Privacy Policy
In short
- Ova is run by a private individual in Estonia, so the EU’s data protection law, the GDPR, applies.
- Your render files stay on your computer. An AI action sends only what it needs, through our gateway, to the AI provider that runs it.
- We keep what we need to run Ova: your name, access code or account, units and a record of use.
- We do not sell your data or use it for advertising.
- To get a copy of your data or have it deleted, write to support@ova.tools.
1. Who we are
Ova (“we”, “us”) makes the Ova Arch app for Windows and runs ova.tools, downloads from dl.ova.tools and the Ova gateway, the online service the app uses. This policy covers all of them. Ova is run by a private individual who goes by the name “Ova”, at 10119 Tallinn, Estonia, who is the controller of the personal data that Ova collects and uses as described in this policy. Contact: support@ova.tools.
2. What we keep and why
For each kind of data: why we use it, the legal basis (GDPR Article 6) and how long we keep it.
- Access data: your name as we recorded it when issuing your access code (usually a first name or nickname), the code, your units, a daily request count and whether your access is switched off. If you have an account, also your email address, display name, Google account ID if you use Google and a record of the units we grant you; once the app can sign in with an account, also your computers (section 4). Used to give you access, charge units, apply the daily limit and email you about your account or changes to this policy or our terms (contract: our Terms of Use; legitimate interest in keeping Ova working and secure and in keeping you informed). Kept while your access is active or your account exists; after your access ends, we delete your code and name from your access record within 6 months.
- Usage records: a record of each paid AI action, upload, cancellation and update download (time, service, units charged or refunded, outcome), linked to your name and your access code or account. Job records link each provider job to your code or account. We use them to charge and refund units, prevent misuse, answer support requests and see who has downloaded updates (contract; legitimate interest in keeping Ova secure and supporting its users). We show each person only their own usage. Kept up to 24 months; once a code is deleted, they keep only its first 12 characters and no name.
- Messages from us in the app, such as notices about Ova or changes to this policy or our terms, sometimes addressed to you by name (contract; legitimate interest in keeping you informed). Kept up to 24 months after sending.
- Content you send for AI processing: images or parts of them, prompts and settings (section 3). Used to run the action you start (contract) and, when needed, to look into a problem or misuse, including content kept in our accounts with the providers (legitimate interest in keeping Ova working and secure). Our gateway does not store it; providers may keep what they receive under their own terms (section 3).
- Support emails: your email address, message and any attachments (legitimate interest in answering you). Kept up to 12 months, or less if you ask.
- Technical data: your IP address, approximate location and other request details, which Cloudflare processes to deliver and protect the website and gateway, and technical messages such as job IDs and errors in the gateway’s logs. When you use sign-in, also the bot check and sign-in protection in section 4. Used under our legitimate interest in keeping Ova working and secure. Gateway logs are deleted automatically after a short time, currently a few days.
We may also keep or disclose data where the law requires it (legal obligation), and keep specific records longer where we need them for a legal claim (legitimate interest). We do not rely on your consent for any of the above. Deleted data can remain in our hosting provider’s backups for a short time.
No law requires you to give us personal data, but we need it to provide Ova under our Terms of Use: without an access code or account, the app’s online features do not work. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Log files the app keeps on your computer can contain file paths (which can include your Windows user name), prompts and images. We see a log only if you send it to us, so please check it first.
3. AI processing
Nothing leaves your computer for AI processing until you start an AI action. The action then sends what it works on, usually a crop of the selected area with your prompt and settings, through our gateway to the provider that runs it. Auto-grouping sends a reduced copy of the whole frame with the names and positions of its mask layers and your group names.
- Ova Pro: an AI image-enhancement provider in the United States, which we name on request;
- Nano Banana Pro: Krea, which passes these requests on to Google, the model’s maker;
- Auto prompt: WaveSpeed;
- Auto-grouping: Anthropic.
Each provider receives these requests under Ova’s own account with it, and we do not add your name, email address, access code or IP address to them. How long a provider keeps what it receives, and whether it may use it to train its models, is set by its own terms and policies (Krea, WaveSpeed, Anthropic).
The app downloads some results, such as Nano Banana Pro images, directly from an address the provider gives, not through our gateway; that server sees your computer’s IP address, as any server your computer connects to does.
You are responsible for what you send. Please do not include personal data about yourself or others, or confidential material.
4. Accounts and sign-in
You can create an Ova account and sign in to it on ova.tools. The Ova Arch app cannot use an account yet and works with access codes until it can. Sign in with Apple is not available yet.
-
Continue with Google: we ask Google only for the openid, email and profile permissions, and from them use only your email address (with Google’s note on whether it is verified and whether Google manages it), name and Google account ID. We use this data only to:
- create your account and sign you in;
- show your name in the app, on ova.tools and in our usage records;
- email you about your account or changes to this policy or our terms.
We do not use it for marketing or advertising and do not sell it. We keep it with your account in our database, which Cloudflare hosts; your name can also stay in our usage records (section 2). We share it only with Cloudflare and the email services we use to write to you, or where the law requires. Ova’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Ova’s access at myaccount.google.com/permissions; to delete your Ova account too, write to us.
- Email codes: sent from login@ova.tools through Resend, our email delivery provider, which receives your email address and the message and keeps them for a limited time under its own terms. A code expires after 10 minutes.
- Bot check: the sign-in form on ova.tools uses Cloudflare Turnstile, which looks at signals from your browser and device and at your IP address; we receive only the result. Cloudflare also uses these signals, as an independent controller, to improve its bot detection (see its Turnstile Privacy Addendum).
- Your computers, once the app can sign in with an account (not available yet): each computer you sign in on gets its own key. We keep a record of it with a generic label such as “Windows · Ova Arch” (not your computer’s name), the app version and when it was last used. A key expires after 180 days unused; we delete its record 30 days after it expires or is revoked.
- Sign-in protection: short-lived counts of recent sign-in attempts per email address and per network, to stop code guessing and spam. Counts per network use a hash of your IP address or of the network it belongs to, not the address itself, and are kept no longer than 24 hours.
7. Your rights
Under the GDPR you can ask to access, correct, delete or restrict your data, and to get the data you gave us in a machine-readable format where we use it to provide Ova to you (portability). You can withdraw consent if we ever rely on it.
Right to object. You can object at any time, on grounds relating to your situation, to uses that rely on our legitimate interests (section 2).
Email support@ova.tools; this is normally free. To find your records, write from your account’s email address or tell us the first 12 characters of your access code (not the whole code). We may ask you to confirm a request another way before we act on it. We reply without undue delay, normally within one month.
You can also complain to a data protection supervisory authority, in particular where you live or work. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.
8. Security, age and changes
- Security: connections to the website, downloads and gateway are encrypted (HTTPS), but no system is perfectly secure. If you think your access code has leaked, tell us and we will switch it off.
- Minimum age: you must be at least 18 to use Ova. If you believe a child has sent us personal data, tell us and we will delete it.
- Changes: we may update this policy by publishing a new version here with a new effective date. If a change significantly affects how we use your data, we will also tell you in the app or by email.
- Contact: support@ova.tools.