The English version is the authoritative version.

Privacy Policy

Last updated: 1 June 2026

1. Who We Are

This mobile application ("Oave", "the app", "we", "us", "our") is provided and operated by: fovoxo OÜ
Registry code: 16112801
Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia
Contact email: support@oaveapp.com

fovoxo OÜ is the data controller for the limited personal data processed in connection with Oave under the European Union General Data Protection Regulation (GDPR).

2. Our Privacy Philosophy

Oave is built with a privacy-first approach. The application is designed to process and store your core personal data directly on your mobile device. We do not require you to create a user account, we do not sync your personalized tinnitus profile to our servers, and we do not sell, rent, or share your information with third parties for marketing or advertising purposes.

The data flows described in this Privacy Policy represent the complete and exhaustive list of data processing activities associated with Oave.

3. What Stays Locally on Your Device

The following data categories are stored exclusively within your device's secure local storage. This data is never transmitted to our servers or accessible by us:

  • Sound Profile: Your tinnitus sound type, frequency, personal intensity setting, calibration results, and individual fine-tune measurements used to personalize the sound.
  • Listening History & Statistics: App usage duration, daily streaks, and customized soundscape preferences.
  • Audio Engineering Settings: Precise volume levels, mixing points, noise type selections, per-ear balance modifications, and foreground balance.
  • App Preferences: Sleep timer configurations, daily reminder schedules, and interface language preferences (supporting English, German, Spanish, Russian, Ukrainian, and Polish).
  • Wellness Check-ins: Your self-reported daily entries and wellness notes.

You can manage this data at any time via the application settings:

  1. Export: You can export this data to a local file (Settings → Export my data).
  2. Deletion: You can permanently wipe this data (Settings → Reset all data). Uninstalling the application will also automatically delete all locally stored data.

4. What You Voluntarily Share with Us

4.1 Support Communications

If you initiate a support request via the "Contact support" feature in the app, your native device email client will generate a pre-filled draft addressed to support@oaveapp.com. To assist our technical team in diagnosing issues, this draft includes a technical snapshot containing:

  • App version and system language preference.
  • Current audio configuration summary (volume, noise type, mixing point, per-ear levels).
  • App state snapshot (tinnitus type classification, calibration status, and active subscription tier).
  • Local settings status (sleep timer status, notification triggers).

Your Control: You can review, edit, or delete any part of this automated technical snapshot before sending the email. Sending this information is completely voluntary. Retention: Sent support emails are securely stored in our corporate inbox to resolve your inquiry and are retained for reference for a maximum period of two (2) years, unless you request earlier erasure.

5. In-App Purchases, Subscriptions, and Data Flows

Oave is distributed via the Google Play Store (for Android devices) and the Apple App Store (for iOS devices).

5.1 App Store Processing

All financial transactions, payment processing, billing data collection, and subscription cancellations are handled exclusively by Google LLC or Apple Inc. We never collect, see, or store your credit card numbers, bank accounts, or billing addresses.

5.2 Subscription Infrastructure (RevenueCat)

To validate, manage, and synchronize your Premium subscription status across your devices, Oave utilizes RevenueCat (RevenueCat, Inc.).

  • Data Transmitted: RevenueCat receives an anonymous, randomly generated purchase token provided by the respective App Store.
  • Data Excluded: RevenueCat does not receive your name, email, tinnitus profile, listening history, or audio parameters.
  • For more details, please review RevenueCat’s Privacy Policy: https://www.revenuecat.com/privacy/

6. Analytics, Performance Monitoring, and Diagnostics

To maintain app stability, fix crashes, and optimize user experience, Oave uses a limited set of third-party services. These tools process automated technical identifiers but do not collect direct identity records or the personal content of your sound profile or wellness notes. The app and the website (oaveapp.com) use separate analytics mechanisms with separate controls, described below.

We do not collect the device advertising identifier (AD_ID): it has been removed from the app build. Oave contains no advertising, and analytics data is never used for advertising, ad targeting, or ad measurement. All advertising-related signals (ad storage, ad user data, ad personalization) are permanently denied.

6.1 App Analytics — Google Analytics for Firebase

Within the mobile application we use Google Analytics for Firebase to understand aggregated, anonymous usage and improve the app.

  • Data Collected: Anonymous in-app events (e.g., "sleep timer started", "fine-tune completed"), device model details, and operating system versions.
  • Approximate Location Only: Any location is approximate, country-level only, derived from your IP address. We do not collect precise/GPS location or city-level location.
  • Data Excluded: No names, email addresses, specific numerical tuning configurations, or check-in note text are transmitted or linked to an analytics profile. No advertising identifier is collected.
  • Consent (EEA/UK): If you are in the EEA, the UK, or Switzerland, app analytics are off by default. Firebase Analytics does not run until you give explicit opt-in consent through a dialog shown at first launch, before onboarding; Google Consent Mode v2 remains denied until you accept. Declining does not reduce app functionality. See Section 6.3 for how to withdraw or grant consent at any time.
  • Consent (Rest of World): Outside the EEA/UK/Switzerland, app analytics are enabled by default, as disclosed here, and can be turned off at any time via the in-app Settings → Analytics toggle.
  • Google's Privacy Policy: https://policies.google.com/privacy

6.2 Website Analytics — Google Analytics 4 (cookie consent)

Our website (oaveapp.com) uses Google Analytics 4 (gtag.js) to understand aggregated web traffic. This is separate from the app's Firebase Analytics: the website does not use Firebase, Google Consent Mode, or the in-app Settings toggle.

  • Opt-In Only: Google Analytics does not load when you arrive on the site. It loads only after you click "Accept" in the website's cookie consent banner. If you decline, nothing analytics-related is loaded.
  • Data Collected: Anonymous website events (page views, referral sources, time spent on pages), approximate country-level location derived from IP, browser and device type. No names or email addresses, and no advertising identifier; website analytics are not used for advertising.
  • Cookies & Opt-Out: Your choice is stored in a first-party cookie (oave_consent). To opt out, decline the banner, or clear/withdraw your cookies in your browser; you may also use standard opt-out browser add-ons.
  • Google's Privacy Policy: https://policies.google.com/privacy

6.3 EEA/UK Analytics Consent, Consent Mode, and Withdrawal (App)

Because Oave relates to a health topic (tinnitus), in-app analytics could indirectly relate to a health context. For this reason we treat your analytics consent as explicit consent within the meaning of GDPR Article 9, and the consent dialog states this plainly.

  • Explicit Opt-In: For users in the EEA, UK, and Switzerland, Firebase Analytics and Google Consent Mode v2 remain in a denied state until you make an active choice. No analytics events are sent before you accept.
  • Withdraw or Grant Anytime (Art. 7(3)): You can change your decision at any time via Settings → Analytics in the app. Withdrawing consent is as easy as giving it and takes effect immediately; it does not affect the lawfulness of processing carried out before withdrawal.
  • On-Device Consent Record (Art. 7(1)): To demonstrate accountability, the app keeps an on-device log of your consent events (the consent status, your region, a timestamp, and the app version). This record stays on your device and is included in your Export my data file (Art. 15). It is not transmitted to our servers.

6.4 Sentry (Crash Reporting & Diagnostics)

We use Sentry (Functional Software, Inc.) to detect bugs, log application crashes, and monitor operational errors in real time. Sentry is used for crash and error reporting only; the app does not use session replay or any visual recording of your screen or interactions.

  • Data Collected: When an unexpected error or crash occurs, Sentry captures technical error logs, stack traces, native crash data, breadcrumbs, device hardware specifications, OS version, and app version.
  • Sentry's Privacy Policy: https://sentry.io/privacy/

7. Device Permissions (Audio & Notifications)

  • Audio Output: Oave requires permission to utilize your device's audio channels to synthesize sound maskers and ambient soundscapes locally. Oave does not access, activate, or record your device’s microphone, camera, contacts, or location.
  • Local Notifications: If enabled by you, Oave triggers local device alerts for daily check-in reminders and sleep timer conclusions. These are scheduled and run entirely on your operating system; we do not operate external notification servers and do not track notification interactions. You can revoke notification access at any time via your device OS settings.

8. Children's Privacy

Oave is not designed or intended for individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has transmitted personal data to us via support channels, please notify us at support@oaveapp.com, and we will delete the data immediately.

9. Your Rights Under the GDPR (European Users)

As an Estonian company, we fully recognize and support your rights under the EU General Data Protection Regulation (GDPR). If you are residing in the EEA, UK, or Switzerland, you possess the following rights:

  • Right of Access & Portability: You can request a copy of the personal data we hold (restricted solely to support emails or active subscription receipts, as your core app data is local). For your local app configuration — including your on-device analytics consent record (see Section 6.3) — you can use the built-in Export my data tool.
  • Right to Erasure ("Right to be Forgotten"): You can request the deletion of your support emails by contacting us. Local data can be wiped by clearing the app data or uninstalling Oave.
  • Right to Rectification: You may request corrections to inaccurate corporate records we hold.
  • Right to Restriction or Objection: You can object to processing based on our legitimate interest (such as diagnostic logging) or request that we restrict processing.

Legal Bases for Processing (GDPR Articles 6 and 9):

  • Performance of a Contract: Processing subscription tokens via RevenueCat to deliver Premium services you purchased.
  • Consent (and Explicit Consent for analytics): Voluntarily enabling notifications, or opting into app or website analytics. Because the app relates to a health topic, in-app analytics consent is handled as explicit consent under Article 9. You may withdraw at any time — in the app via Settings → Analytics, and on the website by declining the cookie banner or clearing your cookies (see Sections 6.1–6.3).
  • Legitimate Interests: Processing crash and error logs (Sentry) and support tickets to maintain software security, resolve platform errors, and improve product performance.

To exercise your GDPR rights, please contact us at support@oaveapp.com. We will respond to verified requests within thirty (30) days. You also have the right to lodge a complaint with a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Teadmised, Tallinn, https://www.aki.ee).

10. California Privacy Rights (CCPA)

If you are a resident of California, the CCPA grants you the right to know what personal information we collect, request deletion, and opt-out of data sales. Oave does not "sell" or "share" your personal information with third-party data brokers. To submit a CCPA inquiry, email support@oaveapp.com.

11. Data Security and International Transfers

We apply industry-standard administrative, physical, and technical measures (including TLS encryption for incoming emails) to safeguard data under our direct control.

Because Oave utilizes global infrastructure providers (such as Google Play, Apple App Store, and RevenueCat), technical telemetry and billing data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Where such transfers occur, they are governed by approved legal mechanisms, such as Standard Contractual Clauses (SCCs).

12. Data Retention Schedule

  • On-Device Data: Kept indefinitely on your hardware until you clear data, clear app cache, or uninstall Oave. This includes the on-device analytics consent record (Section 6.3), which never leaves your device.
  • Support Emails: Retained for up to two (2) years following the resolution of your technical ticket.
  • Subscription Records (RevenueCat/Stores): Retained for the active duration of your subscription plus the mandatory periods required under Estonian tax and corporate accounting laws.
  • Analytics & Diagnostic Telemetry: Retained in accordance with third-party service retention standards (typically up to 14 months for event data).

13. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy to reflect technical, regulatory, or business changes. We will notify you of material changes by updating the "Last updated" date at the top of this document and publishing a prominent in-app notification before the changes take effect.

14. Contact Information

For any privacy questions, data requests, or policy feedback, please contact us: fovoxo OÜ
Email: support@oaveapp.com
Postal Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia