Privacy Policy.

Odyn is made by New Genre Studio(“we”, “us”), based in the United Kingdom. We are the data controller for the information described here. You can reach us at jack@newgenre.studio about anything on this page.

This policy covers the Odyn desktop app and the Odyn website. It does not cover the third-party services you choose to connect Odyn to — those have their own privacy policies, and we link to the main ones below.

Odyn is local-first by design. The following are stored in a database file on your own machine and are never uploaded to us:

• Your projects, chats, messages, and the code your agents read or write.
• Your app settings, notes, canvases, and saved files.
• Git worktrees, branches, and any environment files Odyn copies between them on your machine.
• Sign-in tokens for the services you connect (GitHub, Linear, Notion, Slack, Google, and so on). These are encrypted using your operating system’s own secure storage (Keychain on macOS, Credential Manager on Windows) and stay on your device.

If you delete the app’s data folder, that information is gone — we hold no copy of it.

Account information

To use Odyn you sign in with GitHub. Our authentication provider, Clerk, handles this and stores your account identifier, name, email address, and profile picture. We use it to identify you across devices and to let you join teams.

Team and shared workspace data

If you create or join a team, the shared parts of a project — its name, icon, notes, canvases, reference links, and uploaded files — are synced to our backend (Convex) so your teammates can see them. Your chats, code, and worktrees are never shared this way; they remain local to each person’s machine.

Shared environment variables are a special case. Their values are encrypted on your computer, using a passphrase your team chooses that we never receive, and only the encrypted result is stored. We cannot read your secrets. Variable names and file paths are stored unencrypted so the app can organise them.

Diagnostics and analytics (only with your consent)

When you first open Odyn we ask whether you’re happy for us to receive diagnostics. If you say no, nothing is sent. If you say yes, we collect:

• Crash and error reports(via Sentry) — what went wrong, which part of the app it happened in, and basic performance timings. We strip file paths and shorten free text before sending so your prompts, code, and folder layout aren’t included.
• Product analytics (via Aptabase) — anonymous counts of which features are used, plus your app version and operating system. No content, no identifiers we can trace back to your projects.

Diagnostics are only ever sent from released builds, never from development or test runs. You can change your mind at any time in Settings.

Website

The Odyn website stores a small preference in your browser to remember whether you prefer light or dark mode. It sets no advertising cookies and does not track you across other sites. Our hosting providers keep short-lived server logs, including IP addresses, for security and reliability.

Odyn is a shell around AI coding agents. When you send a message, the contents of that message — and whatever files, commands, and output the agent needs to do the work — are sent directly from your computer to the provider you selected: Anthropic (Claude), OpenAI (Codex), Cursor, or Apple’s on-device model, which sends nothing anywhere.

Those requests use your own account with that provider and do not pass through our servers. What each provider does with that data — including whether they retain it or train on it — is governed by their own terms and privacy policies, not ours. Please read them for the providers you use.

The same applies to the addons you install (GitHub, Linear, Notion, Slack, Google Workspace, Sentry, Stripe, Supabase, and others). Connecting one authorises Odyn, running on your machine, to talk to that service on your behalf. The credential stays on your device, and the data exchanged goes straight between your computer and that service.

If you connect a Google service to Odyn, this section explains exactly what happens to your Google data. It applies in addition to everything else on this page, and where the two appear to differ, this section is the one that governs Google user data.

What we access

Odyn only ever asks for the narrowest permissions the addon you chose actually needs, and Google shows you those permissions on its own consent screen before anything is granted. Depending on which addons you install, that can include the contents of the Google Docs, Sheets and Slides files you ask Odyn to work with, files Odyn creates for you, your calendar events, and your basic profile details (name, email address, profile picture) so the app can show which account is connected.

Odyn does not request broad access to your Google Drive.

How we use it

Google user data is used for one purpose only: carrying out the request you made in the app — reading a document you referred to, updating a sheet you asked to change, checking the day’s calendar for a summary you asked for. It is never used for advertising, never sold, and never used to train, retrain, or improve any artificial-intelligence or machine-learning model, including our own.

Who we share, transfer, or disclose it to

We do not sell, rent, or trade your Google user data, and we do not share, transfer, or disclose it to any third party other than in the limited circumstances below:

• The AI provider you selected— Anthropic (Claude), OpenAI (Codex), or Cursor. When you ask an agent to work with a Google document, sheet, slide deck, or calendar, the parts needed to answer you are sent from your own computer to that provider, using your own account with them, solely to fulfil the request you made. This is the only routine disclosure of Google user data, it happens only when you ask for it, and if you choose Apple’s on-device model nothing is sent anywhere at all. What each provider does with data it receives is governed by their own privacy policy.
• Nobody else. Google user data is never sent to us, to our hosting, authentication, storage, or analytics providers, or to any other addon you have installed. It is never included in crash reports or product analytics. Our own servers never receive it and hold no copy of it.
• Where the law requires it — we would only disclose data in response to a valid legal request, and only what is strictly required. Because Google user data is never stored on our servers, in practice we hold nothing to disclose.
• A change of ownership — if New Genre Studio were ever sold or merged, we would not transfer Google user data to the new owner; it lives on your device, and you would simply reconnect or disconnect as you chose.

Odyn’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it

Google user data — including any sensitive or restricted data covered by your grant — is protected by the following measures:

• Encrypted in transit. Every connection to Google, and every request an addon makes on your behalf, uses HTTPS with TLS. Nothing is transmitted unencrypted.
• Encrypted at rest.Your Google sign-in tokens are encrypted on your own device using your operating system’s secure credential storage — Keychain on macOS, Credential Manager on Windows, the system keyring on Linux. If secure storage is unavailable, the token is held in memory for that session only and is never written to disk.
• Credentials never leave your machine.Google tokens are attached to requests locally, on your own computer. They are never uploaded to our servers, never written into any AI assistant’s configuration file, and never shared between users or devices.
• No server-side copies. We do not store, cache, index, or back up the contents of your Google documents, files, or calendar events. There is no database of Google user data on our side to be breached.
• Access controls and secret handling. Our backend holds only the confidential OAuth client secret required to complete a sign-in. It is stored as an encrypted secret with our hosting provider, is accessible only to the named maintainer under multi-factor authentication, and is never included in the app you download.
• Least privilege. Odyn requests the narrowest scopes that make each feature work, and deliberately omits broad Drive access. Sensitive scopes are requested only where the feature genuinely requires them.
• Secure development. The app is code-signed and notarised, dependencies are kept current, and changes to authentication and credential handling are reviewed before release.

Keeping and deleting it

Because Google user data is only ever held on your own device, you remove it by disconnecting the addon in Odyn, which deletes the stored token and, where the service supports it, revokes the grant with Google. You can also revoke Odyn’s access at any time from your Google account’s permissions page. Uninstalling Odyn, or deleting its data folder, removes it as well. If you have any question about Google data specifically, email jack@newgenre.studio.

We use a small number of providers to run Odyn:

• Clerk — sign-in, accounts, and team membership.
• Convex — storage for shared team project data.
• Cloudflare — our backend API, which holds the secret keys that must not ship inside the app, and website delivery.
• Vercel — hosting for this website.
• Sentry and Aptabase — crash reporting and product analytics, only if you consented.

Some of these providers process data outside the UK and the European Economic Area. Where they do, transfers are covered by appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

Under UK GDPR, we rely on:

• Contract— to give you an account, sync your team’s shared data, and provide the app you asked for.
• Consent — for crash reporting and analytics. You can withdraw it at any time in Settings without losing any functionality.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing faults.

Account and team data is kept while your account is active. If you delete your account, we delete the associated account and team records. Crash reports and analytics are kept for up to 90 days and then deleted or aggregated. Server logs are kept for a short period for security purposes. Anything stored only on your computer is deleted when you delete it.

You have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, ask for it in a portable format, and withdraw consent for diagnostics. To exercise any of these, email jack@newgenre.studio — we aim to respond within 30 days.

If you think we have handled your data badly, you can complain to the UK Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to put it right first.

Odyn is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has given us data, contact us and we will delete it.

We may update this policy as Odyn changes. The date at the top always reflects the current version, and we’ll tell you in the app before any change that meaningfully affects you.

See also our Terms of Service.