Last updated ·

Privacy Policy

OmuType is a Cantonese-first keyboard for typing and voice. It is made by Alano Tech Pte. Ltd., the company that also makes Omucloud; the two are sister products. This policy sets out what personal data OmuType handles, where it goes, how long it is kept, and what you can ask us to do about it. It is the notice we give under Singapore's Personal Data Protection Act 2012 and Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486).

In short:

Typing stays on your phone. The letters you type are turned into words on the device, and we never receive a record of your keystrokes.

Voice goes to the cloud, only when you use it. While you hold or tap the microphone, your voice is sent to speech-recognition providers to be turned into text. Some spoken requests, such as edits and rewrites, also send the text around your cursor to an AI provider. We do not keep your recordings or your text.

Password fields and fields that ask for privacy get no voice, send nothing, and teach the keyboard nothing.

There are no accounts, no advertising and no tracking. Our servers keep a random install ID and counts of how often voice features were used, never what you said or typed.

1. Who we are

OmuType is operated by Alano Tech Pte. Ltd. (UEN 202555886D), a company incorporated in Singapore. In this policy "we", "us" and "our" mean that company. We decide how the personal data described here is handled and are responsible for it: the "organisation" under Singapore's Personal Data Protection Act 2012 (PDPA) and the "data user" under Hong Kong's Personal Data (Privacy) Ordinance (PDPO).

Registered office: 60 Paya Lebar Road, #06-28, Singapore 409051.

OmuType is a sister product of Omucloud, made by the same company. The two do not share data. Using one does not give the other anything about you.

We have designated a person responsible for our compliance with the PDPA. Their business contact address is privacy@omucloud.co. Requests, questions and complaints about personal data may be sent there, and we monitor it for that purpose.

2. What a keyboard can see, and what OmuType does with it

When you turn on any third-party keyboard, Android warns you that it may be able to collect everything you type, including passwords and card numbers. That warning is accurate: the operating system gives every keyboard the characters you type and the text in the field you are typing into. What matters is what the keyboard does with them. This section answers that directly.

Typing

  • Turning keys into words (Jyutping, Cangjie, Quick and English) happens entirely on your phone, using dictionaries built into the app. Typing never needs the network.
  • Your keystrokes are not sent to us or to anyone else, and we keep no log of them.
  • To suggest your own words, the keyboard remembers on your phone up to 100 capitalised or known words you have recently typed (for example a product or a person's name). They stay on the phone. Section 3 explains when some of them are sent as spelling hints during voice.

Voice

  • Voice is the only feature that sends anything off your phone. It works only after you have given OmuType the microphone permission, and it listens only while you hold the microphone key or while a tap-to-talk session you started is running. It does not listen in the background.
  • Your voice is streamed to a speech-recognition provider to be turned into text, and, with the accuracy check on, the finished recording is transcribed once more by a second provider. Section 6 names them.
  • When what you said is an instruction rather than words to insert, for example to change a date, make a message shorter, translate it or send it, the keyboard sends the words you spoke, plus the text before and after your cursor (up to 1,500 characters each way) and any selected text, to an AI provider so it can work out the edit. Text you type is only ever sent this way as part of the field at that moment, and only because you used voice.

Fields where nothing is sent

In password fields, and in fields where the app asks keyboards not to learn (Android's no-personalised-learning flag, which incognito modes use), the microphone is switched off, no text from the field is read for context, and nothing typed there is remembered. Other fields that hold sensitive information, such as an email address or a card number field that is not marked as a password, are treated like ordinary fields: nothing is sent while you type, but if you use voice there the text in the field can be sent as context as described above.

3. What we collect

The following list is complete as at the date shown above.

Kept only on your phone

  • Your keywords: the words, names and codes you add yourself, from the ＋ key, from the text-selection menu ("Add to OmuType keywords") or in settings, and ones the keyboard learns when you correct a word it got wrong. Each keyword carries where it came from and the date it was added.
  • Recently typed words: up to 100 capitalised or known words you typed.
  • Your 32 most recently used emoji.
  • Your settings (punctuation style, Chinese input method, haptics, spacing, the accuracy check).
  • A random install ID, created when the app is first opened. It is not derived from your phone, your SIM, your Google account or anything else about you.
  • While you are speaking, the recording of that one utterance, held in memory (at most about 60 seconds) so it can be resent if the connection drops. It is discarded when the utterance ends and is never written to storage.

If your phone backs up app data to your Google account, Android may include these items in that backup. That backup is between you and Google; we cannot see it.

Sent from your phone when you use voice

  • Your voice, as audio, while the microphone is on.
  • Spelling hints, so that names come out right: up to 50 of your keywords and recently typed words, and names written in Latin letters that are already in the field. When you put the cursor in a field and the microphone permission is on, the keyboard opens the connection to the speech provider in advance so that voice starts instantly, and the hints are sent then. No audio is sent until you press the microphone, and the connection closes after 30 seconds of not being used.
  • When the backup speech provider is in use, the last 48 characters before your cursor, to help it continue the sentence.
  • For spoken instructions only: the words you spoke; the text before and after your cursor (up to 1,500 characters each way) and any selected text; the kind of field (search, chat, email or other) and the identifier of the app you are typing in (for example com.whatsapp), so that the result suits it; and up to 100 keywords.

Kept on our servers

  • Your install ID, the app version, the language setting of your phone (for example zh-HK), the platform (Android), and when that install ID was first and last seen.
  • One row for each backend call and each use of the microphone: the install ID, which service was called, the kind of result (for example "dictate" or "rewrite"), how many characters went in and came out, the size or length of the audio, which model answered, how long it took, and whether it succeeded, with the error message if it did not.

These rows never contain your audio, what you said, the text in your field or your keywords. They exist so we can count usage, keep costs and abuse in check, and find faults.

Our hosting provider also keeps short-lived technical logs of requests to our servers, which may include your IP address. We do not copy IP addresses into our own records.

4. What we do not collect, and do not do

Each statement in this section is a representation as to our current practice and may be relied on as such.

  • No accounts. We do not ask for your name, email address or phone number to use OmuType.
  • No keystroke logging, on our servers or anyone else's.
  • No storage of your recordings, transcripts or field text by us. They pass through our servers where section 6 says they do, and are discarded once the answer is returned.
  • No advertising, no advertising identifiers, no analytics or crash-reporting SDKs, no tracking across other apps or websites, and no profile of you.
  • No sale or rental of personal data, in any form, to anyone.
  • No use of your voice or text to train AI models, by us, or by our providers under the terms we use them on.
  • No location, contacts, photos or files, except a keyword file you choose to export or import yourself.

5. Why we use it

  • to turn your voice into text, and to carry out the edits and rewrites you ask for by voice;
  • to get your names and terms right, using your keywords;
  • to count use of the voice features per install, so we can manage cost, set fair limits and detect abuse of our servers;
  • to find and fix faults and measure speed; and
  • to comply with the law and with lawful orders and directions.

That list is complete. We will not use your personal data for any other purpose without first asking for your consent.

6. Who else receives your data

Voice needs a small number of service providers. They process your data on our behalf, under written agreements, and may not use it for their own purposes, such as training their models. Under the PDPA we remain responsible for what they do with it for us, and under the PDPO we use contractual means to protect it. They are held to protection at least equal to this policy.

  • Alibaba Cloud (Model Studio, Singapore region) — live speech recognition. Your voice and the spelling hints are streamed straight from your phone to it, using a short-lived access code our server issues, so our servers never see that audio. It is also an AI provider for spoken instructions (via our server), and is the one used first at the date of this policy.
  • OpenAI (United States) — the accuracy check: when a recording ends, it is sent once through our server to OpenAI to be transcribed again, with up to 50 spelling hints. OpenAI is also a backup AI provider for spoken instructions. Under its API terms, OpenAI does not train on this data and may keep it for up to 30 days to detect abuse before deleting it. You can turn the accuracy check off in OmuType's settings; voice then uses Alibaba Cloud's result alone.
  • ElevenLabs (United States) — backup speech recognition, used only if Alibaba Cloud cannot be reached. Your voice, the spelling hints and the 48 characters before the cursor are sent straight from your phone. On our current plan ElevenLabs keeps a log of requests under its own retention terms, which we cannot switch off.
  • Anthropic and Google (United States) — backup AI providers for spoken instructions. Neither is in use at the date of this policy. If we switch one on, it will receive what section 3 lists for spoken instructions, only under API terms that do not permit training on it, and we will update this list first.
  • Supabase (servers in Seoul, South Korea) — hosts our backend: the functions that issue access codes, pass spoken instructions and accuracy checks to the providers above, and store the usage rows in section 3.

Beyond these, we disclose personal data only where the law requires it, where a court order or lawful direction compels it, or where disclosure is necessary to protect someone from harm. If the operation of OmuType passes to another company, the small amount of data we hold (section 3) passes with it; we will announce that in the app before it takes effect, and the new operator will be bound by this policy.

7. Data sent outside Singapore and Hong Kong

We are a Singapore company, and our providers process data in Singapore, South Korea and the United States, as listed in section 6. Wherever you are, including Hong Kong, using voice therefore sends your data outside your own territory.

Section 26 of the PDPA permits this only where the recipient is bound to a standard of protection comparable to the Act's. We rely on our written agreements with each provider, which impose those obligations. For users in Hong Kong, we apply the same safeguards so that data transferred outside Hong Kong is protected to a standard comparable to the PDPO.

8. How long we keep it

  • Recordings, transcripts, field text and keywords sent for voice: not kept by us. They are processed and discarded as soon as the answer is returned. Section 6 states what each provider may keep, and for how long.
  • Install record and usage rows: kept while we operate OmuType, to count usage over time and investigate abuse. They are not currently deleted on a timed basis. You can have the rows for your install deleted at any time (section 10).
  • Hosting logs: kept by our hosting provider for a short period under its own schedule, which we do not control.
  • Everything on your phone: kept until you delete it (keywords can be removed one by one in settings), clear OmuType's storage, or uninstall the app.

If we withdraw OmuType, the purpose for which the server records are held ends with it, and we will delete them within 30 days of the service closing.

9. Keeping it safe

All traffic between your phone, our servers and our providers is encrypted in transit. Provider API keys are held only on our servers and never ship in the app; the phone receives only short-lived access codes. Our database tables can be reached only by our own server functions, never directly from the internet. We keep no copy of voice content, so there is none to leak from us.

No service can promise it will never suffer a data breach. If a breach is likely to cause you significant harm, or affects 500 or more people, Part 6A of the PDPA requires us to assess it, notify the Personal Data Protection Commission within 3 calendar days of that assessment, and notify you where we can reach you. We will do so.

10. Delete your data

On your phone, without contacting us

  • Remove single keywords in OmuType's settings, under keywords.
  • Remove everything: Android Settings → Apps → OmuType → Storage → Clear storage, or uninstall OmuType. This deletes your keywords, recent words, emoji, settings and the install ID.
  • Stop voice from sending anything: turn off OmuType's microphone permission in Android Settings. Typing keeps working.

On our servers

Email privacy@omucloud.co with the subject "OmuType data deletion" and include your install ID, which OmuType shows in its settings, under About. We will delete the install record and every usage row for that ID within 30 days and confirm by reply. We ask for nothing else, and we do not need your name.

Please ask before clearing storage or uninstalling: that deletes the install ID from your phone, and without it no one, including us, can tell which records were yours. If you have already removed the app, tell us roughly when you used voice, your app version and your phone model, and we will delete any records we can match.

Recordings and text are not held by us, so there is nothing of that kind for us to delete. Copies a provider keeps under section 6 expire on that provider's schedule.

11. Your rights

You may ask us for a copy of the personal data we hold about you, for information about how it has been used or disclosed in the past year, and to correct anything inaccurate. You may also withdraw your consent to any use at any time. Write to privacy@omucloud.co, with your install ID so we can find your records.

Singapore (PDPA)

We respond as soon as reasonably practicable. If we cannot respond within 30 days, we will tell you within that period when we will. Correction requests are free. For access requests we may charge a reasonable fee; if so we will give you a written estimate first. If you withdraw consent, we will tell you the likely consequences first; withdrawing consent to voice processing means voice can no longer be used, while typing continues to work.

Hong Kong (PDPO)

You may make a data access request and a data correction request under sections 18 and 22 of the PDPO. We will comply within 40 days of receiving it, and any fee for access will not be excessive. We will use your data only for the purposes in section 5 or directly related purposes, and will not use it in direct marketing. If you are not satisfied, you may complain to the Office of the Privacy Commissioner for Personal Data.

Elsewhere

If you live in the European Economic Area, the United Kingdom, California or another place that gives you rights over your personal data, such as rights to erasure, restriction, objection or portability, we will honour them for the data described here, and you may complain to your local data protection authority. We do not sell or share personal data for cross-context behavioural advertising.

12. On iPhone and iPad

An iOS version of OmuType is in development. On iOS a keyboard cannot reach the network unless you turn on "Allow Full Access" for it in Settings. Typing will work without Full Access, and Full Access will be used only for the voice features described in this policy: the same data, the same providers, the same limits. If the iOS version handles data in any way this policy does not already describe, we will update this policy before it is released.

13. Children

OmuType is a general-purpose keyboard and is not directed at children under 13. Because it has no accounts, we do not know the age of anyone using it and we do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has used voice features, write to privacy@omucloud.co with the child's install ID and we will delete the records for it.

14. Changes to this policy

We may update this policy. If a change materially affects how we handle your personal data, such as a new kind of data or a new provider, we will tell you in the app before it takes effect, and the date at the top will change. Where the law requires your consent, we will ask for it rather than assume it from continued use.

15. Contact and complaints

Questions, requests and complaints about personal data go to privacy@omucloud.co, or by post to Alano Tech Pte. Ltd., 60 Paya Lebar Road, #06-28, Singapore 409051. We will acknowledge and investigate any complaint and tell you the outcome.

If you are not satisfied, you may complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg or, in Hong Kong, the Privacy Commissioner for Personal Data at pcpd.org.hk. Nothing in this policy limits your right to do so.

Alano Tech Pte. Ltd. · 60 Paya Lebar Road, #06-28, Singapore 409051 · info@omucloud.co