What Osmia learns about you is yours

Who is responsible

Osmia - the app and this site - is operated by Balder Berg Adelgaard, a sole trader registered in Greece (tax number (AFM) 200354773, tax office DOY Chania; G.E.MI. number 196746358000), at Odyssea Kalligiani 2, 731 35 Chania, Crete, Greece (EU). He is the data controller for everything described here. For any privacy question or request, write to privacy@osmia.day. If Osmia becomes a company, this line will change to name it.

What Osmia collects

We collect only what the practice needs:

• Your email address

  It creates your account and signs you in. With Sign in with Apple it may be an Apple private-relay address instead of your real one - your choice, and Osmia works the same either way.

• Your writing

  The intentions, reflections, journal entries, and conversations you put into the app, the responses Osmia writes back, and an internal structured reading Osmia derives from your words in order to respond well. Thread names and patterns reports generated from your writing are stored with it.

• Your account

  An internal identifier linking your writing to you, and four optional profile details: a display name (how Osmia addresses you), an optional choice of how Osmia should refer to you (she, he, they, or rather not say), your country of residence, and the place whose sky a patterns report may mention - it starts as the timezone your phone's clock is already set to, and you can name your actual town instead, from a list that ships inside the app and is searched on your phone. No location permission is ever asked for and no GPS is ever read. You can leave them blank, change them, or clear them at any time. The pronoun choice is used only for wording - so Osmia does not misname you, and so its Spanish and Danish read correctly - never to assume anything about you.

• The evening words, if you tap any

  The evening reflection offers ten fixed words - five about the body, like tired; five about the mind, like calm. Tap any of them, or none; none is an ordinary answer, and nothing is recorded about not tapping. Only the words themselves are stored, as your choice for that day. Words about your body are health data in the eyes of EU law, and they are treated at the same standard as your writing. There is no scale and no score behind them, and no way for Osmia to build one - the store that holds them can hold only the ten words themselves, never a number.

• Menstrual Cycle, if you set it up

  The app can follow your menstrual cycle. What is stored is the smallest honest record: the dates your periods started - set by you, corrected by you - and, if you use it, a marker that says it has stopped. Nothing else: no symptoms, no flow, no fertility fields of any kind, and no predicted dates, because none are made. The wheel you see works out where today sits from those dates each time; nothing derived is stored. These are health data in the eyes of EU law and are treated at the same standard as the evening words: you set the record up yourself, it is used only to run your practice, and removing it deletes it - genuinely, not a hidden switch-off. What travels with a reply is one word - roughly where in the cycle today sits - never the dates themselves.

• Osmia's notes on your practice

  Short notes Osmia writes for itself as you practise - situations that keep returning, and what has helped - so a reply can know your practice without re-reading your history. Each note is written in Osmia's own plain words - built not to quote your sentences back, not to judge you, and to leave out entirely any conversation where you were in crisis. These notes are not shown in the app. They belong to your account: deleting your account deletes them with everything else, and you can ask for a copy of them at any time.

• The waitlist on this site

  The email address you give, when you gave it, and a salted one-way hash of the connection it came from. The hash exists only to keep the form from being abused and is deleted at launch. The address is used once: to tell you when Osmia opens.

That is the whole list. Osmia does not collect your device location (no GPS, no location services - the country and the place above are settings, taken from your clock or typed by you, never detected from where your phone is), your contacts, wearable or fitness data (nothing is read from any sensor or health app - the evening words and the cycle dates above are things you chose to tap and set yourself), advertising identifiers, browsing history, or payment card details. Subscriptions in the iPhone app are purchased through Apple's App Store. Web subscriptions are paid through Link, a Stripe company, as merchant of record for Osmia. Apple or Link handles the payment; what Osmia receives is the subscription's status - which plan, whether it is active, and when the period ends - never your card.

What your writing can reveal

What you write - the evening words you tap, and the cycle you may keep - may reveal things about your emotional life, your health, your relationships, or your beliefs - the categories the law calls special and protects hardest. Osmia treats all of your writing at that standard, the sensitive and the ordinary alike. It is processed only because you choose to write it, only to run your practice, and with your explicit consent - which you give when you create your account and can withdraw at any time by deleting it.

Why it is processed

In the law's terms, we process your data on three bases: to provide the service you signed up for (your account, your sign-in, showing you your own practice); with your explicit consent (processing your writing to generate Osmia's responses); and out of legitimate interest in keeping the service safe (daily fair-use counters and abuse prevention - counting, not reading). There is no secondary use.

What Osmia does not do

• No advertising

  Osmia carries no ads, and we share nothing with advertisers.

• No tracking

  No analytics, crash-reporting, or telemetry software in the app, no profiling beyond your own practice, and Osmia does not follow you across other apps or sites.

• No selling

  Your information is never sold or rented to anyone.

Where your data goes

Osmia runs on a small number of providers, each processing your data only to provide their service:

• Supabase

  Hosts Osmia's database and authentication. Your account and writing live there, in the EU (Frankfurt), encrypted in transit and at rest.

• A backend service operated for Osmia

  Generates the responses. When you ask Osmia to respond, the text you wrote is sent to it, along with any optional profile details you have set - your name, how you would like to be referred to, and your country - so the reply can address you correctly. Your email and account ID are never sent. So that a reply can follow on from your practice rather than starting cold each time, a small amount of your own recent material travels with it: the intention in effect, the practices you have kept, anything you wrote in the last day or two, any evening words you have tapped recently, the short names of your recent sessions, and how your days have been going - your streak and your days in all, the same record the app shows you on "Your days" - all of it material you wrote, tapped, saved or did yourself, and all of it visible to you in the app. Two things travel that you did not write. A few relevant notes from the set Osmia keeps on your practice - in Osmia's own words, described above. And your place, together with a stretch of already-past weather recorded over it, so that a reply knows what season you are answering from. Your place begins as your clock's timezone unless you name a town yourself, which means it is the one thing here you may not have chosen; the weather is a public record about that place and says nothing about you. Clearing your place under Account → Daylight stops both. If you keep the cycle, one more word travels: roughly where in it today sits - never the dates themselves. The same notes, place and weather may travel with a patterns report, and the notes may travel when Osmia suggests an intention, a reflection question, or helps you word your Direction. It runs in the EU (Amsterdam).

• OpenAI

  Osmia currently uses OpenAI to process the text and context you choose to share with Osmia AI, and to write the reply. OpenAI does not use API inputs or outputs to train its models by default. Your email and account ID are never attached to the text OpenAI sees; the optional profile details you have set are included, because the reply is written using them. OpenAI is a US company; this processing happens under its data-processing terms and the EU-approved transfer safeguards it provides.

• Dictation

  If you use it, your speech becomes text on your own device where your language supports it; otherwise Apple's speech service transcribes it. Your audio never reaches Osmia's servers and is never stored.

• Apple

  Sign in with Apple, if you choose it, and the App Store for subscriptions bought on your iPhone. Apple tells Osmia that a subscription exists and when it ends; Osmia never sees your payment details.

• Stripe and Link

  Link (Sold through Link, LLC, a Stripe company) takes the payment for subscriptions bought on osmia.day as merchant of record for Osmia: it runs the checkout page, collects any VAT or sales tax, sends your receipts and handles payment support, and Stripe processes the payment and keeps the subscription billing running. They hold the billing details you give - your name, email, billing address and payment method - as processors for Osmia and, for fraud prevention, tax and financial regulation, under their own privacy policies. Osmia never sees your card; it can see your name, email, billing country and address, and your invoices, because it is the seller and must keep its accounts.

• RevenueCat

  Keeps your subscription's status in step between the App Store, Stripe, and your Osmia account, so paid access follows you across the app and the web. It receives the purchase record - which plan, whether it is active, when it ends, and where it was bought - under your Osmia account identifier; for a purchase on osmia.day, that record carries the email you paid with. From the app it also receives, as its software requires, your device's per-app vendor identifier and model, your iOS and app version, your preferred languages, and your App Store country. It never receives your card or your writing, and Osmia enables none of its analytics or attribution features. It is based in the United States. When you delete your Osmia account, Osmia asks RevenueCat to delete its record of you as well.

How long it is kept

Your writing is kept for as long as your account exists, so your practice stays continuous. Deleting your account - a control in the app - permanently deletes your writing, your conversations, your history, your profile and the account itself. Transaction records that need to be retained for payment, refund or system-integrity purposes are kept only after identifiers linking them to your Osmia account are removed. The waitlist address is used once, and you can have it removed at any time by writing to the address under Your rights below; its anti-abuse hash is deleted at launch.

Security

Your content is protected by your credentials, standard access controls, and encryption in transit and at rest. To be precise: your writing is not end-to-end encrypted at this stage, and Osmia's operator can, in principle, access stored content to operate and support the service. We will build encryption for the most sensitive things Osmia holds that opens only to your key - so that not even the people who build Osmia can read them.

Your rights

Under the GDPR you can:

• Ask for access to what Osmia holds about you
• Have it corrected
• Have it deleted
• Receive a portable copy
• Restrict or object to processing
• Withdraw consent at any time

The strongest of these is built into the app itself: delete your account, and everything goes with it. For the rest, write to privacy@osmia.day - we answer requests within a month. If you believe your rights have not been honoured, you can complain to your local data protection authority, or to Greece's Hellenic Data Protection Authority.

Children

Osmia is for people aged 16 and over. It is not directed at children and does not knowingly collect data from anyone under 16.

When this policy changes

If this policy changes, the date at the top changes with it, and the current version always lives at this address. If a change matters - new data collected, a new provider, a new purpose - we will tell you inside the app or by email before it takes effect.

Privacy is a design principle at Osmia

The terms of using Osmia→