Privacy Policy

The short version

We collect your email address so you can sign in, billing details through Stripe if you pay us, and the code and prompts you give your agent so it can do the work you asked for. To run an agent we send that content to the AI provider behind it — Anthropic, OpenAI or xAI — and if you dictate, we send the audio to ElevenLabs to turn it into text. We use privacy-friendly analytics with masked inputs. To measure our ads, we use the Meta Pixel and a Google Ads tag, and we tell Meta when someone signs up, starts a trial or pays. We email you about your account and the apps you build, and you can unsubscribe from anything that is not essential. We don't sell your data, and we don't train models on your code.

What we collect

Account data

Your email address, and the sign-in codes and session records that let you stay logged in. We don't ask for a password — sign-in is by one-time code — so there is no password for us to store or leak.

Your content

The prompts you send, the repositories and files you connect or upload, and the state of the Computers we run for you (including snapshots taken so a paused machine can be restored). We process this to operate the service and for no other purpose.

Billing data

If you buy a plan, Stripe processes the payment and stores your card details. We never see or store full card numbers — we keep only the subscription status and identifiers we need to know what you're entitled to.

Usage and diagnostics

We run a self-hosted Umami instance on our own infrastructure for page and event analytics, plus session replay that is sampled and recorded with input masking — form values are masked before they leave your browser, and sensitive dashboard panes (chat, terminal, inspect and secrets) are excluded from recording entirely. Server logs and errors go to Axiom so we can debug failures.

Advertising and measurement

We advertise on Meta (Facebook and Instagram) and Google. To learn which ads bring people who actually use omg, we use:

• The Meta Pixel on omg.dev and app.omg.dev. It records page views and a few steps in the product, such as the starter you pick, signing in, and coming back from one of our emails. It uses Meta cookies (such as_fbp and _fbc) to link these steps to an ad you clicked.
• Server-side conversion events to Meta when you create an account, start a trial or pay. With each event we send a SHA-256 hash of your email address and of your account ID, your IP address, your browser user agent, the Meta click identifiers above, and for a payment its amount and currency.
• The Google Ads tag on omg.dev and app.omg.dev, which measures visits and sign-ups that come from our Google ads.

We never send your prompts, your code, your files or the content of the apps you build to our advertising partners.

Your choice. If you are in the EEA, the UK or Switzerland, none of these advertising tags load, and we send no conversion events about you to Meta, until you tap “Accept” on our cookie banner. If your browser sends a Global Privacy Control signal, we treat it as a refusal wherever you are. You can change your choice at any time with the “Cookie settings” link in our site footer or in the app settings. You can also limit tracking in your Meta and Google ad settings, or by emailing us at the address below.

• Meta (Facebook and Instagram) — Meta Pixel on omg.dev and app.omg.dev, and server-side conversion events
• Google — Google Ads tag on omg.dev and app.omg.dev

Emails we send

We send sign-in codes and account notices, such as project and Computer invitations. When an app you asked us to build is ready, we email you the link. This includes when your web app first goes live and when an Android build of your app is ready to install. If you have not come back a day later, we may send one short follow-up with ideas for your app. We send at most three of these follow-up emails in your first week, and never more than one a day. Every email that is not essential has a one-click unsubscribe link. We do not use open-tracking pixels in these emails. Links in them carry tags so we can tell which email brought you back. In the emails that tell you an app is ready, links also pass through our server first, so we can tell which link you used.

Voice and dictation

If you dictate a message in the mobile app, we record audio only while dictation is switched on, and only after you start it yourself. That recording is sent to ElevenLabs, our speech-to-text provider, which converts it to text. We keep the resulting text as part of your message. We do not use the audio for anything else, and we do not record when dictation is off.

What we send to AI providers

Running an agent means sending your content to the AI company whose model you chose — Anthropic, OpenAI or xAI. That covers the prompts you type, the files and photos you attach, and the code and files the agent reads or edits in the repository you pointed it at. We do not send your contacts, your location, your health data or your device identifiers to any of them.

iMessage

If you choose to use the iMessage entry point, we process the messages you send to omg and the phone number they come from, in order to route your task to your agent and reply to you.

Why we're allowed to process it

• To perform our contract with you — running your Computers, storing your work, taking payment.
• Our legitimate interests — keeping the service secure, preventing abuse of sandbox compute, and understanding aggregate usage so we can improve the product.
• Legal obligation — tax and accounting records for payments.
• Advertising measurement and product emails — our legitimate interest in measuring our ads and helping you finish what you started, or your consent where the law requires it.

Model providers

Running an agent means sending your prompts, and the files relevant to the task, to the model provider behind that agent so it can respond. Which provider depends on the agent you pick. We do not use your code or prompts to train our own models, and we do not sell your data to anyone.

Who else processes your data

We use these subprocessors to run omg. Each one sees only what it needs for its stated purpose:

• Stripe — Payment and subscription processing
• Resend — Email delivery (sign-in codes, account notices, and emails about the apps you build)
• Convex — Application database for accounts and projects
• Hetzner — Compute hosting for the sandbox fleet
• Cloudflare — DNS, CDN and edge routing
• Tigris — Object storage for snapshots and media
• Axiom — Server logs and error diagnostics
• Anthropic — Claude models, when you run a Claude agent
• OpenAI — Codex models, when you run a Codex agent
• xAI — Grok models, when you run a Grok agent
• ElevenLabs — Speech-to-text for dictation, when you dictate instead of typing

We may also disclose data if the law requires it, or where it's necessary to protect our rights, our users, or the safety of others.

How long we keep it

• Account data — while your account is open, then deleted or anonymised after closure.
• Sandboxes and snapshots — deleted on a rolling basis once a Computer is reaped or an account closes. Treat your own git remote as the durable copy.
• Logs and analytics — retained on a rolling window for debugging and trend analysis, then discarded.
• Billing records — kept as long as tax and accounting rules require.

Security

Every Computer runs in its own hardware-isolated Firecracker microVM rather than a shared container, so one tenant's agent cannot reach another's files. Traffic is encrypted in transit, secrets are stored encrypted and are excluded from analytics and session replay, and administrative access to the fleet is restricted and audited.

No system is perfectly secure. If you find a vulnerability, please report it to support@omg.dev rather than disclosing it publicly, and we'll work with you on a fix.

Your rights

Depending on where you live — including in the EEA and UK under the GDPR, and in California under the CCPA — you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it. You can also complain to your local data protection authority.

We do not sell personal information for money. The advertising measurement described above may count as “sharing” for cross-context behavioural advertising under some US state laws. You can opt out of it with one tap on Do Not Sell or Share My Personal Information, linked in the footer of every page and in the settings on app.omg.dev, or by emailing privacy@omg.dev. Global Privacy Control counts as the same opt-out.

To exercise any of this, email privacy@omg.dev. We'll respond within 30 days. You can also delete your account from the dashboard at app.omg.dev/settings/delete-account.

International transfers

Our infrastructure and our subprocessors operate in the United States and Europe, so your data may be transferred across borders. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Children

omg isn't intended for children under 13, and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we'll delete it.

Changes

If we make a material change to this policy we'll update the date at the top and notify you in the product or by email.

Contact

Privacy questions and data requests: privacy@omg.dev. Anything else: the contact page.