Olis — Privacy Policy
1. Introduction
This Privacy Policy explains what personal information Olis collects about you, why we collect it, who we share it with, how long we keep it, and what rights you have over it.
It applies to the Olis mobile application and the services provided through it (the "Services").
This Policy forms part of the Olis Terms of Service, but it is a separate document because it does a different job: the Terms are the agreement between you and us, while this Policy is the notice we are required to give you about how we handle your personal information.
Please read it alongside the Terms of Service, available within the app and at https://oliscommunity.com/terms. Words defined in the Terms — including "Account", "User Content", "Friend", "Olis ID" and "Community Lists" — have the same meaning here.
2. Who We Are and How to Contact Us
The Services are operated by an individual sole proprietor established in the Hong Kong Special Administrative Region ("Olis", "we", "us" or "our"), who is the data controller responsible for your personal information.
You can contact us about anything in this Policy at operations@oliscommunity.com. Our full legal name and address are available on request to that address.
Where the law that applies to you requires us to appoint a data protection officer or a local representative, their details are available at that address.
3. Information We Collect
3.1 Information You Give Us
| What | When |
|---|---|
| Email address | When you register, and when you sign in or reset your password |
| Password | When you register or change it. We never see it — it is handled and stored by our authentication provider in hashed form |
| Display name | When you register, and whenever you change it |
| Profile photo | If you choose to upload one |
| Language preference | When you select a language, or from your device settings |
| Messages, reports and feedback | When you contact us through the app or by email |
3.2 Information Created by Your Use of the Services
| What | Description |
|---|---|
| Saved places | The places you save, and the lists they belong to |
| Ratings and tags | The scores and tags you record against places you have saved |
| Friend connections | Requests you send and receive, and the connections you accept |
| Blocked accounts | Accounts you have blocked, with the display name and photo held at the time of blocking |
| Activity records | Records that you saved or rated a place, used to build your Friends' feeds |
| Saved-list capacity | Counts of places saved and rated, used to calculate the capacity of your saved list |
| Email verification status | Whether you have confirmed your email address, and the date you did |
| Notification settings | Which in-app notices you have chosen to receive |
| Daily usage counts | The number of place searches and place lookups made by your Account each day |
3.3 Information Collected Automatically
We collect very little automatically. When you send us a report or feedback, we record the version of the app you are using and whether you are on iOS or Android, so that a problem can be diagnosed without having to write back to you.
Our service providers may also process technical information, such as an IP address, in the course of delivering the Services to your device. Section 7.2 identifies those providers.
3.4 Location Information
If you grant the location permission, the app asks your device for your position so that the map can show places near you and so that we can tell which country you are in.
We do not store your coordinates. They are held only in the app's memory while it is running. To convert your position into a country, the app sends your coordinates to a third-party geocoding service, BigDataCloud, which returns a country code — see Section 7.2.
The region recorded on your Account is taken from your device's language and region settings when you register. It is not derived from your location.
You can refuse or withdraw the location permission at any time in your device settings. If you do, the map will not centre on you, but you can continue to use the rest of the Services.
3.5 What We Do Not Collect
We think it is as important to say what we do not do.
- We do not use any analytics, tracking or crash-reporting service. There is no analytics software in the Olis app.
- We do not collect or use advertising identifiers, and we do not serve advertising.
- We do not track you across other apps or websites.
- We do not collect payment information. The Services are currently free of charge. If we ever introduce paid features, payment would be handled by the app store, not by us.
- We do not access your contacts, your camera roll beyond the single image you choose as a profile photo, your calendar, your microphone or your messages.
- We do not store a history of where you have physically been.
4. How We Use Your Information
| Purpose | Information used |
|---|---|
| Creating and running your Account | Email address, password, display name, Olis ID, region |
| Providing the core features — saving, rating and organising places | Saved places, ratings, tags |
| Showing your saved places and ratings to your Friends | Saved places, ratings, tags, display name, profile photo |
| Letting people find and add you | Olis ID, display name, profile photo |
| Calculating the capacity of your saved list | Counts of places saved and rated, email verification status |
| Building Community Lists and recommendations | Records that a place was saved, in de-identified and aggregated form |
| Showing the map and nearby places | Location, while the app is running |
| Contacting you about your Account | Email address |
| Managing your Friends and blocked accounts | Friend requests and connections, blocked accounts |
| Sending in-app notices | Account activity, notification settings |
| Investigating reports and enforcing our Terms | Reports, Account records, User Content |
| Controlling costs and preventing abuse | Daily usage counts |
| Keeping the Services secure | Account records, technical information |
| Meeting our legal obligations | Whatever the obligation requires |
4.1 De-identified and Aggregated Information
We count saving activity across all users to produce Community Lists and recommendation features. We do not retain any identifier for you with that information, and we keep no reversible mapping that would allow us to link it back to you or your Account. Your ratings and tags are not used for this purpose, or for any other aggregated feature of the Services. We do not attempt to re-identify aggregated information.
Section 9.3 explains how long this information is kept, and how the lists that record timing are bounded.
4.2 We Do Not Use Your Information for Advertising or AI Training
We do not sell, rent or license your personal information or your User Content. We do not use them to serve advertising. We do not use them to train generative artificial intelligence models, or any model made available outside the Services.
4.3 Automated Decision-Making
We do not make decisions about you by automated means that produce legal effects for you, or that significantly affect you in a similar way. Community Lists and recommendations are suggestions about places; they do not decide anything about you.
4.4 Marketing
We send marketing only with your agreement. You can withdraw that agreement at any time, and doing so does not affect your use of the Services or the service messages described in Section 14 of the Terms of Service.
5. Our Legal Basis for Using Your Information
Where the law of your country requires us to have a legal basis for processing your personal information, we rely on the following.
| Basis | When we rely on it |
|---|---|
| Performance of a contract | To create and operate your Account and provide the features you ask for. Without this information we cannot provide the Services |
| Your consent | For access to your device location and photo library, and for any optional marketing. You can withdraw consent at any time |
| Our legitimate interests | To keep the Services secure, prevent abuse, control third-party costs, and improve the Services — balanced against your rights and freedoms |
| Compliance with a legal obligation | Where we must retain or disclose information under applicable law |
For users in Hong Kong, we process personal information for the purposes described in this Policy, and rely on your consent or another applicable exemption under the Personal Data (Privacy) Ordinance where one is required.
5.1 Consent Where It Is Required Separately
In some countries, including the Republic of Korea, consent to the handling of personal information must be sought separately from agreement to other terms, and separately for each purpose.
Where that applies to you, we will ask for your consent separately and specifically, tell you what is required in order to use the Services and what is optional, and let you use the Services without giving consent to anything optional. The same applies to any separate consent required for a cross-border transfer, or for the handling of sensitive information.
Where the law that applies to you requires your separate consent before we transfer your personal information out of your country, we will ask for it before the transfer. Where we rely on an approved transfer mechanism instead, we will tell you which one.
6. Information Visible to Other Users
Some information is visible to other people using Olis. This is a feature of the Services rather than a disclosure by us, but you should understand it.
| Information | Who can see it |
|---|---|
| Display name and profile photo | Any signed-in Olis user who has your Olis ID |
| Your Olis ID, the region recorded when you registered, your account type, your saved-list capacity, and the date your Account was created | Any signed-in Olis user who has your Olis ID |
| Saved places, ratings and tags | Your Friends only |
| Your recent activity on Olis | Your Friends only |
| Email address | Nobody. It is never shown to other users |
Account type records which tier your Account is on. The Services are currently free for everyone, as Section 3.5 explains, so this is the same for every Account today; it exists so that paid features, if we ever introduce them, do not require a change to what is stored about you.
These fields are held in a separate profile document from the rest of your information, and that document holds nothing beyond what this table lists. Everything else we hold about you — your notification settings, your answers to the questions asked after signup, and your email verification status — is readable only by you.
There is no way to browse or search Olis users generally. Someone can find you only if they already have your Olis ID.
Nothing you record on Olis is published on the public internet, and none of it is accessible to anyone who is not signed in.
Section 7 of the Terms of Service explains this in more detail, including what a new Friend can see about what you recorded before you connected.
7. Who We Share Your Information With
7.1 We Do Not Sell Your Information
We do not sell your personal information, and we never have. We do not share it with data brokers, advertising networks or marketing companies.
7.2 Service Providers
We use the following third parties to operate the Services. They process information on our behalf, or provide a service the app depends on.
| Provider | What it does | What it receives |
|---|---|---|
| Google — Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions) | Stores your Account, your saved places and ratings, and your profile photo; runs our server-side functions | All Account data and User Content, and technical information such as an IP address |
| Google — Maps and Places | Supplies the map, address search, place details and photographs | Search terms you type, and the place you are looking at. Your use of these features is also subject to the Google Maps/Google Earth Additional Terms and the Google Privacy Policy |
| BigDataCloud | Converts your device location into a country code | Your coordinates, at the moment the app asks. We do not send anything identifying you |
| Expo | Delivers over-the-air updates to the app | Technical information about your device and the app version, when checking for updates |
We do not permit these providers to use your information for their own purposes, except where their own terms govern your direct use of their service — which is the case for Google Maps and Places.
7.3 Legal and Safety Disclosures
We may disclose your personal information where we reasonably believe it is necessary to:
- comply with a law, regulation, court order or a lawful request from a government authority;
- enforce our Terms of Service, or investigate a suspected breach of them;
- detect, prevent or address fraud, security problems or unlawful activity; or
- protect the rights, property or safety of Olis, our users, or any other person, including where there is a risk of serious harm.
Where we are permitted to tell you about such a request, we will.
7.4 Business Transfers
If the Services are transferred to another person or organisation, your information may be transferred as part of that. We will tell you before that happens where we are permitted to do so, and otherwise as soon as practicable afterwards, and the recipient will remain bound by this Policy until you are given notice of any change to it.
8. Where Your Information Is Stored and Transferred
The Services are operated from the Hong Kong Special Administrative Region.
Your Account, your saved places, your ratings and tags, and your profile photo are stored on Google's infrastructure in Hong Kong (Google Cloud region asia-east2). They are not stored in the United States.
Some processing happens elsewhere:
| What | Where |
|---|---|
| Your Account data, saved places, ratings and tags | Hong Kong |
| Your profile photo | Hong Kong |
| Server-side processing of your saves and your saved-list capacity | Hong Kong |
| The nightly job that builds Community Lists | United States |
| Account authentication, and the technical information involved in delivering the Services to your device | Google's global infrastructure, which may include servers outside Hong Kong |
| Converting your location into a country code (Section 3.4) | BigDataCloud's servers, which may be outside Hong Kong |
| Delivering app updates | Expo's servers, in the United States |
| Map, search and place information | Google's global infrastructure |
About the nightly job. It reads the records of which Accounts saved which places, so it does receive your Account identifier, together with the place and the time you saved it. It uses them only to count how many different Accounts saved each place, and the information it publishes carries no Account identifier. The records it reads are stored in Hong Kong; the counting happens in the United States.
This means some of your personal information may be transferred to, and processed in, countries whose data protection laws differ from those of the country where you live.
Where we make such a transfer, we take steps to ensure your information remains protected to a standard comparable to that required in the country where you live, including by relying on the contractual data protection commitments given by the providers listed in Section 7.2.
9. How Long We Keep Your Information
| Information | How long we keep it |
|---|---|
| Account data, saved places, ratings and tags | For as long as your Account is open |
| Account data after you delete your Account | 90 days, then permanently erased. See Section 18 of the Terms |
| Profile photo after you delete your Account | Deleted immediately, not retained for the 90 days |
| Friend connections, activity and feed records after deletion | Deleted immediately |
| Your Olis ID reservation after deletion | 365 days, so that nobody else can take your handle, then released. The reservation holds only the handle itself and the identifier of the Account it belonged to — no other Account data |
| Account data after we suspend or close your Account | 90 days, then permanently erased |
| In-app notices | 7 days from when they are sent |
| Daily usage counts | For as long as your Account is open, then erased with the rest of your Account data at the end of the 90 days |
| Reports, feedback and correspondence with us | Kept separately from your Account, for as long as necessary for the purposes in Section 9.1, then deleted |
| De-identified and aggregated information | Kept for as long as the discovery features need it — see Section 9.3. It carries nothing that identifies you |
9.1 Reports and Correspondence
Reports and feedback you send us are kept separately from your Account, and are not deleted when you delete your Account. They record the message you sent, your email address, your Account identifier, and the app version and platform you were using.
We keep them because they are the record of what was raised with us and what we did about it, which we may need in order to deal with a repeated problem, to respond to a complaint, or to defend a legal claim.
We keep them for as long as is necessary for those purposes, and then delete them. If a legal claim, investigation or regulatory request requires us to keep them for longer, Section 9.2 applies.
Where a copy of a report reaches a support mailbox, that copy is subject to the same retention rule and is deleted when it is no longer needed.
If you want a report you have sent us deleted, write to operations@oliscommunity.com and we will delete it unless we need to keep it for one of the reasons above.
9.2 Holding Information for a Legal Claim
Where we are aware of an actual or threatened legal claim, investigation or regulatory request to which your information is relevant, we may keep that information for as long as is necessary to deal with the matter, even after the periods above have passed. We keep only what is relevant, and we delete it once the matter is resolved.
9.3 De-identified and Aggregated Information
We do not retain any identifier for you with this information, and we keep no reversible mapping that would allow us to link it back to you or your Account.
The lists of recently saved places shown on the Explore screen are the only part of this information that records when something happened. Each country's list holds no more than 30 entries, and entries more than three days old are not shown and are discarded the next time the list is written. Older entries are overwritten as new saves arrive rather than being archived.
The remaining aggregated information consists of counts — how many users have saved or looked up a place, and how often a place has appeared in a Community List. These carry no identifier and no record of when any individual acted, and they are not deleted.
10. How We Protect Your Information
We take reasonable steps to protect your personal information, including:
- encryption in transit — all communication between the app and our services uses HTTPS;
- encryption at rest — information stored by our infrastructure provider is encrypted on their servers;
- access rules enforced by the server, not by the app, so that one Account cannot read another Account's saved places, ratings or private data, whatever software it is using;
- passwords we never see — authentication is handled by our provider, and passwords are stored in hashed form; and
- limits on what can be read at once, so that the list of users cannot be downloaded in bulk.
No system is completely secure. We cannot guarantee the security of information transmitted over the internet, and you are responsible for keeping your password confidential and for any activity on your Account. If you believe your Account has been accessed by someone else, tell us immediately at operations@oliscommunity.com.
10.1 If Something Goes Wrong
If we become aware of a breach of security affecting your personal information, we will notify you and the relevant authorities where applicable law requires it, and without undue delay. We will tell you what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.
11. Your Rights
Depending on where you live, you have some or all of the following rights over your personal information.
| Right | What it means | How to use it |
|---|---|---|
| Access | Ask what personal information we hold about you, and receive a copy of it in a commonly used format | Email us |
| Correction | Correct information that is wrong or out of date | Change it in the app, or email us |
| Deletion | Ask us to delete your personal information | Delete your Account in the app, or email us |
| Restriction | Ask us to stop using your information for a period, for example while a complaint is investigated | Email us |
| Objection | Object to our using your information where we rely on legitimate interests | Email us |
| Withdraw consent | Withdraw a consent you have given, such as location or photo access | Device settings, app settings, or email us |
| Complain | Complain to your data protection authority | See Section 14 |
Most of these you can exercise yourself in the app: you can change your display name, photo and language at any time, delete individual saved places and ratings, block other users, and delete your whole Account.
For anything else, write to operations@oliscommunity.com. We will respond within the time your local law requires. Where Hong Kong law applies, we will respond to a request for access to your personal information within 40 days, and will aim to respond within 30 days where practicable. We may need to verify your identity before acting, which usually means replying from the email address registered to your Account.
Using these rights is free, and we will not treat you differently for exercising them.
11.1 Limits on These Rights
We may not be able to act on a request where doing so would:
- reveal another person's personal information;
- prevent us from investigating a breach of our Terms, or defending a legal claim;
- conflict with a legal obligation to keep the information; or
- affect information that has already been de-identified and can no longer be linked to you.
If we cannot act on your request, we will tell you why, and you may complain to your data protection authority as described in Section 14.
We do not offer a self-service export feature, and we do not transfer your information directly to another service. Where you have the right to a copy of your personal information, we will prepare it and send it to you.
12. Children
The Services are not intended for anyone under 16, or under any higher minimum age that applies where you live, and we do not knowingly collect personal information from anyone under that age. Section 3 of the Terms of Service sets out the full age requirement.
If we become aware, or have reasonable grounds to believe, that an Account belongs to someone below the applicable minimum age, we will close it and delete the information associated with it.
If you are a parent or legal guardian and believe a child in your care has created an Account, write to us at operations@oliscommunity.com and we will close it.
13. Changes to This Policy
We may update this Policy. The version in force is always available in the app, and the date it took effect is shown at the top.
Where a change materially affects how we handle your personal information, we will tell you at least 14 days before it takes effect, by notice within the app or by email to the address registered to your Account. Other changes, such as corrections and clarifications, take effect when we publish them.
Where the law requires your consent to a change, we will ask for it rather than simply notifying you.
14. Contact and Complaints
Write to us first at operations@oliscommunity.com. We would rather fix a problem directly, and we will respond to a complaint within 30 days. For requests to access your personal information, see Section 11.
If you are not satisfied with our response, you may complain to the data protection authority in the country where you live. In our principal markets these are:
| Country | Authority |
|---|---|
| Hong Kong SAR | Office of the Privacy Commissioner for Personal Data (PCPD) |
| Singapore | Personal Data Protection Commission (PDPC) |
| Japan | Personal Information Protection Commission (PPC) |
| Republic of Korea | Personal Information Protection Commission (PIPC) |
You may complain to your authority whether or not you have contacted us first.
15. Language
This Policy may be made available in languages other than English. Any translation is provided for convenience only and may not be an exact rendering of the English text. In the event of any conflict or inconsistency between versions, the English version prevails, except where the law of the country where you live requires otherwise.