Legal

Privacy Policy

Last updated 8 August 2026.

Ours is a private organiser for your household — and almost everything you put in it is personal by nature. This explains exactly what we collect, why, who ever sees it, and the controls you have. We've written it to be read, not skimmed. Ours is operated by Ours, reachable at the contact address we publish here before Ours opens to the public.

1. What we collect

Things you give us

• Account basics— your name, email and avatar from sign-in; your household's name, country and timezone.
• Vault documents — titles, issuers, reference numbers (such as a passport or licence number), dates and notes for documents you catalogue. If you attach a file, it stays in your own Google Drive; we store only a link to it, never the file.
• Money — transactions, budgets, recurring bills, and account nicknames with only the last four digits (never full account numbers). If you use the tax tools: your filing country, status and the income figures you enter.
• Kitchen and health details— recipes and meal plans, and if you add them, each member's allergies and dietary needs. See section 4.
• Lists, notes and records — to-dos, shopping links, sticky notes, and records for your car, home, health, travel and investments.

Collected automatically

• Cookies and device storage — see section 8. No advertising trackers, and no third-party analytics of any kind.
• Push subscription details, if you turn notifications on.
• Basic server logs kept briefly by our host for security.
• Product analytics, built by us and stored only on our own servers.We record which features get used so we know what to fix and what to build next. Concretely, one row per action containing: a random-looking code that stands in for your account, your plan tier, the name of the action taken from a fixed list of around three dozen (“opened the app”, “added a transaction”, “scanned a receipt”), the shape of the screen you were on (/money/[id], never the actual record), and how many seconds the screen was in front of you.
  What is never in it: your name, email, user id, household, IP address, device, location, or anything you typed or saved. There is no free-text field and no catch-all bag of properties — the database physically cannot store them.
  The stand-in code is a one-way hash made with a secret key that is kept outside the database, so the analytics cannot be joined back to your account. Anything to do with health features is recorded with no code at all (see section 4). Individual rows are deleted after 30 days; only totals remain. And any figure covering fewer than five people is withheld even from us.
• Crash reports. When something breaks we keep the error type, a shortened message and one line of code — with URLs, email addresses, ID numbers and any quoted values stripped out first. No record of what you were doing beforehand is kept.

From services you connect

• Gmail (optional, read-only) — we read messages that look like receipts and keep only the merchant, amount, date, a short subject line and the message ID (so the same receipt is never imported twice). We never store the body of your emails. See section 5.

2. Why we use it, and our legal grounds

We do not use your data for advertising, do not sell or share it, and our agreement with our AI provider prohibits training on your content.

3. Who inside your household sees what

Ours is built for sharing within one household, so most content — documents, money, meals, lists, allergies — is visible to the members of your household. A few things stay private to you alone: your tax profile, your Gmail connection, your notification preferences and your sign-in credentials. When you add information aboutanother member, make sure they're comfortable with it.

4. Health-related information

If you use them, Ours stores per-member allergies, dietary needs and food notes; medical and health-insurance documents in the Vault; and health records such as appointments and policies. We treat all of it as sensitive:

• We ask for your explicit consent before health information about you is stored, and you can withdraw it at any time — withdrawing deletes the data.
• It is used only to provide the feature you asked for — never for marketing and never for training. It is never used to build a profile of you, and health content never reaches our analytics at all (see the next point for the one narrow exception, which counts nobody).
• It is sent to our AI provider only if you have individually turned AI features on, and only the minimum needed (for example, your allergy list so a suggested recipe avoids it). Another member enabling AI does not send your health data.
• It is never sold, and never shared outside the providers in section 6.
• It is excluded from our analytics as an individual. Using a health feature — opening Health, editing allergies or diets — is recorded with no code standing in for you, so no trail exists of which person used a health feature, only that a health feature was used at all. Even those totals stay hidden until enough of them accumulate that no individual could be picked out.

To access, delete or withdraw consent for health data, contact us at the contact address we publish here before Ours opens to the public. If you are in Washington State and we deny a request, you may appeal by replying to our decision, and may then contact the Washington Attorney General.

5. AI features, and what leaves our servers

Ours has built-in AI provided by Anthropic (United States). It runs only when you use an AI feature, and receives only what that feature needs:

• Ask — your question plus relevant household context, such as recent transactions and document titles and dates.
• Scanning — the photo or text of the receipt or document you are scanning.
• Gmail import — the sender, subject and body of receipt-like messages, to extract merchant, amount and date. The content is processed and discarded; only the extracted fields are kept.
• Kitchen — recipe context including the allergies of members who have consented.
• Wishlist — the product URL, to read its current price.

You can turn AI features off at any time; nothing is sent when they are off.

6. Service providers

The current list always lives at /legal/subprocessors.

7. Where your data lives

Your data is stored in the United States. If you are in the UK, EU or elsewhere, that means it is transferred to the US. Our providers are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses, and we apply the protections in this policy wherever you live.

8. Cookies and device storage

There is no cookie banner because there is nothing to consent to: everything above is either required to run the app or set because you chose it. Ours loads no third-party scripts, contacts no advertising or analytics network, and sets no cookie for measurement — our own product analytics (section 1) use no cookie, no local storage and no device identifier of any kind. If that ever changes, this policy changes first.

9. Your rights

Wherever you live you can access and export your data, correct it, delete your account and data, and withdraw any consent as easily as you gave it. We respond within 30 days. You do not have to ask us for a copy: Settings → Your data downloads your money as a spreadsheet and your whole household as a machine-readable file, and Settings → Security deletes your account outright.

• UK/EU — you also have rights to restriction, objection and portability, and may complain to your data protection authority.
• Canada — you may complain to the Office of the Privacy Commissioner.
• India — contact us as your grievance contact; you may escalate to the Data Protection Board.
• United States — we do not sell or share personal information, and use sensitive information only to provide the service you asked for.

10. Keeping and deleting data

• Your household's content is kept while your household uses Ours.
• If you leave a household — your private data (tax profile, Gmail connection, push subscriptions, allergies) is deleted. Things you contributed to shared areas, such as a transaction you logged, remain with the household.
• If you delete your account — all of the above, plus your profile, is permanently deleted.
• If an owner deletes the household — every document, transaction, recipe, list and record in it is permanently deleted for everyone.
• Deleted data leaves our backups within 30 days. Gmail tokens are deleted the moment you disconnect.
• Analytics rows are deleted after 30 days, whether or not you are still using Ours. What is kept past that point is counted totals — how many people opened Kitchen in a given week — with nothing in them that stands in for a person. One pseudonymous row per account is kept longer, holding only the week you joined and the dates you first added something and last used Ours, so we can tell whether people keep coming back. Ask us and we erase it.
• Crash reports are kept until the bug is fixed, then cleared. They are grouped by fault, not by person, and contain no code standing in for you.
• Problem reports you send usare kept until they are dealt with. They contain exactly what you wrote plus the screen you were on — you can see your household's reports, and they go with your household if it is deleted.

11. Security

Encryption in transit everywhere and at rest in the database. Gmail tokens are additionally encrypted by the application with a key held outside the database. Every table is protected by row-level security, so only your household's members can read your household's rows. Sign-in is handled by your provider — we never see a password — with optional passkeys and a Face ID app-lock.

12. Children

Ours accounts are for people aged 16 or older (18 where local law requires). Parents can keep a child's details — school forms, allergies — inside their own household as a managed child profile, which is controlled entirely by the adults in that household. We do not knowingly let children create their own accounts, and will delete any we learn of.

13. If something goes wrong

If a breach ever puts your data at risk we will tell you what happened, what was involved and what we are doing — within the timelines the law requires.

14. Google API disclosure

Ours' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: the optional read-only Gmail connection is used solely to find purchase receipts and turn them into transactions in your Money tool. We store only the extracted receipt fields, never email bodies. Receipt-like messages are processed by our AI provider only to extract those fields, under an agreement forbidding any other use including model training. We do not use Gmail data for advertising, do not sell it, and do not let humans read it except with your explicit permission, for security, or where the law requires. Disconnect any time in Settings → Connectors, or via your Google Account permissions.

15. Changes

We post changes here with a date and version, and tell you in the app before anything material takes effect.