Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how Oplyr (“we”, “us”) collects, uses, and protects your personal data when you visit our website or join our early-access list. We aim to collect as little as possible and to be transparent about what we do with it.

1. Data we collect

• Early-access details you submit: your email address, and your name if you give one.
• Feedback and questions you submit: your email address and plain-text message.
• Bug reports you send from the app: your name, your email address, what you wrote, the app version and, unless you switch it off, the diagnostics block described in section 2.
• Technical data needed to operate and protect the form: your IP address, browser user-agent, and any campaign (UTM) parameters in the link you arrived from.
• Download events: when you use your personal download link, we record the app version, your operating system and processor type, a timestamp, and which invite the link belongs to, so we can gauge adoption and re-send working links.
• Usage analytics: aggregated, privacy-friendly metrics about page views and performance.

2. What the app itself does with data

Oplyr is a local-first application. Your source code, your files, your voice audio and the memory the app builds (the Brain) are processed and stored on your own machine and are not sent to or stored by us. Speech-to-text runs on the device. The memory import reads agent context files and recent session files that are already on your machine and keeps what you choose there. The app contains no telemetry, no analytics and no crash reporting.

The app makes five kinds of network request:

• Your AI tools. When you ask your AI tool (Codex or Claude Code) to do something, that tool sends the relevant code and your request to its provider under your own account. That is the provider’s processing, governed by their terms, not ours.
• Your Google account, if you connect one. Two features can use a Google account, and each asks only for what it needs:
  • Meetings asks for read-only access to your calendar events (calendar.events.readonly) so the app can show your day, the gaps between meetings, and a reminder before a call starts. Reading events is the only calendar permission Oplyr holds.
  • Music asks for read-only access to your YouTube account (youtube.readonly) so the app can list your own playlists, the videos in them, and the channels you subscribe to, and play them in YouTube’s own embedded player. Reading is the only YouTube permission Oplyr holds.
  Oplyr is built to be one window for the work, so features that do more than read are likely in time. Permissions do not widen on their own: Google grants an app only the access it was approved for, so anything new requires its own consent screen that you see and accept before it can happen. We will always say what a permission is for before asking for it. In the meantime the app reads the data on your own behalf, from your machine. The connection token is stored only on your machine, and disconnecting revokes it with Google and deletes it. We never receive your calendar data, your YouTube data or your token, and the app never sends your code, memory or transcripts to Google. Calendar and YouTube data are held only in memory while the app is open, for at most fifteen minutes, and are never written to disk or to any server of ours. Oplyr’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Oplyr uses the YouTube API Services; by using that feature you also agree to the YouTube Terms of Service and the Google Privacy Policy. You can revoke Oplyr’s access at any time from the app, or at your Google account permissions page.
• Speech models. Speech-to-text and the step that tidies up a transcript run on your Mac, from models the app downloads from Hugging Face: once in the background after the first launch, and when you first set up voice. These are downloads only. Nothing you say, type or build is sent with them, and once the models are on your machine, speech works offline.
• Update checks. On launch the app asks our public release feed, hosted on GitHub, whether a newer version exists. That request carries what any web request carries (your IP address and the app version). Nothing about your work is included.
• Bug reports, if you send one. Settings has a Report a bug form. Only when you press send does the app deliver your name, your email, what you wrote and the app version to us. A short diagnostics block is attached unless you switch it off, and you can read it before sending. It holds the app version, the platform and browser identifier, the microphone permission, whether voice is available (with its last error, if any), which agent is active, and whether a project is connected and writable. It never includes a project path, file names, code, memory or transcripts. We use a report only to fix the problem and to reply to you.

3. How we use your data

• to contact you about early access, product updates, or feedback you sent us
• to send you a confirmation email when you join the early-access list
• to investigate a bug report you sent from the app, and to reply to it
• to prevent spam, fraud, and abuse of our forms
• to understand, in aggregate, how the website is used so we can improve it.

4. Legal basis

We process your early-access and feedback data on the basis of your consent, which you give by submitting the form, and our legitimate interest in operating a secure website and an early-access program. Analytics run only with your consent, which you give or decline in the cookie banner and can change at any time. You can withdraw any consent at any time (see “Your rights” below).

5. Service providers

We share data only with the processors that help us run the Service:

• Vercel for website hosting and privacy-friendly analytics.
• Neon / Vercel Postgres for secure database storage for early-access entries and feedback.
• Resend for sending confirmation and product-update emails.
• Cloudflare for bot protection on our forms (Turnstile) and for storing the app builds that your personal download link serves.
• GitHub for hosting the public release feed the app checks for updates.

We do not sell your personal data to anyone.

Some of these providers are based in, or process data in, the United States. Where personal data is transferred outside the EU/EEA or UK, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. Cookies

We ask for your consent before loading anything non-essential, and analytics stay off until you accept. We use no advertising or tracking cookies, and our analytics measure usage in aggregate without building a profile of you. For the full list and to change your choices at any time, see our Cookie Policy.

7. Data retention

We keep early-access, feedback and bug-report data for as long as the early-access program is active or until you ask us to delete it. Technical logs used for abuse prevention are kept for a short period and then discarded.

8. Your rights

If you are in the EU/EEA or UK, you have the right to access, correct, delete, or receive a portable copy of your personal data. You can also ask us to restrict or object to processing, and withdraw consent at any time. To exercise any of these, email hello@oplyr.com and we will respond within one month. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We use industry-standard measures (encrypted connections, access controls, and reputable infrastructure providers) to protect your data. No method of transmission or storage is completely secure, but we work to keep your information safe.

10. Children

The Service is not directed to anyone under 16, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above.

12. Contact

For any privacy question or request, contact us at hello@oplyr.com.