Oumy Privacy Policy and United States State Privacy Notice

Effective October 20, 2026 · Version 1.0-draft

1. Scope and responsible business

This Policy explains how JBX Huddle LLC (JBX, Oumy, we, us) collects, uses, discloses, and retains personal information through the Oumy app and its App Clip, iMessage, widget, and Siri features, oumy.app, the pay pages at pay.oumy.app, accounts, splits, requests, reminders, friend loans, friendly bets, Oumy Plus, support, and related operations (the Services).

Oumy never holds, pools, or moves money. Payments happen inside the payment app or bank you and your friends already use, such as Venmo, Cash App, PayPal, Zelle, or Apple Cash. Oumy does the math, sends the requests and reminders you approve, and keeps track of who has paid. We never receive your bank login, card number, or payment-app password.

Oumy accounts are for adults in the United States. The Services are not directed to children under 18. A friend who receives a request can open a pay page without an account; Section 2 describes what we collect when they do.

2. Information we collect

Depending on how you use Oumy, we may collect:

• Identity and contact: name, phone number, date of birth, Sign in with Apple identifier and relay email if you use it, account identifiers, and support contact details.
• The people you pick: the name and phone number of each person you choose for a split, request, loan, bet, trip, tab, or crew. Your contacts list stays on your phone. Oumy reads it on the device so you can pick people, and only the specific people you pick leave your phone. We never upload your address book and never invite anyone you did not choose.
• Payment handles: the Venmo, Cash App, PayPal, Zelle, or Apple Cash handles you add so friends can pay you, whether each is verified, and the history of handle changes.
• Money records: what you split or lend, purposes and merchants, amounts, shares, participants, request and reminder status, payment-plan schedules, loan and bet terms, the state you declare for bets, trips and tabs, notes about people you add yourself, and the evidence used to mark something paid.
• Your words and receipts: the sentences you type or say to Oumy, receipt photos, and receipts you share or forward. Receipt photos are read on your phone. When the phone cannot understand a sentence or a forwarded receipt, the text is processed in the cloud as described in Section 6.
• Payment notifications: if you turn on the "Payment caught" Shortcuts automation for a payment app, your iPhone sends Oumy the text of that app's payment notification (such as "Tom Park sent you $128"). Oumy reads it with fixed rules, not a model. We keep a one-way fingerprint of the notification to prevent duplicates and, when it matches an open request, the sender name, amount, app, and time as evidence. Text that is not a payment is discarded.
• Calendar: if you allow it, Oumy reads event titles and attendees on your phone to suggest who was there. Calendar data stays on your phone.
• Friends who use a pay page: the request link they opened, which payment option they tapped, whether they selected "I already paid", report or "don't send me requests" choices, and, only if they opt in to text reminders, their phone number and the time and wording of their consent.
• Oumy Plus: Apple purchase and subscription status, product and transaction references, price and currency, entitlement state, renewal, cancellation, billing-issue, expiration, and refund events. Apple's signed transaction and subscription notifications keep this in sync with your Oumy account. Oumy does not receive your Apple ID password or Apple payment credentials.
• Device and usage: device and operating-system type, app version, push token, IP address, timestamps, language, time zone, in-app interactions, diagnostics, crash and performance events, and security signals.
• Communications: support requests, privacy requests, reports, feedback, and related attachments.

Face ID and Touch ID are handled by your iPhone. Oumy receives only a yes or no, never your biometric data. Oumy does not collect precise location, government identification, or bank or card credentials. Do not send unnecessary sensitive information in support messages.

3. Sources

We collect information from you; your device; the friends you split with, when they act on a request you sent them; Apple (Sign in with Apple, App Store purchases and notifications, push delivery); the payment-app notifications you choose to send to Oumy; receipts you share or forward; authentication, hosting, messaging, email, AI, analytics, support, and security providers; and public sources such as sports scores and recorded weather used to settle a bet. We may infer things like who usually splits together from your own records, but we do not use a solely automated decision to deny a legal right without the review required by law.

4. How we use information

We use information to:

• create, authenticate, recover, secure, and administer accounts;
• turn what you say into a split, request, loan, bet, trip, or tab, and compute every amount with deterministic code that you confirm before anything is sent;
• prepare requests that you send from your own Messages, show friends the right pay page, and open the payment app they choose with the amount filled in;
• send the reminders you turned on, at the times and with the limits described in the app;
• recognize when a friend has paid and mark the request settled, keeping the evidence;
• remember the people, crews, and handles you set up so the next split is faster;
• settle friendly bets from public results, enforce bet caps, and keep the No House Rule;
• provide Oumy Plus, restore purchases, and keep Apple subscription status aligned with your account;
• enforce request limits, prevent spam, fraud, harassment, and abuse, and handle reports and blocks;
• diagnose errors, protect systems and users, and enforce our Terms;
• respond to support, privacy, legal, and regulator requests;
• comply with law and protect rights, property, health, and safety; and
• improve features using aggregated, deidentified, or appropriately controlled information.

We do not sell your information, use it for advertising, or build a profile of a friend who has not joined Oumy. A friend who has not joined is only ever contacted about a request you chose to send them.

5. Legal and operational bases

US law does not use one universal list of processing bases. Depending on the context, we process information to perform a requested service, operate an account, obtain consent, satisfy a legal obligation, protect security and safety, prevent fraud, and pursue legitimate business purposes that applicable law permits. Where consent is required, it must be specific and can be withdrawn prospectively, subject to necessary service and legal processing.

6. How we disclose information

We may disclose relevant information to:

• the people in a request, loan, bet, trip, or tab: your name, the purpose, the amount, your payment handle, and its status, so they can pay you or follow along;
• Anthropic, which provides the cloud AI that understands a sentence the phone could not, a forwarded receipt, or the description of a bet's event. We send the sentence or receipt text and, for a sentence, the first names of the people it may mention. We do not send phone numbers, payment handles, or your contacts list. The model only extracts fields; Oumy's own code computes every amount and you confirm it;
• Supabase for hosting, database, authentication, storage, and server functions;
• Vercel for hosting oumy.app and the pay pages;
• Apple for Sign in with Apple, push notifications, App Clip, and Oumy Plus purchase, restore, renewal, cancellation, and refund status;
• Telnyx for sign-in codes and, only for friends who opted in on a pay page, text reminders from Oumy's number;
• Resend for receiving receipts you forward and for sending service email;
• sports-data and weather providers such as ESPN and Open-Meteo, which receive only the game, place, or date a bet depends on, never your name or contact details;
• the payment app a payer chooses: when someone taps a pay button, their own payment app opens with your handle, the amount, and the note. That app's terms and privacy notice govern the payment;
• authentication, hosting, security, email, push, analytics, crash-reporting, support, and development providers under contracts and instructions appropriate to their role;
• professional advisers, insurers, auditors, and banks as needed for legitimate business and legal functions;
• government, courts, regulators, law enforcement, or other persons when reasonably required by law, legal process, safety, or protection of rights; and
• transaction counterparties in a merger, financing, asset sale, reorganization, or similar transaction, subject to confidentiality and applicable notice and choice duties.

We instruct AI and service providers not to use Oumy data to train their models or for their own purposes, subject to their applicable terms.

7. Sale, sharing, and targeted advertising

JBX does not sell personal information for money. Some state laws define sale, sharing, or targeted advertising more broadly than an exchange for money. If Oumy activates a practice covered by those definitions, we will provide the required notice and opt-out mechanism before or with that practice.

Oumy has no advertising and no advertising pixels. Oumy does not link data about a particular user or device with third-party data for cross-app or cross-site targeted advertising or advertising measurement, and does not share that data with a data broker.

8. Cookies and similar technologies

The Oumy website and pay pages use only the essential technologies needed to show a page, keep it secure, and remember a choice you made on it. They do not use advertising cookies or third-party tracking scripts. Where applicable law requires it, we honor a recognized Global Privacy Control or universal opt-out signal as a request to opt out of covered sale, sharing, or targeted-advertising processing for that browser or device.

9. Messages, push, email, and SMS

Requests go out from your own Messages app by default. Each text Oumy prepares is clearly automated and ends with the name of your Oumy agent. You choose whether to send it.

Oumy texts a friend from its own number only if that friend opts in on a pay page. Those texts are about the specific request, stop at the end of the request, are not sent between 9 p.m. and 9 a.m. in the friend's time zone, and stop immediately if the friend replies STOP. Reply HELP for help. Message and data rates may apply. Mobile numbers and SMS consent are never shared with third parties or affiliates for marketing. Oumy does not send SMS marketing.

Transactional account, request, payment, security, and safety messages are sent as needed to provide the Services or comply with law. Push notifications can be turned off in iPhone Settings.

10. Data retention

We retain information only as reasonably needed for the stated purpose, including active account and service operation and legal, tax, accounting, fraud, security, safety, dispute, and enforcement obligations.

• Evidence attached to a settled request is kept for the life of the request plus 2 years, so either side can see why it was marked paid.
• History you import from another app is stored encrypted and kept for 12 months.
• Payment-notification fingerprints that did not match a request are kept only long enough to prevent duplicates.
• Pay-page SMS consent records are kept for as long as the law requires after consent ends.

A deletion request does not require deletion of information needed for an open request, a fraud defense, a tax record, a legal claim, or another legal exception. When an account is deleted, its open requests are closed and friends are no longer contacted about them. Records your friends keep about money between you, such as their own copy of a settled request, may remain in their accounts. Deleting an Oumy account does not cancel an Apple subscription; cancel it in Apple Subscriptions to stop future renewal.

11. Security

We use administrative, technical, and organizational measures designed for the sensitivity and risk of the information, such as row-level access controls, authentication, Face ID on every money action, encryption in transit, secret isolation, logging, least privilege, monitoring, provider review, and incident response. No system is perfectly secure. Protect your phone and account and contact us if you suspect unauthorized access.

12. Your choices

Depending on the feature, you may:

• choose which contacts, if any, Oumy can see on your phone, and which people to include;
• turn calendar suggestions, payment-notification automations, and reminders on or off;
• edit or remove payment handles and notes about people;
• block a person, report a request, or, as a friend, choose "Don't send me requests" on a pay page;
• reply STOP to any text from Oumy's number;
• turn off push notifications in iPhone Settings;
• request access, correction, deletion, or a portable copy of your information; and
• appeal a denied state privacy request where applicable.

Turning off a preference does not prevent necessary transactional, security, or safety processing.

13. United States state privacy rights

Residents of states with applicable comprehensive privacy laws may have rights to know and access, correct, delete, and obtain a portable copy of covered personal information; opt out of covered sale, sharing, targeted advertising, or qualifying profiling; limit certain sensitive-data uses; receive nondiscriminatory service; use an authorized agent; and appeal a denied request. Rights, exceptions, verification, response times, and applicability vary by state and business thresholds.

Texas's Data Privacy and Security Act, California's privacy laws, Colorado's Privacy Act, and other state laws may apply depending on facts and thresholds. This notice offers a common request channel without representing that every statute applies to every person or processing activity.

Submit a request through available account controls or:

• Email team@oumy.app with subject Privacy Request;
• Phone 281-305-9305.

Describe the request and the state of residence. We will verify identity using information appropriate to the request's risk. An authorized agent must provide authority and may need to support identity verification. We will not discriminate for exercising a right, although deleting data may prevent a feature that needs it.

If we deny a request, the response will explain the basis and any applicable appeal method. Appeal by replying with subject Privacy Appeal. If an appeal is denied, the response will identify any regulator-contact option required by applicable law.

14. Children

The Services are not directed to children under 18, and JBX does not knowingly collect personal information from a child for an Oumy account. If you believe a child submitted information, contact us so we can investigate and take appropriate action.

15. Deidentified and aggregated information

We may use information that is aggregated or deidentified so it is not reasonably linkable to an individual. Where law requires, we maintain it in deidentified form, use reasonable measures to prevent reidentification, and do not attempt to reidentify it except to test protections or as law permits.

16. External services

Venmo, Cash App, PayPal, Zelle, Apple Cash, your bank, the App Store, and other independent services process payments and information under their own terms and notices. Oumy does not control a payment once a payment app opens. Review those notices before using those services.

17. Changes

We may update this Policy prospectively as systems, providers, law, or practices change. The current version and effective date appear at the top. We will provide additional notice or obtain consent when applicable law requires it, and we keep this Policy aligned with our current practices.

18. Contact

Privacy questions and requests:

• JBX Huddle LLC / Oumy
• Email: team@oumy.app
• Phone: 281-305-9305