is kept even after “Delete all Otto data.”
- Otto Intelligence. Turn off “Otto Intelligence” in Settings and Otto runs on your iPhone alone: nothing from the camera is sent, pending suggestions are discarded, and on-screen directions come from your device. Your choice is kept, even after “Delete all Otto data.”
- Voice mode. Voice mode starts with Otto while “Start voice with Otto” is on, which it is unless you turn it off in Settings, under Voice mode; you can also start and stop it from the camera at any time. In Settings, under Voice mode, you can choose Otto’s voice, and under “You and Otto” the language Otto speaks (“Otto speaks”), and you can turn the microphone off for Otto in the iOS Settings app. Between the things you say, nothing from the microphone leaves your iPhone. On-screen guidance works without it.
- Your name. Otto calls you by a name only if you gave it one. Skip the “What should Otto call you?” screen, or clear the name under “Otto calls you” in Settings, and Otto sends no name.
- Your pronouns. Otto uses pronouns only if you chose them under “Pronouns” in Settings, the only place they change. Leave them at Not set and Otto sends none and words things about you neutrally.
- Your answers. Every question when you meet Otto can be skipped. Change or remove your answers in Settings under “You and Otto”.
- Private mode. Ask Otto to stop looking, and it sends no camera views or photos to Google until you let it see again (Section 5).
- Memory. Turn off “Let Otto remember” in Settings under Memory and Otto keeps no new notes and stops using the ones it has; they stay until you delete them. Tap a note to read it, tell Otto what to change, or delete it; “Delete all memories” deletes them all.
- Autonomous capture. Otto takes photos automatically only while Otto is on: after you tap Start on the camera screen, until you tap Stop or Otto stops on its own. Otto is off whenever the camera opens. Voice mode is available only while Otto is on; when Otto stops, voice mode ends and nothing more from the microphone goes to Google.
- Saving to Photos. Otto saves a photo to your Photos library when you tap Save, or on its own when a session ends if you turned on “Auto save” in Settings. Deleting a photo or a session in the App does not remove the copy you saved.
- Usage analytics. Turn off “Share usage analytics” in Settings and Otto stops sending usage analytics, discards any it has not sent yet, and replaces the analytics identifier. Usage analytics already sent stay in Mixpanel until they expire (Section 8); because they are tied only to a random identifier, we cannot find them to delete them.
- Crash reports. Turn off “Share crash reports” in Settings and Otto stops sending crash and error reports, and diagnostic logs unless you share voice recordings.
- Voice recordings. “Share voice recordings” is off unless you turn it on. Turn it off in Settings under Data sharing and Otto stops sharing at once and deletes the recordings it kept.
- Delete all Otto data. In Settings, “Delete all Otto data” deletes, on your iPhone, Otto’s sessions, the photos kept in the App and the places stored with them, the place you were last in and whether you declined talking about it, the name you asked Otto to call you, the pronouns you chose, your answers when you met Otto and the recording of Otto’s greeting, what Otto remembers, and the random identifiers for your installation (including the one for usage analytics), discards usage analytics not yet sent, returns your other settings to their defaults, and asks our servers to delete any voice recordings you shared, turning “Share voice recordings” off, and any voice mode usage records from earlier versions for that installation. The screen shows what will be deleted (sessions, photos, highlights, edited photos and storage used) and asks you to hold to confirm. It keeps your usage analytics and crash reporting choices and your “Otto Intelligence”, “Location” and “Let Otto remember” choices. It does not remove photos you saved to your Photos library, cancel an Apple subscription, or restore the free week’s smart sessions already used. Financial records needed to prevent duplicate grants, handle refunds and meet legal obligations remain, as described in Section 8, and so do misuse records (Section 5). If your iPhone cannot reach our servers at that moment, Otto still deletes the data on your iPhone and asks our servers again the next time you open the App; in any case, the server records expire at the end of their retention period (Section 8).
- Deleting the App removes what Otto stored on your iPhone, except photos in your Photos library and the random installation identifiers, which iOS may keep until you use “Delete all Otto data.”
- Website analytics. ottocam.ai does not load Google Analytics if your browser sends a Global Privacy Control or Do Not Track signal. You can also block or delete cookies in your browser, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.
- Subscriptions. Manage or cancel Otto subscriptions in the iOS Settings app under your Apple Account, or from “Manage subscription” in Otto’s Settings. Refunds are handled by Apple.
10. Your Privacy Rights
Depending on where you live, you may have the right to ask us to confirm whether we process your personal information and to access, correct, delete, or receive a copy of it, and to object to or restrict certain processing. We will not treat you differently for exercising these rights.
How to make a request. Email privacy@trygreenflag.com and tell us which right you want to exercise. Because Otto has no accounts and we cannot link usage analytics, crash reports, voice mode records, or subscription records to your name, we can only locate information you help us identify:
- For voice mode usage records from earlier versions, use “Delete all Otto data” in the App. It deletes the records tied to your installation; the rest expire (Section 8).
- For voice recordings you shared, turn off “Share voice recordings” or use “Delete all Otto data”. Either deletes them.
- For usage analytics, turn off “Share usage analytics” in the App. We cannot locate usage analytics already sent, because they are tied only to a random identifier that the App replaces.
- For subscription records, send your Apple order ID or transaction ID (shown in your Apple receipt). We will locate the matching record and, once it is no longer needed to honor your subscription, refunds, or legal obligations, delete it.
- For support emails, write from the address you used.
- Misuse records (Section 5) are tied only to a pseudonymous identifier and expire after 30 days. Where the law allows, we keep them for those 30 days to prevent abuse even when you ask us to delete your data.
We will respond within the time the law requires, generally within 45 days (one month in the European Economic Area and the United Kingdom), and will tell you if we need more time.
Appeals. If we decline your request, you can appeal by replying to our decision with the subject “Appeal.” We will respond within the time the law requires. If you are not satisfied with the result, you may contact your state attorney general or your data protection authority.
Authorized agents. You may use an authorized agent to make a request where the law allows. We may ask for proof that the agent has your written permission.
11. U.S. State Privacy Notice
This section applies to residents of California and of other U.S. states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.
In the past 12 months we have collected these categories of personal information:
| Category | Examples | Source | Retention |
|---|---|---|---|
| Identifiers | Random installation identifiers (including the usage analytics identifier), the random website analytics identifier, Apple transaction identifiers, IP address, email address if you write to us, and the name you asked Otto to call you if you gave one (sent with the conversation while Otto is on, not kept by us) | Your device or browser; Apple; you | See Section 8 |
| Characteristics of protected classifications | The pronouns you chose, if any (sent with the conversation while Otto is on to word what Otto says about you, not kept by us, never used to infer anything about you) | You | See Section 8 |
| Commercial information | Otto subscription status and history, the free week’s smart sessions, Otto Intelligence day and week usage totals, and refunds | Apple; your device; our ledger | See Section 8 |
| Internet or other electronic network activity | Usage analytics (screens viewed and features used in the App), crash and error reports, voice mode usage records from earlier versions, misuse records, server request logs, website analytics (pages viewed, links clicked, approximate location) | Your device or browser; our servers | See Section 8 |
| Audio, visual and user-provided information | Feedback messages and selected screenshots; reduced-size camera views and photo previews while Otto is on with “Otto Intelligence” on, voice audio while you use voice mode with the microphone allowed, what you asked Otto for, and what you asked Otto to remember, processed by Google through our in-memory gateway and not kept by us; voice recordings and conversations with Otto, only if you turn on “Share voice recordings,” kept 30 days | Your device | See Section 5 |
| Geolocation data | Your location rounded to about 100 meters, while “Places you visit” is on, used only to look up the place you are in and not kept by us; the state, city and place name sent with the conversation | Your device | See Section 8 |
| Inferences | The photo preferences Otto notes in Memory from how you use the App (for example the subjects you save most or the crops you choose), kept only on your iPhone and never about sensitive characteristics | Your device | See Section 8 |
We use these categories for the purposes in Section 6 and disclose them to the service providers in Section 7 for business purposes. We do not sell or share personal information, as those terms are defined under California law, and we do not process personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We do not use or disclose sensitive personal information to infer characteristics about you. We do not knowingly sell or share the personal information of consumers under 16. Because we do not sell or share personal information, there is nothing to opt out of; if your browser sends a Global Privacy Control signal, we treat it as a request to opt out anyway, and ottocam.ai does not load Google Analytics. We do not offer financial incentives for personal information.
You have the rights described in Section 10, including the rights to know, access, delete, and correct, and the right not to be discriminated against for exercising them.
12. Users in the European Economic Area, the United Kingdom, and Switzerland
Greenflag Tech, Inc. is the controller of the personal information described in this Policy. We rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the App, voice mode, and Otto subscriptions | Performance of our agreement with you |
| Sending camera views, photographic context, the name you asked Otto to call you and the pronouns you chose, your answers when you met Otto and what Otto remembers (if any) and, in voice mode, your voice to Google | Your consent, given when you tap “Turn on Otto Intelligence” or turn on “Otto Intelligence” in Settings, and for your voice also the microphone permission; you can withdraw either at any time in Settings, which stops further transmission at once |
| Verifying your subscription, keeping the free week’s smart sessions, applying fair use, reconciling usage and handling refunds | Performance of our agreement with you and compliance with applicable accounting and legal obligations |
| Misuse records, their check and pauses | Our legitimate interest in preventing abuse and keeping to our providers’ rules |
| Looking up the place you are in (“Places you visit”) | Our legitimate interest in letting Otto talk about where you are taking photos (you can turn it off at any time in Settings); its name goes to Google as part of the conversation you consented to |
| Usage analytics in the App | Our legitimate interest in understanding how Otto is used and improving it (you can turn them off at any time in Settings) |
| Crash and error reports, and diagnostic logs | Our legitimate interest in keeping the App stable (you can turn them off at any time) |
| Keeping and reviewing the voice recordings you chose to share | Your consent, given when you turn on “Share voice recordings”; you can withdraw it at any time in Settings, which deletes them |
| App settings, security checks, and server logs | Our legitimate interests in operating and securing our services |
| Website analytics | Our legitimate interest in understanding how people use our website; in these regions Google Analytics sets no cookie and does not recognize return visits |
| Support | Performance of our agreement with you and our legitimate interest in helping you |
| Legal compliance | Compliance with legal obligations |
International transfers. We are based in the United States, and our servers and service providers, including Mixpanel for usage analytics, process information in the United States. Google may process camera views, voice and photographic context in other countries where it runs the Gemini service, and website analytics data in other countries where it runs Google Analytics. Where the law requires, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses in our providers’ data processing terms and, for providers that participate in it, such as Google LLC, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
Your rights. In addition to the rights in Section 10, you have the right to withdraw consent at any time (without affecting processing before the withdrawal), to object to processing based on our legitimate interests, and to lodge a complaint with your local data protection authority.
13. Children and Age Limits
Otto is for people 18 and older. You must be at least 18 to use the App, and we do not knowingly offer it to minors or collect their personal information. Otto has no accounts and cannot independently verify your age; the App is rated 18+ on the App Store. Otto never guesses anyone’s age from their voice or how they look. If you tell Otto during a run that you are under 18, Otto Intelligence and voice mode end for that run and Otto keeps working on your iPhone; we keep only a count, never your words. If you believe a minor has sent us personal information, for example in a support email, contact privacy@trygreenflag.com and we will delete it.
14. Face Analysis and Image Recognition
To take and choose better photos, Otto’s on-device analysis detects whether faces are in the frame, where they are, and simple attributes such as whether eyes are open or someone is smiling. This analysis:
- runs entirely on your iPhone and is stored only with the session on your iPhone;
- is never used to recognize or identify anyone, and Otto does not create face templates for recognition; Otto remembers a person only when you tell it, never from how they look;
- is never sent to us; and
- is deleted with the session.
While Otto is on with “Otto Intelligence” on, the description sent to Google can include how many people are in the frame, whether their eyes are open, and where each one is, how big and which way they face under a temporary number for the run, without sending face templates, and the reduced-size camera views may incidentally contain faces. Those images pass through our gateway to Google as described in Section 5; they are not used to identify people.
Checks that keep a scene private. Before a camera view leaves your iPhone, and before Otto’s own photos reach any cloud feature, Otto checks on your iPhone whether the scene should stay private, using:
- Apple’s on-device scene labels (Vision), on a small copy of each view that would be sent;
- Apple’s Sensitive Content Analysis, only if Sensitive Content Warning is turned on in your iPhone’s settings; and
- on iPhones with Apple Intelligence, its on-device model, answering only in fixed categories, when the first checks find a cue.
These checks run only on your iPhone, and their results are never stored or sent anywhere apart from the private-mode summary and score (Section 5); if a check fails, the view is not sent. Usage analytics never record private mode or these checks.
15. Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls on our servers, and security checks that help keep our services from being misused. On your iPhone, Otto keeps photos and session data in the App’s private storage, protected by iOS data protection. No method of storage or transmission is completely secure. If we learn of a security incident that affects your personal information, we will notify you as the law requires.
16. Photographing Other People
Otto is a camera. You are responsible for the photos you take, including respecting the privacy, consent, and other rights of the people and places you photograph.
17. Changes to This Policy
We will post any changes at ottocam.ai/privacy and update the “Last updated” date. Before a change that materially expands what we collect or how we share it takes effect, we will notify you in the App or on the website, and ask for your consent where the law requires it.
18. Contact Us
Greenflag Tech, Inc., 1401 21st Street #4114, Sacramento, CA 95811, United States. privacy@trygreenflag.com.