Privacy Policy

Effective date: November 6, 2026

This policy describes the OmniPhone desk at app.omniphone.app and the OmniPhone click-to-dial browser extension. OmniPhone is operated by MaidZoom LLC, Boca Raton, Florida ("we," "us," "our"). It covers information those products collect, where it is stored, and where it is sent. Questions: hello@omniphone.app or (561) 817-4160, Monday through Saturday, 9 AM–6 PM Eastern Time, excluding US holidays.

Click-to-dial extension

The extension places a call through your OmniPhone desk from a phone number on a web page, a text selection, a tel: link, or the toolbar keypad. It does not place the call by itself. It does not download or run code from the internet. Its script, styles, icons, and font ship inside the extension package.

Stored in the extension, on your device.

• The desk address (https://app.omniphone.app unless you change it in Options) and whether dial buttons are on.
• After you sign in: a session token and a limited profile containing display name, email, avatar initials and color, and default caller ID. The extension does not store account ids, roles, audit fields, passwords or password hashes.
• The desk's light or dark theme, so the popup can match it.
• While a desk tab is open, a session copy of that tab's call status: each line's number, display name, call state, status label, timer, mute state, caller ID label, and whether the extension placed it, plus the desk's theme and which browser tab is the desk. The extension does not have the tabs permission, so it does not read the address of other sites. The copy is removed when that tab closes, and when the desk page is hidden because you leave it, including browser back/forward caching. Navigating inside the desk does not clear it. The copy does not include contacts, notes, texts, or chat.

Sent to your OmniPhone desk.

• Sign-in sends the email and password you type to /api/ext/login. The password is checked against the stored hash and is not kept by the extension. The desk returns the session token and an account profile. The extension stores only the popup fields listed above.
• When the popup opens it sends the session token to /api/ext/session once, to confirm you are still signed in.
• When you dial and a token is saved, it sends that token and the number (and a name, if the desk already had one) to /api/ext/dial. The desk checks the number and the extension opens your desk tab. If the desk cannot be reached, the number is still handed to the desk tab and the desk checks it there.

Read on web pages. By default the dial-button script runs only on app.omniphone.app. After you allow website access, or on the tab where you open the popup, the extension reads text on the page to find phone numbers and draws a dial button next to each one. The page text, the page address, and your browsing history are not uploaded. Only a number you choose to dial is sent, as described above. The desk at app.omniphone.app is where the extension relays dial, mute, answer, hang-up, and keypad tones to the open tab, and receives the call status described above.

Clipboard. The extension does not read the clipboard and does not request clipboard access. You can paste a number into the popup's number field yourself. Chrome handles that paste. The extension does not store it.

Not collected by the extension. It does not collect health information, payment card numbers, location, browsing history, email or text contents, or a log of your clicks and keystrokes. It does not sell data.

OmniPhone desk

The desk is the browser app at app.omniphone.app. Signing in there uses an email and password. The password is stored on the server only as a scrypt hash. The owner account is the admin email and password hash configured on the server. Other accounts are rows with id, email, display name, role (admin or member), password hash, disabled, title, avatar initials, avatar color, default caller ID, session version, whether the password must be changed, createdBy (the email of the owner or admin who created the account), and created and updated timestamps. A session cookie (or, for the extension, the bearer token above) keeps you signed in.

Kept in this browser. Contacts, text messages, call history, and the dial queue are stored in a database in this browser (IndexedDB), separate for each signed-in person. A contact can include name, phone, email, company, notes, tags, address, deal fields, tasks, and timeline notes. A text includes the number, direction, body, time, delivery status, and any carrier error. A call log includes the number, name, direction, start and end times, duration, how it ended, notes, disposition, caller ID, whether a person or a machine answered, and whether a voicemail script finished. That browser database is not uploaded as a copy of itself, by the desk or by the extension. It stays on the device until you clear the site's data. Using the desk still sends specific pieces out, described below: a number you dial, the audio of a connected call, the body of a text you send, and anything you save in a server-side campaign or in team chat.

Kept on the server. The application is hosted on Render. When Supabase is configured, account records, team chat, and server-side campaign data are stored there. Team chat messages include the room, the author's email, name, and color, the message text, and the time. Campaign and API calling records include the contact's phone and email, the call or message details, createdBy (who placed it: an email or the name of an API key) and createdById (the signed-in user's id, when there is one), and, for an AI assistant call, the text transcript of that conversation (who spoke and the words). The server does not store call audio.

Calls and texts. Calls are connected by Telnyx, our telephone provider. The provider receives the numbers and the call audio it needs to connect the call, plus delivery status. Texts are sent and received through that same kind of provider, which receives the numbers and the message. Caller ID is the number configured on the account. A voicemail drop speaks a script through the telephone provider; it does not save a recording of the person who was called.

Webhooks. Telnyx POSTs call and message status to this server. Those requests include the numbers and the status. For an AI assistant call, Telnyx can also send the text of the conversation. When a campaign or an API call has a webhook URL, this server POSTs an event to that address: the event name, the phone or email, the call or message status, the contact's name and notes when the event is for a campaign contact, and, for an assistant call, the text transcript. The event does not include call audio. If a webhook secret is configured, the POST is signed. When AGENT_SMS_WEBHOOK_URL is set, that address receives inbound text bodies and the numbers on them.

AI audio stream. An API call can ask for AI mode "stream". The server then passes a wss:// address to Telnyx, and Telnyx sends that call's audio to that address for an outside agent to hear and speak. OmniPhone does not store that audio. Assistant mode stores the text transcript on the server (who spoke, and the words) and does not store the audio.

Email. Outreach email is sent through the configured email provider, including Telnyx, Microsoft 365, SMTP, or Resend. Messages include the recipient, subject, body, business footer, and unsubscribe link. New campaign emails may include an OmniPhone tracking image and tracked links. We record observed opens and clicks, their times, the campaign and message, and a short-lived browser/network hash used to consolidate repeat requests. Email privacy tools and automated scanners can affect these measurements. Tracking links stop recording after 30 days. Unsubscribe links are not click-tracked.

Funding applications. Raven Advance applicants provide business and contact information, requested funding, application answers and uploaded documents. Application drafts and uploaded documents are encrypted at rest. An application link's access history records time, IP address and browser details. Application activity is visible to authorized workspace staff; an application-open notification may include the associated business/contact profile and recorded IP address and is sent to the Raven Advance owner at maxim@ravenadv.org. The full application and documents remain accessible through the authenticated application workspace. An IP address or link open does not establish the visitor's identity. Funding-page cookies preserve your application and campaign source on the same device.

Funding website chat. Questions may be processed by our configured AI provider to select funding guidance. Chat messages are saved for staff only if you choose the conversation-saving option. Saved transcripts are encrypted at rest, limited to the most recent 40 exchanges, and hidden from staff views after 14 days; expired records are deleted in background cleanup sweeps. Contact details you explicitly submit create or link a CRM inquiry for manual review and remain subject to our contact-record retention practices. This does not enroll you in automated marketing. A separate optional activity-sharing choice records anonymous page-section and interaction counts. Do not enter account numbers, Social Security numbers, or documents in chat; use the secure application portal.

Payments. Subscription checkout on the pricing page uses a Stripe Payment Link. The card number is entered on Stripe's page. OmniPhone does not receive or store the card number. We keep the billing and tax records described in the Terms of Service.

Text opt-in. The SMS opt-in form records your name, mobile number, the time, the wording you agreed to, the page address, your IP address, and the browser user agent. It saves that consent and does not send a text by itself. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Carriers are not liable for delayed or undelivered messages. See the SMS Policy.

How information is shared

• Telephony provider: Telnyx, only as needed to connect calls and deliver texts.
• Email provider: Telnyx, Microsoft 365, your SMTP server, or Resend, to send configured email and operational notifications.
• Hosting and database: Render hosts the app. Supabase stores the server records described above when it is configured.
• Payments: Stripe processes the checkout on the pricing page.
• Endpoints you configure: a webhook URL on a campaign or an API call, the inbound-text address AGENT_SMS_WEBHOOK_URL when it is set, and the wss:// address of an AI mode "stream" call. Those recipients are not OmniPhone. A webhook receives the event described above (phone or email, status, and an assistant transcript when there is one). The inbound-text address receives the text body and the numbers. The stream address receives the live call audio for that call.
• Legal requirements: when required by law, regulation, or valid legal process.

We do not sell personal information.

Retention

Contacts, text messages, and call history kept in this browser stay on the device until you clear the site's data. You can export the desk's contacts from this browser as a CSV. OmniPhone does not keep a copy of that browser database, so we do not export or delete it for you.

Server records are the accounts, team chat, campaign and API calling records, assistant transcripts, and SMS consent described above. For 30 days after your final billing period ends, you may ask us to export those server records, and you may port your phone numbers to another provider. After those 30 days, we release the numbers and delete your account data within a further 30 days. We keep only the records we are legally required to keep, such as billing and tax records. We do not keep call audio. The Terms of Service states the same billing timeline. Extension data stored by Chrome is removed when you remove the extension. Sign out in the popup deletes the token and profile from the extension.

Your choices

• Sign out of the extension, or remove it, to delete the token and profile it stored.
• Turn dial buttons off in the extension's Options. The right-click menu and the keypad still dial.
• Deny website access. The extension then does not add dial buttons on every site. It can still dial a selection from the right-click menu, and opening the popup can add buttons to that tab only.
• Reply STOP to opt out of texts. Email hello@omniphone.app to ask for access, correction, or deletion.

Children

OmniPhone is a business phone service. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes

If we change this policy, we will post the updated version on this page with a new effective date.

Contact

MaidZoom LLC, Boca Raton, Florida
Email: hello@omniphone.app
Phone: (561) 817-4160
Hours: Monday through Saturday, 9 AM–6 PM Eastern Time, excluding US holidays.