Privacy Policy

Last updated: June 17, 2026

This Privacy Policy describes how Ouranoos collects, uses, stores, and protects information when you interact with the Ouranoos project — its website, documentation, Flutter app, and public cloud infrastructure.

Ouranoos is end-to-end encrypted cloud storage, being built as a network of independent providers. Privacy is embedded in product design: files are encrypted on your device before upload, providers only see ciphertext, and private keys never leave your control.

Where the product stands today

Client-side encryption, the on-chain storage contracts and the payment rails are live. The network of independent provider nodes is under active development: until it is running, a file you upload may have no replica outside your own device. We would rather say so here than let this page imply otherwise.

This policy applies only to Ouranoos. Third-party wallets, storage providers, or enterprise deployments built on top of Ouranoos are governed by their own privacy policies.

1. Scope

This policy covers:

• The Ouranoos website and documentation (ouranoos.com, ouranoos.web.app, and affiliated domains)
• The Ouranoos Flutter app and related open-source components published under the Ouranoos GitHub repository
• Public Ouranoos infrastructure — documented RPC endpoints, IPFS/libp2p interfaces, and EmpoorioChain storage pallets

This policy does not cover:

• Third-party wallets (e.g. Eoonia), identity protocols (e.g. KryptoOS), or storage providers you choose independently
• Unofficial forks or modified distributions of Ouranoos software

2. Data controller

Ouranoos is the encrypted cloud storage product of the Empoorio ecosystem.

For data protection purposes related to this website and official Ouranoos channels, contact the team via:

• Contact form: /contact
• GitHub: github.com/empoorio/ouranoos
• Community: Discord and X / @ouranoos

3. Core privacy principles

Ouranoos is engineered around five principles:

1. Client-side encryption — AES-256-GCM before any provider receives file bytes
2. Metadata protection — local encryption for paths and file metadata where supported
3. On-chain transparency — deals, proofs, and payments on EmpoorioChain without storing plaintext file content
4. Minimal logging — observability without PII, full CIDs, or raw addresses in support exports
5. User control — you choose providers, allowance limits, and withdrawal flows via Eoonia

4. What stays off-chain vs on-chain

Off-chain (on your device or chosen storage)

• Plaintext files and decryption keys
• Encrypted chunks and manifests
• Locally encrypted metadata (ouranoos_metadata.json)

On-chain (public ledger)

• Storage deal ids, provider ids, proof records
• Allowance and payment transaction hashes
• Identity commitments from KryptoOS device credentials (no PII)

5. Information we collect

What we collect depends on how you interact with Ouranoos.

5.1 Website visitors

When you browse the Ouranoos site or read docs, we may collect:

• Server logs — IP address, user agent, requested URL, timestamp (hosting/CDN)
• Analytics — aggregate page views on production builds (see §9)
• Contact form — name, email, and message content you submit voluntarily

5.2 App and SDK users

The Ouranoos app never transmits your file contents or your encryption keys: files are encrypted on your device before upload, and the key stays under your control. What the official mobile app (Google Play, com.empoorio.ouranoos) does process is listed below.

Data	Details	Purpose
Account identity	Email address, display name and profile picture, taken from your Google account if you choose Continue with Google, or the email you supply when registering	Create and authenticate your account
Stored files	Your files, encrypted on-device before upload, plus operational metadata (size, date, identifier) which is not encrypted	Provide the storage service
Photos, video and audio	Only the items you explicitly pick to upload	Let you choose what to upload
Camera	Images captured when you start the capture	Upload photos, scan codes
Device information	Model, OS version, free space and battery level	Tune synchronisation and diagnose errors
Wallet data	Public wallet address and EmpoorioChain transactions	Manage balance and payments in DMS
Biometrics	Fingerprint or face, processed by your device only — never sent to or stored on our servers	Unlock the app

The app requests camera, media and biometric permissions only for the purposes above. It does not collect contacts, location or health data, and contains no advertising SDK.

If you self-host Ouranoos or run a fork, you are responsible for what your own deployment collects.

5.3 Providers and integrators

Organizations operating storage nodes act as independent controllers for operational data they collect. They must publish their own privacy notices.

6. How we use information

We use information collected through official Ouranoos channels to:

• Operate, secure, and improve the website and documentation
• Respond to support, security, and partnership inquiries
• Measure aggregate documentation usage
• Comply with legal obligations

We do not sell personal information for cross-context behavioral advertising.

7. Your rights

Depending on your jurisdiction, you may request access, correction, deletion, or restriction of personal data we hold via official channels.

To delete your account and its data, see Delete your account. That page explains how to do it from inside the Ouranoos Cloud app (com.empoorio.ouranoos) or by request, what is deleted, and what is kept.

Submit requests via /contact with the subject "Privacy Request — Ouranoos".

Because storage keys are user-controlled, we cannot recover lost encryption keys or decrypt your files.

7.1 GDPR

If you are in the European Economic Area, Regulation (EU) 2016/679 (GDPR) grants you the rights of access, rectification, erasure, objection, restriction and portability. We answer requests within one month. You may also lodge a complaint with your supervisory authority — in Spain, the Agencia Espanola de Proteccion de Datos (aepd.es).

7.2 Data retention

We keep your account data for as long as your account stays active. Server logs are retained for up to 90 days. Transactions already written to the public blockchain are immutable and cannot be erased.

7.3 Deleting your account and data

You can delete your account and all associated data at any time:

• In the app — Settings, then Delete account
• By email — write to the address in §13 with the subject "Delete my account"

Deletion removes your stored files, their metadata and your account identity within a maximum of 30 days. On-chain transaction records cannot be deleted, as explained in §7.2.

8. Security

Ouranoos applies administrative, technical, and organizational controls described in the Security guide, including:

• AEAD tamper detection on chunks and manifests
• Fail-closed verification for wallet callback binding
• Provider safe-exit procedures before releasing reserved space

Report vulnerabilities via GitHub security advisories or /contact with "Security Report — Ouranoos".

9. Third-party services

The Ouranoos website may use:

• Google Analytics on production builds (disabled on localhost)
• Firebase Hosting / Google Cloud for static site delivery (ouranoos.web.app)
• GitHub for source code and issue tracking

Each provider processes data under its own terms.

10. Cookies

The site uses essential cookies for appearance preferences and, in production, analytics cookies such as _ga. We do not use advertising or retargeting pixels.

11. Children

Ouranoos materials are not directed at children under 16. We do not knowingly collect children's data through official channels.

12. Changes

We may update this policy as the product matures. Material changes will be reflected in the "Last updated" date above.

13. Contact

Questions about this policy: /contact with "Privacy — Ouranoos".