Skip to main content
    Back to Home

    Privacy Policy

    Last updated: July 26, 2026

    This Privacy Policy explains how Ally by Waiter AI, Inc. ("Ally," "WA.I.TER," "we," "us," or "our") collects, uses, discloses, retains, and protects information when you use the Ally mobile application, website, and related water-care services (collectively, the "Service").

    Ally helps people manage aquariums, pools, spas, ponds, and related aquatic spaces through recordkeeping, water testing, reminders, weather-aware features, notifications, AI-assisted analysis, and support tools.

    Information We Collect

    Account and Contact Information

    • Account identifiers: Name, email address, user ID, authentication status, Sign in with Apple information, language preference, subscription tier, and related account settings.
    • Support and contact records: Contact form submissions, support tickets, support messages, inbound and outbound support email metadata/content, and related records needed to respond to your requests.
    • Referral records: Referral codes, partner referral codes, referral status, reward records, payout eligibility records, and referral landing-page scan metadata such as device type, browser, source URL, and hashed IP address.
    • Partner, beta, and waitlist records: If you apply for a partner, affiliate, beta, waitlist, or similar program, we may collect application details such as name, email address, company, website, social channels, audience information, payout preferences, status, and related metadata.

    Water-Care Content

    • Water body records: Aquariums, pools, spas, ponds, equipment, livestock, plants, maintenance tasks, reminders, preferences, and related notes you add.
    • Water test data: Test dates, parameter values, trends, corrections, health scores, recommendations, and alerts.
    • Photos and media: Images you upload or capture for water tests, aquariums, livestock, plants, chat, profile use, or AI-assisted analysis.
    • AI conversations: Chat messages, attached photos, selected water body context, generated responses, background generation jobs, and AI memory records for premium personalization.

    Audio and Voice Features

    • Voice input: If you use voice features, Ally may process audio recordings, audio format, audio size, and generated transcripts to turn speech into text.
    • Spoken responses: If you use text-to-speech features, Ally may process the text to be spoken, selected voice settings, and generated audio responses.

    Location, Weather, and Notifications

    • Location data: When you enable weather or location-based features, Ally may collect your device location to look up weather, severe weather alerts, rain alerts, and location names. Ally may save location names or coordinates with your profile or water body settings, and reduces stored coordinate precision for long-term application storage where possible.
    • Weather data: Location names, weather forecasts, alert coverage, air quality, radar information, and weather-related notification preferences.
    • Push notification data: APNs device tokens or browser push subscription endpoints, push key material, notification preferences, quiet hours, device time zone, platform, user agent, and delivery logs.

    Payments, Diagnostics, and Usage

    • Subscription data: Product identifiers, entitlement status, subscription-provider user IDs, transaction/webhook metadata, purchase and restore events, and subscription tier changes. App stores and subscription management providers process subscriptions; Ally does not receive full payment card numbers.
    • Diagnostics: Crash data, error reports, performance and reliability events, request IDs, feature area, app release, operating system/browser details, and non-sensitive breadcrumbs used to troubleshoot the Service.
    • Security and activity logs: Login history, activity logs, IP addresses, rate-limit signals, audit records, and abuse-prevention events.
    • Analytics and conversion events: App reliability events, usage diagnostics, and signup/login conversion events may be collected when analytics or conversion tools are enabled. We do not display third-party ads in Ally.

    Local and Device Storage

    • Device and browser storage: Ally may store authentication sessions, preferences, weather caches, radar display choices, location opt-out state, offline data, cookie or local-storage preferences, and compact widget or watch summaries on your device or browser.
    • iOS storage: On iOS, authentication and app data may be stored using system-provided storage such as Keychain and App Group UserDefaults.

    Sources of Information

    • You: Information you enter, upload, record, send, save, or choose to share with Ally.
    • Your device and browser: Permissions, device identifiers needed for notifications, local storage, app version, browser or operating system details, diagnostics, location when enabled, and similar technical information.
    • Service providers: Subscription, authentication, diagnostics, email, support, weather, geocoding, AI, speech, and infrastructure information returned by providers that help operate requested features.
    • Other users or public sources: Referral information, partner or affiliate application context, and public weather, map, or geocoding data where relevant to the Service.

    How We Use Information

    • Provide, maintain, secure, and improve the Service.
    • Create and manage accounts, authentication, subscriptions, referrals, support requests, and in-app settings.
    • Save and sync your water bodies, water tests, photos, maintenance tasks, notification preferences, and chat history.
    • Generate AI-powered recommendations, photo analysis, summaries, reminders, alerts, and personalized water-care guidance.
    • Transcribe voice input and generate spoken audio output when you use voice features.
    • Provide weather forecasts, air quality, radar, severe weather alerts, location names, and weather-aware notifications.
    • Send account, support, transactional, subscription, weather, maintenance, chat, and push notifications you request or enable.
    • Process purchases, restore subscription status, prevent subscription abuse, reconcile provider events, and manage paid features.
    • Measure reliability, diagnose crashes, prevent fraud or abuse, enforce limits, protect accounts, and maintain legal and operational records.

    AI Processing

    Ally uses AI and speech providers to analyze photos, understand your water-care context, generate recommendations, transcribe audio, and generate spoken responses. Depending on the feature, this may include chat messages, uploaded photos, water test values, water body records, display name, recent conversation context, audio submitted for transcription, and text submitted for speech generation. AI recommendations are informational only and are not a substitute for professional aquarium, pool, spa, pond, veterinary, structural, chemical, or safety advice.

    Ally does not use AI outputs to make decisions that produce legal or similarly significant effects about you. You are responsible for deciding whether to act on AI-generated suggestions, especially when chemicals, livestock health, electrical equipment, weather, or safety are involved.

    Third-Party Services

    We share information with service providers that help us operate Ally. These providers process data for us or for the feature you request.

    • Cloud infrastructure and authentication: Hosting, database, file storage, authentication, edge functions, and account security providers.
    • AI, transcription, and speech: Photo analysis, chat responses, recommendations, safety checks, audio transcription, and text-to-speech processing providers.
    • Weather, geocoding, radar, and maps: Weather forecasts, severe weather alerts, air quality, radar frames, reverse geocoding, location names, and map-related services.
    • Payments: App store purchase processing and subscription entitlement management providers.
    • Error monitoring: Crash reporting, error monitoring, and performance/reliability diagnostics providers, with PII scrubbing where configured.
    • Email and support: Transactional email, contact form handling, support ticketing, and inbound support email processing providers.
    • Analytics and conversion measurement: Limited signup, login, product, reliability, and marketing-performance events when analytics or conversion measurement tools are configured.

    How We Disclose Information

    • Service providers: We disclose information to providers that host, process, secure, monitor, analyze, communicate, or support the Service.
    • App stores and subscription platforms: Subscription information may be exchanged with app stores and subscription management providers to provide paid features, restore purchases, process refunds or disputes, and prevent fraud.
    • Legal, safety, and security purposes: We may disclose information when required by law, legal process, security investigations, fraud prevention, abuse prevention, or to protect the rights, property, or safety of Ally, users, or others.
    • Business transfers: If Ally is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to appropriate protections.
    • With your direction or consent: We may disclose information when you ask us to, consent to it, or use a feature that requires disclosure to operate.

    ChatGPT App and Connected Services

    Ally offers an optional ChatGPT app that lets you connect your Ally account to ChatGPT. Linking is voluntary and begins only after you sign in to Ally and approve access through the Ally authorization screen. If you never connect, none of the information described in this section is shared with ChatGPT or OpenAI through this integration.

    When you approve the connection, standard OAuth identity information may be involved, including your Ally user ID, email address, and basic profile information. After you approve, ChatGPT can call the currently available Ally tools on your behalf without a new Ally prompt for each request. These tools are authenticated, scoped to your Ally account, and read-only.

    When ChatGPT makes an authorized request, the connection can return information from your Ally account in these categories:

    • Aquatic-space details, such as the name, type, size, and status of a water body you track.
    • Water-test information and trends, including recorded parameter values and how they have changed over a period you ask about.
    • Care status, including alerts and recommendations Ally has generated for a water body.
    • Maintenance tasks, including upcoming and overdue items.

    This connection does not send:

    • Photos or other uploaded media.
    • Livestock or plant records.
    • Equipment records.
    • Payment or subscription card information.
    • Passwords, access tokens, refresh tokens, or authorization codes.
    • Your ChatGPT conversation history.
    • Precise device coordinates.

    The connection is read-only. It cannot create, edit, or delete Ally records, and it cannot control equipment. Any future write capability would require a product change and appropriate updated authorization before it could alter your Ally data.

    Once ChatGPT calls a tool, the returned information is sent to OpenAI and becomes part of your ChatGPT interaction. OpenAI is the connected platform that receives these results, and OpenAI's handling is governed by your OpenAI plan, settings, and applicable OpenAI policies. Consumer and business handling can differ. We do not control how OpenAI stores, uses, retains, or trains on information sent through your ChatGPT account, and we do not promise a specific OpenAI treatment.

    Signing out of Ally alone does not disconnect the ChatGPT connection. To stop future access, disconnect Ally inside ChatGPT's app or connector settings. Disconnecting stops future tool calls but does not delete information that has already been included in ChatGPT conversations or ChatGPT memories; you must use OpenAI's controls to delete those separately. Deleting your Ally account removes Ally-controlled data under this policy but cannot recall copies previously sent to OpenAI through the connection.

    The Ally MCP application verifies each incoming request, does not create a persistent MCP session or token database on the Ally side, and does not perform background sync or periodic transfer of your data to ChatGPT. Data is only returned when ChatGPT invokes an Ally tool for your request. It may create limited operational records such as tool name, request status, and diagnostic errors used to keep the connection working. Passwords, access tokens, refresh tokens, and authorization codes are not intentionally logged.

    Because these tools may return free-form text you have entered, avoid putting unnecessary personal information in space names, location labels, test notes, or tags that you would not want reflected back in a ChatGPT conversation.

    For more detail on how the connection is authorized and used, see the Terms of Use, AI Transparency, Subprocessors, Security, and Privacy Rights pages. Plain-language help for the ChatGPT connection lives on Ally for ChatGPT privacy and permissions.

    Tracking, Selling, and Advertising

    Ally does not sell personal information and does not share personal information for cross-context behavioral advertising. The Ally iOS app does not request App Tracking Transparency permission and does not use the data listed in this policy to track you across other companies' apps or websites for third-party advertising. We may measure our own signup, login, product, and marketing performance when analytics or conversion tools are configured. Where required by law, we treat browser-based Global Privacy Control signals as opt-out requests for sale or sharing, even though Ally does not currently sell personal information or share it for cross-context behavioral advertising.

    Data Retention

    • Account Data: Retained while your account is active and deleted from active Ally application storage when your account deletion completes.
    • Water-Care Content: Retained while your account is active so Ally can provide your history, recommendations, reminders, saved records, and personalized care context.
    • Photos: Stored while your account is active or until you delete the associated record; deleted from active Ally application storage when your account deletion completes.
    • Chat History and AI Memory: Retained while your account is active so Ally can provide conversation history, background responses, and premium personalization; deleted when the associated account or conversation data is deleted.
    • Audio and Transcripts: Audio submitted for transcription or speech features is processed to provide the requested feature. Generated transcripts or spoken response text may be retained if saved as part of chat, support, diagnostics, or related account records.
    • Support and Contact Records: Retained for up to 12 months from creation or last activity for support continuity, safety, fraud prevention, and legal recordkeeping, unless a longer period is required by law or an active dispute.
    • Security Logs: Login history, activity logs, and audit logs are retained as needed for account security, fraud prevention, abuse prevention, legal compliance, and operational reliability. IP addresses in login history, activity logs, and role audit logs are removed or masked after about 90 days where configured.
    • Notification Logs: Retained as needed to prevent duplicate notifications and troubleshoot delivery; older logs may be deleted or de-identified according to operational retention settings.
    • Subscription Records: Retained as needed to provide paid features, restore purchases, process refunds or disputes, reconcile app store and subscription-provider events, prevent fraud, and meet legal obligations.
    • Backups and Provider Records: Copies may remain in backups, logs, or provider systems for a limited time after deletion from active Ally application storage, subject to legal, security, fraud-prevention, dispute, and provider-retention requirements.
    • Anonymized or Aggregated Data: May be retained indefinitely when it can no longer reasonably identify you.

    Your Choices and Controls

    • Access and export: You can export your account data from Settings in JSON format, or contact us for help.
    • Correction: You can update account and water-care information in the app.
    • Deletion: You can delete your account in Settings. Ally deletes account data, water-care records, chat data, photos, support records, notifications, push subscriptions, activity logs, and related app data it controls, subject to legal, security, fraud-prevention, backup, dispute, and provider-retention limits. App stores, subscription managers, infrastructure, AI, speech, diagnostics, email, and support providers may retain limited records under their own retention policies or legal obligations.
    • Location: You can decline or revoke location permission in device or browser settings. Weather-aware features may not work without location or a manually saved location.
    • Photos, camera, and microphone: You can decline or revoke these permissions in device or browser settings. Photo analysis, uploads, or voice features may be unavailable without the relevant permission.
    • Notifications: You can manage notification categories, quiet hours, sounds, and push permission in Ally and in your device or browser settings.
    • Subscriptions: App Store subscriptions can be managed or canceled through your Apple account. Deleting your Ally account does not automatically cancel an active App Store subscription. Ally can restore purchase status through app store and subscription-provider records.
    • Marketing: You can opt out of marketing emails by using unsubscribe controls when available or contacting us.

    Privacy Requests

    To protect your account, we may need to verify your identity before completing access, correction, deletion, export, or other privacy requests. We will use information provided for verification only for that purpose. We respond to privacy requests within the time required by applicable law. If we deny a request in whole or in part, we will explain the reason where required and provide any appeal or follow-up process required by law.

    California Privacy Rights

    California residents may request to know, access, correct, delete, or receive a copy of personal information. You may also opt out of sale or sharing for cross-context behavioral advertising, although Ally does not sell personal information or share it for cross-context behavioral advertising. If applicable, you may also request to limit certain uses of sensitive personal information, including precise geolocation, and you have the right not to be discriminated against for exercising your privacy rights.

    European and UK Privacy Rights

    If you are in the European Economic Area, United Kingdom, or similar jurisdiction, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to lodge a complaint with a supervisory authority. Where processing is based on consent, you may withdraw consent at any time. Where required, our legal bases may include performance of a contract, consent, legitimate interests, compliance with legal obligations, fraud and abuse prevention, and protection of vital interests or safety. If information is transferred internationally, we rely on appropriate safeguards where required by applicable law.

    Data Security

    We use technical and organizational safeguards intended to protect personal information, including access controls, row-level security, scoped server functions, storage cleanup, audit logging, rate limits, and PII scrubbing for diagnostics where configured. No system can be guaranteed completely secure.

    Children's Privacy

    The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can delete it.

    Changes to This Policy

    We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. If changes are material, we will provide additional notice where required.

    Contact Us

    For questions, privacy requests, or account-data help: