Privacy Policy

Who we are

ooda is operated by Toy Software Ltd, a company registered in England and Wales (company no. 15848160), at C/O Esdg Accountancy Ltd, 44 Royal Parade Mews, London SE3 0TN, United Kingdom. We are the data controller for the personal data described here, and we comply with the UK GDPR and Data Protection Act 2018.

For personal data that you publish through ooda, you (or your organisation) are the controller and we act as your processor. That relationship is covered by our Data Processing Agreement.

What we collect

We collect the minimum we need to run the service:

• Account details — your email, name, organisation membership and role, and a securely hashed password if you set one.
• Billing details — if your organisation is on a paid plan: billing name and email, plan, and payment status. Card details are entered on and stored by Stripe, our payment processor — they never touch our servers.
• Usage and security data — IP addresses, request logs, and similar technical data used to operate the service, apply rate limits, and keep it secure.
• Product analytics — events from the dashboard and service (pages viewed, features used, sites published), associated with your account so we can understand and improve the product.
• Site metadata — site names and URLs, access policies, version history, and who published them.
• Content you publish — the files that make up your published sites.
• Support communications — anything you send us by email.

What we don't collect

We don't use advertising or third-party tracking cookies, we don't sell your data, and we don't use your code or content to train models.

How we use your data

We use the data above to:

• provide the service — host and serve your published sites, and authenticate you (to perform our contract with you);
• keep ooda secure and reliable — rate limiting, abuse prevention, and debugging (our legitimate interest in protecting the service);
• communicate with you about your account and important changes (to perform our contract);
• handle billing for paid plans, through our payment processor Stripe (to perform our contract); and
• meet legal obligations where they apply.

We also use product analytics (PostHog, hosted in the EU) to understand how ooda is used and improve it — our legitimate interest in developing the service. Analytics data stays in the EU, doesn't use tracking cookies, and is never used for advertising or sold.

Your code and AI

ooda only receives the built files you choose to publish — your source code stays on your machine. When you delete a site, its published content and stored versions are deleted with it.

If you use an AI coding agent to drive the ooda CLI, that agent runs on your own machine using your own credentials with your own model provider. Your prompts and AI conversations never pass through ooda, and we don't use your code or content to train models.

Cookies

We use only essential cookies: a session cookie to keep you signed in, and, for password- or login-gated published sites, a short-lived cookie that records you've passed the gate. We don't use cookies for advertising or cross-site tracking.

Third-party processors

We rely on a small number of providers to run ooda. Each processes data on our behalf under its own data-protection terms:

International transfers

Our database and object storage are configured for EU jurisdiction. Some of our processors are based outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK's International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), or transfers to countries the UK considers adequate.

Data retention

We keep account data while your account is active. Published sites and their version history are retained until you unpublish or delete the site. Security and request logs are kept for a short period and then deleted.

You can delete your sites and account at any time.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, and to data portability. To exercise any of these, email [email protected].

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.

Security

We protect your data with encryption in transit and at rest, and strict access controls. You can read more on our security page.

Children

ooda is a tool for software teams and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

Changes

We may update this policy from time to time. We'll change the date above and, for material changes, let you know.

Contact

For anything privacy-related, email [email protected].