omniasst
English
简体中文日本語English繁體中文한국어

Privacy

Privacy policy

We process data only as needed to provide the butler experience, and distinguish device-local content, server usage records, and third-party processing.

Last updated: September 30, 2026 · 2026-08-27

1. Scope and contact

This policy applies to the omniasst mobile app, ai.omniasst.com, and the account, realtime voice, and usage services that support them.

For privacy questions or requests, contact support@omniasst.com.

2. Data we process

  • Account data: email address, display name, account identifier, verification status, and session information. The OmniAsst account service processes passwords; product services do not store plaintext passwords.
  • Butler settings: language, butler name, how the butler addresses you, appearance, and personality choices.
  • Optional notifications: FCM registration token, platform, notification locale, timezone, pseudonymous installation or account identifier, last App activity, butler and owner display names, and separate Butler check-in and friend-message notification preferences. The friend-message preference is account-level, other devices synchronize it when the App next opens, and operating-system notification permission remains device-specific. A friend-message lock-screen alert only says that a new message arrived; Notification Center does not receive message text.
  • Interconnect and messaging: your OmniAsst common-account ID and display name form your profile. After a one-time invitation is created and accepted, we process friend relationships, message text, delivery and read status, blocks, and reports. You may set an account-synchronized private name for a friend; it is visible only to you, is never shown to that friend, and can be changed or cleared at any time. An invitation can be used only once, and the App shows the exact recipient and message for your confirmation before sending.
  • Device-local content: reminders, alarms, notes, and limited relationship events are generally kept on the device unless you expressly use a feature that requires cloud delivery or synchronization.
  • Realtime voice: audio and generated responses are processed through the OpenAI Realtime API during a conversation. A bounded set of private friend names that a signed-in user explicitly configured may be sent to OpenAI as transcription keywords and recipient-recognition context for the current session; friend account IDs, public display names, and the complete friend graph are not included.
  • Usage metadata: pseudonymous device or account identifiers, session and event IDs, model, audio duration, token counts, estimated cost, allowance, and plan status.
  • Capability training feedback: only after your explicit consent for each submission, a fixed structured capability category, platform, App version and build number, language, and one-time random submission identifier are sent. The category, platform, release, and language are added to anonymous aggregate statistics. An account or installation credential is used transiently for authorization and abuse prevention and is not written to the feedback ledger. The original instruction, audio, contact names, message text, and location are not included in the feedback submission or feedback ledger.
  • Location and weather: location is accessed only when you request a related feature and grant permission; coordinates are sent to a weather service to return location or weather results.
  • Diagnostics: error type, connection status, App version, operating system, and necessary security logs. We do not proactively collect your contacts.
  • Speech synthesis: Chinese replies are synthesized by Alibaba Cloud Model Studio Qwen Audio 3.0 TTS Flash. OmniAsst stores no synthesis text or audio. Usage records contain provider-reported billed characters, PCM sample counts, actual audio duration, and completion, cancellation or failure status. Missing final provider billing receipts are explicitly marked incomplete; charges are not fabricated. Device-only private readouts and friend messages are not sent to this synthesizer.

3. Why we use data

  • Contract and service delivery: identify your account, respond by voice, execute confirmed tools, account for allowance, establish friend relationships you expressly accept, deliver confirmed friend messages, and provide support.
  • Consent: microphone, location, notifications, and exact-alarm access are used only after system permission, which you may withdraw in device settings.
  • Capability improvement by consent: anonymous aggregate demand counts help us prioritize future capabilities; declining a submission does not affect the service.
  • Legitimate interests and security: prevent abuse, diagnose faults, protect accounts, and keep the service reliable.
  • Legal obligations: keep transaction, tax, security, or dispute records when applicable law requires it.

4. Providers and international processing

We share only the data necessary for the requested function. Providers may process data outside your country and apply their own safeguards and retention rules.

  • OpenAI processes live audio, model responses, and the bounded private friend names you explicitly configured when they are used as transcription keywords and recipient-recognition context for the current voice session. Before a friend message is sent, OpenAI's Moderation API also processes its text to identify potential harassment, unlawful content, or other abuse. OpenAI states that API data is not used to train models by default unless a customer opts in, and default abuse-monitoring logs may be retained for up to 30 days; we do not describe this third-party processing as zero retention.
  • Open-Meteo and platform location services process coordinates or queries when you ask for location or weather.
  • Apple App Store and Google Play process downloads, purchases, subscriptions, refunds, and store-side diagnostics.
  • OmniAsst Identity Center handles registration, sign-in, verification, and account deletion status for the common account.
  • Google Firebase Cloud Messaging and OmniAsst Notification Center register devices, schedule requested check-ins and friend-message alerts, deliver generic lock-screen alerts without message text, retry failures, and record delivery or click status.
  • Alibaba Cloud Model Studio: receives only Chinese reply text for sprite speech synthesis, routed through our Japanese gateway to a Singapore workspace. This involves cross-border processing and is subject to the provider's data-processing terms. The API key stays on the server and is not included in the App.

5. Retention, security, and deletion

OmniAsst servers do not retain realtime audio recordings or transcript text. Friend-message text is encrypted at rest on the server with AES-256-GCM and an independent key. Ordinary messages, friend relationships, and one-time invitation records are deleted when the account is deleted. If a message is reported, related evidence is separately encrypted and may be kept for up to 180 days to investigate harassment, unlawful content, or other abuse, then deleted or isolated where law requires. An unstarted single-purpose account-deletion handoff ticket is stored only as a hash. Once it has remained unstarted and account-linked for 30 days, maintenance schedules it for anonymization; if the service is unavailable at that threshold, overdue maintenance runs after recovery. If deletion has started but a required dependency cannot yet be cleaned up, the hashed ticket and account link remain only as a persistent deletion job until Realtime, notification, usage, and Interconnect cleanup succeeds; this may exceed 30 days, and the account link is removed immediately after success. After completion or expiry, its random-token hash, consumed-or-expired state, and timestamps are detached from the account and may be retained indefinitely to make retries idempotent and return an explicit expiry result. Once deletion starts, we may also retain, for as long as necessary and potentially indefinitely, an independent-key one-way HMAC of the account identifier together with a pending-or-deleted state and timestamps. This pseudonymous security marker prevents unexpired old credentials from recreating deleted product data; it contains no raw account identifier, but can be matched when that same identifier is presented, and a pending state is not automatically reopened. The signed Identity Center deletion callback is the final cleanup path. A separate deletion-result delivery job stores only the deletion-request UUID and fixed completion fields, not the raw account identifier; an undelivered job is retained until Identity Center accepts it. A delivered result record is scheduled for removal after it has been retained for 30 days, with overdue maintenance performed after service recovery. The usage ledger is retained as needed for billing, audits, allowance corrections, and abuse prevention. Remote-notification profiles and active device tokens are retained while the feature is enabled or until the token is disabled or invalidated; delivery records may be retained for reliability and security. Account and support records are retained until their purpose or a legal requirement ends. You control device-local data in the App or by clearing App data. Capability training feedback is kept only as anonymous aggregate statistics that are not linked to an account or installation. The append-only audit ledger may retain one-way HMACs of the random submission identifier and fixed payload; they are not derived from user or device identity, and only the 24-hour live index suppresses retries.

When a report reaches its retention deadline, its encrypted evidence, free-text review notes, and related moderation-event notes are removed. A suspension that still must remain for account safety keeps only its pseudonymous subject hash, opaque suspension identifier, state, and operational timestamps; its report link and free-text reason or notes are cleared.

Account deletion privacy-compacts the usage ledger rather than erasing its billing audit history. Raw IDC account identifiers in usage-owner, installation-claim, and allowance/store-grant fields are replaced by a domain-separated keyed HMAC. Retained pseudonymous entries can include usage and cost metrics, timestamps, provider event/session IDs, store transaction/grant IDs, plan, expiry and status fields, and billable flags for billing, tax, refunds, disputes, audits, allowance corrections, and fraud prevention. They can still be matched when the same account identifier and server secret are available, so they are not anonymous. The current usage ledger has no automatic expiry.

We use transport encryption, access controls, and least-privilege practices, but no network service can guarantee absolute security.

6. Your choices and rights

  • Deny or withdraw microphone, location, notification, and similar permissions in system settings; related features may stop working.
  • Turn Butler check-ins and friend-message notifications on or off separately in the App. Turning off friend alerts does not delete messages; you can still view them in the App. Notification permission alone does not subscribe you to price promotions or voice-minute offers.
  • Remove or block a friend, and report harassment, unlawful content, impersonation, or other abuse. After a block, neither person can send the other an Interconnect message.
  • Accept or decline each capability training feedback request separately. Nothing is submitted if you decline or do not answer.
  • Review or adjust butler settings, local data, and account information in the App.
  • Start account deletion in the App under Settings → Privacy & legal → Delete account, or use the fallback website contact path if you cannot sign in.
  • Where applicable, request access, correction, deletion, restriction, or portability of your personal data.

7. Children, changes, and contact

omniasst is not directed to children below the digital age of consent where they live. Contact us if you believe a child provided personal data without appropriate permission.

We will update the date on this page and provide reasonable notice when material changes require it. Contact support@omniasst.com with privacy questions.