Privacy policy

1. What this policy covers

This policy applies to odem.ai, Odem accounts, and the Odem desktop engineering workspace for CAD, PCB design, and firmware. “Odem,” “we,” and “us” mean the team operating these services. We are responsible for the personal information we process to operate them.

For privacy questions or requests, contact oleksandr.gorpynich@gmail.com, our current support and privacy contact. Third-party services you connect or install have their own privacy policies.

2. Information we handle

• Account and sign-in information. Your email address, account identifier, authentication records, and session information. If you sign in with Google, Google supplies your Google account identifier, email address, and basic profile information, which may include your name and profile picture. Odem does not receive your Google password.
• Access and billing information. Your access tier, trial or subscription status, and customer, subscription, and transaction references. When you pay, Stripe processes your payment details. Our application does not receive or store your full payment-card number.
• Waitlist and support information. The email address you submit for the Windows release notification, and information you choose to include in support requests, feedback, or attachments.
• Problem reports. When you report a problem from Odem, your description, your account email and identifier, and your app version and platform. If you choose to attach an agent run, the report refers to that run’s diagnostic record.
• Technical records. Hosting, authentication, and delivery services process information such as IP addresses, request times, browser or device information, errors, sign-in activity, and email-delivery status to deliver and protect the service.
• Agent run diagnostics. For each agent run while you are signed in: your prompt, the run’s outcome, and each tool step’s name, file name, duration, status, and error message, with your account identifier and app version. Diagnostics never include file contents, renders, screenshots, or tool outputs.
• Workspace and agent information. Your designs, code, file paths, prompts, conversation history, screenshots or renders used by tools, and tool outputs may be processed when you use the corresponding desktop or AI features, as explained below.

3. Local projects and AI features

Odem opens and edits project files on your computer. Local project files and saved agent conversations are stored in your workspace or application storage. Signing in and checking account access do not, by themselves, upload those files to our account database.

The AI agent uses OpenAI’s Codex through the ChatGPT account or API credentials you connect. When you ask the agent to work, it can read relevant workspace files and send their contents, prompts, conversation context, images, and tool results to OpenAI to carry out your request. This can include proprietary designs or personal information present in your project. Local storage does not mean that AI processing stays on your device.

Your provider’s terms, privacy policy, and account settings govern its retention and use of these requests, including any model-improvement settings. Review them before using confidential material. You can work with local editing tools without submitting a task to the AI agent. Avoid including passwords, private keys, or information you are not authorized to share in prompts or files the agent may read.

Separately, the desktop app sends Odem a run diagnostic record, described in section 2, so we can find and fix failures in the agent and its tools. Odem uses these records only to diagnose and improve Odem’s reliability, not for advertising, and not to train AI models. Your prompt can contain confidential details, so you can turn diagnostics off with the Share Run Diagnostics setting (Settings → Odem). When it is off, the app sends no diagnostics.

Extensions, remote repositories, package downloads, external tools, and other integrations may communicate with their own services when you use them. Those services receive the information needed for the actions you initiate and operate under their own policies.

4. How we use information

We use information to create and secure accounts, keep you signed in, check access, provide the features you request, process subscriptions, send authentication and service messages, respond to support requests, diagnose failures (including from run diagnostics), prevent abuse, and meet legal obligations. A Windows waitlist signup is used for the requested Windows release notification; it is not a signup for unrelated marketing.

Where applicable data-protection law requires a legal basis, we process information as necessary to provide the service you request, for legitimate interests in operating and securing the service, diagnosing and fixing failures, and responding to support requests, to comply with legal obligations, or with your consent where required. You may withdraw consent by contacting us; withdrawal does not affect processing that was lawful before it.

5. Services that process information

We use service providers for the functions below. The information they receive depends on which features you use.

• Supabase: account authentication, account and subscription records, agent run diagnostics, problem reports, and the Windows waitlist.
• Google: identity verification when you choose Google sign-in. We request only basic identity scopes (OpenID, email, and profile). We do not request Gmail, contacts, calendar, or Drive access through sign-in.
• Resend: delivery of authentication emails and of problem reports to our team, including the addresses, message content, and delivery records.
• Stripe: checkout, payment processing, subscriptions, and billing management.
• Vercel and Cloudflare: website hosting, request handling, and desktop-installer delivery.
• OpenAI: AI processing through the account or API credentials you connect, as described above.

We may also disclose information when reasonably necessary to comply with law or valid legal process, protect people and the service, investigate fraud or abuse, or in connection with a merger, acquisition, or transfer of the business, subject to applicable safeguards.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use Google sign-in data to train AI models. Access to account records is limited to the purposes described in this policy.

6. Cookies, session storage, and security

The website uses browser storage to maintain your signed-in session. The desktop app stores account session credentials through the editor’s secret-storage facility. Sign-in and payment providers may use their own cookies or similar technologies to complete and protect those flows. The Odem website does not currently include advertising trackers.

You can sign out or clear browser storage to remove the local website session. This does not delete your account or the records held by service providers. Blocking necessary storage may prevent sign-in from working.

We use HTTPS for hosted service connections, access controls for account records, and server-side handling of service credentials. No system can guarantee absolute security. Protect your device, connected accounts, and API credentials, and contact us if you suspect unauthorized access.

7. Retention and international processing

We retain account information while it is needed to provide your account and service. Retention also depends on the record’s purpose, security and support needs, unresolved disputes, and applicable accounting or legal requirements. Waitlist addresses are retained to provide the requested notification or until you request removal. Run diagnostics are deleted automatically: 1 day after a successful run and 10 days after any other run. A run you attach to a problem report is kept for 10 days after the report. Problem reports are kept for up to 12 months so we can resolve them and follow up, then deleted. Technical logs, delivery records, and backups follow the relevant service’s retention settings and may outlast the active record.

When information is no longer needed for these purposes, we delete or de-identify it. Some records may need to remain after account deletion for legal, fraud-prevention, or dispute-resolution purposes. Deleting an Odem account does not delete files or conversations on your computer, or automatically delete information held in your separately connected AI or other third-party accounts.

Our providers may process information in the United States and other countries where they operate. Privacy protections may differ from those in your country. Where applicable law requires safeguards for international transfers, we rely on the relevant provider’s contractual and other legally recognized transfer safeguards. Contact us for information about the arrangements relevant to your data.

8. Your choices and privacy requests

Contact oleksandr.gorpynich@gmail.com to request access to, correction of, a copy of, or deletion of your account information, or removal from the Windows waitlist, or to delete run diagnostics before they expire. You can stop run diagnostics at any time with the Share Run Diagnostics setting, and object to this processing by contacting us. Please identify the email address associated with your request. We may need to verify your identity, but you should never send us your password, login code, or API key.

Depending on your location and applicable law, you may also have rights to portability, to restrict or object to processing, to withdraw consent, and to complain to your local data-protection authority. We will assess and respond to requests within the period required by applicable law and explain any lawful limitation. We will not discriminate against you for exercising applicable privacy rights.

You can revoke Odem’s Google connection in your Google Account settings. Revoking that connection does not itself delete your Odem account. You can manage a subscription through your Odem account; cancellation and deletion are separate requests. For information held by a separately connected provider, use that provider’s privacy controls as well.

9. Children

Odem is an engineering tool intended for adults, not children under 13 or the higher minimum age required by local law. We do not knowingly collect personal information from children below that age. If you believe a child has provided such information, contact us so we can investigate and remove it as appropriate.

10. Changes to this policy

We may update this policy as the service changes. We will post the updated version here and change its effective date. For material changes, we will provide additional notice where required, and obtain consent if applicable law requires it.