Privacy

OScar is run by RIEN Network AB (org. no. 559323-5277), Bockhornsvägen 5, 587 32 Linköping, Sweden. We are the controller of the personal data described here. Questions: contact@riennetwork.com.

What we collect

• Your account: your email address and a securely hashed password. If you turn on two-factor sign-in, its secret.
• What you create: notes, files, photos, drawings, invoices, events, contacts, budget lines and the rest of your content. Vault entries are encrypted in your browser; we cannot read them.
• Your plan: which plan you have and its status. Payments are handled by Paddle, who sees your card details; we never do.
• Security data: IP addresses and timestamps, used to stop abuse (for example too many sign-in attempts) and kept only briefly.
• AI usage: when you use an AI feature, the text or picture you send and how many credits it used.

The free tools that run in your browser store your work in your browser only; it does not reach our servers.

Why we use it

• To provide the service you signed up for (the contract with you).
• To keep accounts and the service secure (our legitimate interest).
• To keep accounting records where the law requires it.

We do not sell your data, show ads or use your content to train AI models.

Who helps us run OScar

• Supabase: database, sign-in and file storage, hosted in Zurich, Switzerland.
• Vercel: the servers that run the site, in Frankfurt, Germany.
• Anthropic: the AI model behind the AI features; only what you send to an AI feature.
• Cloudflare Turnstile: the check that you're a person when you sign in or sign up.
• Resend: sends account emails, such as the confirmation link.
• Paddle: payments, as the merchant of record.

Where a provider handles data outside the EU or EEA, the transfer is covered by the EU's standard contractual clauses or an equivalent safeguard.

How long we keep it

As long as you have an account. Things you move to the trash are deleted for good after 30 days. When you delete your account, your content and files are deleted with it. Records the law requires us to keep, such as payment records, are kept as long as required.

Your rights

You can see, correct, export and delete your data. Export everything and delete your account from the Account page, or email us for anything else. You can also object to how we use your data, and complain to the Swedish Authority for Privacy Protection (IMY).

Cookies

We only use cookies that the service needs to work. See Cookies.