OmniCloudPrivacy Policy
This policy describes how the OmniCloud app for iPhone and iPad (“OmniCloud”, “the app”, “we”) handles information. OmniCloud is a client for cloud providers you already use. It is designed to keep your data on your device.
Summary
- OmniCloud has no user accounts and operates no servers. We do not collect, receive or store any of your data.
- The app communicates directly from your device with the cloud providers you connect (Google Cloud, Oracle Cloud, Hetzner Cloud) and with Apple services such as the App Store.
- Credentials are stored only in your device’s Keychain, limited to this device and not synced to iCloud.
- There are no advertisements, analytics, tracking or third-party SDKs that collect data.
Information the app stores on your device
| Information | Where it is kept | Purpose |
|---|---|---|
| Cloud credentials: Google service account keys or sign-in tokens, Oracle API keys, Hetzner API tokens | Device Keychain (this device only) | Authenticating your requests to the provider you connected |
| Account names you enter, project and region identifiers | Local database on the device | Showing and organizing your connected accounts |
| Cached resource details: instance names, states, IP addresses, machine types, networks, firewall rules | Local database on the device | Showing your resources quickly and offline |
| Public price lists from Google Cloud | App cache on the device | Estimating costs and comparing regions |
| Preferences: language, appearance, app lock | Device settings | Remembering your choices |
Root passwords generated when you create a server are shown to you once and are never stored. On Google Cloud, the password is sent to your instance only as a one-way SHA-512 hash and removed from the instance’s metadata after it has been applied.
Data accessed through Google APIs
When you connect Google Cloud with Sign in with Google, OmniCloud requests these permissions:
https://www.googleapis.com/auth/cloud-platform: to read and manage Google Cloud resources in the projects you choose.openidandemail: to show which Google account is connected.
With this access, the app runs these actions, and only when you ask for them:
- Lists your Google Cloud projects so that you can choose one.
- In the project you choose:
- Enables the Compute Engine, IAM, Cloud Resource Manager and Cloud Billing (price catalog) APIs.
- Creates a service account named
omnicloud-ios. - Grants it the Compute Admin and Service Account User roles.
- Creates a key for it.
- Reads, creates, starts, stops, resizes and deletes Compute Engine instances, and reads and changes VPC firewall rules and subnets.
- Reads Google’s public Compute Engine price catalog.
Data received from Google APIs is used only to show you your resources and to carry out the actions you request. It is stored only on your device as described above, and it is never transferred to us or to any third party, never used for advertising, and never used to train AI or machine-learning models. No human reads it.
OmniCloud’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other cloud providers
Oracle Cloud and Hetzner Cloud credentials that you enter are used only to call those providers’ APIs from your device, in the same way. Each provider processes your requests under its own privacy policy.
Sharing
We do not sell, share or transfer your information. The only parties that receive it are the cloud providers you connect, and only to fulfil your requests. Purchases are handled by Apple through the App Store.
Retention and deletion
- Data & Privacy in the app can clear all cached resource data, or remove all accounts on this device together with their Keychain credentials.
- Deleting the app removes its local database and cache. iOS can keep Keychain items after an app is deleted; if you reinstall OmniCloud, it removes any stored credentials that no longer belong to an account. To remove them right away, use remove all accounts before deleting the app.
Resources the app created in your cloud accounts, such as the omnicloud-ios service account and
servers, belong to you and remain until you delete them in your cloud console.
Revoking Google access
- Remove OmniCloud’s access to your Google account at myaccount.google.com/permissions.
- In the Google Cloud console, under IAM & Admin › Service accounts, you can delete the
omnicloud-iosservice account or its keys.
Security
Credentials are protected by iOS Keychain encryption and are only available while the device is unlocked. All network requests use HTTPS directly to the provider. You can also lock the app with Face ID or your device passcode.
Children
OmniCloud is a tool for managing cloud infrastructure and is not directed to children under 13.
Changes
If this policy changes, the updated version will be posted on this page with a new effective date.
Contact
Questions about this policy: lovele.cn@gmail.com