OMF Oh My Feed
All menus
Saved
English한국어

PRIVACY

What the current service handles.

The catalog supports optional Google account sign-in for saved tools, interest settings, and support, has no payments, and can process limited consent-gated product-event aggregates. Hosting and support intake also involve limited data processing.

Cloudflare edge request data

Oh My Feed is delivered using Cloudflare as an infrastructure and service provider. When your browser requests a page or API route, Cloudflare can process edge request metadata needed to deliver, secure, and operate the service. This can include IP address, request time, requested URL, HTTP headers, user agent, network and security signals, and diagnostic data.

Cloudflare describes how it may process Customer and End User data in its Privacy Policy. The application also exposes a first-party product-event endpoint for the limited events described below, but the browser sends those events only after affirmative local consent and not when Global Privacy Control or Do Not Track is enabled.

Data kept in your browser

If you choose a language, the site stores omf.lang in localStorage. If you save catalog tools while signed out, it stores their canonical IDs in omf.catalog.saved.v1. If aggregate product statistics are allowed, omf.analytics.consent.v1 records that local choice. A separate omf.analytics.ga4-consent.v1 value records the optional Google Analytics choice; an older aggregate choice does not authorize GA4. omf.header.auth.v1 in sessionStorage only remembers whether this tab last saw a signed-in session, so the header does not flicker between pages.

Signed-in account sessions use the HttpOnly cookies omf_session and temporary Google OAuth flow cookie omf_oauth. While signed in, saved tool IDs are stored with your account and synchronized across devices. Existing browser saves are uploaded only when you choose to import them. Account saves remain until you remove them or your account is deleted; clearing browser data does not remove account saves. You can remove browser-local language and saved values from the working controls on Cookies & local data, or clear site data in your browser. Account-session cookies are managed by sign-in and sign-out flows.

Google sign-in and account records

Google sign-in provides your Google account identifier and verified email address. We store these with an internal account ID, email verification time, and account creation and update times to recognize your account, synchronize saved tools and interest settings, and connect your support requests. We do not receive your Google password.

When you choose interest topics while signed in with Google, we store up to 20 GitHub topic identifiers with your account. Only topics you explicitly select are saved as personalization inputs; we do not store browsing or search history for personalization. You can change or clear them in Interest settings. They remain until you remove them or your account is actually deleted. Signing out or clearing browser data does not delete account interests. CLI project signals, selections, and feedback stay local and are not synchronized with your account. WebMCP continues to access public catalog data only.

We also store a hashed session credential and session creation, expiry, and revocation records, plus temporary sign-in verification records. A session is valid for up to 7 days; a sign-in attempt expires after 10 minutes. These validity periods do not delete database records. Account, identity, session, and sign-in verification records currently have no scheduled deletion period. Signing out invalidates the session but does not delete the account or its saved tools. Your interest topics also remain.

To request account or personal-data deletion, contact contact@ohmyfeed.stream or use Contact. Include the account email or case reference; do not send passwords or login codes. We may ask you to verify ownership. There is currently no self-service account deletion button.

Support, correction, and takedown cases

When you submit a form, the service stores the case type, email address, message, consent state, case status, creation and update times, and—when relevant—the target type and canonical target ID. Duplicate submissions are checked to avoid creating the same request twice. If you are signed in with an active account, the case can be linked to that account so you can view owned cases. The purpose is to receive, review, track, and operate the request.

Each case has a 30-day retention deadline from submission. After that deadline, routine cleanup deletes the case, its replies, handling history, and related email delivery records. Cleanup may finish after the deadline. Signed-in customers can read their published replies in their account. For a signed-out submission, keep the private status link shown after submission; anyone with that link can read the status and published replies until the deadline. Email notification is not guaranteed.

Accounts, product events, payments, and visitor profiles

The current public product offers optional Google account sign-in for account and support workflows, but does not accept payments. Account personalization uses only explicitly selected interest topics; it does not infer interests from browsing or search history. When local analytics consent is granted, the browser may send tool_row_open and outbound_github_click with a public canonical catalog ID to the service's daily aggregate endpoint. The server rejects raw identity fields, free text, arbitrary URLs, account identifiers, cookie values, User-Agent data, and visitor or session identifiers. Google Analytics 4 is configured for the public catalog, but it loads and collects only after a separate explicit GA4 consent; the default is no GA4 collection. It can then send sanitized page views, tool detail opens, outbound GitHub clicks, and successful saves. GA4 is not anonymous: it uses pseudonymous client and property cookies configured for up to 90 days, and Google may process device and network data. GA4 receives fixed view keys and accepted public catalog IDs, the external referring site's origin, and bounded campaign labels from utm_source, utm_medium, utm_campaign, utm_id, utm_content, and utm_term. Referrer paths, queries, hashes, credentials, local/private hosts, and self-referrals are removed. Campaign labels are limited to 100 letters, numbers, spaces, hyphens, underscores, or dots; obvious email addresses, URLs, phone numbers, controls, and credential-like values are rejected. These lexical checks cannot prove that a label contains no personal information, so campaign owners must not place personal information in UTM labels. GA4 does not receive site searches, free text, interests, account IDs, User-ID, auth tokens, or arbitrary query values. Enhanced measurement and granular location and device data collection are off, Google Signals and user-provided data are not enabled, and advertising personalization is blocked in all regions. The GA4 property retains user and event data for two months with reset-on-activity off; that setting does not govern standard aggregated reports. Revoking consent stops future GA4 events in this browser and removes GA cookies scoped to this host where browser rules allow; it does not erase data already received by Google. No-consent visits, suppressed referrers, and requests blocked by browsers or extensions are not recoverable later. Product-event counts are not ranking input. Cloudflare currently injects its Web Analytics beacon on the homepage independently of the optional Google Analytics integration. These are separate measurement systems; their counts should not be added together. Cloudflare request processing for delivery and security still applies. Public catalog data concerns public GitHub repositories, people, and organizations rather than a visitor's browsing profile.

Optional account-linked member statistics

A separate opt-in on Cookies & local data allows daily account-linked flags for catalog activity, adding a saved tool, and opening a saved tool detail or its GitHub link. The service resolves the account from your signed-in session and uses a 90-day UTC reporting window for these daily flags to count participating active members and saved-tool users. Expired records are routinely deleted; physical deletion may take longer while cleanup catches up. Member analytics does not receive saved tool IDs or lists or import past saves. Account save synchronization and interest settings are service operational data processing, separate from optional member statistics, and work without analytics consent. Interest topics and lists are not sent to aggregate product statistics, Google Analytics, or member analytics; interest settings add no tracking events. Aggregate, Google Analytics, and member-statistics choices are independent. GPC and Do Not Track stop collection. Signup-group statistics use previously consented daily activity to measure saves during UTC days 0–6 and activity on day 7 after signup. Incomplete observation windows are excluded. Later consent withdrawal or blocked collection can prevent a return from being observed; this is not a measure of every member’s actual return. Withdrawal stops future collection in this browser only. Previously recorded daily flags remain in statistics until they fall outside the 90-day UTC reporting window, then are routinely deleted. This choice does not change consent in other browsers or devices. Saving tools and setting interests work regardless of this choice. Withdrawing analytics consent does not clear account interests.

Your choices and requests

You may avoid signing in, avoid submitting a support form, clear local browser data, sign out to clear the account session cookie, or contact us about access, correction, deletion, or other privacy questions through Contact. Include enough information to identify your case or data. We may need to verify the request before acting. Please use the same contact for questions about these records or their retention.

CLI connections and local adoption data

Signing out of the website, including all web sessions, does not disconnect the CLI. Its separate read permission lasts up to 30 days unless you revoke the device on the account page or use CLI logout. Neither action removes installed files. account-status is only local state with the last checkedAt, not a current access check. saved, recommend and login --complete check access online.

Optional CLI linking reads account Saved IDs and explicitly selected interests. After Google sign-in you personally confirm a matching device code and 30-day read-only personalization scope; the CLI completes it with login --complete. The CLI creates a 32-byte bearer secret in a local 0600 file and sends only its SHA-256 hash in the approval URL. The server stores the hash, account/device label, creation, expiry, revocation and last-used timestamps, never the raw secret. At most 10 active devices can be viewed/revoked on the account page. Expired or revoked connection hashes remain until actual account deletion to prevent reuse; 30 days is a validity period, not a deletion schedule. The 10-minute pending window is only a local completion deadline, not server-certified challenge expiry or OAuth RFC 8628.

Account caches are bound to user and connection IDs. Offline use requires retrieval within 24 hours and an unexpired grant. Remote revocation cannot be detected offline, so cached Saved and interests may remain usable until the earlier limit or the next connected 401. A connected 401 clears credentials/cache; a pending 401 within the completion window may mean not yet approved. logout --confirm revokes this connection and clears local credentials/cache. With --offline or an unavailable server, remote revocation is unconfirmed; revoke the device on the website.

Project signals, queries, feedback, source/project files and adoption plans/history are not uploaded to OMF. Local plans contain official source URLs, project paths, versions, file-change descriptions and approval/verification receipts, retained until you remove them. Secrets and raw command stdout/stderr are not kept in plans/history or output artifacts; receipts record byte counts/hashes and actual exit/status information. Host AI content follows that provider’s existing conversation policy. Approved local programs may use the filesystem/network as explained in the plan; the runner is not a sandbox. Saved is not installation approval. Unlinking, clearing a selection/history, clearing browser data or withdrawing analytics consent does not uninstall files. Account reading is operational processing, separate from optional member statistics; no project history, interests or Saved lists are added to analytics. WebMCP remains public-only and guest Saved import remains manual. See CLI linking and approved adoption.

Optional discovery measurement and feedback

Taste cards are computed in your browser from your Saved list and the public catalog. Three-tool kit links include the three public tool IDs you explicitly select, excluding your account, full Saved list and reasons. Reasons stay in tab memory and are included only when you choose to copy notes. Recipients of links or copied notes can see the content you share.

When enabled, today’s blind pick works without analytics consent. A separate, optional choice measures this browser tab’s steps for up to 24 hours using a random key. We store its hash, experiment version and group, language, a limited entry-source category, timestamps and whether each discovery step occurred. We do not link it to your account, tool IDs, searches or Saved list. GPC and Do Not Track prevent collection. Other analytics choices do not enable it.

Records expire after 30 days and are removed in scheduled batches; cleanup can be delayed by an outage or backlog. “Stop and delete this session” immediately stops sending and requests deletion for this tab, including when the feature is off. A failed deletion can be retried in the same tab. Closing or clearing browser storage does not itself send a server deletion request. Other tabs and devices are not linked.

After revealing a pick, you can send a rating, category and optional comment without email. Administrators alone can read it. Feedback includes the public set date and feature version; experiment context is added only with measurement consent. Free text is stored separately from behavioral records and expires after 30 days. Avoid personal information. The receipt lets you delete the feedback while the page remains open; reloading may lose that receipt. Deletion retains a non-content replay-prevention marker for 30 days. Use support for other privacy requests. Blind-pick set sharing sends only the public dated set, never your choice or Saved list. Three-tool kit sharing, described above, includes the three tools you explicitly choose.

Personal workspace memory

My workspace stores your explicit workspace names, topic and language choices, comparison IDs, decisions, revisit dates, notes and last checked public metadata. It does not store search or click history or send workspace content to analytics. Default storage lasts only in this tab. Device memory is opt-in under omf.workspace.v1. Erase removes personal content and retains only a revision marker that fences stale tabs. Clearing browser storage also removes that marker. Devices without safe storage locking keep work in memory only.

Account workspace uses your signed-in account and stays out of shared browser storage. Device import requires preview and confirmation. Data remains until you erase it or the actual account row is deleted. Erase retains an empty revision record and does not remove Saved tools or interests. Logout, account deactivation, deletion requests or analytics withdrawal are not workspace deletion. Public comparison links include only three public tool IDs. Private draft copy includes notes and decisions and is labelled separately.