Privacy Policy

Omnihorn is provided by Ivorn (“we”, “us”), a sole proprietor registered in Ukraine ([[PLACEHOLDER: registration number]]), [[PLACEHOLDER: registered address]]. Privacy contact: [[PLACEHOLDER: DPO/privacy contact]], or write to privacy@unicornfamily.dev.

• For account, workspace, billing and website data we are the controller: we decide why and how it is processed.
• For End User data sent by the installers of our customers’ apps, the customer who publishes the app is the controller and we are their processor, acting on their instructions under the Data Processing Addendum. If you are an End User, contact the publisher of the app first; we will help them answer you.

When Paddle becomes available as a payment option, Paddle collects the billing details it needs (such as your name, address, country and tax ID) as the merchant of record under its own privacy notice; we will receive only what we need to apply your plan.

The installers our customers distribute send us:

• Update checks — the app, channel and platform, and a random device ID sent as the X-Installer-UUID header. The device ID is generated by the installer and stored only on that computer, in the installer’s local storage. It is not derived from hardware or from the person, and we do not link it to any name or email.
• Install, update and uninstall events — event type, the random device ID, app and build identifiers, platform and operating-system version string, and the time.
• Private channel access logs — for private channels only: which channel token was used, the device ID, platform, whether an update was offered, and the time.
• Crash reports — when the installer’s desktop window crashes, the error, stack trace and the same random device ID above, sent to our error-monitoring subprocessor (see the subprocessor list). No name, email or IP address is attached. Not yet active for every installer — see the subprocessor list for status.

We do not store End Users’ IP addresses in any database and we do not geolocate them: the analytics schema has a region field, but nothing fills it today. The customer who publishes the app sees this data as aggregated charts and lists in their dashboard.

• When a sign-in link is requested, the requesting IP address is used to limit how many links one address can request. It is held in memory (Redis) for one hour and then expires.
• Our reverse proxy writes standard access logs — IP address, time, requested URL, status and user agent — for requests to our websites and APIs, including installers’ update checks. These logs are collected in our self-hosted log system for security and troubleshooting.
• Our application logs record operational events and errors. They do not record IP addresses; they can contain an email address, for example when a sign-in link is issued.
• The IP address of the request in which you accept our Terms is stored with your consent record.

Our own staff sign in to a separate, private administration site with their own accounts (email, name and a password stored as an argon2id hash). Every administrative action — such as a plan change, a suspension or a build revocation — is recorded in an audit log naming the staff member and the workspace or app concerned. The audit log contains no IP addresses and is kept indefinitely, because it is our record of decisions taken about customer accounts.

• Contract — account, workspace, content, billing and transactional email data, to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interests — security, abuse prevention (rate limits, disposable-email blocking, malware scanning), proxy logs, the audit trail, and keeping consent records as evidence (Art. 6(1)(f)).
• Legal obligation — accounting and tax records for payments (Art. 6(1)(c)).
• For End User data, the lawful basis is chosen by the customer who publishes the app; we process it on their instructions.

We make no decisions with legal or similarly significant effects about you by automated means. Refusing a sign-up from a disposable email domain or rate-limiting sign-in links are automated safeguards against abuse that you can raise with us.

The website sets no cookies and uses no analytics or advertising trackers. The dashboard keeps your sign-in session and your theme choice in your browser’s local storage. Details are in the Cookie Policy.

We use a small number of service providers (subprocessors) — for hosting, email delivery, payments and private networking. They are listed, with what they do and where, in the subprocessor list. We also disclose data when the law requires it, or to protect people from harm such as malware distribution. We do not sell personal data and do not share it for advertising.

We are based in Ukraine, and our infrastructure is self-hosted. Some providers process data in the European Union or the United States. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on [[PLACEHOLDER: SCC module/version and transfer mechanism]]. Ask us at privacy@unicornfamily.dev for a copy of the relevant safeguards.

We have not yet enabled automatic deletion schedules for most data. Until we publish them, this is what actually happens:

• Account, workspace and consent data: kept while your account exists, and deleted when we close your account at your request, except records we must keep by law.
• Builds: kept until you delete them or your account is closed. Plan-based build retention is described in the Terms of Service (section 10) and currently runs in preview mode without deleting anything.
• End User analytics events and private-channel access logs: kept until the account is closed or the publisher asks us to delete them, or until we introduce a retention schedule. Deleting an app deactivates it but does not yet purge its events, and the dashboard shows only the history the plan allows while older events are kept.
• Payment records: for as long as accounting and tax law requires.
• Sign-in rate-limit entries: one hour. Sign-in links: 15 minutes or until used.
• Reverse-proxy and application logs: kept in our log system until we introduce a retention schedule for them.
• The staff audit log: indefinitely (section 5).

We will publish concrete retention periods here as each schedule is introduced.

Measures in place include: channel tokens and API keys stored only as SHA-256 hashes; every build manifest signed with Ed25519 and verified by the installer before anything is applied; app signing keys encrypted at rest (optionally in a key-management service); staff passwords hashed with argon2id and the administration site reachable only over a private network; per-workspace access control over uploaded files (a workspace can only reference files it uploaded itself); and TLS for all public traffic. No system is perfectly secure; if a breach affects your personal data, we will notify you and, where required, the authorities.

Depending on where you live (including under the GDPR and Ukraine’s Law “On Personal Data Protection”), you can ask us to give you access to your data or a portable copy, correct it, delete it, restrict or object to its processing, and withdraw consent where processing relies on it. There is no self-service export or deletion yet: write to privacy@unicornfamily.dev from your account email and we will respond within one month. You can also complain to your data-protection authority.

Omnihorn is a tool for professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

The date and version at the top of this page change whenever we change this policy. For a material change we will ask you to review and accept the new version in the dashboard.

Privacy: privacy@unicornfamily.dev · Legal: legal@unicornfamily.dev