Privacy Policy

1. Scope and contact

This Privacy Policy applies to the Omuuz website, accounts, purchases, licenses, downloads, and support services. Omuuz is the service and brand responsible for the processing described here. Privacy questions and requests may be sent to mhzever@gmail.com.

Individual macOS products may provide an additional in-product notice where their processing differs from the storefront. Third-party websites and services are governed by their own policies.

2. Information we collect

We collect information you provide, including your email address, account details, support messages, and information needed to complete a purchase or deliver a license.

When purchases are available, we retain transaction facts such as product, order identifier, amount, currency, payment and refund status, license entitlement, and timestamps. Stripe processes payment-card details; Omuuz does not store complete card numbers.

We receive limited technical information needed to operate and secure the service, such as IP address, browser and device type, request time, referring page, session identifier, and security or error events.

3. Email and Google sign-in

For email sign-in, we process your email address and a short-lived verification challenge. Plaintext one-time codes are not retained after verification.

If you choose Continue with Google, Omuuz requests only openid, email, and profile. Google may provide a stable account identifier (sub), your email and verification status, name, and profile image. We use this data only to create or find your account, authenticate you, display basic account information, prevent abuse, and protect account security.

Omuuz does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google product content. The initial implementation does not retain Google access or refresh tokens. Authorization codes and ID tokens are discarded after validation and are not placed in analytics or application logs.

4. How we use information

Where a legal basis is required, we rely on performance of a contract, compliance with law, legitimate interests in operating and securing the service, or consent when specifically requested.

• Provide and secure accounts, authentication, sessions, and account recovery.
• Process orders, issue licenses, provide private downloads, and show purchase history.
• Send login, receipt, license, security, update, refund, and support messages.
• Detect fraud, abuse, account compromise, and technical failures.
• Maintain and improve Omuuz and meet tax, accounting, legal, and regulatory obligations.

5. How we share information

We do not sell personal information, share it for cross-context behavioral advertising, or use Google sign-in data for advertising.

We share information only as needed with providers that operate Omuuz: Cloudflare for hosting, delivery, and security; Google when you choose Google sign-in; Stripe for checkout, payment processing, fraud prevention, and refunds; and transactional email providers for account, receipt, license, refund, and support messages.

We may disclose information when required by law, to protect users or the service, investigate fraud or security incidents, complete a business transfer with appropriate safeguards, or follow your direction.

6. Cookies and sessions

Omuuz uses cookies and similar storage necessary for sign-in, security, language preferences, checkout continuity, and core site operation. Authentication sessions use protected cookies. Blocking cookies may prevent sign-in, checkout, and account functions from working.

7. Retention

Backups may retain deleted information for a limited recovery cycle. Minimal records may remain where needed to prevent fraud, resolve disputes, enforce agreements, or comply with law.

• Login challenges and OAuth transactions: up to 10 minutes and single-use.
• Active session records: up to 30 days unless renewed or revoked earlier.
• Account and identity records: while active, then deleted or de-identified within 30 days after a verified deletion request, except where retention is required.
• Orders, refunds, invoices, and tax records: for the period required by applicable tax, accounting, fraud-prevention, and consumer law.
• Security and diagnostic logs: ordinarily up to 90 days; support communications: ordinarily up to 24 months after resolution.

8. Security

We use encrypted transport, restricted secrets, protected session cookies, short-lived login transactions, token validation, access controls, and logging restrictions. No online service can guarantee absolute security.

9. Your choices and rights

You may use email instead of Google sign-in. After establishing another verified method, you may request that Google be disconnected. Revoking Omuuz in your Google Account prevents future Google authentication but does not automatically delete your Omuuz account, orders, or required records.

Depending on where you live, you may have rights to access, correct, delete, or receive your information; object to or restrict processing; withdraw consent; or appeal. To exercise a right or request account deletion, email mhzever@gmail.com. We may verify your identity. We will not discriminate against you for exercising an applicable privacy right.

10. International processing and children

Omuuz and its providers may process information in countries other than your own. Where required, recognized safeguards apply. Mandatory privacy and consumer rights where you live are not limited by this policy.

Omuuz is not directed to children under 13 or the higher minimum age required where they live, and does not knowingly collect information from children below that age.

11. Changes and contact

We may update this policy when the service, law, or our practices change. We will revise the effective date and provide additional notice when required. We will update this policy before materially changing how Google user data is used.

Privacy requests and questions: mhzever@gmail.com.