Privacy policy

Accounts and sign-in

OpenApps is operated by TAO Inc. You can browse the public catalog without an account. When you create an account, we store your name, email address, verification status and account identifier to provide sign-in and manage access to developer keys and connected apps.

Password accounts store a password hash. We send verification and password-reset emails through Cloudflare. Browser sessions use an authentication cookie; session records can include your IP address and browser information for security.

When Google sign-in is available and you choose it, Google supplies your account identifier, name, email address, verification status and profile image. We store the linked identity and authentication credentials needed for sign-in. We request basic identity permissions, rather than access to Gmail, Drive or Calendar. Google's own privacy policy applies to its services.

Developer keys and connected apps

We store developer-key names, prefixes, hashes and expiration information. The complete key is shown only when it is created. OAuth connections record the client, permissions and authorization information needed to issue and revoke access. You can revoke keys and connected apps from your account page.

API and MCP usage produces diagnostic and usage records, such as tool names, request outcomes, durations and error details. Authenticated activity can be associated with your OpenApps account identifier. Connected clients are responsible for their own handling of data you share with them.

Analytics and error tracking

We use PostHog's US-hosted service for web and product analytics, performance measurements, error tracking and Cloudflare Worker logs. Events include page paths, selected catalog filters, navigation, account actions, device and browser information, and diagnostic details. Signed-in activity is associated with an opaque OpenApps account identifier; we do not add your account name or email to the analytics profile.

The browser stores an analytics identifier in local storage. Our browser analytics respects the browser's Do Not Track setting. Session replay and copied-text capture are disabled. Autocapture is limited to navigation links and masks element text and attributes.

We apply redaction to telemetry for passwords, API keys, authorization tokens, cookies, email addresses and other sensitive fields. URL queries and fragments are removed from captured URLs; search events record query length rather than the search text. Security processing and server diagnostics continue independently of browser analytics settings.

Service providers and processing

Cloudflare hosts the website, database, media, authentication email and OAuth infrastructure. PostHog processes analytics and diagnostic data. Google processes Google sign-in when you use that option. When you contact our team, we use your message to respond to your request. These providers may process data outside your country.

We use this information to operate the service, authenticate users, manage authorized access, prevent abuse, diagnose failures and understand how the product is used.

Your choices and data requests

You can browse without signing in, sign out of browser sessions, revoke developer keys and OAuth connections, and enable Do Not Track to prevent our browser analytics from capturing activity. Clearing this site's local storage removes its stored analytics identifier; later visits may create a new identifier if analytics is enabled.

Account information is retained while needed to operate your account. Authentication records have expiration times; telemetry retention is managed in our service providers' settings. Revoking access stops use of the credential but does not erase historical diagnostic records.

Contact us to request access, correction or deletion of your account information. We may need to verify account ownership before processing a request. Please do not send passwords, developer keys or reset links in email.

Changes to this policy

We update this page when our handling of account or usage information changes. The date above identifies the latest version.

Contact us

For account help, email support@theopenapps.com. For privacy and data requests, email privacy@theopenapps.com.

Support and privacy mailboxes are being configured. Email delivery has not yet been verified.

Service-provider privacy policies: Cloudflare, PostHog and Google.