ABOVE PRIVACY POLICY
Effective Date: 7 October 2026
Last Updated: 7 October 2026
Operator: New Version Limited
Location: New Zealand
Contact: above.support@newversion.studio
1.0 INTRODUCTION AND SCOPE
1.1 Above is made by New Version Limited, a company based in New Zealand ("we," "us," or "our"). This Privacy Policy explains how we collect, use, store and protect your personal information when you use Above.
1.2 This policy covers:
(a) The Above app for iPhone and iPad
(b) The Above app for Android
(c) The Sky Check web page your friends open
(d) Our website at https://sites.google.com/view/above-app/home
1.3 We decide how your personal information is used in Above, so we are the "controller" (or "agency" under New Zealand law).
1.4 Our privacy contact is the New Version Limited privacy team at above.support@newversion.studio. Email is the best way to reach us about anything in this policy.
1.5 This Privacy Policy should be read together with our Terms of Use at https://sites.google.com/view/above-app/terms-of-use.
2.0 THE SHORT VERSION
2.1 Most of what you do in Above stays on your phone. Your Sky Path progress, Sky Journal, moods, reflections, techniques and plans are stored on your device, not on our servers. If you have an account, we also keep your onboarding answers and chosen journeys with it, so logging in on a new phone brings your plan back.
2.2 You can use Above without an account. An account is only needed for chatting with Olie, the community and Sky Check.
2.3 Olie is an AI. If you agree, what you write to Olie, and some other text you type, is sent to an AI model made by OpenAI, through our provider OpenRouter, to write replies and to check for signs that you might need urgent help. We ask before this happens, and you can say no.
2.4 We do not sell your data. We do not show ads, we do not track you across other apps or websites, and we do not use your data for advertising.
2.5 You are in control. You can export your data, delete a chat and delete your account from inside the app.
3.0 INFORMATION WE COLLECT AND WHY
3.1 Some of your information never leaves your phone. Some is stored on our servers so that features work. Some is handled by service providers ("processors") who work for us. This section explains what each kind of information is, where it is kept and why.
3.2 INFORMATION KEPT ON YOUR DEVICE ONLY
(a) Sky Path progress, Sunbeams, streaks, badges and Olie's Nest. We use them to run the app.
(b) Sky Journal moods, tags and notes, moments, signs and reflections, saved and custom techniques, what helped you feel better, and reminders. We use them to run the app. Text you type may be sent for a safety check (see Section 5.0).
3.3 INFORMATION KEPT ON YOUR DEVICE AND, WITH AN ACCOUNT, ON OUR SERVERS
(a) Onboarding answers (what brings you here, quiz answers, your Weather Map) and the journeys you chose. If you have an account, they are also kept on our servers (Supabase), linked to your account. We use them to personalise your plan and to bring it back when you log in on a new or cleared phone.
(b) Your first name. We use it to greet you and so Olie can use your name.
(c) Your age group (for example "13 to 17"). We use it to apply teen protections and age rules.
3.4 ACCOUNT INFORMATION (OUR SERVERS)
(a) Your email address and password, if you sign up with email, are kept on our servers (Supabase). We use them to create and secure your account. Your password is stored in a scrambled form that we cannot read.
(b) Your Apple or Google sign-in identifier is kept on our servers (Supabase). We use it to let you sign in.
3.5 FEATURE DATA (OUR SERVERS)
(a) Olie chats, chat titles and insights, and your mood after a chat are kept on our servers, and are sent to our AI provider when Olie replies. We use them to provide the chat and let you look back on it.
(b) Safety events record that a safety check found a risk, and where and when. They never contain your words. They are kept on our servers to keep the service safe and to improve our safety checks.
(c) Community posts, hearts, reports and blocks are kept on our servers. Posts are visible to other adult members. We use them to run the community.
(d) Your Sky Check link and your friends' anonymous answers are kept on our servers. We use them to show you how friends see you.
3.6 SUBSCRIPTION INFORMATION
(a) Subscription status and purchase history are kept by Apple or Google (whichever store you bought from) and on our servers. We use them to give you Above Plus.
3.7 TECHNICAL INFORMATION
(a) Crash reports and performance data go to Sentry, our crash reporting provider, and are not linked to your account. We use them to find and fix bugs.
(b) Security signals (your IP address and browser signals) go to Cloudflare Turnstile when you sign up, log in or reset a password. On our servers, a scrambled daily code made from your IP address is used for rate limits. We use them to stop automated sign-ups and abuse.
3.8 SUPPORT EMAILS
(a) Emails you send us are kept in our email inbox. We use them to answer you.
(b) When you use Contact us in the app, your email app opens with a draft that already includes your app version, your phone's operating system and version, your plan (Free or Plus), whether you are signed in, your language and the time. You can read or delete these details before you send. We use them to look into your message.
3.9 INFORMATION WE DO NOT COLLECT
(a) Your contacts
(b) Your photos
(c) Your precise location
(d) Your advertising identifier
4.0 OLIE AND AI
4.1 WHAT OLIE IS
(a) Olie, the owlet in Above, is an AI companion. Olie is not a person, a therapist or a doctor.
(b) Olie can listen and suggest ideas, but cannot give medical advice and does not replace professional support.
4.2 WHO PROVIDES THE AI
(a) Olie's chat replies are written by an AI model made by OpenAI. The model we use is called gpt-6-luna.
(b) We reach it through OpenRouter (https://openrouter.ai), a service that routes requests to the model. OpenRouter routes to OpenAI first and to Microsoft Azure as a fallback.
(c) Both OpenRouter and OpenAI act as our processors. We ask OpenRouter to route only to providers that do not train on this data.
4.3 WE ASK FIRST
(a) Above asks for your consent once at the end of onboarding, and again when you open Olie chat if you have not agreed yet.
(b) The consent screen says which provider is used and explains what is sent.
(c) Until you agree, chat stays closed and safety checks run on your device only.
(d) You can change your mind at any time in Settings, then Privacy and AI, then AI features.
4.4 WHAT WE SEND WHEN YOU CHAT
(a) Your message
(b) The recent conversation (up to the last 20 turns)
(c) Your first name, and whether you are a teen (not your exact age)
(d) Instructions we write for Olie
(e) Only if you turn on "Share my details with Olie" (see 4.5A): your journey in Above, up to three things you said you would like to work on, which one you want to start with, and where you would most like to feel calmer
4.5 We never send your email address or any account identifier. To check a chat message for risk, the message and up to three of your earlier messages are also sent to an AI model. When you finish a chat, the conversation is sent to create a short title and up to three insights.
4.5A SHARING YOUR DETAILS WITH OLIE
(a) "Share my details with Olie" is a separate choice from AI features. It is off unless you turn it on, and it needs AI features to be on.
(b) While it is on, the details in 4.4(e) go with each message you send Olie, so Olie can suggest things that fit you. They come from your answers when you started, which you can see and change in Settings, then About you.
(c) They are used only to write that reply and are not stored with your chat.
(d) We never share your journal, mood notes, quiz results, your exact age, or the hard moments you told us about when you started.
(e) You can see whether it is on, and turn it off, from the "My details" button in Olie's chat and panel, or in Settings, then Privacy and AI. Turning off AI features turns it off too.
4.6 WHAT HAPPENS TO IT
(a) Your chats are stored on our servers so you can come back to them.
(b) OpenRouter and OpenAI process the data to return a reply.
(c) OpenAI does not train its models on data sent through its API. It may keep that data for up to 30 days to monitor for abuse.
(d) We do not require zero data retention, because the providers that offer it filter out exactly the kind of difficult conversations Olie is there for.
(e) Nothing you share is sold or used for advertising.
4.7 OLIE MAKES MISTAKES
(a) AI can be wrong, can misunderstand you and can sound more certain than it should be.
(b) Olie only knows your first name, the recent history of the chat and, if you chose to share them, the details in 4.5A.
(c) If something Olie said felt wrong or unsafe, please tell us at above.support@newversion.studio.
5.0 SAFETY CHECKS
5.1 Because some people use Above in hard moments, we check text you type for signs that you might be in danger. This works in three steps.
5.2 ON YOUR DEVICE
(a) Every piece of free text is first checked on your phone against a list of crisis phrases. This never leaves your device.
5.3 WITH AI, IF YOU AGREED
(a) If AI features are on, journal notes, reflections, SOS notes, community drafts and feedback may also be sent to our servers and checked by an AI model. We do not store the text.
(b) If you are signed in and a risk is found, we store a safety event (the kind of check, the level and the time), never your words.
5.4 ALWAYS CHECKED ON OUR SERVERS
(a) Olie chats are always checked on our servers before Olie replies.
(b) Community posts are always checked by AI moderation before other members see them, whether or not you have turned on AI features.
5.5 WHAT HAPPENS IF A RISK IS FOUND
(a) Above shows you crisis support options and Olie stops coaching.
(b) Above does not contact anyone on your behalf.
(c) Safety checks can miss things, and can flag something that is not a crisis.
5.6 If you are in crisis, contact your local emergency number or a local helpline. findahelpline.com lists them.
6.0 HEALTH INFORMATION AND YOUR CONSENT
6.1 Information about your mood, stress, anxiety and wellbeing is health information. Several laws, including the EU and UK GDPR (Article 9), treat it as a special category that needs extra care.
6.2 Most of this information stays on your device and we never see it.
6.3 Where it reaches our servers or our AI provider (Olie chats, safety checks, community posts), we rely on your explicit consent. You give it on the AI consent screen, and when you choose to post in the community after accepting its guidelines (GDPR Article 9(2)(a)).
6.4 You can withdraw consent at any time. Turn off Settings, then Plan and account, then AI features, delete chats or posts, or delete your account. Withdrawing does not affect processing that already happened.
7.0 USING ABOVE WITHOUT AN ACCOUNT
7.1 You can skip creating an account. Without one, everything you do stays on your device.
7.2 Chatting with Olie, the community and Sky Check are not available without an account.
7.3 If you agree to AI safety checks, text you type can still be checked by our AI provider without being linked to you (see Section 5.0).
7.4 Usage analytics, if you turn them on, are linked to a random identifier for your app install, not to you.
7.5 If you later create an account, the data on your device becomes linked to your account on that device.
8.0 LEGAL BASES (EU, UK AND SIMILAR LAWS)
8.1 If your local law asks us to name a legal basis, these are ours:
(a) Contract (Article 6(1)(b)): to create and run your account, and to provide chat, community and Sky Check.
(b) Explicit consent (Article 6(1)(a) and Article 9(2)(a)): to process health information on our servers or with our AI provider.
(c) Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)): to sell and manage Above Plus, and to keep the records we must keep by law.
(d) Legitimate interest (Article 6(1)(f)): for crash reports, in a working, secure app.
(e) Legitimate interest (Article 6(1)(f)), and explicit consent where health information is involved: for bot checks, rate limits, moderation and safety events, to keep Above and its users safe.
(f) Legitimate interest (Article 6(1)(f)): for Sky Check answers from your friends, to provide the feature you asked for. Answers are anonymous.
(g) Contract or legitimate interest: to answer your emails.
9.0 WHO WE SHARE INFORMATION WITH
9.1 We share information only with the providers below, who process it for us under their terms, and as the law requires. We never sell it.
9.2 SERVICE PROVIDERS
(a) Supabase Inc. provides accounts, our database and our server functions. Our project is hosted in the United States (Ohio).
(b) OpenRouter and OpenAI provide the AI replies for Olie, the safety checks and community moderation, as described in Section 4.0. Microsoft Azure may be used as a fallback. These are United States companies.
(c) Functional Software Inc. (Sentry) provides crash and performance reports.
(d) Cloudflare Inc. provides bot protection (Turnstile) on sign-up, log-in and password reset.
(e) Apple Inc. provides Sign in with Apple, App Store payments and, on iPhone, speech recognition when you use the microphone in chat.
(f) Google LLC provides Continue with Google, Google Play payments and, on Android, speech recognition when you use the microphone in chat. Google also hosts this website (Google Sites) and supplies the fonts on the Sky Check page.
(g) A web host serves the Sky Check page. Like any web host, it sees the IP address and browser details of each visitor.
9.3 Apple and Google act under their own privacy policies when you use their sign-in, payments or speech features. When you buy Above Plus, we verify the purchase with Apple or Google on our servers.
9.4 OTHER PEOPLE
(a) Other members of the community see what you post and your first name.
(b) People you send your Sky Check link to see your first name and the questions.
9.5 LEGAL REASONS
(a) We may disclose information if the law requires it, to protect someone's life or safety, or to protect our rights.
(b) If New Version Limited is sold or merged, your information may pass to the new owner under this policy, and we will tell you first.
10.0 INTERNATIONAL TRANSFERS
10.1 We are based in New Zealand, and several of our providers are in the United States or other countries. When your information goes overseas, we make sure it is protected.
10.2 NEW ZEALAND
(a) We only send it to providers bound to protect it in ways comparable to the Privacy Act 2020 (Information Privacy Principle 12), through our contracts with them or their terms.
10.3 EU, EEA AND UK
(a) New Zealand has an EU adequacy decision.
(b) For providers in countries without one, we rely on the safeguards the law recognises, such as the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data), or the EU-US Data Privacy Framework where the provider is certified.
10.4 AUSTRALIA
(a) We take reasonable steps so overseas recipients handle your information in line with the Australian Privacy Principles.
11.0 HOW LONG WE KEEP INFORMATION
11.1 ON YOUR DEVICE
(a) Data on your device stays until you choose "Also clear this phone" when logging out, delete your account, or delete the app. A plain log-out keeps it on your phone.
11.2 ON OUR SERVERS
(a) Your account and profile: until you delete your account.
(b) Olie chats: until you delete the chat, or 24 months after each message, whichever comes first.
(c) Safety events: 24 months.
(d) Sky Check links: they stop working after 90 days and are deleted with your account.
(e) The scrambled IP codes used for rate limits: about 2 days.
(f) Daily usage counts (chat limits): 30 days.
(g) Server backups: overwritten on a regular cycle shortly after deletion.
(h) Subscription records: until you delete your account. Apple and Google keep their own billing records, and we keep what tax law requires.
(i) Support emails: up to 24 months after the conversation ends.
11.3 WITH OUR PROVIDERS
(a) Data held by our AI provider is kept by OpenAI for up to 30 days to monitor for abuse, as described in Section 4.0.
(b) Crash reports (Sentry) are kept for a limited time and are not linked to your account.
12.0 YOUR RIGHTS AND CHOICES
12.1 WHEREVER YOU LIVE, YOU CAN:
(a) Get a copy of your data. In Settings, then Privacy and AI, then Export my data, you can create a file with everything Above holds about you, on your phone and (if you are signed in) on our servers. You can also email us.
(b) Correct your data. Change your name in Settings, then Plan and account, then Manage account, or email us.
(c) Delete your data. You can delete a chat, delete a community post, or delete your whole account in Settings, then Danger zone, then Delete account. Instructions are also at https://sites.google.com/view/above-app/delete-account.
(d) Withdraw consent for AI features at any time in Settings, then Plan and account, then AI features.
12.2 Email above.support@newversion.studio for anything you cannot do in the app. We may need to confirm it is you before acting. We reply within 20 working days (New Zealand) or one month (EU and UK), and sooner where we can. There is no charge.
12.3 NEW ZEALAND
(a) Under the Privacy Act 2020 you can ask to access your personal information (IPP 6) and ask us to correct it (IPP 7).
(b) If you are not happy with how we handle your request or your information, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
12.4 EUROPEAN UNION, EEA AND UNITED KINGDOM
(a) Under the GDPR and UK GDPR you also have the right to restrict or object to processing, to data portability, and not to be subject to solely automated decisions with legal or similarly significant effects.
(b) Our safety checks and community moderation use automated tools. They do not have legal effects, but you can ask a person at above.support@newversion.studio to review a moderation decision.
(c) You can complain to your local data protection authority (in the UK, the Information Commissioner's Office).
12.5 CALIFORNIA AND OTHER US STATES
Under the California Consumer Privacy Act, as amended by the CPRA, we tell you the following:
(a) Categories we collect: identifiers (email, user id), customer records (name), commercial information (purchases), internet or other electronic activity (usage events, if you turn them on), general (not precise) location from your IP address, inferences (chat titles and insights), and sensitive personal information (health information you share, account log-in).
(b) Sources: you, your device, Apple and Google sign-in, and Apple and Google for purchases.
(c) Purposes: described in Section 3.0.
(d) We do not sell or share your personal information (including for cross-context behavioural advertising), and we have not done so in the past 12 months.
(e) Sensitive personal information is used only to provide the service you asked for and to keep it safe, as allowed by the CPRA regulations. We do not use it to infer characteristics about you.
(f) Your rights are to know, access, delete and correct your information, and to not be discriminated against for using these rights. You can use them in the app or by emailing above.support@newversion.studio. An authorised agent can ask for you with your signed permission.
(g) Retention: described in Section 11.0.
12.6 AUSTRALIA
(a) We handle personal information in line with the Australian Privacy Principles.
(b) You can ask for access or correction, and complain to us first. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
13.0 USAGE ANALYTICS
13.1 Above does not collect usage analytics from the app. No events about which features you use, screen views, or location data reach us. Crash reports and performance data still go to Sentry, as described in Section 3.7, so we can find and fix problems.
14.0 CHILDREN AND TEENS
14.1 Above is for people 13 and older. Where local law sets a higher age for agreeing to online services on your own (for example 14, 15 or 16 in some countries, and 18 in countries where everyone under 18 needs a parent's consent), that higher age applies, up to 18. Our Terms of Use give the details at https://sites.google.com/view/above-app/terms-of-use.
14.2 If you enter an age below the minimum, Above does not let you continue and shows you where to get help.
14.3 TEEN PROTECTIONS (13 TO 17)
(a) The community is closed to teens.
(b) Olie is told to keep language age-appropriate and to encourage talking to a trusted adult.
(c) Until our servers know your age group, we treat your account as a teen's, so the community stays closed and Olie uses the teen instructions.
(d) If your account has no age group yet, Above asks for it before you enter the community.
14.4 If you believe a child under the minimum age has given us personal information, email above.support@newversion.studio and we will delete it.
15.0 SECURITY
15.1 TECHNICAL MEASURES
(a) Data travels between the app and our servers over encrypted connections (TLS).
(b) Our database uses row-level security, so each account can only reach its own data.
(c) Server keys are never in the app.
(d) Access to our servers and provider dashboards is limited to the people at New Version Limited who need it.
15.2 DATA ON YOUR DEVICE
(a) Data on your device is protected by your phone's standard file protection.
(b) Above does not add its own encryption on top, so anyone who can unlock your phone can open the app.
(c) Your on-device data may be included in your phone's backups.
15.3 No system is perfectly secure, but we work to protect your information and fix problems quickly.
15.4 IF SOMETHING GOES WRONG
(a) If a privacy breach is likely to cause serious harm, we will tell the Office of the Privacy Commissioner and affected people as soon as practicable, as the New Zealand Privacy Act 2020 requires.
(b) Where the GDPR or UK GDPR applies, we will notify the relevant authority within 72 hours where required, and affected people without undue delay.
(c) We will follow other local notification laws where they apply.
16.0 CHANGES TO THIS PRIVACY POLICY
16.1 If we make an important change, we will tell you in the app before it takes effect, and update the effective date above.
16.2 If a change needs your consent, we will ask for it.
17.0 CONTACT INFORMATION
17.1 PRIVACY QUESTIONS
Privacy team: above.support@newversion.studio
Support page: https://sites.google.com/view/above-app/support
17.2 BUSINESS INFORMATION
Operator: New Version Limited
Location: New Zealand
App: Above (iPhone, iPad and Android)
17.3 If you are in crisis, please do not wait for an email reply. Contact your local emergency number or a local helpline. findahelpline.com lists them.
END OF PRIVACY POLICY
New Version Limited
6 October 2026