oto · Privacy policy

Privacy policy

Draft of 31 October 2026, under legal review. oto is in testing and not yet publicly released.

Who we are

oto is a travel journal app made by Ilica One Technologies LLP, North Lakhimpur, Assam, India. Questions and requests: business@ilica.in.

What we collect

• Your email address, to sign you in with a one-time code. There are no passwords.
• Your profile: name, optional home country, km or miles, and whether your public profile is on.
• A confirmation that you are 18 or over, and when you gave it. We do not store your date of birth.
• Your journal: journeys, checkpoints (place names, how you travelled, times and time zones, notes), and coordinates only if you add them or tap “Use my location”.
• Photos you add. Before a photo leaves your phone it is resized and all hidden information inside it is removed, including where and with which camera it was taken.
• Your home area, if you set one, so stops near home stay private automatically. It is never shown to anyone.
• Your acceptance of this policy and the terms, with the version and time.

We do not collect your location in the background, your contacts or advertising identifiers. We do not sell your data and show no ads.

What becomes public

Nothing, unless you choose. If you publish a story, others see its title, days, route and how you travelled; notes and photos only if you switch them on and choose them. Hidden stops, stops near home, stops without a location and exact coordinates are never public. Your public profile is off unless you switch it on.

Where it is stored and who processes it

Your data is stored in India. Supabase (database, sign-in and photo storage, Mumbai region) and PowerSync (sync, India region) process it on our behalf; Brevo sends your sign-in code emails and sees only your email address; Google Firebase serves this website. On your phone, your journal is kept in a database encrypted with a key unique to your account.

How long we keep it

Until you delete it. A journey, checkpoint or photo you delete disappears at once and is permanently erased from our servers after 30 days. Deleting your account erases everything immediately; copies in our providers’ backups expire on their normal schedule. A minimal record that privacy actions happened (without their contents) is kept to show your choices were applied.

Your rights

You can see your data (Profile → Download my data), correct it in the app, delete it (Profile → Delete account, or this page), and withdraw consent by deleting your account. Under Indian law you may also nominate someone to exercise these rights, and raise a grievance with us at business@ilica.in and then with the Data Protection Board of India.

Age

oto is only for people aged 18 or over.

Changes

If this policy changes in a way that matters, we will tell you in the app before it applies.