Privacy Policy

Last updated: March 8, 2026

OwOsy ("we," "us," or "our") is a product of Phinguin. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the OwOsy website (owosy.com), the OwOsy web dashboard (app.owosy.com), the OwOsy Translate Framer plugin, and the OwOsy Translate client-side widget (collectively, the "Service").

1. Information We Collect

1.1 Account and Payment Information

When you create an account on the OwOsy dashboard (app.owosy.com), we collect your email address and store it in our authentication provider, Supabase. If you sign in via Google OAuth, we receive your email and basic profile information from Google.

When you subscribe to a paid plan, our payment processor Lemon Squeezy collects your name, email address, billing address, and payment details. We receive your email address, license key, and subscription tier from Lemon Squeezy but do not directly handle or store your payment card information. License keys are stored in our database to validate your subscription tier.

1.2 Website Content You Translate

When you use the OwOsy Translate plugin to scan and translate your site, your published page content is fetched by our Cloudflare Worker and sent to OpenAI's API (GPT-4o mini) for translation. Your website content is transmitted to and processed by OpenAI. Translations are cached in Cloudflare KV for up to 90 days. We do not control how OpenAI processes data beyond what is specified in our agreement with them. Please review OpenAI's Privacy Policy for details on their data handling practices.

1.3 Widget Configuration

Site configuration data (selected languages, widget position, theme, accent color) is stored in Cloudflare KV, associated with a site ID generated by the plugin.

1.4 Usage Data

We track the following usage data to enforce plan limits and improve the Service:

  • Word count per billing period
  • Languages translated to
  • License key validation events

1.5 Cached Translations

Translated page content is cached in Cloudflare KV storage for up to 90 days. Cached translations are associated with a site ID and page path, not with individual visitors.

1.6 Glossary Data

Glossary terms you create are stored in Cloudflare KV storage, associated with your license key.

1.7 Visitor Data

The client-side widget does not collect personal information from your site's visitors. The widget:

  • Stores the visitor's language preference in their browser's localStorage (stays on their device, persists until cleared)
  • Caches site configuration in sessionStorage (stays on their device, cleared when the browser tab closes)
  • Fetches cached translations from our API over HTTPS

No cookies are set by the widget. No visitor tracking or analytics are performed.

Rate limiting: Our API uses visitor IP addresses (via Cloudflare's CF-Connecting-IP header) solely for rate limiting purposes. IP addresses are stored temporarily in Cloudflare KV with a 120-second expiration and are not logged, stored permanently, or associated with any visitor profile.

1.8 Dashboard Local Storage

The OwOsy web dashboard (app.owosy.com) uses browser localStorage to store temporary application state (e.g., glossary edit flags). This data stays on your device, contains no personal information, and is used solely for UI functionality.

1.9 Cookies and Third-Party Resources

The OwOsy marketing website (owosy.com) does not set first-party cookies. The OwOsy dashboard (app.owosy.com) uses Supabase authentication, which stores a session token in localStorage (not cookies).

We load resources from third-party services that may set their own cookies or collect data:

  • Google Fonts (fonts.googleapis.com) — font delivery; see Google's Privacy Policy
  • Fontshare (fontshare.com) — font delivery
  • unpkg (unpkg.com) — JavaScript library delivery

These resources are loaded for essential functionality (typography and UI components). By using our website, you consent to these third-party resources being loaded. No non-essential tracking cookies are set.

2. How We Use Your Information

  • To provide and operate the translation Service (plugin, API, and widget)
  • To process your subscription and payments (via Lemon Squeezy)
  • To enforce plan limits (word counts, language limits)
  • To cache translations for fast delivery to your site's visitors
  • To respond to support requests

3. Third-Party Data Processors

We share your data with the following third-party services in order to provide the Service:

Service Purpose Data Shared
OpenAI Translation processing Website text content you translate
Cloudflare API hosting, data storage, widget delivery Usage data, cached translations, widget config, glossary, license data
Supabase User authentication, site management database Email address, site configurations, license keys
Lemon Squeezy Payment processing, subscription management Email, billing info, license keys

Data Processing Agreements (DPAs) are in place with our primary processors. For copies of applicable DPAs or a complete list of sub-processors, contact [email protected].

4. Data Retention

  • Cached translations: 90 days from creation, then automatically deleted
  • Widget configuration: Retained until you delete it or your subscription ends
  • Usage data: ~35 days per billing period, then automatically deleted
  • License data: Cached for 24 hours, refreshed from Lemon Squeezy
  • Glossary data: Retained until you delete it or your subscription ends

5. Data Security

All data is transmitted over HTTPS. Our API runs on Cloudflare Workers with data stored in Cloudflare KV, which provides encryption at rest. The widget communicates with our API exclusively over HTTPS. We do not store your payment information directly.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data
  • Portability: Request your data in a machine-readable format
  • Restriction: Request restriction of processing of your data in certain circumstances
  • Objection: Object to processing of your data
  • Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected].

6.1 For EU/EEA Residents (GDPR)

We process your personal data on the following legal bases:

  • Contract performance: To provide the translation Service, process your subscriptions, and cache translations
  • Legitimate interest: To enforce plan limits, track usage, and improve the Service
  • Legitimate interest: To respond to support requests

Your data may be transferred to and processed in the United States (via OpenAI, Cloudflare, and Supabase). These transfers are covered by the service providers' standard contractual clauses (SCCs) and data processing agreements. For details on specific transfer mechanisms, contact [email protected].

You have the right to lodge a complaint with your local data protection supervisory authority.

6.2 For California Residents (CCPA/CPRA)

We do not sell your personal information. You have the right to know what data we collect, request deletion, and opt out of any sale of personal information (which we do not engage in).

7. Information for Website Owners Embedding the Widget

If you embed the OwOsy Translate widget on your website, your visitors' page content is translated client-side using pre-cached translations. The widget makes HTTPS requests to our API to fetch cached translations. We recommend adding the following disclosure to your website's privacy policy:

"This website uses OwOsy Translate to provide multilingual translations. The translation widget fetches pre-cached translations from OwOsy's servers (api.owosy.com) via HTTPS. The widget stores your language preference in your browser's localStorage. No personal information is collected by the widget. IP addresses may be temporarily processed for rate limiting (120-second retention). For more information, see OwOsy's Privacy Policy."

8. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date above and, where required by law, will seek your consent before applying material changes.

10. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

Phinguin
Email: [email protected]