oxguide-legal

OxGuide Privacy Policy

Last Updated: March 9, 2026 Effective Date: January 5, 2026

1. Introduction

OxGuide (“we,” “our,” or “us”) operates the OxGuide mobile application (the “App”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

We are committed to protecting your privacy and ensuring transparency about our data practices. Please read this Privacy Policy carefully. By using the App, you consent to the practices described herein.

Company Information:

Business Name: OxGuide
Contact Email: hello@oxguide.com

2. Information We Collect

2.1 Information You Provide

Account Information:

Email address
Display name
Password (encrypted, never stored in plain text)
Authentication method (email/password or Google Sign-In)

Purchase Information:

Transaction history for in-app purchases
Subscription status and expiration dates
Payment processing is handled entirely by Apple App Store or Google Play Store; we do not collect or store payment card details

AI Guide Conversations:

Messages you send to our AI Guide
Conversation history for context continuity
Landmark-specific chat threads

2.2 Information Collected Automatically

Location Data:

Precise location (GPS coordinates) when you grant permission
Used for: navigation, nearby landmark detection, map positioning
Location data is processed in real-time and not permanently stored on our servers

Camera Data:

Camera access for landmark detection feature
Images are processed on-device using machine learning
We do not store, transmit, or retain any images or video from your camera

Device Information:

Device type and model
Operating system version
Unique device identifiers (for analytics and crash reporting)
App version

Usage Data:

Features accessed and frequency of use
Navigation routes and landmarks visited
App performance metrics
Crash reports and error logs

Partner Attribution Data:

On Android, we may read the Play Store install referrer to determine if you installed the app via a partner link (e.g., QR code at a hotel or tourist attraction)
On iOS and as a fallback on Android, we may read your device clipboard once at first launch to check for a partner attribution code. The clipboard is read only once, and any attribution code found is immediately cleared from the clipboard
Attribution data (partner ID, timestamp) is stored to credit the referring partner. No other clipboard content is collected or stored

2.3 Information from Third Parties

We may receive information from third-party services you use to sign in:

Google Sign-In: Email address, display name, profile picture URL

3. How We Use Your Information

We use collected information for the following purposes:

Purpose	Legal Basis (GDPR)
Provide navigation and tour guide services	Contract performance
Process in-app purchases and subscriptions	Contract performance
Deliver AI-powered landmark information	Contract performance
Send service-related communications	Legitimate interest
Improve app functionality and user experience	Legitimate interest
Analyze usage patterns and fix bugs	Legitimate interest
Prevent fraud and ensure security	Legitimate interest
Comply with legal obligations	Legal obligation

4.1 Third-Party Service Providers

We share data with the following service providers who process data on our behalf:

Service	Purpose	Data Shared	Privacy Policy
Firebase (Google)	Authentication, database, analytics	Account data, usage analytics	Google Privacy Policy
Mapbox	Maps and navigation	Location data (anonymized)	Mapbox Privacy Policy
Google Places API	Place information and photos	Location queries	Google Privacy Policy
RevenueCat	Subscription management	Purchase data, user ID	RevenueCat Privacy Policy
Groq	AI model inference for tour guide responses	Chat messages, landmark context, pseudonymous user ID	Groq Privacy Policy
LangChain / LangGraph	AI conversation orchestration	Chat messages, landmark context, pseudonymous user ID	LangChain Privacy Policy
LangSmith (by LangChain)	AI conversation tracing and quality monitoring	Chat messages, conversation metadata	LangChain Privacy Policy
Tavily	Web search for landmark information	Search queries about landmarks	Tavily Privacy Policy
Amazon Polly (AWS)	Text-to-speech for AI guide narration	AI-generated landmark descriptions (no user messages)	AWS Privacy Policy
Fly.io	Cloud hosting for AI backend server	Chat messages in transit, processed in memory	Fly.io Privacy Policy
Google Sign-In	Authentication via Google account	Email address, display name, profile picture URL	Google Privacy Policy
Android Play Install Referrer	Partner attribution tracking	Install referrer URL (contains partner ID if installed via partner link)	Google Privacy Policy

4.2 We Do NOT:

Sell your personal information to third parties
Share your data for third-party advertising purposes
Use your AI conversations to train external AI models
Share your precise location with advertisers

4.3 Legal Disclosures

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

5. Data Retention

Data Type	Retention Period
Account information	Until account deletion + 30 days
AI conversation history	12 months, or until you delete it
Purchase/transaction records	7 years (legal/tax requirements)
Usage analytics	26 months (anonymized after 14 months)
Location data	Not stored; processed in real-time only
Camera/image data	Not stored; processed on-device only

6. Data Security

We implement industry-standard security measures:

Encryption in transit: All data transmitted using TLS 1.2+
Encryption at rest: Sensitive data encrypted in databases
Authentication: Secure token-based authentication via Firebase
Access controls: Limited employee access on need-to-know basis
Regular audits: Periodic security reviews and updates

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 All Users

You have the right to:

Access your personal data
Correct inaccurate information
Delete your account and associated data
Withdraw consent for optional data collection
Disable location or camera permissions via device settings

If you are in the EEA, you have additional rights under the General Data Protection Regulation (GDPR):

Right to erasure (“right to be forgotten”)
Right to data portability (receive your data in a portable format)
Right to restrict processing
Right to object to processing based on legitimate interests
Right to lodge a complaint with your local data protection authority

Data Controller: OxGuide Contact for GDPR requests: hello@oxguide.com

7.3 California Residents - CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with:

Right to know what personal information we collect and how it’s used
Right to delete your personal information
Right to opt-out of the sale of personal information (we do not sell your data)
Right to non-discrimination for exercising your privacy rights

To exercise CCPA rights: Email hello@oxguide.com with subject “CCPA Request”

Categories of personal information collected in the past 12 months:

Identifiers (email, name, device ID)
Commercial information (purchase history)
Internet activity (app usage data)
Geolocation data (with your permission)
Inferences (AI conversation context)

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States, where our service providers operate.

For EEA users, we ensure appropriate safeguards through:

Standard Contractual Clauses (SCCs) with service providers
Adequacy decisions where applicable
Your explicit consent for certain transfers

9. Children’s Privacy

OxGuide is not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children.

If you believe we have collected information from a child, please contact us immediately at hello@oxguide.com, and we will promptly delete such information.

10. How to Delete Your Data

Delete Specific Data Types:

You can request deletion of specific data without deleting your entire account. Email hello@oxguide.com with any of the following subject lines:

Data Type	Email Subject	What Gets Deleted
AI Conversations	“Delete Chat History Request”	All AI guide conversation history and chat threads
Saved Lists	“Delete Saved Lists Request”	All saved places lists and itineraries
Navigation Data	“Delete Navigation Data Request”	Navigation history, route data, and location history
App Preferences	“Delete Preferences Request”	All app settings, analytics consent, and cached data

Include the email address associated with your account. We will process your request within 30 days.

Delete Your Account:

Option 1: In-App Deletion

Open the OxGuide app
Go to the Profile tab
Scroll down and tap Delete Account
Confirm the deletion

Option 2: Email Request

Email hello@oxguide.com with subject “Account Deletion Request”
Include the email address associated with your account
We will process your request within 30 days

Option 3: Web Request Visit our Account Deletion Page for instructions.

Upon account deletion, the following data is permanently deleted:

Account information (email, display name, profile)
AI conversation history and chat threads
AI-generated landmark context and itinerary data stored on our AI backend
Saved places lists and itineraries
Navigation history and route data
App preferences and settings (including analytics consent)
Partner attribution data
Landmark detection history

The following data may be retained after account deletion:

Purchase and transaction records — retained for 7 years as required by law for tax and accounting purposes
Anonymized, aggregated analytics data that cannot be linked back to you

11. Push Notifications

With your permission, we may send push notifications for:

Navigation alerts and directions
Landmark arrival notifications
Important service updates

You can disable notifications in your device settings at any time.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

Posting the updated policy in the App
Updating the “Last Updated” date
Sending an email notification for significant changes

Your continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data:

Email: hello@oxguide.com

For Data Protection Requests: Use subject line: “Privacy Request” or “GDPR Request” or “CCPA Request”

We aim to respond to all requests within 30 days.

14. Additional Disclosures

Analytics

We use Firebase Analytics to understand how users interact with the App. This includes:

Anonymous usage statistics
Feature engagement metrics
Crash and error reporting

You can opt out of analytics collection in the App settings (when available) or by contacting us.

Machine Learning

Our landmark detection feature uses on-device machine learning (TensorFlow Lite). The ML model:

Runs entirely on your device
Does not send images to external servers
Does not learn from or store your images

This Privacy Policy was last updated on March 9, 2026.