privacy · last changed Oct 7, 2026
What we collect,where it lives, who sees it.
Every storage key and processor named. No advertising cookies.
Every storage key and processor named. No advertising cookies.
Your name, email and organisation; the records, files and credentials you store; the audit trail of access to them; and device identifiers for machines you pair.
In a Postgres database hosted by Supabase in the region your organisation chose, behind row-level security. Static assets and API functions run on Cloudflare.
People in your organisation, according to the roles its admin sets. Opscend staff do not read your records; support access is logged in the trail like any other access.
When you use Oppa with a key you brought, the content you send is transmitted to that provider under their terms. Sealed records are never included. When you use Claude Code through the bridge, nothing passes through our servers at all.
The browser keeps your session (sb-…-auth-token), your theme (ov:theme) and the email you typed on a form (ov:email) in local or session storage. No advertising cookies. Analytics, when enabled, respect consent.
Records and files until you delete them. The trail for the life of the organisation. Backups for 30 days.
Export everything, delete your organisation, or ask us a question at [email protected].