Privacy

Who I am

I am Opal, a service that looks after websites, at myopal.dev. To reach the people who run me, use my contact form.

What I keep

• Your account: your email address and a name. If you sign in with GitHub, your GitHub user number and the verified email it gives me. I never keep your GitHub password or token.
• Your sites: each site's address, the repository you connect, and what my checks find there. A site login you give me is kept in a locked store that only your account can read, never in my database, and you can remove it.
• What you tell me: your messages and my replies, what I write down to remember, and your ideas, plans and projects. When you talk to me by voice I keep the words, not the recording. My spoken replies are kept as sound so I can play them again.
• Files you give me: logos, brand briefs and pictures you like. When you remove one, its contents and its name are deleted.
• Payments: Stripe takes your card, and I never see it. I keep your Stripe customer and subscription numbers, the email Stripe gives me, your plan and whether it is paid. If you fill in my intake form after paying, I keep what you wrote there.
• Email: the replies you send to my emails, and a check of whether each reply really came from you.
• From my home page: your email if you join the waitlist, and your name, email and message if you write to me.
• Counts: how much of my help each account uses, and when you sign in or out. I keep no record of your IP address. I use it only for a moment, to slow down anyone sending too many requests. The servers I run on keep their own request logs.

Why I keep it

To do the work you asked for: to check and fix your sites, answer you, remember what you asked, send you email and take payment. I do not sell what you give me, and I do not use it for advertising.

Cookies

When you sign in I set one cookie, opal_session, which keeps you signed in for 30 days or until you sign out. Two short ones help sign in work: opal_return remembers where to take you back to, for 15 minutes, and opal_gh is used while you sign in with GitHub, for 10 minutes. There are no analytics or advertising cookies. My home page sets none at all.

Who helps me

These companies process your data for me, each only for the part of the work named here.

• Google Cloud runs me and holds my database, in the United States. It also holds the site logins you give me, and checks how fast your site loads, which sends it your site's address.
• OpenRouter passes what you write, and what I need from your sites and my memory to answer you, to the language model that writes my replies: Claude, by Anthropic. A brand brief you ask me to read goes the same way.
• ElevenLabs turns your voice into words, and my replies into speech.
• Resend sends my email and receives your replies.
• Stripe takes your payments.
• GitHub holds your code. I read it and propose changes there with the access you give me, and you can sign in with it.
• Cloudflare carries the traffic to myopal.dev.

To check your site's software, I also look up the names and versions of its packages in public package lists. That sends nothing about you.

How long I keep it

Most of it stays for as long as you have an account with me, until you ask me to delete it. Some of it goes sooner:

• A sign in link works once, for 15 minutes.
• A session ends after 30 days.
• The address your email replies go to stops working after 30 days.
• The check of where a reply came from is deleted after 14 days.
• A file or picture you remove loses its contents at once.
• A memory you tell me to forget is deleted at once.

Deleting your data

There is no delete button yet. To have your account and your data deleted, write to me through my contact form from the email address you use with me, and say so. A person reads it, deletes your data by hand, and writes back when it is done.

That deletes your account and what is tied to it: your sites and their logins, your messages and the words of your voice messages, what I remember, your files, projects and brand kits, and anything you sent from my home page with that address. What stays: counts of the help you used, with nothing left that links them to you, and Stripe's own record of your payments, which Stripe keeps under its own rules.

Until then you can remove things yourself in the app: forget a memory, remove a file or a picture, remove a site login, disconnect an assistant, or sign out.

Your Facebook connection

I do not connect to Facebook or read anything from it. If you connected an app called My Opal Dev to your Facebook account, remove it on Facebook: open Settings and privacy, then Settings, then Apps and websites, and remove My Opal Dev. That ends the connection. To have anything I hold about you deleted as well, write to me as above.

Changes

When this page changes, the date at the top changes with it.

The rules for using me are in my terms.