Privacy Policy

Effective Date: August 10, 2026

Introduction

Thank you for using oh?. Your privacy is important to us, and we are committed to collecting as little personal information as reasonably necessary to provide the app.

This Privacy Policy explains what information we collect, how we use it, how it is stored, and the choices available to you when using oh?.

1. Information We Collect

1.1 Content You Create

When you use oh?, you may create and send content that includes text, emojis, stickers, font selections, backgrounds, visual layouts, and other customization choices.

This content is stored using Apple's CloudKit infrastructure so that it can be delivered to another randomly selected user.

Content you send should be considered visible to the random recipient who receives it. You should not include personal, confidential, sensitive, or identifying information in anything you create or send.

1.2 iCloud, CloudKit, and Sign in with Apple Identity

oh? uses Apple's iCloud, CloudKit, and Sign in with Apple technologies to provide cloud storage, user identification, random content delivery, abuse prevention, and other core functionality.

You are not required to create a traditional oh? account using a username or password.

The app may use an iCloud-associated identifier provided through CloudKit to distinguish users and operate the service. oh? does not receive or have access to your Apple Account password.

If you use Sign in with Apple, we may receive and store your Apple-provided user identifier. If Apple provides them, we may also receive and store your relay email address and name. We use this information for account continuity, abuse prevention, moderation, safety enforcement, and to send you a small number of service-related emails, such as a welcome email when you sign up or important notices about your account or the service. We do not send marketing emails. Your name, email address, Apple Account credentials, and Sign in with Apple identity are not intentionally shown to other users.

1.3 Age Assurance Information

oh? is intended only for adults who are 18 years of age or older.

To help confirm that you are 18 or older, oh? uses Apple's Declared Age Range API where it is available. Apple provides the app only with age-range information, such as whether you are above or below the required age threshold, based on age information declared to Apple by you or, where applicable, your parent or guardian.

The Declared Age Range API does not provide oh? with your exact date of birth.

Where Apple's Declared Age Range API is unavailable or does not provide sufficient age-range information, we may ask you to confirm directly that you are 18 years of age or older.

We do not request, collect, or store your exact date of birth for age verification.

1.4 Usage and Service Information

To operate the daily exchange experience, oh? may store limited information such as:

• When you last used the app.
• Whether you have sent something that day.
• Whether you have received something that day.
• Creation and delivery timestamps.
• Delivery status.
• Reactions to received content.
• Reports submitted about content.
• Whether widget onboarding has been completed.
• Whether the app's minimum-age requirement has been satisfied, where necessary to provide and protect the service.

1.5 Accountability and Moderation Information

To help keep oh? safe, we may store limited account and moderation information separately from public content records. This may include app user identifiers, Apple-provided account identifiers, report records, moderation status, and information needed to investigate abuse, enforce our rules, block abusive users, and prevent repeat violations.

This information is used for safety, security, abuse prevention, and legal compliance. It is not used for advertising or cross-app tracking.

1.6 Purchases

oh? offers an optional one-time purchase called "oh? plus" that unlocks additional creative options in the editor. Payment is collected by Apple through your Apple Account. We never receive your payment card details.

To provide the purchase and keep it unlocked across your devices and reinstalls, we process limited purchase information, such as an app-specific user identifier, the product purchased, purchase timestamps, price and currency, refund status, and related receipt information provided by Apple.

oh? also offers an optional consumable purchase that gifts oh? plus to a randomly selected user. If you buy a gift, we verify the purchase and create single-use redemption tokens on our service, along with limited state needed to deliver them (such as how many gifts you have available, which thing a gift is attached to, and whether a gift has been redeemed). If you receive and redeem a gift, we process your app-specific user identifier to unlock oh? plus on your account. We do not keep a record pairing a gift's buyer with its recipient — gifts are double-blind, like everything else in oh?. Redemption records are kept for a short period to prevent a gift from being redeemed twice, and redemption attempts are rate-limited to prevent abuse.

1.7 Approximate Location Information

Where this feature is available, oh? may use coarse information such as a country code or approximate region to provide experiences such as showing that something came from another country or travelled an approximate distance.

oh? does not require or collect your precise GPS location for its core functionality.

1.8 Photo Library (Saving Shareable Cards)

If you choose to save a shareable card to your device, oh? asks for add-only access to your photo library and writes that single image to it. This access is write-only: oh? cannot read, browse, or import any of your existing photos, and it does not access your camera roll for any other purpose.

The saved image stays on your device unless you choose to share it. We do not receive, upload, or store a copy of the images you save to your photo library.

1.9 Apple Music

oh? lets you attach a song to the thing you send, using Apple's MusicKit technology. If you choose to use this feature, oh? asks for your permission to access Apple Music.

This access is used only to let you search the Apple Music catalog, to attach the song you pick, and to play a song when you tap the play button on a thing you received. oh? does not read, collect, or store your Apple Music library, your playlists, your listening history, or your recommendations.

When you attach a song, oh? downloads that song's album artwork from Apple's servers and caches it locally on your device (in a shared App Group container) so the artwork can be shown inside the app and on the Home Screen widget. The song you attach — its title, artist, album artwork, an Apple Music link, and a catalog identifier — travels as part of the content you send, and is visible to the person who receives it, like the rest of your creation.

Playing a song opens or uses Apple Music, which is operated by Apple under Apple's own terms and privacy policy. You can turn the Apple Music connection on or off at any time in Settings within the app, and you can change the underlying permission in your iPhone's Settings app.

1.10 Usage Analytics and Session Replay

To understand how oh? is used and to improve it, we use PostHog, an analytics service, to collect information about how you interact with the app. This includes events such as the screens you visit, the features and tools you use, when you send or receive something, purchase activity (such as viewing the paywall or completing a purchase), and limited technical information collected by the PostHog SDK, such as your device model, operating system version, app version, screen size, and coarse location derived from your IP address (such as city or country).

Analytics records are pseudonymous: they are associated with a random, app-specific identifier derived by hashing, not with your name or email address. Analytics events never include the content you create — not the words you write, not the designs you make. Where an event describes what you made, it carries only counts and kinds (for example, "3 text layers, has music"), never the content itself.

We also use PostHog's session replay feature, which reconstructs a visual recording of your app session from periodic screen images so we can find confusing screens and bugs. Text you type is masked in these recordings. Recordings are pseudonymous like the rest of our analytics, are used only to improve the app, and are never sold or used for advertising.

Analytics data is used solely for the purposes described in this policy — understanding usage, finding problems, and improving oh?. It is not used for advertising, is not used to track you across other companies' apps or websites, and is not sold.

2. How We Use Your Information

We use information collected through oh? to:

• Create and deliver things between randomly selected users.
• Enforce daily sending and receiving limits.
• Display received content through the Home Screen widget.
• Process reactions.
• Prevent duplicate or improper deliveries.
• Confirm eligibility under the app's 18-or-older requirement.
• Detect, investigate, and respond to abuse.
• Process user reports.
• Process your purchase of oh? plus and keep it unlocked on your devices.
• Deliver gifts of oh? plus bought by one user to a randomly selected recipient, and unlock oh? plus on the recipient's account when a gift is redeemed.
• Send you a small number of service-related emails, such as a welcome email when you sign up or important notices about your account or the service.
• Maintain the reliability and security of the service.
• Understand, in pseudonymous form, how the app is used — which features are used, where people get stuck, and how flows perform — to improve oh?.
• Improve the functionality and user experience of oh?.

We do not sell your personal information.

We do not use your information for targeted advertising.

We do not use your information to track you across apps or websites owned by other companies.

3. Random Content Delivery

The core purpose of oh? is to deliver user-created content to randomly selected users.

When you send something through oh?:

• Your creation may be stored in Apple's CloudKit infrastructure.
• Your creation may be delivered to another randomly selected user of the app.
• The recipient will be able to see the content you created.
• The recipient may keep a local copy of received content on their device.
• Your name, email address, phone number, precise location, Apple Account credentials, and Sign in with Apple identity are not intentionally displayed to the recipient.
• Limited non-identifying contextual information, such as an approximate distance or country, may be displayed if that feature is enabled.

Because content is shared with another person, you should never include information you do not want another user to see.

4. Home Screen Widget

oh? uses Apple's WidgetKit technology to display received content on your iPhone Home Screen.

The app may store a local copy of your currently received content in a shared App Group container so that the oh? widget can render it efficiently.

This locally cached information is used solely to provide the widget experience.

5. Data Storage and Apple's Services

oh? uses Apple's CloudKit and iCloud technologies to store and synchronize information required to provide the service.

CloudKit and iCloud are operated by Apple. Information processed through Apple's services may also be subject to Apple's own privacy policies and terms.

Apple's Declared Age Range API is used where available to help determine whether a user meets the app's minimum-age requirement. Apple does not provide oh? with the user's exact date of birth through this API.

Service providers

oh? relies on the following services to operate. None of them uses your data for advertising or tracking, and we do not sell your data.

• Apple iCloud (CloudKit): stores the things you create, send, and receive, and the email and name Apple shares with us at sign-in. Handled under Apple's privacy policy.
• Apple Music (MusicKit): if you use the song feature, Apple provides catalog search results, song details, and album artwork, and plays the song you select. Apple does not share your Apple Music library, playlists, or listening history with oh?, and this feature is used solely to let you attach and play songs. Handled under Apple's privacy policy.
• Cloudflare: we use Cloudflare (a Worker and Cloudflare storage) to match senders with recipients and to deliver your daily notification. For this, it stores your Sign in with Apple identifier, your device's push notification token, your timezone and country/region, and an internal reference used to delete your data from our email service if you delete your account. If you buy or receive a gift of oh? plus, Cloudflare also stores the gift's single-use redemption tokens and limited gift state (such as how many gifts a buyer has available and whether a gift has been redeemed) — but no record pairing a gift's buyer with its recipient. Cloudflare does not receive or store the content you create — that stays in iCloud. This data is used solely to operate oh?'s daily exchange, and Cloudflare acts as a service provider processing it on our behalf.
• Resend: we use Resend, a transactional email service, to deliver the small number of service-related emails described in this policy (such as a welcome email when you sign up). For this, Resend receives the email address Apple shares with us at sign-in (often an Apple private relay address), your first and last name where Apple shared them with us, and the contents of those emails, solely to deliver these emails on our behalf. Resend does not receive the content you create in the app.
• RevenueCat: we use RevenueCat to process and remember in-app purchase state (whether your account has oh? plus). For this, RevenueCat receives an app-specific user identifier, purchase and receipt information from Apple (such as the product purchased, price, currency, timestamps, and refund status), limited device and app information collected by its SDK (such as device model, operating system, and app version), the email address and name Apple shared with us at sign-in (kept as a support contact), your country or region, and basic service flags (such as whether the widget is set up). This includes gift purchases; and if you redeem a gift of oh? plus, our service instructs RevenueCat to unlock oh? plus on your account, so RevenueCat records that your account has oh? plus even though you did not buy it. RevenueCat does not receive your payment card details or the content you create, and acts as a service provider processing this data on our behalf.
• PostHog: we use PostHog, an analytics service, to collect the pseudonymous usage analytics and session replays described in section 1.10 — usage events, limited device and app information, coarse IP-derived location, and masked-text session recordings, associated with a random hashed identifier. PostHog never receives your name, your email address, or the content you create. Analytics traffic is routed through our own domain to PostHog's US cloud. PostHog acts as a service provider processing this data on our behalf, and does not use it for its own purposes.

When you delete your account (Settings → Privacy & terms → Delete my account & data), the data held by these services is erased, except for a single minimal, non-identifying record we keep only to enforce a ban if your account was removed for violating our rules. Records of service emails that were already sent (such as delivery logs held by our email provider) may persist for a limited period before they are deleted in the ordinary course. Records of your one-time purchase are kept by Apple and mirrored by our purchase processor so the purchase can be restored on your Apple Account and for financial record-keeping; deleting your oh? account does not delete your Apple purchase history. If you bought gifts of oh? plus that have not been redeemed yet, deleting your account removes your identifier from them, but the gifts themselves keep travelling to a random recipient — they carry no information about you. Analytics records (section 1.10) are pseudonymous — they contain no name, email, or created content — and are not automatically erased when you delete your account; you can request their erasure at any time by emailing hello@ohapp.wtf, and we will delete them from our analytics service.

6. Content Moderation and Safety

To help protect users, oh? may analyze content before or after it is sent for potential violations, including:

• Harassment.
• Threats.
• Hate speech.
• Explicit sexual content.
• Spam.
• Scams.
• URLs.
• Phone numbers.
• Email addresses.
• Social media handles.
• Attempts to exchange personal contact information.
• Other harmful or prohibited content.

Moderation may be performed using on-device technologies, Apple-provided frameworks, automated rules, and user reports.

No automated moderation system is perfect.

Users may report inappropriate content. Reports may include information about the reported content, the reason for the report, and limited technical identifiers necessary to investigate abuse.

We may remove content, restrict features, block users, suspend access, preserve records for investigation, or take other action when we believe a user has submitted objectionable content, abused the service, or violated our rules.

7. Sharing Your Information

We do not sell your personal information or share it with advertisers for targeted advertising.

Information may be disclosed only when reasonably necessary:

• To provide content to its intended random recipient.
• To operate the app through Apple's infrastructure.
• To verify eligibility under the app's age requirement.
• To investigate abuse or enforce our rules.
• To comply with applicable law, regulation, legal process, or a valid governmental request.
• To protect the rights, safety, and security of users, the public, or the service.

8. Data Retention

We retain information only for as long as reasonably necessary to provide oh?, maintain service integrity, prevent abuse, comply with legal obligations, and resolve disputes.

This may include user-created content, delivery records, daily sending and receiving records, account identifiers, moderation records, reports, reactions, and timestamps.

User-created content may be retained after delivery where necessary for saved content, abuse investigations, reports, security, service integrity, or legal obligations.

Locally cached widget content may remain on your device until it is replaced, deleted, or the app's data is removed.

Ban-record retention after deletion: If your account was removed for violating our rules, we retain a single minimal, non-identifying record for the sole purpose of enforcing that removal. It contains no personal information and is not used for any other purpose.

9. Data Deletion

You can delete your account and all associated data at any time from Settings → Privacy & terms → Delete my account & data. This permanently erases your account, the email Apple shared with us, and the content you've created and received. If your account was removed for violating our rules, we retain a single minimal, non-identifying record for the sole purpose of enforcing that removal; it contains no personal information and is not used for any other purpose.

You may also request deletion of information associated with your use of oh? — including the pseudonymous analytics records described in section 1.10 — by contacting us at hello@ohapp.wtf .

Certain limited information may be retained where reasonably necessary for fraud prevention, abuse prevention, security, legal compliance, or the establishment, exercise, or defense of legal claims.

Because oh? delivers user-created content to other users, deleting information from our CloudKit records may not delete content that has already been delivered to, cached by, saved by, screenshotted by, or otherwise retained on another user's device.

10. Age Requirement and Children's Privacy

oh? is intended only for adults 18 years of age or older. You must be at least 18 years old to access or use the app.

We do not knowingly collect personal information from anyone under 18 years of age.

The app uses age-assurance measures, including Apple's Declared Age Range API where available and direct age confirmation where necessary, to help enforce this requirement.

If we learn that a user is under 18, we will remove their access and delete their information, subject to any limited retention required for safety, abuse prevention, security, or legal compliance.

If you believe that a person under 18 is using oh? or has provided personal information through the app, please contact us at hello@ohapp.wtf so that we can investigate and take appropriate action.

11. No Advertising or Cross-App Tracking

oh? does not use your data for cross-app tracking.

oh? does not sell user data to advertisers or data brokers.

oh? uses first-party usage analytics and session replay, as described in section 1.10, solely to understand and improve the app. This data is pseudonymous, is not combined with data from other companies' apps or websites, is not used for advertising, and is not shared with advertisers or data brokers.

If advertising or cross-app tracking technologies are ever introduced in the future, this Privacy Policy and the app's App Store privacy disclosures will be updated as required.

12. Security

We use reasonable technical and organizational measures to protect information handled through oh?.

The app relies on Apple's technologies, including CloudKit and iCloud, for its core cloud infrastructure.

However, no electronic storage or transmission system can be guaranteed to be completely secure.

13. Your Choices and Rights

Depending on where you live, you may have certain rights concerning your personal information, including the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Request information about how your data is used.

To exercise a privacy-related right, contact us at hello@ohapp.wtf .

We may need to verify your request before completing it.

14. International Users

oh? may be available to users in multiple countries.

Information may be processed through Apple's infrastructure in accordance with Apple's applicable terms, privacy practices, and data-processing arrangements.

15. Changes to This Privacy Policy

We may update this Privacy Policy as oh? evolves.

When we make changes, we will update the Effective Date at the top of this policy and provide additional notice where required by law.

16. Contact Us

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or your information, please contact us at:

App: oh?
Developer: Sunil Neurgaonkar
Email: hello@ohapp.wtf
Country:Bavdhan, Pune, Maharashtra, India 411021