Your Mind, Extended.

LAST UPDATED · 20 MAY 2026

Oaza ("we", "us", "the app") is a personal intelligence tool designed to help you capture notes, chats, calendar items, files, and reflections. Your inner life is yours. This page describes — in plain English — exactly what we collect, why we collect it, where it lives, and what rights you have over it.

Oaza is operated by Oaza Intelligence Ltd (the "data controller" under UK GDPR / EU GDPR). For privacy questions, data deletion, or any rights request, contact us at the address listed on the Contact page.

• Account data — email address, first name, and a hashed copy of your password. We never see your raw password.
• App content — notes, journal entries, chat messages, calendar events, files you upload, and other content you choose to create inside Oaza.
• Passcode — a one-way hash of your 4-digit unlock code. The raw passcode never leaves your device.
• Settings & preferences — theme, profile photo, and similar customisations.
• Technical logs — basic request metadata (timestamp, IP address, error traces) kept short-term for security and debugging.

We do not collect advertising identifiers, do not sell any data, and do not run third-party advertising or behavioural tracking inside the app.

• Contract — to provide the core service you signed up for (storing your notes, syncing across devices, AI replies).
• Legitimate interest — to keep the service secure, prevent abuse, and improve reliability.
• Consent — for anything optional (e.g. uploading a profile picture). You can withdraw consent at any time.

Your content is stored in our encrypted backend (Lovable Cloud, powered by Supabase) in EU/US data centres. Files are stored in a private, access-controlled bucket. Database row-level security ensures that no user — including us, except for service-account maintenance — can read rows that don't belong to you.

When you chat with Oaza's AI, the relevant prompt and recent context are sent to our AI provider (Lovable AI Gateway, which routes to models from Google and OpenAI) to generate a reply. These providers process the request to return a response and do not use your content to train their models under our agreement. The reply is then stored alongside your conversation so you can read it later.

We share data only with the processors needed to run the app:

• Hosting & database (Supabase / Lovable Cloud)
• AI inference (Lovable AI Gateway → Google, OpenAI)
• Email delivery (for verification and password resets)

We will only disclose information to law enforcement when legally compelled to do so by a valid order.

We keep your content for as long as your account is active. When you delete your account, all your rows across notes, conversations, messages, files, settings, and profile are permanently erased within 30 days. Short-term technical logs are kept for up to 90 days.

• Access — download a full JSON export of everything we hold about you from the Profile page.
• Rectification — edit your name, email, profile, or any content at any time.
• Erasure — delete your account from the Profile page to permanently remove all your data.
• Portability — the export is in machine-readable JSON.
• Complaint — you can lodge a complaint with your local data protection authority (e.g. the UK ICO).

Oaza is not intended for children under 13 (or 16 in the EU). If you believe a child has created an account, contact us and we'll remove it.

All traffic is encrypted in transit (HTTPS / TLS). Passwords are hashed by our identity provider. The unlock passcode is stored only as a SHA-256 hash. We check passwords against the Have I Been Pwned database to block reused, leaked credentials. See the Security page for the full list of controls.

• Private account authentication with verified email sign-up and secure password reset links.
• User-level access controls so one account cannot browse another person's records.
• Encrypted transport for every connection between the app, backend, and supporting services.
• Private file storage with controlled access instead of public buckets.
• Short-term technical logging to detect abuse, errors, and suspicious activity.

If we make material changes, we'll notify you in-app before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.