Privacy Policy
Last updated
This policy explains what personal data Owlie collects, why, who processes it on our behalf, how long we keep it, and the rights you have.
Who we are
Owlie ("we", "us") is operated by Mighty Byte SRL, București, Sectorul 1, Intrarea Gheorghe Simionescu, Nr. 19, Ap. B26, Romania. We are the controller of the personal data described here. You can reach us about privacy at [email protected].
What we collect
Account data. Your email address, a securely hashed password, and whether your email is verified. When you sign in we keep a session record with the IP address and browser user agent used for that session.
Former waitlist data. Owlie's waitlist is closed and anyone can now create an account. If you joined the waitlist before it closed, we hold your email address, the optional note you wrote about how you would use Owlie, the page you signed up from, and a one-way hash of your IP address that was used to limit abuse.
Content you configure. The Sources you follow (for example channel, feed, podcast, or community URLs), your Operations and their instructions, filters, labels, and output settings.
Content we fetch and produce for you. Items fetched from your Sources (such as article text, transcripts, and metadata) and the Results we generate from them, including your reading state in the Inbox.
Shared Results. When you share a Result, anyone with its link can see that Result, the Item's title, Source name and original link, and a plain description of the Operation that produced it. Your instructions and filters are never shown. You can stop sharing a Result at any time, and its link then stops working.
Notification settings. Webhook URLs and signing secrets you add. These are stored encrypted.
Personal access tokens. Tokens you create for API or MCP access. We store only a hash of each token.
Billing data. Your credit balance and transaction history. Payments are processed by Stripe; we never receive or store your full card details.
Feedback. Messages you send us through the feedback form.
Usage data. Which pages of Owlie are visited and which features are used (for example creating an Operation, sharing a Result, or starting a credit purchase), the referring page, browser and device type, and an approximate location derived from the IP address of the request. When you are signed in, this is linked to your internal user id. When you create an account, the visit you create it in is linked to it too: the page you arrived on, the referring site, and any campaign tags in the link you followed (such as utm_source). We record which button or link was used, not the text on the page, so the content of your Results is not collected. We do not record your screen or sessions.
Error reports. When something breaks in the website or the service, the error message, where it happened, and the page you were on.
Operational data. Server logs (request paths, status codes, timing, and the messages the service writes while it runs) used to keep the service running. Email addresses, sign-in and verification tokens are removed from analytics, error reports and logs before they leave our systems. To limit abuse, we briefly hold the IP address of sign-in, sign-up, and password-reset requests in server memory to count attempts; these counts are not stored and are cleared within minutes. Usage, error and operational data are identified by an internal user id, never by your email address.
Why we use it
- To provide the service you ask for: fetching your Sources, running your Operations, and delivering Results (performance of our contract with you).
- To secure your account, prevent abuse, and keep the service reliable (our legitimate interests).
- To understand how Owlie is used, find and fix errors, and improve the product (our legitimate interests).
- To process payments and keep accounting records (contract and legal obligations).
- To send service emails such as verification, password reset, and the notifications you enable (contract).
- To invite people who joined our former waitlist to create an account (your request / our legitimate interests).
We do not sell your personal data and we do not use it for advertising.
Who processes it for us
We use the following service providers. Each processes data only on our instructions, under a data processing agreement with us.
| Provider | Purpose | Data involved |
|---|---|---|
| Railway | Hosting the Owlie API and background processing | All service data in transit and processing |
| Neon | Database hosting | Account, content, billing, and notification data at rest |
| Cloudflare | Hosting and delivering the Owlie website | Request metadata such as IP address |
| Stripe | Payment processing | Payment and billing details |
| OpenAI | Generating Results from fetched content using your instructions | Fetched Item content and your Operation instructions |
| Resend | Sending account and notification emails | Your email address and email content |
| PostHog (EU) | Product and website analytics, error tracking, and server logs | Internal user id, usage data, approximate location, browser and device type, error reports, and server logs |
Audio is transcribed on our own servers; it is not sent to a third-party transcription service. To fetch public content from your Sources we call third-party platforms and APIs such as YouTube, Reddit, and Apple Podcasts, and use a proxy provider for some YouTube requests. These requests contain the content identifiers needed to fetch the Source, not your account details. Webhooks you configure send your Results to the destination you choose.
Our providers host the data we control in the European Union.
International transfers
Our data is hosted in the European Union. Some of our providers are companies established in the United States and may access or process data from there, for example to provide support or run their services. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU–U.S. Data Privacy Framework.
How long we keep it
- Account, content, and Results: for as long as your account exists. When you ask us to delete your account we delete this data within 30 days, except where we must keep records for legal reasons.
- Run records: deleted automatically after 7 days.
- Source activity logs: deleted automatically after 30 days.
- Billing records: kept for the period required by Romanian tax and accounting law, generally up to 10 years.
- Former waitlist entries: until you are invited and sign up, or you ask us to remove them.
- Analytics, error reports and server logs in PostHog: up to 1 year.
- Backups: database backups may retain deleted data for up to 7 days before it is overwritten.
Cookies and local storage
Owlie uses only strictly necessary cookies: a session cookie that keeps you signed in. We store small preferences in your browser's local storage, such as your light or dark theme. We do not use analytics or advertising cookies.
Our analytics (PostHog) run without cookies or browser storage. Each page load gets a random identifier that is kept only in the page's memory and is gone when you close or reload the page, so visitors who are not signed in are not recognised across visits. When you sign in or create an account, usage in that page load is linked to your internal user id so we can understand how members find and use Owlie. You can object to this processing by emailing us; a content or tracker blocker will also stop it.
Your rights
Depending on where you live, you can ask us to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. To make a request, email [email protected]. We will respond within one month.
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority. Our lead supervisory authority is Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro.
Children
Owlie is not intended for anyone under 16, and we do not knowingly collect their personal data.
Security
We protect data in transit with TLS, store passwords and access tokens only as hashes, encrypt notification credentials at rest, and restrict internal access. No system is perfectly secure, and we will notify you and the relevant authorities of a personal data breach where the law requires.
Changes to this policy
We will update the date at the top when this policy changes, and notify you by email or in the app before material changes take effect.
Contact
Questions about this policy: [email protected].