← Off Script

Privacy Policy for Off Script


Effective Date: June 5, 2026

Last Updated: June 5, 2026


Introduction


Off Script ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.


Our Core Privacy Principles:

  • End-to-End Encryption (E2EE): Your sensitive data is encrypted on your device before being sent to our servers. We cannot read your question responses, Love Bank deposits, or other private information.
  • Data Minimization: We only collect what's necessary to provide our service.
  • User Control: You decide what to share, with whom, and for how long.
  • Transparency: We're clear about what data we collect and why.

    • Information We Collect


    1. Information You Provide Directly


    Account Information

  • Email address: Used for account creation, partner matching, and important notifications
  • Display name: Optional, used to personalize your experience
  • Date of birth: Required for age verification (18+ only) to access adult content categories
  • Profile photo: Optional, from your Google account or uploaded by you

    • Relationship Data (End-to-End Encrypted)

  • Question responses: Your answers to compatibility questions
  • Love Bank deposits: Positive moments you record about your partners
  • Partner information: Names, relationship types, and connection details
  • Compatibility scores: Calculated locally on your device

    • Important: All relationship data is encrypted on your device before being sent to our servers. We use industry-standard AES-256-GCM encryption. Even if our servers were compromised, attackers would only see encrypted data that is useless without your encryption keys, which never leave your devices.


    2. Information Collected Automatically


    Device Information

  • Device identifiers: Unique device ID (for multi-device sync and push notifications)
  • Device type: Android version, manufacturer, model
  • App version: To ensure compatibility and provide support

    • Usage Information (Minimal)

  • Login timestamps: When you sign in/out
  • Feature usage: Which screens you visit (for improving the app)
  • Crash reports: Anonymous error logs to fix bugs

    • Push Notification Tokens

  • FCM tokens: To send you notifications about partner activity (encrypted data updates, matches, etc.)

    • 3. Information from Third Parties


    Google Sign-In

  • Google ID token: Used to authenticate your account
  • Email, name, profile photo: From your Google account (with your permission)

    • We do not access your Google contacts, calendar, or any other Google services beyond basic profile information.


    How We Use Your Information


    Primary Uses

    1. Provide the Service: Create your account, sync data across devices, match you with partners

    2. End-to-End Encryption: Encrypt and decrypt your data (keys stay on your devices)

    3. Push Notifications: Notify you of partner activity, matches, and important updates

    4. Age Verification: Ensure you're 18+ before accessing adult content

    5. Customer Support: Respond to your questions and troubleshoot issues


    We Do NOT

  • ❌ Sell your data to third parties
  • ❌ Use your data for advertising
  • ❌ Read your encrypted question responses or Love Bank deposits
  • ❌ Share your data with partners without your explicit consent
  • ❌ Train AI models on your personal data (see "Third-Party Services" section)

    • Data Sharing and Disclosure


    With Your Partners (Your Choice)

  • When you connect with a partner, you choose to share your encrypted data with them
  • Your partner can only decrypt data you've explicitly shared
  • You can revoke access at any time (they lose access within 24 hours)

    • With Service Providers

    We use the following third-party services to operate Off Script:


    Supabase (Backend Infrastructure)

  • What they store: Your email, encrypted relationship data, device info, push tokens
  • What they CAN'T see: Your plaintext question responses, Love Bank deposits (encrypted)
  • Data Processing Agreement: We have a DPA with Supabase that prohibits them from using your data for any purpose other than providing our service
  • Location: Supabase stores data on secure servers (AWS infrastructure)
  • Their policy: https://supabase.com/privacy

    • Important: Supabase does NOT use customer data to train AI models or for any other secondary purposes. Due to our end-to-end encryption, even if Supabase wanted to use your data, they would only see encrypted ciphertext.


    Google (Authentication)

  • What they provide: Sign-in service (OAuth)
  • What they know: You use Off Script (but not what you do in the app)
  • Their policy: https://policies.google.com/privacy

    • Firebase Cloud Messaging (Push Notifications)

  • What they do: Deliver push notifications to your device
  • What they know: Your device token, when notifications are sent (not the content)
  • Their policy: https://firebase.google.com/support/privacy

    • Legal Requirements

    We may disclose your information if required by law, such as:

  • In response to a valid court order or subpoena
  • To protect our rights, property, or safety
  • To prevent fraud or abuse

    • Note: Due to E2EE, we cannot provide plaintext relationship data even if legally compelled. We can only provide metadata (emails, timestamps, device info).


    Your Privacy Rights


    Under GDPR (European Users)

    If you're in the EU/EEA, you have the right to:


    1. Access: Request a copy of all your data (Settings → Download My Data)

    2. Rectification: Correct inaccurate data (edit in the app)

    3. Erasure ("Right to be Forgotten"): Delete your account and all data (Settings → Delete My Account)

    4. Data Portability: Export your data in machine-readable format (JSON)

    5. Object: Opt out of optional data processing (analytics, data sharing tier)

    6. Withdraw Consent: Revoke any consent you've given (Settings → Privacy & Consent)


    Under CCPA (California Users)

    If you're in California, you have the right to:


    1. Know: What personal information we collect and how we use it

    2. Delete: Request deletion of your personal information

    3. Opt-Out: Opt out of "sale" of personal information (we don't sell data, but you can opt out of the optional data sharing tier)

    4. Non-Discrimination: We won't discriminate against you for exercising your rights (free tier remains fully functional)


    How to Exercise Your Rights

  • Download Your Data: Settings → Privacy & Data → Download My Data
  • Delete Your Account: Settings → Privacy & Data → Delete My Account
  • Manage Consents: Settings → Privacy & Data → Manage Consents
  • Contact Us: privacy@youramaryllis.us (or the email in "Contact Us" section)

    • Data Retention


    Active Accounts

  • Encrypted relationship data: Stored until you delete it or your account
  • Account information: Stored until you delete your account
  • Device information: Stored until you remove the device or delete your account

    • Deleted Accounts

  • Immediate deletion: All data is deleted from active systems within 1 hour
  • Backup deletion: Data is removed from backups within 30 days
  • Confirmation: You'll receive an email when deletion is complete

    • Partner Impact

    When you delete your account:

  • Your partner receives a notification
  • Your partner can no longer see your data (encryption keys are deleted)
  • Your partner's own data (their responses, their Love Bank) remains (they own it)
  • This is GDPR-compliant: your deletion doesn't extend to your partner's independent data

    • Data Security


    Encryption

  • In Transit: All data is encrypted using TLS 1.3 during transmission
  • At Rest: Sensitive data is encrypted on our servers (even though we can't decrypt it)
  • On Device: Encryption keys are stored in Android Keystore (hardware-backed when available)

    • Access Controls

  • Server-side: Row-level security (RLS) ensures users can only access their own data
  • Client-side: PIN protection per partner (optional)
  • Multi-device: Secure key provisioning between your devices (no manual recovery secret needed in most cases)

    • Security Practices

  • Regular security audits
  • Penetration testing (planned)
  • Bug bounty program (planned)
  • Incident response plan

    • What Happens in a Data Breach?

    If our servers are breached:

    1. Your encrypted data is safe: Attackers only get ciphertext (useless without keys)

    2. Metadata at risk: Emails, relationship graph, timestamps could be exposed

    3. We notify you: Within 72 hours (GDPR requirement)

    4. We notify authorities: As required by law


    Children's Privacy


    Off Script is not intended for users under 18. We do not knowingly collect data from children. If you're under 18, do not use this app.


    If we discover we've collected data from a child, we'll delete it immediately. If you believe a child is using Off Script, please contact us at privacy@youramaryllis.us.


    Optional Data Sharing Program (Premium Plus Tier)


    What Is It?

    Premium Plus is an optional subscription tier where you can choose to share anonymized data with us in exchange for a lower price ($2.99/month instead of $3.99/month).


    What You Share (If You Opt In)

  • Anonymized question responses: No names, emails, or identifying info
  • Aggregated Love Bank patterns: Types of deposits, frequency (not specific content)
  • Relationship type and duration: E.g., "Dating, 6 months" (not who you're dating)
  • Age range: E.g., "26-35" (not exact age)
  • General location: E.g., "North America" (not city or address)

    • What You DON'T Share

  • ❌ Any personally identifiable information (PII)
  • ❌ Partner identities or contact info
  • ❌ Exact locations or timestamps
  • ❌ Raw encrypted data (we only collect after client-side anonymization)

    • How We Use It

  • Improve the app (which questions are most valuable, which features are used)
  • Anonymized research papers (with your permission)
  • Aggregated trend reports (sold to ethical researchers, therapists, or relationship platforms)
  • Train on-device AI models (never cloud models that could leak data)

    • Your Rights

  • Opt in required: This is completely optional (not required for the app)
  • Opt out anytime: Settings → Privacy & Data → Data Sharing (data deleted within 30 days)
  • Transparency: Quarterly "Research Insights" reports showing what we learned
  • K-anonymity: Minimum 100 users in any reported cohort (you can't be singled out)

    • International Data Transfers


    Off Script is based in the United States. If you're outside the US, your data may be transferred to and stored on servers in the US.


    We ensure adequate protection through:

  • Standard Contractual Clauses (SCCs): With Supabase and other processors
  • End-to-End Encryption: Your sensitive data is encrypted before leaving your device
  • GDPR Compliance: We follow GDPR requirements for international transfers

    • Changes to This Privacy Policy


    We may update this Privacy Policy from time to time. When we do:

    1. We'll notify you: Via email and in-app notification

    2. We'll update the "Last Updated" date: At the top of this policy

    3. Material changes require consent: If we make significant changes, we'll ask for your consent again


    You can always view the current policy in Settings → Privacy Policy.


    Contact Us


    If you have questions about this Privacy Policy or want to exercise your privacy rights:


    Email: privacy@youramaryllis.us

    In-App: Settings → Help & Support → Contact Us

    Mail: Off Script Privacy Team, [Address TBD]


    Data Protection Officer (for GDPR inquiries): privacy@youramaryllis.us


    Response Time: We aim to respond within 48 hours for general inquiries, 72 hours for GDPR/CCPA requests.


    Supervisory Authority


    If you're in the EU/EEA and believe we've violated GDPR, you have the right to lodge a complaint with your local data protection authority:

  • List of EU DPAs: https://edpb.europa.eu/about-edpb/board/members_en

    • Summary (TL;DR)


    ✅ We use end-to-end encryption: We can't read your sensitive data

    ✅ We don't sell your data: Never have, never will

    ✅ You control your data: Download or delete anytime

    ✅ Minimal collection: Only what's needed to provide the service

    ✅ Transparent: Clear about what we collect and why

    ✅ GDPR & CCPA compliant: Full privacy rights for all users

    ✅ Optional data sharing: Lower price if you opt in (completely optional)


    Questions? Contact us at privacy@youramaryllis.us


    ---


    Version: 1.0

    Effective Date: June 5, 2026

    Last Updated: June 5, 2026