Skip to content
Otto

Legal

Otto Privacy Policy

Effective date: September 28, 2026

This Privacy Policy explains how Greenflag Tech, Inc., a Delaware corporation ("Greenflag Tech," "we," "us," or "our") handles information when you use Otto, our camera application for iPhone, and the Otto pages at ottocam.ai (together, the "App").

Otto is built to keep your photography on your device. There is no account, no login, and no cloud photo processing. This Policy describes the small amount of information that does leave your iPhone, why, and what you can do about it. If you do not agree with this Policy, do not use the App.

1. Controller and Contact

Greenflag Tech, Inc. is responsible for personal information processed under this Policy.

Greenflag Tech, Inc.
1401 21st Street #4114
Sacramento, CA 95811
United States

Privacy and data requests: privacy@trygreenflag.com
Support: support@trygreenflag.com
Legal: legal@trygreenflag.com

2. Quick Summary

  • Your photos never leave your device through Otto. The camera feed, candidate photos, and finished photos are processed on your iPhone. Otto saves the photos you keep to your Photos library and nowhere else.
  • Your voice stays on your device. Spoken instructions are transcribed on your iPhone using Apple's on-device speech technology. We never receive audio or transcripts.
  • No account. We do not collect your name, email, phone number, or contacts.
  • What we do receive: crash and performance diagnostics with no photo or voice content, configuration requests, app integrity tokens, and, if you subscribe to Pro, subscription status from Apple identified by transaction numbers rather than by you.
  • No advertising, no tracking, no sale of personal information. We do not use advertising identifiers and do not request tracking permission.

3. Information Processed Only on Your Device

The following is processed entirely on your iPhone and is not transmitted to us:

  • Camera frames used to understand the scene and decide how to take the photograph.
  • Candidate photographs captured during a smart session. These are stored in Otto's private storage on your device and deleted automatically after a retention period (currently 7 days) unless you save them.
  • Finished photographs you keep, which Otto saves to your Photos library with your permission.
  • Voice input and its transcription, used to understand what you want to photograph, then discarded.
  • Spoken guidance generated on your device.
  • Face and scene analysis used to choose settings, timing, and the best photograph. This analysis is transient, is not used to identify anyone, and is not stored beyond the session or sent anywhere.
  • Your settings and preferences, including guidance level, voice toggles, aesthetic profile, and auto-save.
  • Your daily smart-session count for the Free plan, kept locally.

Apple frameworks used for camera, vision, speech, on-device intelligence, and photo saving run on your device under Apple's own terms. When on-device speech recognition is unavailable for your language, the App tells you and voice input is disabled rather than sent to a server.

4. Information We Receive

4.1 Crash and performance diagnostics

We use Firebase Crashlytics (Google LLC) to receive crash reports and selected non-fatal error reports, and Apple's MetricKit to receive aggregated performance data. These reports include device model, iOS version, App version, free memory and storage at the time of the event, a stack trace, and a Crashlytics installation identifier. They never include photos, thumbnails, audio, transcripts, recognized text, face data, or your location. Crash reporting also follows your iPhone's "Share With App Developers" setting.

4.2 Remote configuration

The App periodically fetches configuration values (for example the Free daily session limit) from Firebase Remote Config (Google LLC). This request carries a Firebase installation identifier, device and App version information, and, as with any internet request, your IP address, which Google processes transiently to deliver the response. The App works without this request using built-in defaults.

4.3 App integrity

To protect our subscription service from abuse, the App uses Firebase App Check with Apple App Attest. Apple attests that the App is a genuine, unmodified copy running on a real Apple device, and Firebase issues a short-lived token. The token proves the App is authentic; it does not identify you and is not proof of purchase.

4.4 Subscription information

If you subscribe to Otto Pro, Apple processes your payment. We do not receive your name, payment details, or Apple ID. Apple sends us App Store Server Notifications and we may query the App Store Server API to keep your subscription status accurate. This information includes Apple's transaction and subscription identifiers, product, status, renewal and expiration dates, and refund or revocation events. We store a minimal subscription record keyed by these identifiers, together with a random pseudonymous installation identifier generated by the App, so that your Pro access can be reconciled. We cannot use this record to identify you by name.

4.5 Support email

If you write to us, we receive your email address and whatever you include. Please do not send photographs unless they are needed to resolve your issue.

4.6 Website

The Otto pages at ottocam.ai are served by Google Firebase Hosting. They set no cookies and run no analytics. Standard server logs (IP address, browser, pages requested) are kept briefly for security and operations.

5. Product Analytics

The App does not currently use a third-party product analytics service. If we introduce one in the future, we will update this Policy before any analytics data is sent, describe exactly what is collected, keep the same rule that no photo, voice, text, face, or location content is ever included, and offer an in-app setting to turn it off.

6. How We Use Information

We use the information in Section 4 to: operate and improve the App's stability and performance; deliver configuration changes without an App update; protect our services from fraud and abuse; provide, verify, and reconcile Pro subscriptions; respond to your requests; and comply with law.

We do not use any information to build advertising profiles, to identify people in photographs, or to train models on your photographs or voice.

7. How We Share Information

We share information only with:

  • Service providers acting on our instructions: Google LLC (Firebase Crashlytics, Remote Config, App Check, and the Cloud Functions and Firestore infrastructure that hosts our subscription service, in the United States) and Apple Inc. (App Store, App Attest, subscription notifications, and the on-device frameworks described above under Apple's terms).
  • Legal and safety recipients when required by law, legal process, or to protect rights, safety, or the integrity of our services.
  • A successor in a merger, acquisition, or asset sale, under this Policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

8. Retention

  • Candidate photographs: on your device only, deleted automatically after the retention period (currently 7 days) or when you discard them.
  • Session metadata on your device: kept up to 90 days for the App's own quality measurements, then deleted.
  • Crash and performance diagnostics: retained by Crashlytics for 90 days.
  • Subscription records: retained while your subscription is active and for up to 24 months after it ends, for accounting and to honor refunds and restores, then deleted or anonymized.
  • Support email: retained as long as needed to resolve the matter and for a reasonable period afterward.

Deleting the App deletes everything Otto stored on your device except the photographs you saved to your Photos library.

9. Your Rights and Choices

  • Permissions. You control camera, microphone, speech recognition, and Photos access in iOS Settings. Otto requests Photos permission only to add photographs, never to read your library.
  • Voice. Voice output and microphone input can be turned off independently in the App.
  • Auto-save. You can turn off automatic saving and choose which photographs to keep.
  • Crash reporting. Follow your iPhone's Analytics and Improvements settings.
  • Subscriptions. Manage or cancel in iOS Settings under your Apple Account. Refunds are handled by Apple.
  • Access, correction, deletion. Because we hold no account and cannot link diagnostics or subscription records to your identity by name, our ability to locate information about you is limited. If you provide your Apple order or transaction identifier, we can locate and delete the subscription record associated with it once it is no longer needed to honor your subscription. Write to privacy@trygreenflag.com.

10. California and Other U.S. State Privacy Disclosures

In the past 12 months we have collected these categories of personal information as described above: identifiers (installation identifiers, Apple transaction identifiers, IP address, support email address); commercial information (subscription status); and internet or electronic activity (crash and performance diagnostics). Sources: your device and Apple. Purposes: Section 6. Recipients: Section 7. We do not sell or share personal information, do not use sensitive personal information to infer characteristics, and do not knowingly collect information from consumers under 16. You have the right to know, delete, correct, and to not be discriminated against for exercising your rights. Submit requests to privacy@trygreenflag.com; we will verify requests using the identifiers described in Section 9. You may use an authorized agent with written permission.

11. Users Outside the United States

Our services are provided from the United States, and information described in Section 4 is processed there by us and our providers. Where your local law requires a legal basis, we rely on the performance of our agreement with you (subscriptions, delivering the App), our legitimate interests in security, stability, and fraud prevention, and your consent where you grant device permissions. Where local law grants additional rights (access, portability, objection, complaint to a supervisory authority), you may exercise them by writing to privacy@trygreenflag.com.

12. Children

Otto is a general-audience camera application. It is not directed to children under 13, and we do not knowingly collect personal information from children. Because the App collects no account information, we have no way to determine a user's age; if you believe a child has provided us personal information through a support email, contact us and we will delete it.

13. Security

Photographs and session data on your device are stored in the App's private container protected by iOS Data Protection. Identifiers that need to persist are kept in the iOS Keychain. Server-side records are held in access-controlled Google Cloud infrastructure, our service endpoints require App Check attestation, and no server credential is ever included in the App. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.

14. Photographing Other People

Otto is a camera. You are responsible for the photographs you take, including respecting the privacy, consent, and legal rights of the people and places you photograph.

15. Changes to This Policy

We will post any changes at ottocam.ai/privacy and update the effective date. If a change materially expands what we collect (for example, enabling product analytics), we will update this Policy before the change takes effect and, where practical, notify you in the App.

16. Contact

Greenflag Tech, Inc., 1401 21st Street #4114, Sacramento, CA 95811, United States. privacy@trygreenflag.com.