OUTERNET PRIVACY POLICY

Last Updated: August 10, 2026

Effective Date: August 10, 2026

INTRODUCTION

Ampel Co. (“Ampel,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use Outernet, our mobile application and related services (the “Service”). Outernet is a group chat application with an AI participant and a per-group feed of recommended content.

Please read this Privacy Policy carefully. By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Service.

This Privacy Policy should be read together with our Terms of Service. Capitalized terms not defined in this Privacy Policy have the meanings given in the Terms of Service.

1. INFORMATION WE COLLECT

We collect information in three ways: information you provide directly, information collected automatically, and information provided by other users.

1.1 Information You Provide Directly

Account Information. Your account is identified by your mobile phone number, which we verify by sending a one-time code by text message. We also collect your display name, an optional profile photo, the interests you select or enter, and your settings and communication preferences. We do not collect a password; signing in is done with a one-time code each time.

Optional Stated Location. You may optionally tell us your general location (for example, a city or neighborhood) by typing it into your profile. This is free-text you choose to provide — it is not collected from your device. We use it to make group recommendations (such as local events) more relevant. You can edit it, remove it, or limit its use at any time in your settings. See Section 1.2 for what we do not collect about your location.

Messages and Content. When you use the Service, we collect the messages you send in group conversations and in one-on-one conversations with the AI assistant, photos and other content you post to a group's feed, reactions and feedback (such as ratings or reports), and related conversation history and context.

Contacts (Optional). To help you find people you know and invite others, you may grant Outernet access to your device's contacts. If you do, we do not upload your address book. Instead, your device sends us only a scrambled (salted, one-way hashed) version of each phone number, along with the name you have saved for that contact, so we can show you which of your contacts are already on Outernet and help you invite others. If you mention someone in conversation by a name you have saved for them, the AI assistant may also use that saved name to recognize who you are referring to and personalize its responses. Your raw address book never leaves your device. Contacts access is optional — the Service works without it — and you can revoke it at any time in your device settings.

Communications. We collect information when you contact our customer support, send us email correspondence, or provide feedback and survey responses.

1.2 Information Collected Automatically

Usage Data. We automatically collect information about how you use the Service, including features and functions you access, session duration and frequency, time and date of access, and engagement metrics (such as messages sent and feed content viewed).

Device and Technical Information. We automatically collect device type, model, and operating system, app version, IP address, mobile network information, time zone and locale settings, push notification tokens, and crash reports and error logs. Our error reporting is configured so that error reports do not include the content of your messages.

Location Information. We may infer your approximate geographic location from your IP address and time zone settings. We do NOT collect precise geolocation data through GPS or mobile device sensors, and the app never requests location permission from your device. The only location information associated with your profile is the optional stated location you type in yourself (see Section 1.1).

Website Analytics, Cookies, and Similar Technologies. On our website, we use cookies and similar technologies to enable core functionality (authentication, session management), collect aggregate page-view and usage statistics (via Vercel Analytics, which does not use cookies or track you across sites), and measure advertising effectiveness (via the Meta Pixel). The Outernet mobile app does not use advertising identifiers. See Section 9 for details on managing cookies.

1.3 Information from Other Users

Contact Matching. If another user grants contacts access and your phone number is in their address book, we may receive a hashed version of your phone number and the name they have saved for you. We use this only to show that user which of their contacts are on Outernet and to support invitations.

Invitations. If another user invites you to Outernet by text message, we process your mobile number solely to deliver that invitation. See Section 3.8.

Group Conversations. Messages that other members send in groups you share may include information about you.

2. HOW WE USE YOUR INFORMATION

2.1 To Provide and Operate the Service

We use your information to operate group conversations and one-on-one conversations with the AI assistant, deliver messages and push notifications, verify your phone number and authenticate your account, maintain your conversation history, generate and deliver each group's feed of recommended content, provide customer support and respond to inquiries, and troubleshoot technical issues.

2.2 The AI Assistant and Your Information

The AI assistant participates in your conversations. To be useful, it reads the conversations it takes part in and maintains context from them — for example, your interests and things you have shared with it — so that its responses and recommendations are relevant. This context carries across your conversations: ordinary social information the assistant learns about you (such as your interests) may inform its participation in your groups, wherever it was shared. The Service is designed so that sensitive information you share with the AI in a private one-on-one conversation is not repeated by the AI in group conversations.

Feed Recommendations. To recommend content to a group (such as articles, videos, and local events), the Service uses the group's interests and conversations to search the public web. Search queries sent to third-party search providers describe topics of interest; they do not include your name, phone number, or account identity.

2.3 To Improve the Service

We use aggregated and de-identified data to analyze usage patterns, develop new features and capabilities, and monitor and improve Service performance and reliability. We do not use your messages or content to train AI models, and our agreements with AI model providers prohibit them from using your data to train their models.

2.4 For Communications

We use your information to send service announcements and updates (such as changes to Terms or features), send push notifications about activity in your groups (you can manage these in your device settings), send promotional communications about Outernet (you may opt out at any time), and conduct surveys and request feedback.

2.5 For Legal and Safety Purposes

We use your information to comply with applicable laws, regulations, and legal processes, respond to lawful requests from government authorities, enforce our Terms of Service and protect our rights, detect, prevent, and address fraud, security, or technical issues, and protect the safety and rights of our users and the public.

3. HOW WE SHARE YOUR INFORMATION

We share your personal information with third parties only as described below. We do not sell your personal information to third parties.

3.1 With Other Members of Your Groups

Content you share in a group — messages, photos, feed posts, and reactions — is visible to the other members of that group. Your display name and profile photo are visible to members of your groups and to users you connect with. If you provide a stated location, it may inform recommendations made to your groups; you can remove it or limit its use in your settings.

3.2 AI Model Providers

When you use the Service, the content of your conversations is transmitted to third-party AI model providers to generate the AI assistant's responses and to maintain the assistant's context (see Section 10). These providers may process that content on their servers, temporarily retain it for service operation and safety monitoring, and apply content moderation and safety filters. We maintain data processing agreements with our AI model providers that restrict their use of your data to providing the Service and prohibit them from using your data to train their models. See Section 10 for more detail on how your data flows to AI providers.

3.3 Service Providers

We share information with third-party companies that perform services on our behalf:

Hosting and Infrastructure:

• Vercel: Application hosting and backend infrastructure
• Supabase: Database and authentication services for account data, conversation history, and application data
• Modal: Compute infrastructure on which our AI systems run

Text Messaging:

• Twilio: Delivers one-time verification codes and invitation text messages. Twilio receives the destination phone number for each message. See Twilio's privacy notice at https://www.twilio.com/en-us/legal/privacy.

Website Analytics:

• Vercel Analytics: Collects aggregate page-view and usage statistics on our website. It does not use cookies and does not track you across sites.

Push Notification Delivery:

• Apple Push Notification service (Apple) and Firebase Cloud Messaging (Google): Deliver push notifications to your device. When a notification is sent, these services receive your device push token and the notification content, which may include a sender name, a group name, and a short message preview. You can turn notifications off at any time in your device settings.

Error Monitoring:

• Sentry: Collects crash reports and error logs so we can find and fix problems. Our integration is configured so that error reports do not include the content of your messages.

Content Discovery:

• Web search providers: Help us find public web content (articles, videos, events) to recommend to groups. They receive topical search queries, not your name, phone number, or account identity.

Advertising Measurement (Website Only):

• Meta Platforms, Inc. (Facebook): We use the Meta Pixel on our website to measure advertising effectiveness and attribute conversions to ad campaigns. The Outernet mobile app does not include the Meta SDK and does not collect advertising identifiers. (The legacy Ampel chat application, which is being retired, includes the Meta SDK: it reports app activity events to Meta — such as app installs, app opens, referral activity, and subscription purchase events including amount — regardless of tracking consent, and collects the device advertising identifier only with your consent through Apple's App Tracking Transparency prompt. That application also uses the AppsFlyer attribution service, which receives a device identifier, account identifiers (your account ID and, in referral events, the account ID of the user you referred), and similar app activity events — app opens, invitations, referral activity, and subscription events including amount — for install attribution and marketing measurement. Both end when that application is discontinued.) Meta does not receive your name, phone number, message content, or other account information from us. You can adjust your ad preferences in the Meta Privacy Center at https://www.facebook.com/privacy/center/.

All service providers are contractually obligated to protect your information and use it only for the purposes we specify.

3.4 Legal and Regulatory Authorities

We may disclose your information when required by law, regulation, legal process, or governmental request, requested through valid subpoena, court order, or similar legal process, necessary to enforce our Terms of Service or protect our rights, necessary to protect the safety, rights, or property of Ampel, our users, or the public, or required to detect, prevent, or address fraud, security, or technical issues.

3.5 Business Transfers

If Ampel is involved in a merger, acquisition, asset sale, bankruptcy, or similar business transaction, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in the Service at least 30 days before your information is transferred and becomes subject to a different privacy policy.

3.6 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for purposes such as research and analytics, industry reporting, and service improvement.

3.7 With Your Consent

We may share your information with other third parties when you explicitly consent to such sharing.

3.8 SMS and Text Messaging

When an Outernet user invites you by text message, we process the recipient mobile number solely to deliver that one-time invitation through our SMS provider (Twilio) and to honor opt-out requests. We do not share mobile phone numbers or SMS opt-in and consent data with third parties or affiliates for their own marketing or promotional purposes, and we do not sell this information. If you reply STOP, we retain only a one-way hashed record of your number for the sole purpose of suppressing future messages. See our SMS Terms for program details, message frequency, and opt-out instructions.

4. YOUR PRIVACY RIGHTS

4.1 General Rights (All Users)

Regardless of where you live, you have the following rights:

• Access: You can access your personal information through the app or by contacting us at privacy@ampel.ai.
• Correction: You can update or correct your personal information (including your display name, profile photo, interests, and stated location) in the app or by contacting us.
• Deletion: You can delete your account directly in the app's profile settings, or request deletion by contacting us at privacy@ampel.ai. When you delete your account, your login identity (including your phone number), profile details, personal records, and media attached to your messages are permanently deleted. Messages, posts, and comments you shared into groups that still have other members remain visible to those members — so their conversations stay intact — attributed to a deleted member rather than to you, and photos attached to feed posts are retained as part of a group's shared content.
• Data Portability: You can request a copy of your personal information in a commonly used, machine-readable format.
• Contacts Access: You can revoke Outernet's access to your device contacts at any time in your device settings.
• Marketing Opt-Out: You can opt out of promotional communications at any time. You cannot opt out of service-related communications (such as account notifications and verification codes).

4.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). See Section 11 for detailed information.

4.3 Other State Privacy Rights

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Oregon, Montana, Texas, Kentucky, Indiana, Rhode Island, and others) have similar rights, including the right to access and delete personal information, the right to correct inaccurate information, the right to opt out of the sale of personal information (we do not sell personal information), the right to opt out of targeted advertising, the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and the right to appeal a denial of a privacy request. Please contact us at privacy@ampel.ai to exercise your rights. We will respond within the timeframe required by your state's law.

4.4 Cookie Preferences

You can manage cookie preferences through your browser settings. See Section 9 for more information.

4.5 How to Exercise Your Rights

To exercise any privacy right, email privacy@ampel.ai with your full name, the phone number associated with your account, the specific right you wish to exercise, and any relevant details. We will verify your identity before processing your request and will respond within 45 days (or as required by applicable law). If we need additional time, we will notify you of the extension and the reason.

4.6 Non-Discrimination

We will not discriminate against you for exercising your privacy rights. Exercising your rights will not affect the price or quality of the Service, except where a reduction in data may limit certain personalized features.

5. DATA RETENTION

5.1 Retention Periods

We retain different types of data for different periods:

5.2 De-Identified Data

We may retain de-identified or aggregated data that can no longer be used to identify you for an indefinite period for research, analytics, and service improvement purposes.

5.3 Data Transmitted to AI Model Providers

Conversation content transmitted to third-party AI model providers may be retained by those providers in accordance with their own retention policies and our data processing agreements. We require our AI model providers to delete this data within a reasonable period, typically 30 days, except where retention is required for safety monitoring or legal compliance.

6. DATA SECURITY

6.1 Security Measures

We implement administrative, technical, and physical security measures to protect your personal information, including encryption of data in transit (TLS/SSL) and at rest, access controls and authentication requirements, regular security assessments and monitoring, secure data storage through reputable cloud service providers, and one-way hashing of contact phone numbers so that your address book is never uploaded in readable form.

6.2 Third-Party Security

Our key service providers maintain industry-standard security programs; Vercel and Supabase maintain SOC 2 certifications.

6.3 Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users and applicable regulatory authorities as required by law. Notification will be provided without unreasonable delay and, where required, within the timeframes specified by applicable state and federal law (typically 30 to 72 hours after discovery, depending on jurisdiction).

6.4 No Guarantee of Absolute Security

No system is completely secure. Despite our efforts, we cannot guarantee absolute security of your information. Please notify us immediately of any suspected unauthorized access to your account at support@ampel.ai.

7. CHILDREN'S PRIVACY

7.1 Age Restriction

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will promptly delete that information.

7.2 Users Between 13 and 18

Users between 13 and 18 years old may use the Service with the consent of a parent or legal guardian, as required by our Terms of Service and applicable law.

7.3 Parental Contact

If you believe we have collected information from a child under 13, please contact us immediately at privacy@ampel.ai. We will take prompt steps to delete the information and, if appropriate, terminate the child's account.

8. INTERNATIONAL USERS

8.1 U.S.-Based Service

Ampel is based in the United States, and our Service is currently available only to U.S. residents. Our data storage and processing facilities are located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 What We Use

We use cookies and similar technologies for the following purposes:

Essential Cookies: Required for the Service to function properly, including account authentication, session management, and security features. These cookies cannot be disabled without impairing the Service.

Website Analytics: We use Vercel Analytics on our website to collect aggregate page-view and usage statistics. It does not use cookies and does not track you across sites.

Advertising Measurement (Website Only): We use the Meta Pixel on our website to measure advertising campaign performance. The Meta Pixel places a cookie when you visit our website that helps Meta attribute conversions to specific ad campaigns. The Meta Pixel is not loaded on pages containing invitation links or similar credentials. The Outernet mobile app does not include the Meta SDK, does not collect advertising identifiers, and does not use advertising cookies. The legacy Ampel chat application, which is being retired, includes the Meta SDK: it reports app activity events to Meta (app installs, app opens, referral activity, and subscription purchase events including amount) regardless of tracking consent, and collects the device advertising identifier only with your consent through Apple's App Tracking Transparency prompt. That application also uses the AppsFlyer attribution service, which receives a device identifier, account identifiers, and similar app activity events for install attribution and marketing measurement. You can adjust your ad preferences in the Meta Privacy Center at https://www.facebook.com/privacy/center/.

9.2 Managing Cookies

You can manage or disable cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. However, disabling essential cookies may prevent the Service from functioning properly.

9.3 Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting. There is currently no industry standard for how companies should respond to DNT signals. We do not currently respond to DNT signals. We use Meta's advertising tools on our website to measure our own ad campaign performance, but we do not sell your data or engage in cross-context behavioral advertising.

10. DATA SHARING WITH AI MODEL PROVIDERS

Because the AI assistant is powered by third-party AI models, it is important that you understand how your data flows to these providers.

10.1 What Data Is Shared

When the AI assistant generates a response, the content of the relevant conversation — along with context necessary for processing (such as conversation history, participants' display names, and the interests and other context the assistant maintains) — is transmitted to a third-party AI model provider. In addition, conversation content and engagement activity may be processed by AI providers in the background to maintain the assistant's context — for example, summarizing conversations, deriving interests and other durable context about you, and creating numerical representations (embeddings) of that derived context so the assistant can recall it. We do not transmit your phone number or other account identifiers to AI model providers.

10.2 How Providers Use Your Data

Under our data processing agreements, AI model providers are authorized to process this content solely to provide the Service — generating responses, maintaining the assistant's context as described in Section 10.1, applying content moderation and safety filters, and complying with applicable law. Our agreements prohibit AI model providers from using your content for their own model training or for any purpose other than providing the Service.

10.3 Provider Retention

AI model providers may temporarily retain conversation content for operational purposes (such as abuse detection and safety monitoring), typically for no more than 30 days, after which it is deleted. We regularly review our providers' data handling practices.

10.4 Your Control

You can delete your conversation history or your account at any time from within the app. However, data already transmitted to AI model providers is subject to their retention policies and our data processing agreements. If you have concerns about a specific provider, please contact us at privacy@ampel.ai.

11. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA SUPPLEMENT)

This section applies to California residents and supplements the information in this Privacy Policy with disclosures required by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

11.2 Categories of Personal Information Disclosed for Business Purposes

In the preceding 12 months, we have disclosed the following categories of personal information to the following categories of recipients for business purposes:

11.3 Sale and Sharing of Personal Information

We do not sell personal information as defined by the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising. If our practices change, we will update this Privacy Policy and provide a “Do Not Sell or Share My Personal Information” link.

11.4 Sensitive Personal Information

We do not collect Social Security numbers, government identification documents, biometric data, financial account credentials, or precise geolocation. To the extent the content of your messages constitutes sensitive personal information, we process it solely to provide the Service you request and for the purposes authorized by CCPA/CPRA Section 1798.121; we do not use it to infer characteristics about you for other purposes. Because we use such information only as necessary to provide the Service, the right to limit use of sensitive personal information would not result in a change to our current practices. If you wish to exercise this right, contact privacy@ampel.ai.

11.5 Exercising Your CCPA/CPRA Rights

To exercise your California privacy rights (including the right to know, delete, correct, and opt out), email us at privacy@ampel.ai. We will verify your identity before processing your request and will respond within 45 days. You may designate an authorized agent to make requests on your behalf by providing written authorization.

12. CHANGES TO THIS PRIVACY POLICY

12.1 Updates

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last Updated” date at the top of this page. For material changes, we will provide notice via prominent notice within the Service, or via text or email where appropriate, at least 30 days before the changes take effect.

12.2 Your Options

If you disagree with material changes to this Privacy Policy, you may close your account before the changes take effect. Your continued use of the Service after the effective date of changes constitutes your acknowledgment of the revised Privacy Policy.

13. CONTACT US

13.1 Privacy Questions

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices:

• Email: privacy@ampel.ai
• Mail: Ampel Co., Attn: Privacy Officer, 8 The Green, Suite B, Dover, DE 19901

13.2 Data Rights Requests

To exercise your privacy rights (access, deletion, correction, etc.), email privacy@ampel.ai with your full name, the phone number associated with your account, your specific request, and any relevant details. We will verify your identity before processing and will respond within 45 days (or as required by applicable law).

13.3 General Customer Support

• Email: support@ampel.ai