privacy policy — the okay company

The short version: we collect only what we need to run our products, we never sell your information or use it for advertising, we don't train AI on your content, and you can see, take or delete your data whenever you like.

1. Who we are

This Privacy Policy explains how The Okay Company LLC (“the okay company”, “we”, “us” or “our”) handles personal information when you use the Services listed in our Terms of Service:

okaycompany.com, the company site;
okay engineering (okayengineering.com), its devices and its Mac apps such as OkayCopy;
the okay designer (okaydesigner.com), in the browser and on the Mac;
OkayLogin (okaylogin.com), the account used across Okay products;
OkayPanda, OkayPortal, the okay model and okaybravo, as and when they are offered;
and any other website, app, device or service of ours that links to these terms.

We are the “controller” (or “business”) for that information. Contact us about privacy at okay@okaycompany.com (subject “Privacy”), or by post at The Okay Company LLC, c/o Northwest Registered Agent LLC, 732 S 6th St, Ste N, Las Vegas, NV 89101, USA.

When a business uses our Services to handle its own customers' information (for example a company running its private okay model), we process that information for the business and on its instructions, and the business's own privacy policy applies to it.

2. What we collect

Information you give us

Account details: your name, email address and passkey public keys (we never receive your passkey's private key or your device's biometrics).
Your Content: designs, files, prompts, messages and settings you put into a product, and what the product makes from them.
Purchase details: what you bought, billing name and address, shipping address for devices, and payment status. Stripe handles card details; we see only the card type, last four digits and expiry.
Messages: what you send when you email us or ask for support.

Information collected automatically

Service logs: IP address, browser or app version, device type, pages or features requested, times and error reports. Our hosting provider records these to deliver and protect the Services.
Sign-in and security data: session identifiers, sign-in times and devices, used to keep you signed in and spot misuse.
App update checks: our Mac apps check okayengineering.com for updates, which sends the app version and macOS version.

We don't use advertising trackers, cross-site tracking, fingerprinting or third-party analytics. See our Cookie Policy.

Information from others: if you sign in to another company's app with OkayLogin, we receive what is needed to complete that sign-in. If you are invited to a team, the person inviting you gives us your email address.

3. How we use it

To provide the Services you ask for: run your account, save and sync your work, ship devices, and take payments (necessary for our contract with you).
To keep the Services secure, prevent fraud and abuse, and fix problems (our legitimate interests).
To send you service messages such as sign-in codes, receipts, security alerts and important changes (contract and legitimate interests).
To answer you when you contact us.
To improve the Services using aggregated or de-identified information about how features are used (legitimate interests). We don't use Your Content to train AI models.
To send product news, only if you ask for it (consent); every such email has an unsubscribe link.
To meet legal obligations such as tax records, and to establish or defend legal claims.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. AI features

When you use an AI feature with your own API key (for example from Anthropic, OpenAI or Google), your prompt and the content needed to answer it go directly from your device to that provider under its own terms and privacy policy. When an AI feature runs on our own infrastructure, such as a private okay model, your content is processed only to give you the answer and is not used to train shared models.

5. Who we share it with

We share personal information only:

with service providers that run parts of the Services for us under contracts that limit their use of it, such as hosting, payments and email. They are listed on our service providers page;
with services you choose to connect, such as an AI provider using your key or an app you sign in to with OkayLogin;
when the law requires it, or to protect the rights, safety and property of you, other people or us;
as part of a merger, acquisition or sale of all or part of our business, in which case this policy keeps applying to your information and we'll tell you first;
with your permission.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined in California law, and we haven't in the past 12 months. We honor Global Privacy Control signals as an opt-out anyway.

6. How long we keep it

Account details and Your Content: while your account is open. When you delete something or your account, we remove it from live systems within 30 days and from backups within 90 days.
Service and security logs: usually up to 30 days, longer only while investigating abuse.
Purchase and tax records: as long as tax and accounting law requires (generally 7 years).
Support emails: up to 2 years after the conversation ends.

7. Security

We use passkeys instead of passwords, encrypt data in transit (HTTPS/TLS) and at rest with our hosting provider, limit who can access data, and keep logs of sensitive actions. No system is perfectly secure; if a breach affects your information we'll tell you and the authorities as the law requires. To report a vulnerability, see our Security page.

8. Your rights and choices

Wherever you live, you can ask us to:

access the personal information we hold about you, and get a copy in a portable format;
correct information that's wrong;
delete your information or your account;
object to or restrict some uses, and withdraw consent where we rely on it;
opt out of marketing emails (use the unsubscribe link) and of any sale or targeted-advertising sharing (we don't do either).

Most of this you can do yourself in your account settings. Otherwise email okay@okaycompany.com (subject “Privacy request”). We'll reply within 30 days (45 days where California law applies), may need to confirm your identity first, and won't treat you differently for using your rights. You may use an authorized agent; we may ask for proof of their authority. If we turn down a request, you can appeal by replying to our answer with “Appeal” in the subject, and we'll respond within 45 days.

California residents. In the past 12 months we collected the categories described in section 2: identifiers (name, email, IP address), commercial information (purchases), internet activity (service logs), and the content you provide. We collected them from you, your devices and the services you connect, for the purposes in section 3, and disclosed them only to the recipients in section 5. We don't collect sensitive personal information to infer characteristics about you. You have the rights to know, delete, correct, opt out of sale and sharing, and limit use of sensitive information, and not to be discriminated against for using them.

Nevada residents. We don't sell covered information as defined in NRS 603A. You may still send an opt-out request to okay@okaycompany.com and we'll record it.

Other U.S. states. Residents of states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the rights above and may appeal a refusal as described.

European Economic Area, United Kingdom and Switzerland. Our legal bases are listed in section 3. You may also complain to your local data protection authority. When information moves to the United States, we rely on our providers' Standard Contractual Clauses (and the UK Addendum) or their certification under the EU–U.S. Data Privacy Framework.

9. Where information is processed

We are based in the United States. Our hosting provider runs a global network, so information may be processed in other countries where it or our other providers operate, with the safeguards above.

10. Children

The Services are not directed to children under 13 (or under 16 in the EEA and UK), and we don't knowingly collect their personal information. If you believe a child has given us information, email okay@okaycompany.com (subject “Privacy”) and we'll delete it.

11. Changes

We'll post any change here and update the date above. For material changes we'll also tell you by email or in the Services before they take effect.