Privacy Policy

• Account.A random account id, the time it was created, the network address it was created from, and, if you arrived from another site or through a campaign link before signing up, the name of that source (see Cookies below). The network addresses recorded when an account is created and at each sign-in are used to cap how many new accounts one network can open per day, to refuse invite rewards between accounts that have signed in from the same network, and to help us investigate abuse. While you are signed in, and whenever you call the API with a key, the account also keeps the country or region, state or province and city you were last in (determined from the network address by Cloudflare, the network provider in front of the site, and passed on with the request); it is visible only to the operator in the administration area, is used to help investigate abuse, and is replaced whenever it changes, so only the latest one is kept; a location recorded on a signed-in visit to the site takes precedence and is not replaced by one recorded on an API call. When an account has no such record yet, the operator looks up its approximate country or region, state or province and city from the network address already recorded for it (the one from the most recent sign-in, or else the one it was created from) in an offline database kept on the server (the free edition of DB-IP), and marks the result as an estimate in the administration area; the lookup runs on the server, so the address is not sent to any third party for it. Your next signed-in visit or API call replaces the estimate with the location actually recorded. While you use the pages of the site signed in, they also send the time zone and language settings of your computer with each request, and the account keeps the latest values; the operator also looks up which network operator the address above belongs to, in the same offline database (the free edition of DB-IP). All of this is visible only to the operator in the administration area and is used to understand where users are and to help investigate abuse.
• Sign-in identity.The email address you verified with a code, and, if you sign in with Google, the account identifier, email address and profile picture Google reports; if you sign in with GitHub, your GitHub account number, a verified email address from your GitHub account and your GitHub profile picture; if you sign in with Discord, your Discord account number, the verified email address of your Discord account and your Discord profile picture; if you sign in with Microsoft, your Microsoft account identifier and the email address of your Microsoft account; if you sign in with Hugging Face, your Hugging Face account number, the verified email address of your Hugging Face account and your Hugging Face profile picture; if you sign in with Reddit or Telegram, your Reddit or Telegram account number, together with the email address you then verify with a code. Reddit also reports your username, and Telegram your display name and username; these are used only to show you which account is being linked while you verify that email address (15 minutes at most) and are not stored after that. Of a Telegram account only the account number is kept; no phone number or profile picture is taken. Nothing else is taken from Google, GitHub, Discord, Microsoft, Hugging Face, Reddit or Telegram. An address written with a plus tag before the @ (such as name+tag) is treated as the same address without the tag, and for gmail.com and googlemail.com addresses dots before the @ are ignored, so these forms all sign in to one account.
• Sign-in codes.Each code is stored as a salted hash, expires after 10 minutes, and is deleted once used. We also count how many codes were requested and how many sign-ins failed for an address on a given day, and discard those counts when the day ends.
• Password.A password is optional. If you set one, only a salted hash of it is stored, and we cannot read the password itself. We also count how many wrong passwords were entered for an address on a given day, and discard that count when the day ends.
• Signed-in devices.For every browser you sign in from: a hashed session token, when it signed in and was last seen, a shortened browser identifier and the network address. A session lasts 30 days. The account page lists these devices and lets you sign the others out.
• Keys.Only an irreversible hash of each key, so a copy of our database cannot be used to spend anyone's balance. Alongside it, the name, spending cap and expiry date you set for the key, if any.
• Balance and counters.Current balance, the amounts added and spent in total, spending per day for the last few days (with a per-day count by model and by the tool that made the calls), how many pictures the account has drawn today, the number of wrong claim codes entered today, the number of surveys completed, and the bonus calls earned from surveys that have not been used yet. An account opened before check-ins were withdrawn may still hold what was recorded for them then (check-in days); it stays with the account until the account is deleted.
• Activity log.The last 40 events on the account: sign-ins (with the browser identifier), shares created, payments and claim codes, signing up through an invite link and invite rewards, promotion rewards, the reward for a first published picture, survey rewards and their reversals, adjustments made by the operator, and model calls; events recorded before check-ins were withdrawn stay until newer ones replace them. A model-call entry holds the time, the model and the amount used (marked free for free models), never the content (excerpts of calls made with an API key are described under API call content below).
• Invites.Your invite code, the account that invited you, and the accounts you invited, with the time and whether the reward was given; and how many free answers from Claude, GPT and other big models the account has received and how many it has used, and until when a raised free-model call limit earned by inviting lasts. The address you submit for the promotion reward is kept on the account too, with the time it was submitted and the result of its review; only the latest submission of an account is kept. Whether the account has received the reward for its first published picture is kept on the account too, with the time and the number of free answers given.
• Survey transactions.For each survey the partner reports: its transaction id, your account id, the amount in US dollars the partner reports for it, the number of bonus calls added, and whether it was reversed. Kept for 30 days so that repeated notices are ignored and reversals can be matched to the original reward.
• Profile.The name and the picture you set on your account page, if any. If you have not uploaded a picture and sign in with Google, GitHub, Discord or Hugging Face, a copy of that account's profile picture is taken at sign-in and used as your picture on this site; once you remove it, no copy is taken again. The name is shown only on this site and is not used to sign in; the picture is kept as received and replaced or deleted when you change or remove it.
• Preferences.Interface language and which email alerts you have switched on.
• Feedback.What you send from the feedback page: the kind you chose, the part of the site it concerns, the text, the email address you left (or, when signed in, the address of your account), the account id when signed in, the page language, and the network address it was sent from, which is used only to limit how many submissions a network can make in a day. Each submission is emailed to the operator and kept until the operator has dealt with it and deletes it.
• Top-ups.How much the account has ever topped up, and how much it has spent today on Claude, GPT and other big models. The payments themselves are described under Payments below.
• Provider keys.If you connect API keys from other AI providers on the My providers page, each key is encrypted before it is stored and is used only to send your own requests to that provider and to fetch its model list. The site shows only the last four characters of a key and never displays it again. Disconnecting a provider deletes the key at once. The site operator can see which providers are connected and the last four characters, not the key.
• Conversations.Every conversation you have on the chat page is saved to your account: the messages you sent, the replies, the model used and the time. For a message that carried images, only the number of images is saved, not the images. For a message that carried a file, the text read from the file is saved with the message; the file itself is never uploaded. Up to 50 conversations are kept per account. You can rename or delete any of them, or delete all of them, on the chat page; deletion takes effect immediately. We do not use them to train models. The operator can read them in full in the administration area, to understand how the site is used; apart from that, they are not shown to anyone unless you share them. The messages are, however, sent to the model provider that answers them; see “Your prompts”.
• Shared conversations.When you press Share on the chat page, the messages you chose are copied to our server under a random link and can be read by anyone who has that link. A share is deleted after 90 days, or earlier if you delete it from the console. Besides the messages, a share keeps only the number of times it has been opened.
• Visit statistics.Each time a page of the site is loaded in the browser, the server counts the visit; API calls, moving between pages within the site, recognisable automated crawlers, pages that did not open (a requested address that does not exist, for example) and the operator’s own visits while signed in are not counted. Page loads from the network ranges of large cloud-hosting providers, which are almost always automated, are also left out of every figure described below; only the number of such distinct visitors per day is kept (those ranges are taken from public internet routing records). The aggregate records the number of page loads per day, which pages were loaded, the visitor’s country or region (determined from the network address by Cloudflare, the network provider in front of the site, and passed on with the request), the visitor’s device type and browser family (recognised from the browser identifier and counted per day only), and where visits came from: the campaign name in the link (utm_source) if there is one, otherwise the domain of the referring site, or “direct” when there is none. Distinct visitors per day are counted with a one-way hash of the network address and browser identifier that changes every day and cannot be turned back into either. These aggregate figures are kept for 90 days. Alongside the aggregate, the server keeps a recent visit detail: one row per page load holding the time, the page (followed by the pages then opened within the site, which the page sends to the server as you move between them), the visit source, the visitor’s network address and country or region, and the first 8 characters of the daily hash above (to tell visitors apart within one day). That detail holds at most 500 rows and nothing older than 7 days; anything beyond is deleted automatically. All of the above is visible only to the operator, in the administration area.
• Account action record.While you are signed in, the server records under your account the pages of this site you open and the actions you take together with how they ended (for example creating a key, calling a model, and why a call failed, such as an insufficient balance). Calls made with an API key are recorded under the account the key belongs to. A record holds the name of the action, the time, the model chosen, the name of the calling tool and the result; it never holds the messages you send, the model’s replies, keys or file contents. Each account keeps at most 300 records and nothing older than 30 days; anything beyond is deleted automatically, and the record is erased when the account is deleted. It is visible only to the operator, in the administration area, is used to understand how features are used and to investigate problems, and is included in the account data you export. In addition, while you are signed in and a page of this site is in front, your browser tells the server about once a minute which page you are on, so that the operator can see in the administration area which accounts are online at that moment; this is held only in the server’s memory, is not added to the record, and is cleared about two minutes after you leave.
• API call content.When a model is called with an API key (/v1/chat/completions, /v1/messages and /v1/responses), the server keeps, under the account the key belongs to, an excerpt of each call: the first 1,000 characters of the system prompt, the first 4,000 characters of the last user message and the first 4,000 characters of the reply, together with the time, how long the call took, the model chosen, the name of the calling tool, the result and the amount used. Calls that did not succeed (for example for an insufficient balance) are recorded too. Images and files themselves are not kept. Each account keeps at most its latest 100 calls and nothing older than 30 days; anything beyond is deleted automatically, and the record is erased when the account is deleted. It is visible only to the operator, in the administration area, is used to understand how the site is used, and is included in the account data you export.
• Suspension and deletion.An account the operator suspends is deleted at once, together with its balance, API keys, conversations, API call content, images, published pictures and works; the operator’s log keeps only the reason and a masked email address. To stop the same person signing up again, the service keeps a one-way hash of the account’s sign-in email address and Google, GitHub, Discord, Microsoft, Hugging Face, Reddit or Telegram account number, which cannot be turned back into the original. An account with a payment on record is suspended rather than deleted, with the reason recorded on the account. Accounts that never signed in and never held a balance are deleted after 3 days without a visit.

Accounts created before 2026-08-31, when signing in became mandatory, may hold no email address at all; such an account is identified only by its key.

The operator can view the records above, including email addresses, in an administration panel, can adjust balances, suspend accounts and download a backup of the data. The data lives on our hosting provider's persistent storage; once a day the server also copies the account data to a backup on the same storage and keeps the last 14 copies. An encrypted copy of each daily backup is also kept in our file storage (Cloudflare R2), likewise for the last 14 copies. The hosting provider (Railway) and the network provider in front of the site (Cloudflare) keep ordinary request logs, including network addresses, under their own retention rules.

• Your key,in this browser's local storage. It leaves your device only inside the requests you make to the API.
• Which conversation is openon the chat page, and any message you have typed but not sent. The conversations themselves are stored on our server with your account, as described above.
• Display settings:interface language and colour scheme.
• A visitor idfor session replay, in local storage, as described under Session replay below.
• Cookies.A sign-in cookie valid for 30 days; a short-lived anti-forgery cookie during Google, GitHub, Discord, Microsoft, Hugging Face, Reddit or Telegram sign-in; after you confirm a Reddit or Telegram account that is not linked to an account here yet, a cookie valid for 15 minutes that holds a one-time ticket until you verify an email address; when you arrive through an invite link, a cookie holding the invite code until you sign in, for a week at most; in some sign-in flows, a cookie remembering which page to return to; and, when you first arrive from another site or through a campaign link, a cookie named onomeo_src, valid for 30 days, that holds only the name of that source and is stored with your account if you sign up in that browser.

Clearing this site’s data removes all of the above from the device. Your balance is not affected: sign in again and the console issues a new key on the same account.

Requests you send to the API, and messages you send on the chat page, are forwarded to the third-party model provider that serves the chosen model, and the reply is returned to you. Images you attach on the chat page, or include in an API request, travel the same way: they are passed to that provider so that it can answer, and we do not store them. Depending on the model, that is one of several third-party model providers. When you use the arena on the chat page, the same message is sent to each model you selected, so each of those providers receives it. Conversations on the chat page are stored with your account, as described under Conversations above. For requests sent directly to the API, an excerpt of the request and the reply is kept, as described under API call content above; the time, the model chosen and the result are recorded as described under Account action record above, and the amount used, for billing and for counting calls. We do not use prompts, replies or conversations to train models. The providers handle what they receive under their own terms, which we do not control; some of them, particularly on free tiers, may retain submitted content or use it to improve their services. We advise against submitting sensitive personal information, such as passwords, identity document numbers or health details. To enforce call limits, the server also counts recent calls per account and per network address; each count is kept only for the length of the limit window (currently 5 hours) and then discarded.

To enforce the Content Policy, prompts for pictures and videos, generated pictures, uploaded pictures, pictures turned into videos, photos given to a picture-editing model, and the titles and pictures of works being published are checked by AI models that serve this site, under the same terms as other requests to model providers described above; a picture that fails is discarded and not stored. The last message of each chat request and API call, and each model reply, are compared with a list of terms on our server and are not sent anywhere for this. For each check we keep a record: the time, the account and its email address, where on the site it happened, the first 200 characters of the prompt, message or reply, the decision, the category, the short reason the checking model gave, and the operator’s review of the decision, if any. Only the operator can see these records. The most recent 5,000 records are kept; older ones are deleted as new ones arrive. When an account is deleted, the account, the email address, the excerpts and the checking model’s words are removed from its records; the time, the place, the category, the decision and the review are kept as the record of how the policy was enforced.

When you upload a work to the Works section, the following is stored and shown.

• What you submit.The address of the work, its title, description, how it was made, the AI tools and the source code address you give, whether you allow it to play on onomeo, whether its site lets other sites embed it (checked by our server, which reads only the reply headers of that address), when it was submitted and reviewed, and the review result with any reason the operator gave.
• Recordings and covers.The screen recording and the cover picture you upload are stored in our file storage (Cloudflare R2) and served from there. Until a work is approved they are listed nowhere, and their addresses are given only to you and the operator. Files uploaded but not used in a submission within an hour are deleted. When a work is rejected, its recording and cover are deleted.
• What is public.Once a work is approved, anyone can see its recording, cover, title, address, description, how it was made, AI tools and source code address, together with your display name and profile picture on this site (without a name, a four-character tag derived from your account id) and the X and GitHub links you add as an author. Your author page lists your approved works. Pictures you publish to the Works page are likewise listed together on a public page of their own, under the same display name, profile picture or tag, with the number of likes they have received. While anonymous mode is on in your account, none of this is shown on your pictures, videos and works, those already published included, and you have no author page or public page; this site still records which account published each of them. Your email address is never shown.
• Views and plays.For each approved work only two totals are kept: how many times it was viewed and how many times someone went to play it. To count each person once a day per work, the server keeps, in memory only and for the current day, the account id or, when signed out, a hash of the network address; this is never written to storage. Views by the author and by the operator are not counted.
• Reports.A report keeps the work, the reason chosen, the time and who sent it: the account id when signed in, otherwise a hash of the network address, used only to stop the same person reporting a work twice. Reports are visible only to the operator.
• Works that play here.A work that plays inside onomeo is another website loaded into the page. Your browser connects to that website directly, and it may collect information about you under its own privacy terms.
• In your browser.Whether you turned on moving to the next work when a recording ends is kept in this browser’s local storage.
• Deletion.Deleting a work deletes its recording and cover. When your account is deleted, including when the operator suspends it, your works with their files and reports, and your author links, are deleted with it. The works records are part of the daily backup and are replaced as the backups roll over, within 14 days.

Sign-in codes; if you leave the alert switched on, at most one notice per day when your balance drops below the alert level the site sets; and, if you leave return reminders switched on, reminder emails sent by the operator by hand rather than automatically, at most one of each kind and usually at least 7 days apart, when the account has not been used since signing up or has gone quiet for a few days; and, if offers and updates are on (on by default for new accounts; they can be turned off at any time), an email when the site has a reward or offer to explain, such as the one about the promotion reward, which carries your invite link; each is sent once and has an unsubscribe link; accounts created before September 26, 2026 are not switched on by default. Emails are delivered through a third-party email service (Resend), which processes the recipient address and message for that purpose.

Top-ups are paid through a third-party payment provider (Ko-fi, Dodo Payments, Whop or Waffo Pancake, as shown on the checkout page), which collects the payment under its own terms and privacy policy; we never receive card or payment account details. When you start a top-up while signed in, we may give that provider your sign-in email or account id so the payment can be added to your account. For each payment, the provider sends us a transaction id, the email address and display name used for the payment, the amount and currency, and the time. We store these with the account the payment was attached to and, when the payment matched no account, the claim code we emailed. We use them to add the payment to the right account, to list your top-ups (the day, the amount paid and the amount added) on your own account page, to show the payment on the site owner’s admin page, and to answer a dispute or refund; they are kept with that record for as long as the account exists and for as long as bookkeeping requires. When a payment is added to an account, we email that account’s sign-in address once to say so, with the amount added and the balance. If the email used for the payment is not the one you sign in with here and the payment was not tied to an account, we email that address once with the claim code. Write to [email protected] to have the name and email on a payment record removed.

Surveys are provided by CPX Research, operated by Make Opinion GmbH, Berlin, Germany. When you open the survey wall, the only thing we send to the partner is your account id. Inside the wall, the partner asks its own profiling questions, sets its own cookies and sees your network address and device details; all of that, including the answers you give, is handled by the partner under its own privacy policy, not by this one. What the partner sends back to us is a transaction id, an amount in US dollars, and whether the survey was completed or reversed, tied to your account id; from that amount we work out the bonus calls added to your account. We never receive your answers.

Google’s advertising script is loaded on our pages. It is required for Google to verify the site and, if display advertising is switched on, to serve ads. Rewarded ads are not offered. Third-party vendors, including Google, may use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising at google.com/settings/ads, opt out of a wider list of vendors at aboutads.info/choices, and read how Google handles data from sites that use its services at policies.google.com/technologies/partner-sites.

On the web chat page, a card marked “Sponsored” may appear under every third answer; it is provided by Idlen. To choose it, we send Idlen the technical keywords recognised in that question (for example Python or React) and the kind of question, together with one-way hashes of the conversation and account identifiers; the text of the question itself is not sent. Idlen records that the card was shown. When you click the card, we report the click to Idlen and the advertiser’s site opens in a new page, under that site’s own policies. The card never appears in answers returned through the API.

To see where visitors get stuck, our pages load a session replay script from PostHog (PostHog Inc.; the data is stored on its servers in the European Union). It records how a page is used: which pages open, where the pointer moves, what is clicked and scrolled, and the size of the browser window. Everything you type is masked before it leaves your browser, and so is every piece of text other than the site’s own labels (buttons, links and headings): messages and replies on the chat page, names, email addresses and keys are never sent. The operator’s administration pages are not recorded. A recording is tied to a random visitor id kept in this browser’s local storage and, while you are signed in, to your account id, never to your email address; your network address is dropped by PostHog on arrival. Recordings are kept for 30 days and then deleted. Only the operator can view them, to understand where the site is confusing and to investigate problems. For recordings with more than a minute of activity, PostHog also writes a one-line summary for the operator using a Google Gemini model it runs; that model sees only the same masked recording. When a page fails, the same script also records the error (its message, where in the code it happened and the address of the page), so that faults can be found and fixed.

While you are not signed in, our pages load Google’s sign-in script (from accounts.google.com). If your browser is signed in to a Google account, you will see a prompt offering to continue with that account. When the script loads, Google receives your IP address and browser information and can read and write its own cookies. Only after you confirm the prompt does this site receive that Google account’s identifier, email address and profile picture, which are used for the same purpose as when you choose “Continue with Google”.

Apart from the session replay described above, we load no third-party analytics script and do no cross-site tracking of our own; visits are counted by our own server, as described above. We do not sell or rent any of the data above. We do not receive your survey answers, and we do not use what you send to the models to train models.

The Data tab of the account page downloads everything the server holds about your account as a JSON file, and deletes the account: the account, its balance, keys, activity log, conversations, API call content, images, published pictures, works, profile picture and shared conversations are removed at once. To stop an account being deleted and opened again straight away, a one-way hash of its sign-in email address and Google, GitHub, Discord, Microsoft, Hugging Face, Reddit or Telegram account number is kept for 30 days, during which the same identity cannot register again. Payment records keep the payer email, amount and date for bookkeeping. If you cannot sign in, write to the address below from the email address the account is signed in with. Copies of the account in the daily backups are replaced as the backups roll over, within 14 days. Survey transaction records, which contain only the account id, an amount and a number of bonus calls, expire on their own after 30 days.

[email protected]