Privacy Policy

When you create an OMEGA account or purchase a subscription, we collect:

• Email address
• Full name (optional)
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• Subscription tier, status, and billing history
• License key associated with your account
• Legal acceptance records, including accepted document versions, required affirmations, timestamp, IP address, and user agent
• Where phone verification is required at signup: your mobile phone number in international (E.164) format and the timestamp of its verification (used for account verification and fraud and abuse prevention)

Where phone verification is required at signup, you must provide a mobile phone number in international (E.164) format and confirm a one-time code we send to that number by SMS. Verification is performed by Twilio Inc. (United States): Twilio Lookup checks the line type, and only real mobile lines are accepted (VoIP and landline numbers are rejected; if the check cannot complete, the number is not accepted). Twilio Verify then sends the SMS code and manages code generation, expiry, and retry throttling. Successful verification issues a short-lived signed token, valid for 30 minutes, that is consumed at account creation.

• We store the verified phone number and a verification timestamp on your account.
• Each verified phone number can be associated with only one account; this uniqueness is enforced by our database.
• Your phone number and related verification metadata are shared with Twilio solely to perform the verification.
• We use phone numbers only for account verification and fraud and abuse prevention. We do not send marketing SMS, we do not call you, and we never sell phone numbers or share them beyond Twilio.
• Numbers associated with banned or fraud-revoked accounts are retained on a phone blocklist (see Data Retention below).

Payments are processed by Stripe, Inc. We do not store your credit card number, CVV, or full payment details on our servers. We receive and store only:

• Stripe customer ID and subscription ID
• Last four digits of your card (for display purposes only)
• Card brand and expiration month/year
• Billing country and postal code
• Invoice records required for tax compliance

To enforce license terms and prevent abuse, the OMEGA desktop app sends the following to our licensing server on activation and periodically thereafter:

• License key
• A hardware fingerprint (a one-way hash of hardware identifiers, not your serial number)
• macOS version and CPU architecture
• OMEGA app version
• Number of active devices on your license
• The IP address used for the license server connection (see “License-Server IP Logs” below for full details)

We do not collect your device serial number, Apple ID, or any personally identifiable hardware attribute in recoverable form.

Each connection to central.myomega.ai for license validation, activation, deactivation, or session establishment is logged with: the IP address of the connecting client, a timestamp, account or session identifiers, and the response code (success / fail / blocked). We use these logs exclusively for:

• License verification: confirming the connection comes from a legitimate licensed device
• Fraud prevention: blocking known VPN, proxy, Tor, datacenter, hosting, and anonymizer IP ranges (use of OMEGA over those services is prohibited under the Acceptable Use Policy and applicable License Agreement)
• Abuse detection: identifying impossibly rapid activation/deactivation cycles, geographic-jump patterns indicative of seat-sharing, or coordinated chargeback attempts
• Limited operational security: DDoS mitigation, rate limiting, and country-level sanctions compliance

License-server IP logs are retained for 90 days and then automatically deleted. They are stored separately from any other data we hold about you and are never combined with the content of your local OMEGA usage (which we never see) or with marketing analytics. Access to IP logs is restricted to a small set of OMEGA engineers for the limited purposes above.

If you must use a corporate VPN as part of an employer-mandated security policy, contact the legal team with your account email and the static egress IP range to request a corporate-VPN exception. Personal VPNs, public VPN services, Tor, and anonymizer networks are not eligible for exceptions.

We collect aggregated, anonymized telemetry to improve OMEGA. This includes:

• Feature usage frequency (e.g., which agent domains are most used)
• App session duration and crash reports
• Task completion rates at an aggregate level
• Error codes and stack traces (stripped of any user content)

Analytics events are anonymized before transmission. You can disable telemetry at any time in OMEGA Settings → Privacy.

When you visit myomega.ai, we collect standard web server logs including IP address, browser type, referring URL, and pages visited. We use this data solely for security monitoring and aggregate traffic analysis.

If configured, the marketing website may use Google Analytics, Google Ads conversion tags, Google Translate cookies, and Fingerprint visitor IDs for aggregate measurement, language selection, fraud prevention, and abuse defense. You can disable non-essential analytics and optional fingerprinting in the controls below.

If you contact us via email or a support ticket, we retain the content of that communication and your email address to provide support and maintain a record of resolved issues.

• Creating and managing your account
• Verifying mobile phone numbers at signup and screening them against the anti-abuse phone blocklist, where phone verification is required
• Processing payments and issuing licenses
• Enforcing license seat limits and preventing abuse
• Sending transactional emails (receipts, password resets, subscription notices)
• Recording required legal acknowledgements for account creation, billing, age-of-majority, acceptable use, and copyright/model responsibility

• Analyzing anonymized telemetry to identify performance bottlenecks
• Understanding aggregate feature adoption to prioritize development
• Diagnosing crashes and errors via anonymized stack traces

• Detecting and preventing fraudulent use of licenses
• Complying with applicable laws and regulations
• Enforcing our Terms of Service

We will only send promotional emails if you have explicitly opted in. You can unsubscribe at any time using the link in any marketing email. To opt out of all marketing, you can submit a privacy request.

You may request a copy of all personal data we hold about you.

You may update inaccurate or incomplete information by logging into your account or contacting us.

You may request that we delete your account and all associated personal data. We will comply within 30 days, subject to any legal retention obligations.

Account deletion removes Central account data, license records that are no longer needed for fraud/dispute defense, support profile data, and non-required operational records. Billing records, Stripe event evidence, legal acceptance proof, chargeback records, and tax/accounting records may be retained for the minimum period required by law or needed to resolve disputes.

Where phone verification was required at signup, account deletion also removes the verified phone number and verification timestamp stored on your account, with one exception: if your account was banned or had access revoked for fraud, the phone number itself is retained on a phone blocklist after deletion so the same number cannot immediately be used to create a new account. This retention rests on our legitimate interest in fraud and abuse prevention (GDPR Art. 6(1)(f)) and falls within the deletion-right exception of GDPR Art. 17(3). The blocklist stores the number only, with no other personal data.

Local OMEGA workspace data lives on your Mac. You can delete it by removing local workspaces from OMEGA or deleting OMEGA’s local Application Support data after export. Central deletion does not automatically reach into a device you control.

You may request an export of your account data in a machine-readable format. OMEGA exports NDJSON (newline-delimited JSON), which you can re-import into another OMEGA installation or read with any tool that handles JSON Lines. Exports include your tasks, memories, automations, personas, agent trust tiers, and learned style preferences. The content is on your Mac, this is just the account metadata needed to rebuild it on a new install.

Central account export includes account email, the verified phone number where phone verification was required at signup, license state, device activation history, legal acceptance records, and support metadata that OMEGA controls. Provider accounts, Stripe payment data, Composio-connected app data, GitHub repositories, deployment targets, and local files must be exported from those systems or from your Mac directly.

You may disable anonymized usage telemetry at any time in OMEGA Settings → Privacy → Telemetry.

• Contract performance: processing necessary to deliver the Services you have subscribed to (account management, licensing, payment).
• Legitimate interests: fraud prevention, security monitoring, retention of banned phone numbers on the anti-abuse phone blocklist, and anonymized product analytics where these interests are not overridden by your rights.
• Consent: marketing emails (you may withdraw consent at any time).
• Legal obligation: retaining financial records as required by law.

Our servers are located in the United States. If you are in the EEA or UK, your data is transferred to the US under the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) as applicable. You may request a copy of the relevant safeguards by emailing submit a privacy request.

In addition to the rights listed above, EEA/UK residents have the right to restrict processing, object to processing based on legitimate interests, and lodge a complaint with their local data protection authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EU member state).

In the past 12 months we have collected: identifiers (name, email, phone number where phone verification is required at signup, IP address), commercial information (subscription records), internet or network activity (web server logs), and inferences drawn from anonymized telemetry (aggregate feature usage patterns). We have not collected sensitive personal information as defined by the CPRA.

We do not sell or share your personal information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.

• Right to know what personal information we collect, use, disclose, or sell.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (not applicable: we do not sell or share).
• Right to limit use of sensitive personal information (not applicable: we do not collect sensitive PI as defined by CPRA).
• Right to non-discrimination for exercising your privacy rights.

To submit a California privacy request, email submit a privacy request with subject line “California Privacy Request.” You may also authorize an agent to submit a request on your behalf.