ORACULUM: Life Guidance · Application privacy

Privacy Notice

Effective and last updated: 28 October 2026 · Version 1.0

This notice covers the ORACULUM mobile application and its supporting services, including the TestFlight beta. The corporate website privacy policy is separate.

Current beta: ORACULUM is for adults aged 18 and over. Use fictional, non-sensitive examples during testing. Do not submit medical records, intimate information, religious or political beliefs, or confidential information about other people. The beta is not intended to process those special categories of information. Text fields do not automatically prevent you from entering them.

1. Who is responsible

The controller is Oraculum Digital Labs Ltd, Cyprus company HE 498123. Registered office: Andrea Araouzou 2, Stefano Plaza, 1st Floor, Office 101, Kato Polemidia 4150, Limassol, Cyprus. For privacy requests and support, contact office@oraculumlabs.eu.

2. Information we use

An anonymous sign-in creates an account identifier and session. Your saved journey is linked to that identifier; “anonymous” sign-in does not mean the stored information is anonymous under data-protection law. If you protect your journey using a supported sign-in method, we also process its verification and identity details. Email verification does not give us access to your inbox.

Depending on what you use and provide, we process:

Account identifiers, email if supplied, authentication sessions, language, age confirmation, profile and preferences.
Questions, conversations, journal and dream entries, goals, decisions, life events, relationship information and saved guidance. Optional features may use birth date, time and place, or questionnaire answers.
Derived summaries, connections and patterns based on the content you permit the relevant feature to use.
Consent settings, privacy requests, support correspondence and technical records needed for security, usage limits, cost accounting and reliability.
Subscription status, transaction identifiers and purchase-verification records returned by Apple. Apple processes your App Store payment details; we do not receive your full payment-card details.
If notifications are enabled: a device push token, account association, language, notification preferences and delivery status. Reminder payloads are generic and are not intended to contain journal or conversation text.

Most information comes from you or your use of the app. Authentication, purchase and delivery providers return the information needed to perform their respective tasks. Optional features may be unavailable in a particular beta build.

3. Purposes and legal grounds

Account and requested features — performance of a contract: We maintain your journey, save requested content, recover protected accounts, verify entitlements and provide support as necessary to deliver the service you request.
External AI and optional processing — consent: We ask for a separate AI permission before sending content for external AI guidance. Optional personalisation, product analytics and reminders use the relevant choices where offered. You can refuse or withdraw consent; the affected feature may then be unavailable. Withdrawal does not affect processing that was lawful before withdrawal.
Security and reliability — legitimate interests: We process limited operational information to prevent abuse, enforce service limits, troubleshoot failures and protect accounts. Our interest is a secure, reliable service; this is subject to your rights, including the right to object.
Compliance — legal obligations: We handle data-rights requests and retain records necessary to meet applicable legal duties. Limited evidence may also be retained where necessary to establish, exercise or defend legal claims.

The current beta does not offer special-category processing as an intended service. A general acceptance of this notice is not explicit consent to such processing. If you accidentally submit sensitive information, use the deletion controls or contact us.

4. AI and your choices

ORACULUM uses OpenAI for external AI guidance. A request may include your current input, language and relevant saved context that you have allowed for AI use. Generated guidance may be saved to your journey. The integration requests that responses are not stored as retrievable API response objects; this does not eliminate provider security or abuse-monitoring retention. OpenAI documents that such logs may contain inputs and outputs and are normally retained for up to 30 days, with exceptions. See OpenAI API data controls.

Use Privacy & My Data to manage permissions and the available export and deletion actions. Marking a supported record Private or Do not use for AI restricts its future use in AI context; it does not delete that record or recall requests already processed. Revoking permission stops future processing dependent on that permission.

Summaries and inferred patterns can constitute profiling. They support reflection and may be wrong. ORACULUM does not make decisions about your employment, credit, insurance, legal rights or medical treatment on your behalf. You remain responsible for your choices. Do not treat guidance as a reliable prediction or professional advice.

5. Providers, recipients and international transfers

We use Render for backend hosting and the application database, Supabase for authentication, OpenAI for AI requests, an email-delivery provider for authentication messages, and Apple for App Store, TestFlight and Apple Push Notification services. Each receives information relevant to its task. Authorised personnel and service providers may access information where necessary for support, operation or security. We may disclose information when legally required or necessary to protect legal rights.

The current application database and authentication project are hosted in Frankfurt. This does not mean all processing stays in the EEA: providers, their support operations and subprocessors may process information elsewhere, including the United States. Where required, transfers rely on an applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, with additional measures as appropriate. Contact us for information about applicable safeguards.

Provider data-processing terms: Render, Supabase and OpenAI. Apple handles information for its own store and testing services under Apple’s privacy terms. TestFlight feedback and crash reports may include information you send to Apple; avoid private content in screenshots and reports.

The current beta does not use advertising SDKs to sell or share your reflection content for advertising.

6. Retention and deletion

Your account and saved journey: We keep these while your account is maintained and the information is needed for your requested features, until you delete the relevant content or request account deletion. There is no automatic inactivity-deletion schedule in the current beta. Uninstalling the app does not delete server data.
Account deletion: The app provides an account-deletion request that removes the associated active account, profile and journey records, including stored content, derived app records, entitlements and notification associations. The operation also requests removal of the authentication account. Treat an error as an incomplete request and contact support if it persists.
Limited evidence and operational records: Deletion does not immediately erase every operational record. Minimal deletion evidence, security records, cost-accounting records and records necessary for legal duties or claims may remain. Retention depends on the purpose: investigation or request resolution, the applicable provider log cycle, and any applicable legal retention or claim period. Such records must not be reused to reconstruct a deleted journey.
Backups and external providers: Deleting active data does not instantly erase backup copies or information already processed by an external provider. Backup copies expire through the relevant provider’s rotation and deletion procedures. We do not promise a single fixed deletion period for all backups or provider logs. Restricted copies may remain where required by law or for a specific security investigation.

Deleting your ORACULUM account does not cancel an Apple subscription or delete records Apple retains independently. Manage subscription cancellation in your Apple account.

7. Your rights

Subject to applicable law, you can request access, correction, erasure, restriction and portability of your information, object to processing based on legitimate interests, and withdraw consent. Use the in-app controls or email office@oraculumlabs.eu. We may ask for proportionate information to verify account control; do not send passwords, one-time codes or full payment details.

We respond without undue delay, normally within one month. Where the law allows an extension for complexity or multiple requests, we will explain the reason and timing. You may complain to your local supervisory authority or the Cyprus Commissioner for Personal Data Protection.

8. Security and changes

We use encrypted connections, access controls and encryption for selected stored content and tokens. This is not end-to-end encryption: the service must process permitted content to provide its features. No system can guarantee absolute security.

We update this notice when the service or relevant processing changes. The date and version above identify the current notice. Material changes will be communicated through an appropriate app or account channel, and fresh consent requested where required.