privacy policy

last updated 9 november 2026

this policy explains what omnicode collects, why, and what you can do about it. the short version: we keep what is needed to run the editor and your account, we do not sell data, and there are no ads or third-party trackers.

what stays in your browser

without an account, projects, settings, themes and layout are stored only in your browser (indexeddb and localstorage). we never receive them unless you run code or sign in.

what we store if you create an account

• your email address and display name;
• a salted hash of your password (pbkdf2-sha256), never the password itself;
• projects you choose to sync, compressed, with their names and timestamps;
• session records so you stay signed in (an http-only cookie named omnisession, valid 30 days);
• short-lived counters of sign-in attempts per ip address and email, used only to slow down password guessing.

services that see your data

• cloudflare hosts the site, the api and the database. it processes requests (including ip addresses) to deliver and protect the service.
• wandbox receives the code and stdin of the file you run, unless a dedicated runner is configured. see wandbox.org.
• github, gitlab, bitbucket, codeberg receive a download request when you import a repository from them.
• google fonts is contacted only if you set a custom editor font by name or url.

what we do not do

no advertising, no analytics trackers, no selling or renting of data, and no use of your code to train machine learning models.

keeping and deleting data

account data is kept until you delete it. settings → account → delete account removes your account, sessions and every synced project immediately. projects cached in your browser are not touched; clear them from the projects list or your browser settings.

your rights

depending on where you live (for example under the gdpr or ccpa) you can ask to access, correct, export or delete your data, or object to how it is processed. most of this you can do yourself in the app; for anything else, email us and we will answer within 30 days.

security

traffic is encrypted with https, passwords are hashed, session tokens are stored hashed, and sign-in attempts are rate limited. no system is perfectly secure, so use a unique password.

children

omnicode is not directed at children under 13 and we do not knowingly collect their data.

changes and contact

we will post changes here and update the date above. contact: privacy@omnicode.dev.