Olifant

Privacy policy

Last updated: October 31, 2026

Who is responsible

The controller under the GDPR is Mücahit Gürbüz, Südostallee 120, 12487 Berlin, Germany. Email: mucahitgurbuzcompany@gmail.com. Phone: +49 176 83258742.

This policy covers the Olifant iOS app, the servers behind it, and this website. It explains what data we process, why, on which legal basis, who receives it, and what your rights are.

What we process

We process only what Olifant needs to work, and what you or your family choose to add.

  • Account: your email address, the sign-in ID from Apple, Google or email code sign-in, your display name and color, your birth date if you add it, your language and your time zone.
  • Circle and members: the circle's name, country, language and time zone, member roles, invites, and the phone number on your profile if you add it.
  • Children: a child gets a profile, not an account. See the Children section below.
  • Family content: events, routines, tasks, lists, notes, dossiers, announcements, room messages, comments, birthdays and other occasions, and money entries such as bills, assets and goals.
  • Documents: files, photos, scans and PDFs you add to the inbox or the document vault.
  • Email: messages and attachments forwarded to your circle's Olifant address. Mail from senders the circle has not approved is stored but held until an adult approves or discards it. If you connect Gmail, Olifant reads, with read-only access, only mail that has your chosen label or comes from an approved sender.
  • Health data: vaccination, checkup and dental plans per person, and emergency cards (blood type, allergies, conditions, medications, doctors, insurance, emergency contacts). Medical documents in the vault are health data too. This is special category data under Art. 9 GDPR.
  • Location: only while you share it or send an SOS. A share lasts 15 minutes, 1 hour or 4 hours and ends by itself. An SOS sends your position, name and phone number to every other member of your circle and shares your location for 1 hour.
  • Assistant: your questions, the answers, and the memories you ask Olifant to keep.
  • Device and technical data: your push token, device language and time zone, and IP addresses in server logs.
  • Crash reports: technical data about a crash, without your name, email or content.
  • Usage statistics: only if you turn them on in Settings. They hold event names and counts, linked to your account. They are off by default.
  • Subscription: which circle has Olifant Pro, the product, the expiry date, and purchase events. Apple handles payment. We never see your card details.
  • Caregiver links: when someone opens an emergency card link, we log the time, the result, the browser type and a hashed form of the IP address, never the address itself.

Why we process it and on which legal basis

You can withdraw any consent at any time, in the app or by email. This does not affect processing that happened before. You are not required by law to give us data. Without an email address or an Apple or Google sign-in you cannot create an account, and without the data a feature needs you cannot use that feature.

  • To provide Olifant under our contract with you: your account, circles, syncing your data to your devices, reminders and push notifications, invites, the inbox, the assistant, the weekly family meeting, export and deletion (Art. 6(1)(b) GDPR).
  • Health plans, emergency cards and caregiver links: only with explicit consent for each person (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
  • AI features: only after an adult in the circle turns on Olifant AI for the circle (Art. 6(1)(a) GDPR). Inbox mail and documents can contain health data, so this consent also covers Art. 9(2)(a) GDPR. Without it, no AI feature runs, and mail stays in the inbox for you to handle yourself.
  • Gmail: only with your consent when you connect it (Art. 6(1)(a) GDPR).
  • Location and SOS: with your consent each time you share (Art. 6(1)(a) GDPR) and the iOS location permission.
  • Usage statistics: only with your consent (Art. 6(1)(a) GDPR, §25(1) TDDDG).
  • Crash reports, security logs, abuse prevention and an AI usage log with counts only (to enforce quotas and control cost): our legitimate interest in a stable, secure and affordable service (Art. 6(1)(f) GDPR).
  • Legal duties, such as answering authorities where the law requires it (Art. 6(1)(c) GDPR).

Your right to object

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons that arise from your particular situation (Art. 21 GDPR). We then stop, unless we show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. Write to mucahitgurbuzcompany@gmail.com.

Children

Olifant is made for families, but accounts are for adults aged 18 or older. A child gets a profile, not an account, and never signs in. An adult in the circle creates and manages the profile and acts for the child. That adult must hold parental responsibility or act with the consent of whoever holds it.

A child profile stores the display name, color, birth date, language and time zone, plus what adults attach to it, such as health plans, an emergency card or gift ideas. Health data about a child needs explicit consent from an adult who confirms parental responsibility.

A child's name and birth year reach Google Vertex AI only after an adult turns on Olifant AI for the circle. Health plans and emergency cards never reach it.

An admin can delete a child's profile, and every record about the child, at any time. We do not knowingly collect personal data directly from children, including children under 13 in the United States.

How AI is used

Olifant uses Google's Gemini models through Google Cloud Vertex AI. Requests go to Google's EU endpoint. We use no other AI provider. Nothing from a circle goes to Vertex AI until an adult in that circle turns on Olifant AI. It can be turned off at any time, and then no new data is sent. This is what each feature sends once it is on:

  • Inbox: one item at a time (subject, text and attachments such as PDFs and photos), the circle's date and time zone, and the members' display names, roles and birth years. The result is a proposal. Nothing is created until an adult accepts it.
  • Assistant: your question, recent messages of your conversation, items you are allowed to see (events, routines, open tasks, lists, dossier titles, announcements) and matching memories. It never sends health plans, emergency cards, files, phone numbers or birth dates.
  • Quick add: the text you enter and the context needed to turn it into an item.
  • Gift ideas: the occasion, the person's name and age, and member names.
  • Memories: the text of one memory at a time, to build a search index for the assistant.
  • Weekly family meeting: only for Olifant Pro circles, and only if an admin also turns on the meeting. Titles, dates, counts and member names of items the whole circle can see. Never adults-only, private or health items.

What happens to AI data

Google acts as our processor. Under Google Cloud's terms for Vertex AI, Google does not use this data to train its models. We do not log the text you send or the answers. We log only counts and timing, to enforce quotas.

AI output is a suggestion. It can be wrong. Olifant makes no decision about you that has legal or similarly significant effects (Art. 22 GDPR).

Who receives data

These service providers process data for us as processors under a data processing agreement, unless stated otherwise:

  • Supabase (Supabase, Inc., USA): database, sign-in, file storage and server functions. Data is stored in Frankfurt, Germany.
  • PowerSync: syncs your data to your devices. Servers in the EU.
  • Google Cloud Vertex AI (Google): the AI features above. EU endpoint.
  • Resend (USA): receives all mail forwarded to your circle's address before Olifant does, and delivers our emails, such as sign-in codes.
  • Sentry (Functional Software, Inc., USA): crash reports. EU data region.
  • RevenueCat (USA): subscription status. It receives your user ID, the circle ID and purchase data, never your name, email or content.
  • Vercel (USA): hosts this website.
  • Apple: delivers push notifications as our processor. For Sign in with Apple, App Store purchases and iCloud, Apple acts under its own terms and privacy policy.
  • Google: if you sign in with Google, Google shares your email address and a Google account ID with us. If you connect Gmail, we read mail as described above. Google acts under its own terms and privacy policy for its side.
  • Other members of your circle see what you share according to the visibility you choose: everyone, adults only, or only you.
  • Authorities and courts, only where the law requires it.

Transfers outside the EU

Some providers are based in the USA or can access data from there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.

We do not sell your data. We do not share it for advertising. Olifant contains no advertising or tracking SDK.

How long we keep it

We keep your data while your account exists. When you delete your account, your private data is deleted from the app right away and removed from the Olifant database within 30 days. What you shared with your family, such as messages, notes, and files, stays in the family circle under "Deleted member". If you were the last adult, the whole circle is deleted. Database backups roll off within 7 days after that. Records that providers must keep are not part of the account deletion: purchase records at Apple and RevenueCat, and crash reports in Sentry until their retention ends. Shared locations are deleted 24 hours after a share ends.

  • Items you delete: removed for good after 30 days.
  • Inbox items that were discarded, or held and never approved: deleted 30 days after the last change.
  • Location requests: 7 days. Caregiver link logs: 30 days. Weekly meeting agendas: 8 weeks.
  • AI usage log, usage statistics and subscription events: 13 months.
  • Server logs at our hosting providers: as long as each provider's retention period.

Your rights

Under the GDPR you have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time (Art. 7(3)).

You can do much of this yourself in the app: Settings, then Export data, or Delete account. The last admin of a circle with other adults must hand the circle over first. Deleting your account does not cancel an App Store subscription. Cancel it in your Apple account settings. For anything else, write to mucahitgurbuzcompany@gmail.com.

You have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the law was broken. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Berliner Beauftragte für Datenschutz und Informationsfreiheit

People named in your content

Your content can name people who do not use Olifant, such as teachers, doctors or the sender of an email. We process this data only to provide Olifant to you and your family, with the safeguards in this policy. They have the same rights and can contact us at mucahitgurbuzcompany@gmail.com.

Security

Data is encrypted in transit. Access rules in the database decide who sees each item, and tests check them. Files on your device are protected by iOS data protection. No system is fully secure, so keep your device locked and up to date.

This website

Vercel hosts this website. When you visit it, Vercel processes your IP address, the time, the page and your browser type in server logs, to deliver the pages and keep them secure (Art. 6(1)(f) GDPR). The website sets no cookies, has no analytics and loads no third-party scripts. Invite links contain the invite code in the address, so it appears in these logs. Invite codes expire after 7 days. The emergency card page loads the card directly from our database in the EU.

Google user data

Olifant's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Gmail data only to show you events, to-dos and payments inside Olifant. We do not use it for advertising, do not sell it, and do not use it to train general AI models. People at Olifant read it only with your consent, for security, or where the law requires.

Google API Services User Data Policy

Changes

If we change this policy in a way that matters, we tell you in the app before it applies. The date at the top shows the current version.