Transparency
What the app can send, and what it is made of.
A privacy claim you can’t inspect is only a promise. This page lists what Oolo can send and when, the domains it may contact, every third-party component and license, and where each model came from.
How to read this page
Oolo is pre-release. Nothing here describes a shipping product yet. Tables marked “generated” are built from the repository each time this site is built, so they follow the code. Everything else describes the design we are building to, taken from our design documents.
The release labels come from our roadmap:
- Planned for v1 local-only on iPhone, iPad and Android. Planned for December 2026 to April 2027.
- Planned for v2 accounts, sync, Ask and more platforms. Planned for April to September 2027.
- Planned for v3 record networks, research and watch apps. From September 2027.
Dates are plans, and plans change. Last checked against the documents on 17 October 2026.
What the app can send, and when
By default, nothing. Every row below is something that leaves your device only because you turned it on or asked for it.
Scroll sideways to see every column.
| When | What leaves your device | Where it goes | Default | When planned |
|---|---|---|---|---|
| You use the app: import, read, chart, track a cycle | Nothing. It all runs on the device. | Nowhere | Always | Planned for v1 |
| You download a model or a reference pack | A download request. The mirror sees your IP address and which file you asked for. No health data. | Our model and reference-data mirror | Offered during setup, with the size shown. Wi-Fi by default. | Planned for v1 |
| You buy or restore the Lifetime unlock | The App Store or Google Play handles the payment. The app asks the store whether you own the unlock. | Apple or Google | Only when you buy or restore | Planned for v1 |
| You export or share a file | What you choose, to where you choose. Each export asks you to confirm and is logged on your device. | The Files app, Google Drive or the share-sheet target you pick | Only when you ask | Planned for v1 |
| You export diagnostics for a bug report | A bundle of timings and error codes, with no values or text. You review it first. | Nowhere automatically. You attach it to your report yourself. | Only when you ask | Planned for v1 |
| You turn on sync | Encrypted batches of changes and encrypted files, padded to hide sizes and signed by your device. Never keys, and never readable data. | Our sync relay and storage (EU or US), or your own S3-compatible storage | Off | Planned for v2 |
| You create an account | Account ID, device public keys, your wrapped key slots (ciphertext) and your purchase entitlement. No name, no date of birth, no health data. | Our account service | No account is needed to use the app | Planned for v2 |
| You connect a cloud wearable | A sign-in handled by a token service that only exchanges OAuth tokens. It never receives your health data. | Our token broker, and the wearable company you choose | Off | Planned for v2 |
| You forward email to your inbox address | The email you forward. It is encrypted on arrival, and the plaintext exists only briefly in memory. | Our encrypt-on-arrival inbox | Off | Planned for v2 |
| You use Private Cloud Boost for one request | That one request, sent encrypted to attested confidential-computing hardware (Apple Private Cloud Compute, Tinfoil or Privatemode). We see only ciphertext. | An attested secure enclave | Off. It asks for each request. | Planned for v2 |
| You share a summary with a clinician | An encrypted summary. The key sits in the part of the link after the “#”, which browsers don’t send to a server. Links expire. | Our share-link storage | Only when you create a link | Planned for v2 |
| You turn on diagnostics (tier 1) | Usage events from a fixed list, never health values, and crash reports with personal data scrubbed. | An analytics service without persistent IDs, and a crash-report service | Off | Planned for v2 |
| You donate a correction (tier 2) | One correction at a time: what changed in the field. A redacted image of that row only if you add it. | Our corrections service | Off. It asks for each correction, or “always” if you choose. | Later |
| You donate data to a research study (tier 3) | Structured, generalized data for one study, after informed consent and ethics approval. You see a field-by-field preview first. | The study’s trusted research environment | Off. It asks for each study. | Planned for v3 |
Consent is recorded on your device with what it covers and when it ends. It is never asked in the middle of a task, never pre-ticked and never bundled with a purchase or a feature. Withdrawing comes with a receipt that confirms deletion. Details are in the data and learning design.
What we never do: sell data, give insurers, employers or advertisers access to it, train on data you didn’t donate, or use research data for marketing.
Allowlisted domains
The app has no third-party SDKs. It may only open connections to the categories below, it logs every request on your device, and links open in your system browser.
Hostnames are reserved, servers are not live yet. Every server below is on our domain, oolo.me, and none is contacted unless you turn on the feature that needs it. Until a server is running, the app says it couldn’t reach it. Adding a domain needs an entry in our decision log.
Scroll sideways to see every column.
| Category | Used for | Hostname | Contacted when | What it can see | When planned |
|---|---|---|---|---|---|
| Model and reference-data mirror | Signed model files, terminology packs and content packs | models.oolo.me | You download or update a model or pack | Your IP address and which file | Planned for v1 |
| Apple App Store and Google Play | Buying and restoring the Lifetime unlock | Run by Apple and Google. The operating system makes these requests. | You buy or restore | The purchase | Planned for v1 |
| Your own computer | A local model server on desktop | Loopback only (127.0.0.1) | You run a model on a desktop computer | Nothing leaves the computer | Planned for v2 |
| Sync relay and blob storage | End-to-end-encrypted sync, in the EU and the US | sync.oolo.me | Sync is on | Ciphertext, account ID, padded sizes, timestamps, IP addresses | Planned for v2 |
| Accounts and entitlements | Passkey sign-in, and unlocking a purchase on other devices | pay.oolo.me (Android purchase checks) | You sign in or restore | The account data listed on the privacy page | Planned for v2 |
| OAuth token broker | Signing in to cloud wearables | auth.oolo.me | You connect a wearable | OAuth tokens. Not health data. | Planned for v2 |
| Wearable companies you connect | Their sign-in and data services | The company’s own domains | You connect that company’s service | Whatever that company already holds about you | Planned for v2 |
| Email inbox | Importing records from forwarded email | inbox.oolo.me, mail to in.oolo.me | You forward an email | The email, in memory, until it is encrypted | Planned for v2 |
| Private Cloud Boost | One-off requests on attested secure hardware | Placeholder | You approve a request | Ciphertext only | Planned for v2 |
| Share links | Encrypted summaries for clinicians | sync.oolo.me (links open on oolo.me) | You create or open a link | Ciphertext only | Planned for v2 |
| Diagnostics (opt-in) | Usage events and crash reports | t.oolo.me | Diagnostics are on | Event names from a fixed list, and scrubbed crash reports | Planned for v2 |
Alongside the allowlist, the app keeps a log of its own requests with time, domain, purpose and
bytes. Our web end-to-end tests fail on any request outside the allowed hosts. See
e2e/support/fixtures.ts.
Third-party components and licenses Generated
This section is generated when the site is built, on 24 October 2026 (UTC). It runs the repository’s own
license checker, scripts/check-licenses.ts,
which CI also runs on every change. It follows every runtime dependency of the app, the shared
packages and the services, and the build tools they pull in. Tests, evaluations and developer
tooling are not part of what ships, so they are left out.
Our own code is AGPL-3.0-only. Dependencies must be permissive: MIT, Apache-2.0, BSD, ISC and similar. A few packages used only while building have a recorded exception.
- Packages checked
- 710 (329 shipped at runtime, 381 used only to build)
- Outside the policy
- 0
- Full list
- third-party.json, every package with its version, license and use
| License | Packages |
|---|---|
| MIT | 619 |
| ISC | 32 |
| BSD-3-Clause | 12 |
| BSD-2-Clause | 11 |
| Apache-2.0 | 10 |
| BlueOak-1.0.0 | 6 |
| 0BSD | 3 |
| MIT OR CC0-1.0 | 3 |
| OFL-1.1 | 2 |
| Unlicense | 2 |
| MPL-2.0 | 2 |
| MIT AND Apache-2.0 | 1 |
| Python-2.0 | 1 |
| CC-BY-4.0 | 1 |
| MIT OR Apache-2.0 | 1 |
| CC0-1.0 | 1 |
| BSD-3-Clause OR GPL-2.0 | 1 |
| MIT AND Zlib | 1 |
| MIT-0 | 1 |
Recorded exceptions
These are not permissive licenses. Each is used at build time or as data, never shipped in the app, and the reason is recorded in the policy file.
Scroll sideways to see every column.
| Package | License | Scope | Why it is allowed |
|---|---|---|---|
@fontsource/noto-sans-bengali 5.3.0 | OFL-1.1 | data | Noto font files embedded in the web visit-summary PDF. The SIL Open Font License permits bundling fonts in software; it is not a software licence and does not affect the app's code (docs/12). |
@fontsource/noto-sans-devanagari 5.3.0 | OFL-1.1 | data | Noto font files embedded in the web visit-summary PDF. The SIL Open Font License permits bundling fonts in software; it is not a software licence and does not affect the app's code (docs/12). |
caniuse-lite 1.0.30001816 | CC-BY-4.0 | data | Browser-support data read by browserslist (via @expo/metro-config and Babel) at build time; not part of the JS bundle |
lightningcss 1.33.0 | MPL-2.0 | build-time | CSS compiler invoked by @expo/metro-config (and vite in dev) at build time; not part of the JS bundle. Path: @app/mobile > expo > @expo/metro-config > lightningcss |
lightningcss-darwin-arm64 1.33.0 | MPL-2.0 | build-time | Prebuilt platform binaries (optionalDependencies) of lightningcss; required only by lightningcss |
Direct runtime dependencies
The components our own code imports directly, with the workspace packages that use them (names are those in the repository).
Scroll sideways to see every column.
| Component | Version | License | Used by |
|---|---|---|---|
@fontsource/noto-sans-bengali | 5.3.0 | OFL-1.1 | mobile |
@fontsource/noto-sans-devanagari | 5.3.0 | OFL-1.1 | mobile |
@formatjs/intl-getcanonicallocales | 3.2.12 | MIT | mobile |
@formatjs/intl-locale | 5.3.12 | MIT | mobile |
@formatjs/intl-pluralrules | 6.3.16 | MIT | mobile |
@hono/node-server | 2.1.5 | MIT | donations, inbox, models-cdn, purchases, sync-relay, telemetry-service, token-broker |
@kingstinct/react-native-healthkit | 16.2.0 | MIT | mobile |
@noble/ciphers | 2.4.0 | MIT | crypto |
@noble/curves | 2.4.0 | MIT | connectors, crypto, entitlements, sharing |
@noble/hashes | 2.4.0 | MIT | ai, connectors, crypto, entitlements, inbox, learning |
@pdf-lib/fontkit | 1.1.1 | MIT | mobile |
@scure/base | 2.4.0 | MIT | crypto |
@scure/bip39 | 2.4.0 | MIT | crypto |
age-encryption | 0.3.1 | BSD-3-Clause | crypto |
aws4fetch | 1.0.20 | MIT | inbox, sync-relay |
expo | 57.0.30 | MIT | mobile |
expo-battery | 57.0.3 | MIT | mobile |
expo-build-properties | 57.0.22 | MIT | mobile |
expo-camera | 57.0.6 | MIT | mobile |
expo-constants | 57.0.22 | MIT | mobile |
expo-crypto | 57.0.4 | MIT | mobile |
expo-device | 57.0.2 | MIT | mobile |
expo-document-picker | 57.0.3 | MIT | mobile |
expo-file-system | 57.0.7 | MIT | mobile |
expo-font | 57.0.4 | MIT | mobile |
expo-haptics | 57.0.3 | MIT | mobile |
expo-iap | 6.1.0 | MIT | mobile |
expo-image | 57.0.5 | MIT | mobile |
expo-image-picker | 57.0.20 | MIT | mobile |
expo-linking | 57.0.13 | MIT | mobile |
expo-local-authentication | 57.0.3 | MIT | mobile |
expo-localization | 57.0.2 | MIT | mobile |
expo-network | 57.0.3 | MIT | mobile |
expo-notifications | 57.0.23 | MIT | mobile |
expo-print | 57.0.2 | MIT | mobile |
expo-router | 57.0.28 | MIT | mobile |
expo-screen-capture | 57.0.4 | MIT | mobile |
expo-secure-store | 57.0.4 | MIT | mobile |
expo-share-intent | 8.0.1 | MIT | mobile |
expo-sharing | 57.0.23 | MIT | mobile |
expo-splash-screen | 57.0.10 | MIT | mobile |
expo-sqlite | 57.0.4 | MIT | mobile |
expo-status-bar | 57.0.1 | MIT | mobile |
expo-symbols | 57.0.3 | MIT | mobile |
expo-system-ui | 57.0.4 | MIT | mobile |
expo-web-browser | 57.0.3 | MIT | mobile |
fflate | 0.8.3 | MIT | connectors |
hono | 4.13.13 | MIT | donations, inbox, models-cdn, purchases, sync-relay, telemetry-service, token-broker |
i18next | 26.4.7 | MIT | mobile |
i18next-icu | 2.6.0 | MIT | mobile |
intl-messageformat | 12.1.3 | BSD-3-Clause | mobile |
llama.rn | 0.12.9 | MIT | mobile |
pdf-lib | 1.17.1 | MIT | mobile |
pg | 8.23.1 | MIT | inbox, sync-relay, token-broker |
postal-mime | 4.0.7 | MIT-0 | connectors, inbox |
qrcode-generator | 2.0.4 | MIT | mobile |
react | 19.2.3 | MIT | mobile |
react-dom | 19.2.3 | MIT | mobile |
react-i18next | 17.0.21 | MIT | mobile |
react-native | 0.86.3 | MIT | mobile |
react-native-ble-plx | 3.5.1 | MIT | mobile |
react-native-gesture-handler | 2.32.0 | MIT | mobile |
react-native-health-connect | 4.1.3 | MIT | mobile |
react-native-nitro-modules | 0.37.1 | MIT | mobile |
react-native-reanimated | 4.5.1 | MIT | mobile |
react-native-safe-area-context | 5.7.0 | MIT | mobile |
react-native-screens | 4.26.2 | MIT | mobile |
react-native-svg | 15.15.4 | MIT | mobile |
react-native-web | 0.21.4 | MIT | mobile |
react-native-worklets | 0.10.1 | MIT | mobile |
regenerator-runtime | 0.13.11 | MIT | mobile |
tsx | 4.23.15 | MIT | donations, inbox, models-cdn, purchases, sync-relay, telemetry-service, token-broker |
zod | 4.6.7 | MIT | ai, entitlements, ingest |
Licensed separately
- Models keep their own licenses, listed in the next section.
- Medical terminologies ship as data packs under their own licenses. Lab templates, test-name synonyms and education content are planned under CC BY-SA 4.0.
- LOINC. The test-matching subset (LOINC 2.82) is a
separate data pack under the LOINC license, with LOINC’s names kept unchanged. The license
requires this notice, which is repeated here word for word from the repository:
This material contains content from LOINC (http://loinc.org). LOINC is copyright © Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the license at http://loinc.org/license. LOINC® is a registered United States trademark of Regenstrief Institute, Inc.
- This website sends none of this to your browser. It has no scripts, fonts or images from anywhere else, and the tool that builds it (Astro, MIT) is not part of the pages.
Model provenance Generated
Every on-device model the app can download is listed in a manifest, with its source repository, the exact revision, its license, its size and its SHA-256. The app checks the hash after a download and doesn’t load a file that doesn’t match. We use Apache-2.0 or MIT models by default, because open weights that run on your device send no data to the model’s maker.
- Generated from
packages/ai/src/manifests/models.json- Manifest
- version 1, dated 2026-10-17, 14 entries
- File SHA-256
f93d6235a3d1cf68c0f40fb4e9efb572c6d605bea9687e614c20cfea1bf029a0- Site built
- 24 October 2026 (UTC)
Not shipped by default. EmbeddingGemma 300M (Q8_0, Gemma terms) uses a license that is not Apache-2.0 or MIT. It is listed so the record is complete, and it is left out unless a build explicitly allows other licenses.
Scroll sideways to see every column.
| Model | Lowest tier | License | Runtime and size | Source and revision | SHA-256 | Checked |
|---|---|---|---|---|---|---|
Qwen3.5 0.8B (Q4_K_M) qwen3.5-0.8b-q4_k_m For chat, router, classification | T1 | Apache-2.0 | llama.rn 533 MB | unsloth/Qwen3.5-0.8B-GGUF 6ab461498e20 | bd258782e35f7f458f8aced1adc053e6e92e89bc735ba3be89d38a06121dc517 | verified 2026-10-17 |
Qwen3.5 0.8B (Q4_0, Android OpenCL) qwen3.5-0.8b-q4_0 For chat, router, classification | T1 | Apache-2.0 | llama.rn 563 MB | ggml-org/Qwen3.5-0.8B-GGUF 8fea620810c4 | 57d1997790d1744fba5b40a7317df71ea5e2acee28c47e78f0cce39c0703f8cf | verified 2026-10-17 |
Qwen3.5 2B (Q4_K_M) qwen3.5-2b-q4_k_m For chat, extraction, explanation | T1 | Apache-2.0 | llama.rn 1.3 GB | unsloth/Qwen3.5-2B-GGUF f6d5376be1ed | aaf42c8b7c3cab2bf3d69c355048d4a0ee9973d48f16c731c0520ee914699223 | verified 2026-10-17 |
Qwen3.5 4B (Q4_K_M) qwen3.5-4b-q4_k_m For chat, extraction, explanation | T2 | Apache-2.0 | llama.rn 2.7 GB | unsloth/Qwen3.5-4B-GGUF e87f176479d0 | 00fe7986ff5f6b463e62455821146049db6f9313603938a70800d1fb69ef11a4 | verified 2026-10-17 |
NuExtract3 4B (Q4_K_M) nuextract3-q4_k_m For extraction | T2 | Apache-2.0 | llama.rn 2.8 GB | numind/NuExtract3-GGUF 28a1aae6288c | 7ee3c0ee9e5699a4391624ae758487f583f73b3242aa4e73dc2bb33e508d703e | verified 2026-10-17 |
Gemma 4 E2B instruct (Q4_0 QAT) gemma-4-e2b-it-q4_0 For chat, explanation | T2 | Apache-2.0 | llama.rn 2.8 GB | ggml-org/gemma-4-E2B-it-GGUF b4243c156154 | 8e30dff3ac4c8434c49a7036fa15564bdbb6044e42bf04550bf1a096ad7e6a52 | verified 2026-10-17 |
Gemma 4 E4B instruct (Q4_0 QAT) gemma-4-e4b-it-q4_0 For chat, extraction, explanation | T3 | Apache-2.0 | llama.rn 4.6 GB | ggml-org/gemma-4-E4B-it-GGUF b8093469224f | a555b900214b477d8880e7832e0b8925e139b0159640036b09fe472b6f2097f2 | verified 2026-10-17 |
Gemma 4 E2B instruct (LiteRT-LM) gemma-4-e2b-it-litertlm For chat, explanation | T2 | Apache-2.0 | litert-lm 2.6 GB | litert-community/gemma-4-E2B-it-litert-lm b3ca0d2f0767 | 181938105e0eefd105961417e8da75903eacda102c4fce9ce90f50b97139a63c | verified 2026-10-17 |
Gemma 4 E4B instruct (LiteRT-LM) gemma-4-e4b-it-litertlm For chat, extraction, explanation | T2 | Apache-2.0 | litert-lm 3.7 GB | litert-community/gemma-4-E4B-it-litert-lm 2eee7ac325f2 | 0b2a8980ce155fd97673d8e820b4d29d9c7d99b8fa6806f425d969b145bd52e0 | verified 2026-10-17 |
multilingual-e5-small (ONNX int8) multilingual-e5-small-onnx-int8 For embedding | T0 | MIT | transformers.js 118 MB | Xenova/multilingual-e5-small 761b726dd34f | f80102d3f2a1229f387d3c81909990d8945513e347b0eab049f7de3c6f98c193 | verified 2026-10-17 |
EmbeddingGemma 2 (text, Q8_0) embeddinggemma-2-q8_0 For embedding | T1 | Apache-2.0 | llama.rn 310 MB | ggml-org/embeddinggemma-2-GGUF bfcd298762cc | 2188ac1deca4b77dffefd603c2776a9d76d9d74ec01841392982ebb840b09135 | verified 2026-10-17 |
EmbeddingGemma 300M (Q8_0, Gemma terms) embeddinggemma-300m-q8_0 For embedding | T1 | Gemma Not shipped by default | llama.rn 334 MB | ggml-org/embeddinggemma-300M-GGUF 0f741b5a6585 | b5ce9d77a3fc4b3b39ccb5643c36777911cc4eb46a66962eadfa3f5f60490d63 | verified 2026-10-17 |
Qwen3 Embedding 0.6B (Q8_0) qwen3-embedding-0.6b-q8_0 For embedding | T1 | Apache-2.0 | llama.rn 639 MB | Qwen/Qwen3-Embedding-0.6B-GGUF 370f27d7550e | 06507c7b42688469c4e7298b0a1e16deff06caf291cf0a5b278c308249c3e439 | verified 2026-10-21 |
multilingual-e5-small (Q8_0, GGUF) multilingual-e5-small-q8_0 For embedding | T0 | MIT | llama.rn 132 MB | keisuke-miyako/multilingual-e5-small-gguf-q8_0 e1da94460f22 | 0d5a5a0b0ad84faad6357a6145e769b0661f0efbf53acf74598afc34dab454f4 | verified 2026-10-21 |
Device tiers
- T0: under 2 GB of free memory. No language model. Text recognition, lab layout templates and rules.
- T1: many 6 to 8 GB Android phones and non-Pro iPhones. A model of about 1.3 GB.
- T2: recent flagship phones and M-series iPads. A model of about 2.7 to 3.5 GB.
- T3: Macs and PCs with 16 GB or more.
Oolo picks a tier from measured free memory and a short benchmark, not from the phone’s model name. See on-device AI.
Check a model yourself
- Download the file from the source repository at the revision shown.
- Compare its size, then compute its hash and compare that with the SHA-256 above.
shasum -a 256 Qwen3.5-0.8B-Q4_K_M.ggufThe mirror’s manifest is also planned to be signed (Ed25519), and the app will check that signature before it trusts any hash. Some models need extra files that are not listed yet, such as a separate vision file. The manifest’s notes say which. We also evaluate some models only as baselines and don’t ship them, for example MedGemma, whose license comes with restrictions. A model card with an evaluation report for every model version is planned.
Release signing and provenance
No release exists yet. This is what each release is planned to carry, and how you will check it. Keys, fingerprints and exact commands will be published here with the first release.
Scroll sideways to see every column.
| What | Protection | How you can check it | When planned |
|---|---|---|---|
| Android app | Signed by our release key through Google Play. A separate F-Droid build, with no Google services, is built reproducibly so F-Droid can verify the APK. | Build it from source and compare it with the published APK | Planned for v1 |
| iPhone and iPad app | Signed by Apple when it goes through the App Store. | Install only from the App Store | Planned for v1 |
| Build provenance | A signed attestation (SLSA provenance, through Sigstore) that links each binary to the source commit it came from. |
Verify with a Sigstore-compatible tool, such as GitHub’s gh attestation verify.
Exact commands come with the first release.
| Planned for v1 |
| Software bill of materials | A list of every component in the build, published with the release. | Download it next to the release and compare it with the components section above | Planned for v1 |
| Model manifest | The mirror’s list of model hashes, signed with an Ed25519 key. | Public key: Published with the first release | Planned for v1 |
| Desktop installers | Signed installers for Windows, Mac and Linux. Details to follow. | To be published | Planned for v2 |
Who holds the release keys is Placeholder until the legal entity exists. Only install Oolo from the official stores, from F-Droid, or from a build you made yourself. Unofficial forks and builds are not ours, and the name and logo will be covered by a trademark policy so that forks use their own name.
Security reporting
Please report vulnerabilities privately, through GitHub Security Advisories. Don’t open a public issue, pull request or discussion.
Never include real health data, yours or anyone else’s. Reproduce with the app’s sample-data mode or a synthetic document. Please say what is affected, how to reproduce it, the impact as you understand it, and whether you want credit.
| Step | Target |
|---|---|
| Acknowledge your report | 3 business days |
| Initial assessment and severity | 7 days |
| Fix for critical issues | 7 days |
| Fix for high-severity issues | 30 days |
| Fix for medium and low issues | 90 days, or the next release |
- Disclosure. We agree a date with you (90 days by default, sooner once a fix ships), publish a GitHub Security Advisory, and credit you unless you prefer otherwise.
- Safe harbor. We won’t pursue legal action for good-faith research that uses your own accounts, devices and synthetic data, and that stops short of other people’s data.
- In scope are the app, storage and cryptography on the device, sync and the other services, any egress outside the allowlist, the document and model pipeline, and the supply chain. The policy has the full list.
- Support never asks for a recovery key or for health data. Anyone who does is not us.
-
Our
security.txtpoints to the same place.
Planned assurance
- An external audit by a firm in the class of Cure53 before 1.0, and every year after.
- A cryptography review and a penetration test, with the threat model and a cryptography whitepaper published.
- A bug bounty before 1.0. There is no paid bounty yet.
Annual transparency report Placeholder
There is nothing to report yet, because nothing is in operation. Once the service has run for a year we plan to publish a report each year. This is what it will cover.
Scroll sideways to see every column.
| Topic | What it will say | Status |
|---|---|---|
| Requests from governments and courts | How many we received and how many we answered. Our answer to every request is ciphertext and minimal metadata, because we hold no keys. Our request policy will be published first. | Not yet published |
| Security audits and fixes | Who audited what, what they found, what we fixed, and the advisories we published. | Not yet published |
| Incidents and breaches | Any breach, what was affected, and when people were told. | Not yet published |
| Sync reserve and costs | How much of each sale is set aside for long-term sync, and what sync costs per user. | Not yet published |
| Funding | Sales, grants and donations, and any conditions attached to them. | Not yet published |
| Models | Model versions shipped, their evaluation reports and any license changes. | Not yet published |
Name, entity and contacts Placeholder
The name (Oolo) and the domain (oolo.me) are decided. The other details depend on where the legal entity is registered, which is not decided yet.
| Detail | Status |
|---|---|
| Product name, logo and domain | Oolo, oolo.me |
| Legal entity, country and address | Placeholder Not decided |
| Trademark owner and policy | Placeholder To be published |
| Data protection contacts and representatives, where a law requires them | Placeholder To be published |
| Accessibility statement | Placeholder To be published |
| Release signing key custody | Placeholder To be decided |