Privacy Policy

This Privacy Policy applies to all end-users, students, educational institutions, and developers interacting with Odemny, the Odemny Identity Service (OIS), and Odemny Pass accounts.

Our core privacy objective is strict data minimization: we collect only the minimal technical attributes required to authenticate your account, maintain stateful single sign-on (SSO) sessions, and adhere to regional regulatory guidelines.

Odemny enforces an uncompromising policy against collecting invasive, sensitive, or superfluous personal information.

Attributes We Collect:

• Username Identifier: A unique alphanumeric username chosen at account creation, used as your identity handle across the ecosystem.
• Primary Email Address: Your generated or provided system email (such as username@odymail.org) for identity communication.
• Full Display Name: An optional display name configured in Account Settings to personalize your profile interface.
• Profile Picture (Optional): A custom avatar image uploaded voluntarily by the user, stored as base64 or secure CDN image URI.
• Country / Region Selection: A geopolitical location indicator (e.g., Taiwan, Republic of China) selected solely to calculate regional compliance rules.

Attributes We NEVER Request or Store:

• No race, skin color, or ethnic ancestry attributes.
• No birth dates, exact age records, or astrological identifiers.
• No real home addresses, postal zip codes, or national identity card numbers.
• No biometric signatures, facial recognition templates, or fingerprint data.
• No search query profiling linked to personal identities; search inputs are processed ephemerally on-the-fly to query indices.

Security is baked into the foundation of Odemny Identity Service (OIS). Plain-text passwords are never stored in our databases, cloud caches, or log files.

When you authenticate via OIS, your password is submitted over an encrypted TLS 1.3 channel to our Cloudflare Workers edge gateway, where the mathematical hash signature is derived and compared against the stored cryptographic digest. The plain-text string is immediately released from memory upon verification.

We believe in your absolute right to be forgotten. When an account is deleted—whether initiated through Account Settings or confirmed via the 3-second OIS hold-to-delete challenge—our backend executes an immediate and irreversible multi-table purge protocol:

• Database Eradication: All user records across the Firebase Realtime Database tables (users and odemny_accounts) are permanently erased via atomic nullification across all primary and secondary candidate keys (username, email, normalized identifiers).
• Residual Scan Verification: The deletion engine scans all remaining database nodes to ensure no orphaned credentials or records remain.
• Session & Cookie Termination: The authentication cookie (odemny_session) is expired immediately with Max-Age=0, and all local session tokens and device account registries are purged from browser memory.
• Identifier Release: Once purged, the username identifier is released from the database and becomes immediately available for new registrations.

Odemny utilizes essential client-side storage technologies exclusively for authentication, state management, and user session continuity:

• odemny_session Cookie: A partitioned, secure HTTP-only cookie configured with SameSite=None; Secure; Partitioned; Domain=.odemny.com; Path=/ to allow seamless, secure SSO verification across Odemny subdomains.
• odemny_local_device_accounts (Local Storage): Stored locally on your personal device to enable the multi-account chooser dropdown. This record never leaves your device and is not synchronized to external servers.
• odemny_session_user (Local Storage): Contains active session profile metadata (name, email, avatar) to render client interface headers.

You may clear your browser cookies and local storage cache at any time through your browser settings or directly via the "Reset Consent & Cookies" tool in Account Settings.

Odemny relies on enterprise cloud infrastructure to maintain uptime and performance:

• Cloudflare Workers: Serves as our global edge computing reverse-proxy, processing TLS 1.3 termination, CORS headers, and WebKit favicon proxying.
• Google Firebase / Google Cloud: Hosts our encrypted backend database clusters and authentication synchronization modules.
• Connected Developer SSO Applications: When you use Odemny Pass to sign in to third-party applications, the application only receives the explicit scopes you authorize (username, name, email, avatar). You can inspect and revoke authorized applications at any time in Account Settings.

To ensure free access to our search utility, Odemny may host third-party programmatic ad units, sponsored search suggestions, or affiliate integrations.

These independent advertising partners may drop marketing cookies, browser telemetry scripts, or device analytics over their display units. Odemny does not sell or trade your database records to marketing brokers; however, we exercise no direct control over external ad scripts. If you visit third-party websites linked through our search index, their respective privacy policies govern your interactions.

Odemny is fully compliant with the Children's Online Privacy Protection Act (COPPA) and international student privacy frameworks:

• We do not collect student birthdates, ages, or private domestic details.
• Educational institutions must ensure that student accounts are provisioned without personally identifiable information (PII).
• Schools and district administrators assume full responsibility for managing student access whitelists and obtaining necessary parental consents.

Odemny operates under the democratic legal protections of Taipei jurisdiction. We uphold the privacy of human rights activists, students, and citizens globally.

Anti-Surveillance Protection: Odemny explicitly denies, rejects, and refuses compliance with extraterritorial data surveillance orders, administrative subpoenas, or national security warrants issued by authoritarian regimes, including the People's Republic of China (PRC) and the Russian Federation. To prevent state-mandated security intrusions (such as PRC CSL, DSL, and PIPL compliance audits), users operating from within PRC jurisdiction are excluded from Odemny account creation.

While Odemny implements state-of-the-art security precautions, no digital infrastructure is completely infallible. All privacy features, identity services, and data storage systems are provided strictly on an "AS IS" and "AS AVAILABLE" basis.

You maintain complete autonomy over your Odemny Pass data. Within Account Settings, you can:

• Inspect all stored profile parameters in real time.
• Export a complete JSON archive of your account records.
• Inspect your cryptographic SHA-256 signature.
• Revoke connected SSO application authorizations.
• Execute permanent, immediate account deletion.

For legal or privacy inquiries, please open a support ticket or submit an inquiry through the official platform developer console.