Privacy notice

This notice explains what data we collect when you use otlta and how we use it. It covers all of it: the web app at app.otlta.com, the otlta apps for iOS and Android, and this site. We are Jodi Anoorabh LLP, an Indian limited liability partnership, and we're the data controller for everything below.

What we collect

• Account data: name, email, password hash, profile photo (optional). Required for authentication.
• Workspace content: wiki pages, tasks, sprints, comments, attachments, AI conversation history. Stored on your behalf.
• GitHub data, if a workspace connects a repository: commit ids, commit and workflow-run links, and commit author names from the events GitHub sends us. An author may be someone with no otlta account. We read commit messages to find card references and do not store them.
• Usage events: AI request type, model used, input/output token counts, cost in INR micros. Used to enforce fair-use limits and bill you correctly.
• Operational logs: request paths, IP addresses (transient), error stack traces. 30-day retention.
• Crash and diagnostic data: when the app crashes or throws, a report goes to Sentry. Device or browser, OS version, app version, and the stack trace. Detail below.
• Payment metadata: Razorpay subscription ids and billing-period status. We never see your card number.

How we use it

• Run the service: authenticate you, route your requests, store your content.
• Bill you: calculate seat counts, generate invoices, charge via Razorpay.
• Improve the service: aggregate, anonymized usage trends. We don't analyze your individual content.
• Communicate with you: account email, billing receipts, security notices.

What we don't do

• We don't sell your data. We've never received an offer to.
• We don't train AI models on your content.
• We don't share your content with third parties except the sub-processors listed on the security page, and only as needed to run the service.
• We don't have a customer-support tool that can read your wiki or tasks. The platform-admin route exists for incidents (e.g. comp accounts, internal debugging) and is allowlisted to two engineers, and admin actions are recorded in an audit log.

Crash reports

When something throws — a crash in the mobile app, an unhandled error in the browser — we send a report to Sentry so we can find it and fix it. A report carries the stack trace, the app version and build, your device or browser and its OS version, and a short trail of the screens and controls you touched just before. It does not carry your wiki pages, tasks, comments or AI conversations.

Each report is tagged with the user id of whoever is signed in, so we can tell one broken account apart from an outage. That id is the only thing in the report that identifies you, on the web and in the mobile apps alike; we look the person up in our own database when we need to. Your email address is not attached.

Sentry processes crash reports in its EU region. Nothing is reported from development builds.

Mobile apps

The iOS and Android apps are the same account and the same data as the web app — there's no separate mobile profile, and nothing above stops applying because you're on a phone. What differs is mechanical:

• You sign in with an email and password, with Google, or with Apple. The session is kept in the app's private storage on the device rather than in a browser.
• To stay readable without a signal, the app keeps a copy on the device of the workspace content you have loaded in it: your name and email, your workspaces, your tasks and the tasks, comments, sprints, epics, notifications and digests shown on screens you have opened, the names and email addresses of fellow workspace members, and any reminder email address set on those tasks or on documents you have opened (which can belong to someone who has since left the workspace). For documents it keeps the list of every document you can see in each workspace you have opened in the app (titles and details such as tags and dates, not their text) and the full text of the documents you have opened (private documents included). It is not sent anywhere from the phone. It is deleted from the phone when you sign out, whether or not you have a signal, and when a different account signs in on that phone. Anything in it older than seven days is dropped the next time the app runs; an app update can also discard it, but does not always. It sits in the app's private storage with no encryption from otlta beyond what the phone itself applies. iOS leaves it out of iCloud backups; on Android it can be included in your Google backup, as the session token can. Search terms, Ask conversations and documents' public share links are not kept on the device.
• A task you create in the app with no signal is kept on the device until it can be sent: its title, priority and due date, which workspace it is for, and when you created it. It is sent to otlta when the app next has a signal, and then deleted from the device. If otlta refuses it (for example, because you are no longer in that workspace), it stays on the device with the reason shown until you discard it. An unsent task stays on the phone, under your account, until one of five things happens: it is sent; you sign out from the app's Settings, which warns you first if any are still waiting, or if it cannot read what is waiting; you delete your account from the app's Settings; a different account signs in on that phone; or 30 days pass without you being signed in on that phone. If the phone's storage refuses one of those deletions from Settings, the app tells you. Being signed out any other way does not delete it straight away — for example when you sign out on the web, which signs your other devices out too (a device that is already signed in can keep working for up to about an hour, until its current session runs out), or when the phone's session expires or is rejected. In that case the app shows and sends nothing while it is signed out, and sends the waiting tasks, and tells you so, when you sign back in with the same account. A task that was still being saved at the moment the session ended is kept with them, or the app tells you it could not be. Unsent tasks are kept this way for up to 30 days after you were last signed in on this phone, counted from the last time the app was open with you signed in; once that has passed, they are deleted the next time the app is opened. So signing out on the web does not by itself remove them from a phone you no longer have: they go when someone else signs in on it, when the app is removed, or the first time the app is opened after the 30 days. If the account was deleted somewhere other than this phone, its unsent tasks stay in the app's storage on the same terms: until a different account signs in, the app is removed, or the app is opened after the 30 days. They sit in the same private storage as the copy above, with the same lack of encryption from otlta and the same backup behaviour.
• On launch the app asks Expo's update service whether a newer JavaScript bundle exists. That request carries the app version, the platform, your IP address and a random per-installation identifier that Expo generates on first launch. The identifier is not your account and does not follow you to another device, but it does persist until the app is uninstalled.
• Feedback you send from Settings includes the app version, platform, OS version and the screen you were on, so a bug report is actionable without you having to describe your setup.
• The apps never ask you for a permission at runtime: there is no location, camera, photo-library, contacts, microphone or notification prompt, because nothing in the build uses those. On Android 12 and below the package does declare legacy storage permissions, which Android and the Play listing surface under "photos and media" — they arrive with the image library we build on, and no code path reads them. There are no advertising identifiers and no ad or analytics SDKs.

Deleting your account works the same from the app as from the web — Settings → Delete account. Your login is destroyed in that request and cannot be recovered. Where deleting you leaves an organization with nobody in it, that organization and its content are scheduled for erasure instead; see Retention below.

Cookies

On the web we keep you signed in using session storage in your browser, managed by Supabase Auth; in the mobile apps the equivalent token sits in the app's own storage on your device. We don't use third-party analytics tracking on the marketing site. The app surfaces basic usage telemetry to Cloudflare Analytics Engine, anonymized at the org level.

Your rights

You can download your wiki pages, correct your account info, or delete your account at any time from Settings (full workspace exports on request). India's Digital Personal Data Protection Act, the GDPR, and the CCPA all apply where they do; if you're a resident covered by one of those, the rights you have under that law are yours regardless of what this notice says.

Email privacy@otlta.com to make a request. We respond within 30 days; usually faster.

Retention

We keep your content while your account is active. If you delete your organization, we hold the data for 30 days (in case you change your mind) and then permanently remove it. Operational logs are pruned after 30 days. GitHub commit records are deleted when a workspace disconnects the repository, and comments GitHub added to a card stay on that card as workspace content. Backups are encrypted and rolled forward weekly.

Children

otlta is not for children under 13. Don't create an account if you're younger than that.

Changes

If we make a meaningful change, we'll email account owners 30 days before it takes effect.

Contact

Privacy questions: privacy@otlta.com. Anything else: hello@otlta.com.