OSAMAPrivacy Policy
The short version: OSAMA runs its AI on your own computer. Your conversations, voice, files and screen never leave your machine. The only things our servers ever see are your account email and your plan. If you connect Gmail or Google Calendar, that data flows directly between your computer and Google — it never passes through us.
Who we are
OSAMA is made by Xioraa. If you have any question about this policy or your data, email [email protected].
What stays on your computer
OSAMA is a local application. The following never leaves your device and we never receive it:
- Everything you say or type to OSAMA, and everything it says back
- Your microphone audio
- Anything OSAMA remembers about you (your "Brain"), and your chat history
- Files, folders and photos you share with it
- Screenshots taken when you ask it to look at your screen
- The contents of your email and calendar
These are stored in a folder on your own PC and are deleted when you delete them.
What we collect
- Your email address and password — to create your account. Passwords are stored only as a salted cryptographic hash; we cannot read them.
- Your plan and unlock codes — so the app knows what you've paid for.
- Sign-in codes — a 4-digit code, valid for 10 minutes, then deleted.
- Standard server logs — kept briefly by our host (Cloudflare) for security and reliability.
We do not sell your data, we do not run advertising, and we do not build advertising profiles.
Google account connections (Premium)
If you choose to connect Gmail or Google Calendar, OSAMA asks Google for permission to read and manage your mail and calendar so it can summarise what matters, write and send email you ask it to send, and create calendar events you ask for.
- You grant this yourself, in your browser, directly with Google. OSAMA never sees your Google password.
- The access token is stored only on your computer. It is never sent to us and we have no ability to read your mail or calendar.
- Your email and calendar content is used only to carry out what you ask, in the moment. It is not used to train any model.
- You can disconnect at any time in Settings → Connections, which deletes the token from your PC, and you can revoke access at myaccount.google.com/permissions.
OSAMA's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Other services OSAMA can use
Some features reach the internet when you use them, and only then: web search and weather lookups, Spotify (if you connect it), and voice generation. Requests go directly from your computer to those services under their own privacy policies.
Payments
If and when paid plans go live, card details are handled entirely by our payment processor. We never see or store your card number.
Children
OSAMA is not intended for children under 13, and we do not knowingly collect their data.
Your rights
You can ask us to show you, correct, or delete the account data we hold. Email [email protected] and we'll action it. Deleting your account removes your email, password hash and plan record from our systems. Anything stored on your own PC is yours to delete directly.
Changes
If this policy changes materially, we'll update this page and the date at the top.