Privacy at Onimo

Private. Always.

Enforced by architecture, not by policy.

A promise you cannot check is only a slogan. This page sets out what Onimo does with your data, what we will never do with it, and where the promise stops. It is written to be held against us.

What we promise

Built to find, not to follow.

Only you see where

Where your Onimo goes is visible to you alone. Your location is never sold and never shared.

Finding, not tracking

Your Onimo sleeps most of the time. It reports in at intervals rather than streaming, because finding something does not require a live trail.

Other homes cannot reach your Onimo

Other Finders help you find your Onimo, but they can never make contact with an Onimo that is not on their own profile.

Onimo is a privacy intermediary, not a pass-through. Your movements are not ours to sell, because we deliberately never hold them in a form that could be sold. We also do not keep a record of whose Finder passed your Onimo along. That link is needed while the position is worked out, and it survives only briefly in technical logs. It is not part of your history.

Where the promise stops

The honest edges.

Two things are true at once, so we say both.

Our promise covers the location data of the people who use Onimo, and the infrastructure we run ourselves. It does not cover the one-off platforms a purchase runs through, such as a crowdfunding or shop platform, and it does not cover ordinary marketing email that you asked for and can stop at any time. Those parties have their own terms, and we are not going to pretend otherwise.

There is one step we do not yet do ourselves: turning a satellite snapshot into a position. That goes to a specialist service. We want to bring it in-house, and this page will say so when we do.

Data that is not yours or ours

Not only your data.

To find something where satellites cannot reach, an Onimo notes which wifi networks are in range. Those networks belong to other people, so this belongs on this page.

What is stored is the identifier a wifi network broadcasts anyway, plus roughly where it was seen. Not its traffic, not who uses it, and no record of whose Onimo saw it. That last omission is the point: it makes the list a list of routers instead of a record of where people have been, and it cannot be turned back into one.

If you do not want your network in there, you do not have to ask us. Add _nomap to the end of its name and it is skipped. That is the convention Google introduced for this and asks other providers to respect, and you can check it yourself.

Data we could share

Numbers, never names.

We do not sell personal data. Not now, and not at a better offer.

What we may do is share aggregated figures with organisations that can put them to use: how often things go missing in a region, how long they stay missing, how far they tend to travel. Those numbers say something about patterns in general and nothing about you, your household or your address. Where it earns money, it goes towards keeping the subscription low for the people who own an Onimo.

This is where a promise usually gets vague, so here it is in writing. Two things have to be true before anything leaves at all.

  1. No one’s privacy is the price. Not at a good offer, not at a better one. Private. Always. is the veto, not the slogan.
  2. It comes back to the people who own an Onimo: a lower subscription, a stronger network, better devices, something that works where it did not work before. By owners, for owners.

A benefit has to be named in writing before the fact. Being good for the company does not count.

And four rules on what may leave:

  1. No personal data leaves Onimo. No names, no addresses, no email addresses, no device identifiers.
  2. Only figures from which no single household or Onimo can be picked out. What level that takes is decided per case, and never by us alone.
  3. Never the movements of one Onimo, in any form, to anyone.
  4. What is shared, with whom and why, is published here before it happens.

Oversight

Not our word alone.

A rule is worth what the check on it is worth. Onimo should not be the only party deciding whether Onimo is keeping to the rules above, so we are setting up independent oversight for exactly this decision, with the power to stop a proposal.

It works in both directions. A proposal that meets the rules is approved; a proposal that is refused comes with the rule it fails, in writing, here. That way this is something you can read and check rather than something you have to feel good about.

Who sits on it and how they are appointed is being worked out. We will publish that here before the first proposal is ever tested, and until that oversight is in place, nothing is shared.

And it should not depend on who owns Onimo. We are working out how to tie these rules to the company instead of to its owner, so that a later owner cannot quietly drop them. That is not arranged yet. When it is, this page will describe it, and you will be able to read the instrument itself rather than a sentence about it.

×Where your Onimo is, what may ever be shared, and why it may leave at all.WHERE YOUR ONIMO ISYour OnimoOn the collar, the bike,whatever you attach it to.LoRaA FinderYours, or anotherhome’s. Passes it on.internetstill sealedWHAT THE ONIMO SENDSShort messages, at intervals rather than as a stream.More while you are looking for it, and now and then thewifi names in range, which is what makes the map better.ONIMONetwork serverUnseals the message. Nothing else touches it.Position serviceWorks out where, from what the device sent.Your accountThe result is kept here. Nowhere else.only youYouIn the app, or onthe web. No one else.leaves OnimoSatellite solverA satellite snapshot goes to a specialistservice that turns it into coordinates.WHAT MAY EVER BE SHAREDONIMOEvery Onimo togetherMany accounts at once,never a single one.AggregationNames, addresses anddevice ids drop out here.only numbersThe gateTwo conditions and four rules,all published before the fact.Independent oversight decidesthe level, and can refuse.Not yet in place.SHUTAn organisationFigures about patterns.Never a record.WHY IT MAY LEAVE AT ALLBack to the ownersA lower subscription. A stronger network. Better devices.Something that works where it did not work before.By owners, for owners.A benefit has to be named in writing before the fact.Your location is never sold and never shared. What may ever leave is figures no single household can be picked out of.Click to enlarge

Questions

Ask us anything about this.

Privacy questions, data requests, or a hole in the reasoning above: write to privacy@onimo.com.