Privacy Policy

Last updated: September 6, 2026

OmniDebugLink is a remote debugging relay: it connects your AI coding tool to your own app running on a real device, so the AI can inspect the UI, take screenshots, and inject input. This policy describes what we collect, why, and what you can do about it.

What we collect

Account data

• Username — the identifier you pick at sign-up.
• Password hash — we store only a salted cryptographic hash, never your plaintext password.

Device and connection data

• Device name and session ID (sid) — reported by the SDK you embed in your app, used to route debugging traffic to the right device.
• Capability manifest — the list of debugging tasks your app registers (e.g. screenshot, UI traversal), so AI tools know what the device can do.

Debugging traffic

• Task records — when an AI tool invokes a debugging task, we log metadata such as the task name, the target device, the calling account, and timestamps, for security auditing and abuse prevention.
• Relayed payloads — task parameters and results (including screenshots) transit our relay to be delivered to your AI tool. They are delivered in real time and are not retained as content beyond operational logging.

Security and abuse-prevention data

• IP-based rate-limit counters — short-lived counters keyed by IP address, used to throttle brute-force and spam attempts against login, registration, and token endpoints.
• Security event logs — failed logins, rate-limit hits, and similar events, kept for operational security.

Cookies and tokens

• A session cookie keeps you signed in to the web console.
• Access tokens you create (device tokens and MCP authorizations) are stored so your devices and AI tools can authenticate. MCP tokens are shown to you only once; afterwards only a short prefix is displayed.

What we don't do

• We don't sell your data.
• We don't run advertising or third-party analytics trackers.
• We don't read your app's source code or your AI conversations — we relay debugging traffic between endpoints you control.

How we use the data

• Routing debugging traffic between your devices and your AI tools.
• Authenticating your account, devices, and MCP clients.
• Protecting the service from abuse (rate limiting, security auditing).

Retention and your controls

• You can revoke any device token or MCP authorization at any time from the console; revocation takes effect immediately.
• Changing your password automatically revokes all MCP authorizations.
• Short-lived security data (rate-limit counters, one-time OAuth codes) expires automatically.
• To request deletion of your account and associated data, contact us via GitHub (below). A self-serve deletion flow is on our roadmap.

Security

All traffic is encrypted in transit (TLS). Passwords are stored as salted hashes. Device tokens and MCP tokens are random, revocable credentials — treat them like passwords and never commit them to source control.

Changes to this policy

If we make material changes, we will update the date above and announce the change on the website before it takes effect.

Contact

Questions or deletion requests: open an issue at github.com/omnidebuglink.