OmniCode — Privacy Policy
Effective 4 August 2026. This policy describes what OmniCode does today. We'll update it when our data practices change, and the date above will change with it.
Contact: bhulakshminarayana1@gmail.com
The short version
- We read the problem you're looking at and the code in your editor only when you ask for a hint, and we send it to an AI model provider to generate that hint.
- We strip credentials first. API keys, tokens, passwords and private keys are removed server-side before anything reaches a model (
coach-service/coach/redaction.py). - We never store your source code. Solve replays record how *long* your code was, not what it said.
- You can turn code sharing off entirely and still get coaching from the problem text.
- You can export or delete everything at any time.
Who we are
OmniCode is operated by Bhulakshmi Narayana. This policy covers myomnicode.com, the OmniCode API, the OmniCode browser extension, and the OmniCode VS Code extension.
What we collect
You give us
| Data | When | Why |
|---|---|---|
| Email address | Sign-up | Account identity and service email |
| Payment details | Subscribing | Handled entirely by Stripe — we never see or store card numbers |
Collected while you use OmniCode
| Data | Detail | Why |
|---|---|---|
| Problem text | The statement of the problem you're solving | To explain and coach it |
| Visible code | What's in your editor, credentials removed | To diagnose your approach |
| Platform + problem id | e.g. "NeetCode / two-sum" | To build your cross-platform skill map |
| Pattern outcomes | Encounters, mistakes flagged, hint depth | The skill map and spaced repetition |
| Solve timeline | Timestamps, edit events, and code length only | Session film study |
| Usage + cost ledger | Model calls, tokens, cost | Quotas, billing and abuse prevention |
We do NOT collect
- Your source code as stored text — only its length, in timelines.
- Screenshots. Nothing is captured visually.
- Browsing history. The extension runs only on the coding-platform pages listed in its manifest, and only reads the page you're actively solving on.
- Keystrokes. The editor is sampled every 15 seconds for change detection, not recorded.
Automatic credential redaction
Before any observation reaches a model, the server removes values that look like secrets: named assignments (API_KEY=…, password=…), .env lines, AWS/Stripe/GitHub/Slack/Google key formats, JWTs, Authorization headers, private-key blocks, and passwords embedded in connection strings. The variable *names* are kept so the model can still reason about your code.
This runs server-side, so it applies regardless of which client you use (coach/redaction.py, tested in tests/test_reliability.py).
It is not a guarantee against every possible secret. Please don't paste production credentials into a practice problem.
Turning off code sharing
PATCH /me/privacy {"allowCodeUpload": false} (also in the app settings). With it off, the server strips visibleCode before the observation reaches a model, and you're coached from the problem text alone.
Who we share it with
We do not sell your data, ever. We share it only with the processors needed to run the service — the current list, with what each one receives, is in SUBPROCESSORS.md.
The most important one: your problem text and redacted code go to an AI model provider (currently DeepSeek, Moonshot and Google Gemini) to generate hints. They process it to return a response. Review their terms if this matters to you — it's the core trade of using an AI coach.
How long we keep it
These windows are enforced by code (api/retention.py), not just stated here:
| Data | Retained |
|---|---|
| Solve timelines | 180 days |
| Session events | 365 days |
| Billing/cost ledger | 730 days (tax and dispute records) |
| Usage counters | 400 days |
| Skill map | Until you delete your account |
Live at GET /privacy/retention.
Your rights
| Right | How |
|---|---|
| Access / export | GET /me/export returns everything we hold, as JSON |
| Deletion | DELETE /me erases your account and all associated rows immediately |
| Correction | Contact us |
| Restrict processing | Turn off code sharing, or turn the coach off entirely |
| Object / withdraw consent | Stop using the service and delete your account |
If you're in the EEA/UK, our lawful bases are contract (providing the service you signed up for) and legitimate interests (security, abuse prevention, and keeping the service running). You may complain to your local data protection authority.
If you're in California, we do not sell or share personal information as CCPA/CPRA defines it, and we don't discriminate against you for exercising your rights.
Security
- All traffic over HTTPS.
- We never store passwords — authentication is handled by a managed identity provider.
- Card details never touch our servers.
- Logs and error reports are scrubbed of code, problem text and credentials before they're written (
api/observability.py). - Details, including our threat model, are in SECURITY.md.
Children
OmniCode isn't directed at children under 13 (or under 16 in the EEA/UK), and we don't knowingly collect their data. Contact us if you believe a child has provided us personal information.
International transfers
Our infrastructure and model providers may process data outside your country, including outside the EEA/UK. Where required we rely on Standard Contractual Clauses or equivalent safeguards. *(To be confirmed with counsel once the hosting region is chosen.)*
Changes
We'll update the date above and, for material changes, notify you in-product or by email before they take effect.