Omumu Pod Privacy Policy

Last updated: 15 October 2026

Omumu Pod is a mobile app published by Omumu Solutions AS ("Omumu", "we", "us") that lets you record, trim, and merge podcast episodes on your phone and upload them to an Omumu site. This policy explains what information the app collects, how it's used, and who it's shared with.

Information the app collects

Audio recordings. When you record takes, the audio is captured by your device's microphone and stored in persistent app storage on your device while you edit (reorder, trim, merge). Recordings are not sent anywhere unless you choose to upload the finished episode.

Account credentials. Signing in uses OAuth 2.0 against the Omumu site you specify. The app stores the resulting access token, refresh token, app client ID, and site address on your device, in your operating system's secure credential storage (iOS Keychain / Android Keystore). These stay on your device and are only sent back to that site to authorize your requests. The app does not receive your site password; the site verifies it in your browser.

Episode details you enter. Title, show notes, episode type, and season/episode numbers you type before uploading.

Technical data received by the site. Like any website, the Omumu site and its content delivery network receive your IP address, device and app information (user agent), and the time of each request when the app signs in or uploads. This is used to operate and secure the service.

The app does not use analytics, crash reporting, or advertising SDKs, and does not collect location, contacts, or any data beyond what's described above.

How this information is used and shared

Recordings and episode details are only transmitted when you tap Upload, and only to the Omumu site you signed into — the same site address you typed in during sign-in. That site then stores, masters, and (if you choose) publishes the episode into its podcast feed. We do not sell your data or use recordings for advertising.

Omumu uses these service providers (data processors) to run the service:

• DigitalOcean hosts the application servers and database in New York, United States. Account data, episode details and transcripts are stored there, and audio passes through the server while it is mastered with FFmpeg.
• Bunny.net (BunnyWay d.o.o., Slovenia) stores original and processed audio in Frankfurt, Germany, with replication to Stockholm, Sweden. Published audio is delivered through Bunny.net's content delivery network, whose caches may hold copies in other countries.
• AssemblyAI transcribes episodes when transcription is configured and the site has the required feature and quota. On publishing, the server gives AssemblyAI's EU service a link to the mastered audio; AssemblyAI downloads and transcribes it, and the transcript is stored with the episode. AssemblyAI states that files sent to its EU service stay in the EU and are not used for model training.

International transfers

Data stored with DigitalOcean is transferred to the United States. DigitalOcean is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection, and its data processing agreement includes the EU Standard Contractual Clauses as a fallback. AssemblyAI is a U.S. company that is also certified under the EU-U.S. Data Privacy Framework. Published episodes are public and can be delivered to listeners anywhere through the CDN.

Data retention and deletion

• Recorded takes are saved in persistent app storage so an interrupted session can be resumed. Delete individual takes in the editor or discard the saved session. Exported M4As use temporary app storage. Signing out does not delete audio. Device backup settings may affect additional copies.
• Sign-in credentials are stored per site. Signing out removes the credentials for the current site; credentials saved for other sites are separate. On iOS, Keychain entries can survive uninstalling the app, so sign out first if you want them removed.
• Uploaded audio and metadata remain on the site until removed. Episode deletion schedules destruction of unused original, mastered and rendered audio resources; files still referenced elsewhere are retained. CDN and browser caching is configured for one month. Removing an episode is not an immediate recall of cached copies; server-side deletion requests also require cache purging. Public podcast directories and listeners can retain copies after publication.
• DigitalOcean database backups expire after seven days and weekly application-server backups after four weeks. Deleted data may remain in these restricted backups until expiry.
• AssemblyAI deletes submitted audio and transcripts after 30 days; its deletion process can take additional processing time. Transcripts stored with the episode are deleted with the episode.
• Billing and security metadata, including technical request data, may have separate retention.

Contact privacy@omumu.com (and the site owner, if it isn't you) for server-side deletion requests.

Your rights under GDPR

If you're in the European Economic Area, the General Data Protection Regulation gives you rights over the personal data described above. You can ask to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to our processing
• Receive your data in a portable format

Sign-in credentials stored on your device can already be deleted yourself by signing out. For anything else — or for data held by the Omumu site you upload to — contact privacy@omumu.com or that site's owner. You can also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

Legal basis for processing. We process credentials, audio and episode metadata as necessary to provide the recording and upload service you request (performance of a contract). We process technical request data to keep the service secure and working, based on our legitimate interest in doing so. Microphone permission controls access to recording; it does not authorize unrelated uses of your audio.

Data controller. Every Omumu site is hosted by Omumu Solutions AS and owned by the Omumu customer who set it up. Omumu Solutions AS is the data controller for the app, your Omumu account and the data needed to provide the service to you. Episodes and other content on a site are controlled by the site's owner: if you upload to your own site, that's you; if you upload to a site someone else owns, that owner decides how the content is used, and Omumu processes it on their behalf as a data processor.

Permissions the app requests

• Microphone — to record podcast takes. Recording starts only when you choose Record and continues while the screen is locked or other apps are open until you stop it or close the recording screen.
• Notifications — to show a persistent notification required by Android while recording continues in the background or the screen is locked.
• Internet — to sign in and upload episodes.

Children's privacy

Omumu Pod is not directed at children and we do not knowingly collect information from anyone under 13.

Changes to this policy

We may update this policy as the app changes. We'll update the "Last updated" date above when we do.

Contact

Omumu Solutions AS
Organisation number 929 673 956
Åsengata 4C, 0480 Oslo, Norway

Questions about this policy or your data can be sent to privacy@omumu.com.