Effective 24 March 2026
Omora is a personal home-inventory app. We store what you give us, process it to make the app work, and don't sell or share your data with advertisers. This policy explains exactly what we collect, why, and what you can do about it.
Omora is operated by Philip Skinner ("we", "us"). Our contact details are at the bottom of this page. Our backend infrastructure runs on Supabase (hosted in the EU).
| Data | Purpose | Linked to You |
|---|---|---|
| Email address | Account creation, sign-in, verification | Yes |
| Name, phone, address | Account profile, coverage personalisation | Yes |
| Product records | Inventory tracking, warranty reminders | Yes |
| Receipts, photos, documents | Proof storage, AI extraction | Yes |
| Country & currency | Warranty rules, formatting | Yes |
| Purchase details | Coverage calculation, claims export | Yes |
| Crash & performance data | Stability monitoring via Sentry | No |
| Lightweight analytics events | Feature usage (no PII, no third-party SDK) | No |
Omora prefers on-device processing wherever possible. Receipt OCR and PDF text extraction happen locally using Apple's Vision framework. Extraction caches, pending uploads, and reminder schedules stay on your device.
Your product records, documents, photos, and profile are stored in our Supabase backend (EU region) so they sync across your devices. Row-level security ensures you can only access your own data.
After on-device text extraction, Omora may send relevant receipt text or product context to a backend AI service (currently DeepSeek, routed through our Supabase Edge Functions) to structure receipt data, answer inventory questions, or suggest product matches. Only the text needed for the specific feature is sent. The AI is limited to Omora-related tasks and is not a general-purpose chatbot.
AI provider API keys are managed server-side and never stored in the app.
Passwords are validated locally for strength and checked against known breaches using the Have I Been Pwned k-anonymity API. Only a 5-character hash prefix is sent, never the password itself.
We use Sentry for crash and performance monitoring. Sentry receives a pseudonymised user identifier, crash data, and app performance metrics. It does not receive your email, name, product data, or documents. Default PII collection is disabled.
We do not sell your data. We do not share it with advertisers. Your data is only processed by:
We keep your data for as long as your account is active. When you delete your account:
Under GDPR and UK GDPR, you have the right to:
You may also lodge a complaint with your local data protection authority.
Omora is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it.
We protect your data with:
Our primary infrastructure is EU-hosted (Supabase). Sentry and AI providers may process data outside the EU/EEA under standard contractual clauses or equivalent safeguards.
We may update this policy to reflect changes in the app or legal requirements. Material changes will be communicated through the app. The effective date at the top will always reflect the latest version.