Privacy

Privacy Policy

Effective June 27, 2026. Updated October 14, 2026.

Ohiyo is built around a simple promise: the hosted server should not be able to read your private messages. This policy explains what the official hosted service at ohiyo.gg, app.ohiyo.gg, and ohiyo-server-production.up.railway.app handles. If you self-host Ohiyo, your host controls its own data practices.

For a more technical, honest boundary of what Ohiyo protects and what metadata remains, read the public privacy threat model.

What we collect

• Account data: username, display name, password hash, two-factor sign-in settings if you turn it on (the authenticator secret, stored encrypted, and hashes of your recovery codes), avatar/profile details, linked-device records, sessions, roles, server membership, invites, preferences, and similar app state.
• Content: messages (as ciphertext for end-to-end encrypted DMs and group chats; as readable text for server channels and for conversations where encryption is off), encrypted group/key-backup blobs, file metadata, uploaded files/attachments, emoji, server icons, and other content needed to deliver the service.
• Operational data: IP-derived rate-limit keys, request metadata, logs, crash/error details, abuse-prevention signals, and infrastructure metrics needed to run and secure the service.
• Push notification data: if you enable push, the relay stores device endpoints/tokens, recipient ids, platform type, and delivery timestamps. Push payloads are content-free: they should say only that activity exists, not message text, filenames, channel names, invite codes, or E2E keys.
• Discord import data: if you use Discord import, uploaded/staged import archives and mapped metadata are processed to perform the import. Bot tokens and import internals are treated as private operational data.

What we cannot read by design

Ohiyo offers end-to-end encryption for DMs and group chats, turned on per conversation. For those conversations the hosted server stores and relays ciphertext and does not receive the plaintext. Server channels, polls, and conversations where encryption is off are stored on the server in readable form. Some metadata remains necessary to operate the product, such as usernames, server/channel membership, timestamps, routing information, file records, and moderation/admin state.

How we use data

• Provide accounts, servers, messaging, calls, uploads, search/indexing when enabled, Discord import, Instant Servers, and content-free notifications for sleeping servers.
• Secure the service, prevent abuse, debug failures, enforce limits, and maintain backups.
• Communicate service-critical updates or respond to support/security reports.

We do not run advertising, sell personal data, or add third-party analytics trackers to the landing page.

Backups and retention

The hosted production database and uploads are stored on Railway infrastructure. A copy of the database (not the uploads) is kept in Cloudflare R2 storage and updated every ten seconds, so the service can be restored if the server's storage is lost. The copy holds what the database holds, in the same form: messages in end-to-end encrypted conversations stay ciphertext. Something changed or removed from the live service can stay in that copy for up to three days. Ephemeral logs and staged import files may be retained only as needed for operations, safety, debugging, or legal requirements.

Optional paid hosting

Where paid Instant Servers are enabled, Stripe handles checkout, payment details, invoices and the billing portal under its own privacy policy. Ohiyo sends Stripe account and instance identifiers, not message content or encryption keys. Ohiyo stores Stripe customer, subscription and checkout identifiers, plan status and billing timestamps; it does not receive full card details. Managed community machines use Fly infrastructure where configured; paid hosting is not available on every deployment.

Deleting a hosted server or account first closes pending checkouts and cancels subscriptions. If payment or hosting services fail, deletion stops and can be retried; cancellations or server removals already completed are not rolled back. Billing records and processed event identifiers remain after account deletion to handle late payment events and operational or legal obligations. Stripe customer and invoice records are not erased by deleting an Ohiyo account; contact us about billing-data retention. Exported server databases and uploads may include readable server-channel content and unencrypted files, not just ciphertext.

Your choices

• You can use the web app, desktop app, or self-host your own Ohiyo server.
• You can delete your account in the app, under Settings → Account. It happens at once. Every message you sent is deleted from the server, for everyone. A space you own passes to its longest-standing member, or is deleted if nobody else is in it. Your encryption keys and recovery backup are deleted. Emoji you added to someone else's space, and pictures other people still use, stay. People you wrote to may still have copies on their own devices, and your username becomes free for someone else to take.
• You can change your password under Settings → Account, which signs you out on every other device.
• You can turn on two-factor sign-in under Settings → Account, so signing in also needs a code from an authenticator app or one of your recovery codes.
• You can use built-in security features such as linked-device management, logout everywhere, local key vault controls, recovery-key backup deletion, disappearing messages, and the dead-man switch where available.
• For hosted-service data questions or deletion requests that are not exposed in the app, open a private security/contact thread through the GitHub repository.

Links to other sites

A YouTube link or a link to a post on X in a chat shows a play button. The player is only loaded when you press it, and then your browser loads the video or post directly from YouTube or X, under their own policies. In chats that are not end-to-end encrypted, Ohiyo also shows link previews: the Ohiyo server reads the linked page's title and description, and your browser loads the preview picture (for a YouTube link, the video's picture) from the site it lives on. End-to-end encrypted chats show no previews, so nothing is fetched there until you press play or follow a link.

The GIF picker searches KLIPY, when GIF search is switched on for the service you use. Your search goes from the Ohiyo server to KLIPY, so KLIPY doesn't get your IP address or any id of yours with it. The GIF previews in the picker, and GIFs people send, load from KLIPY's servers in your browser, like any picture linked in a chat, so KLIPY sees your IP address then. Encrypted chats offer no GIF picker.

Third-party providers

Ohiyo currently relies on these providers. Railway hosts the app, the server, the database and uploads. Cloudflare stores the copy of the database described under Backups and retention, and provides the relay for calls that can't connect directly. GitHub hosts this website, the source code and the desktop releases. Porkbun provides the domain name. Their processing is governed by their own terms and policies.

One thing in the app reaches Google: when you join a call, it asks Google's public STUN servers how your device can be reached. Google sees your IP address, not your messages or your call. The app's typefaces ship with the app, so opening Ohiyo doesn't contact Google Fonts. Calls connect directly between the people in them whenever they can, so the people you call can usually see your IP address too.

Some networks don't allow a direct connection. Then Ohiyo can pass the call through a relay run by Cloudflare. Cloudflare sees the IP addresses of the people in the call and carries its sound and video, which stay encrypted between them, so Cloudflare can't hear or see the call.

Changes

We may update this policy as the service moves from launch to broader availability. Material changes will be reflected on this page.