1. About this policy
This policy describes the Omriss iOS and Android apps and the omriss.app website. Omriss helps you visualize new looks for rooms, exteriors, and gardens using AI. Omriss is operated by Muntean Holding AS, a Norwegian limited company (aksjeselskap). Muntean Holding AS is the legal operator and is responsible for the personal information described in this policy.
For privacy questions or requests, email yolo@illebra.app. You can also visit our contact page.
2. Information we process
Photos and creative instructions. Photos you select, additional views, masks, mood-board images, design choices, and written instructions are processed when needed for the AI feature you use. This may include multiple reference images.
Projects on your device. Saved photos, generated designs, project details, mood boards, and app preferences are stored on your device. Without an account nothing is synced, so they stay there until you delete them.
Account and sync. Omriss works without an account: the app gives you an anonymous Firebase identifier. Creating an account or signing in is part of Omriss Pro. You can use an email address and password, or sign in with Google or, on iOS, Apple. We receive your email address and, if you use Apple or Google, the name that provider shares. Firebase Authentication stores these details and handles your password; we cannot see it. While you are signed in and Pro is active, the app copies your projects, designs, photos, mood boards, and a few settings to Firebase (Cloud Firestore and Cloud Storage) under your account, so they appear on your other devices. Only your signed-in account can read or change them through the app. If Pro ends, syncing pauses and what is already in your account stays there until you delete it.
Credits, ads, and purchases. Our backend keeps a wallet for your identifier: credit balances, the ads you watched and when, usage counters, and the country or region your device reports. Apple or Google processes payments for Omriss Pro and top-ups, and we do not receive your payment card details. Our subscription provider, RevenueCat, receives purchase information such as receipts, transaction identifiers, the product, your subscription status, and your Firebase identifier, plus technical data such as your IP address. It tells our backend about purchases so we can grant credits. We keep a record of each top-up purchase (identifier, product, credits, and time) and each rewarded-ad credit (ad unit, outcome, and time) so that credits are never granted twice. When you sign in to an existing account on a new device, a short-lived one-time code, stored only as a hash, moves the earned and purchased credits from that device’s guest identity to your account.
Service and security data. Firebase provides an authentication identifier, which is anonymous until you create an account. Our backend records usage counters and timestamps associated with that identifier to enforce limits. Google/Firebase and our AI provider may also process network and diagnostic information, such as IP addresses, request metadata, and error logs, to operate and protect their services.
Crash reports. In release versions of the apps, Firebase Crashlytics collects crash reports, such as the stack trace, device model, operating system and app version, the time of the crash, and an installation identifier. We use them to find and fix bugs. We do not intentionally include your photos, design instructions, or email address.
Analytics. We use Google Analytics for Firebase (Firebase Analytics) in the iOS and Android apps and, with your consent, on this website. Analytics can process pages or screens viewed, sessions, engagement, feature interactions, app version, device model, operating system, browser, language, referral information, and approximate location derived from an IP address. The website uses cookie-based client identifiers; the apps use app-instance identifiers and may process advertising identifiers depending on device permissions and app settings. Google Analytics uses IP addresses to derive location and does not log or store individual IP addresses. We do not intentionally send your photos, design instructions, contact messages, name, or email address to Analytics.
Mobile advertising. The iOS and Android apps use Google AdMob to show rewarded ads that you can choose to watch to earn credits. Its Google Mobile Ads SDK may collect IP addresses (including approximate location), advertising and app/device identifiers, ad impressions and clicks, other app interactions, and diagnostic data such as crashes and performance information. Collection depends on the platform, SDK configuration, and consent or device permissions. These data support ad delivery, measurement, fraud prevention, and, where permitted, personalized advertising. Where required, the app asks for your consent with Google’s consent message and, on iOS, with Apple’s tracking permission prompt. When you finish a rewarded ad, Google confirms it to our backend together with your Firebase identifier so we can credit you.
Messages. If you contact us by email, we receive the name, email address, and message you choose to send. This website does not upload form entries to a contact database.
3. Why we process it
We process your selected content to deliver the AI feature you request. We process authentication and usage information to provide reliable service, enforce request limits, prevent abuse, and troubleshoot errors. We process account, sync, and purchase information to run your account, keep your projects in sync, manage your subscription and credits, and prevent credit abuse. We use crash reports to keep the apps stable. We use correspondence to respond to you.
Where applicable under European data protection law, the bases are performing the service you request (including your account, subscription, and purchases), legitimate interests in operating and protecting the service and keeping the apps stable, and compliance with legal obligations. Website analytics relies on your consent. Mobile analytics and advertising choices depend on the app’s consent controls and device permissions. Where required, consent must be obtained before optional analytics, personalized advertising, or tracking begins.
4. AI and service providers
AI requests pass through our Firebase/Google Cloud backend to OpenAI. The images, instructions, and reference material needed for your request are sent to OpenAI for processing. OpenAI states that API inputs and outputs are not used to train its models by default, unless a customer opts in.
Provider processing and retention depend on the endpoint and account settings. Abuse-monitoring logs may be retained for up to 30 days by default, with exceptions. See OpenAI’s data controls and Firebase’s privacy information for details.
Google also processes analytics, crash report, and mobile advertising data through Firebase Analytics, Firebase Crashlytics, and AdMob. AdMob may share data with advertising partners for ad delivery and measurement. See Google’s Privacy Policy, Google Analytics data collection, and AdMob’s data disclosures.
Firebase (Google Cloud) also provides sign-in, the database and file storage behind sync, and our backend. Apple and Google process sign-ins with their services, and payments for purchases, under their own privacy policies. RevenueCat processes purchase information for us; see RevenueCat’s Privacy Policy. Some features open other sites in your browser, such as a Google shopping search for similar items. Those links contain only a text search phrase, not your photos, and the sites handle it under their own policies.
These providers may process information outside your country, including in the United States.
5. Storage and deletion
Without an account, your projects stay on your device until you delete them or remove the app, subject to your device’s backup settings. The app’s “Delete all data” control removes local app data; it does not erase information already processed or retained by service providers. With an account, deleting a project or mood board also removes its synced copy, and signing out removes the copy from that device while your account keeps it.
You can delete your account at any time with “Delete account” on your profile. This permanently deletes your synced projects, mood boards, photos, and designs, your credit balance and usage records, and then your sign-in. It cannot be undone. It does not cancel an App Store or Google Play subscription, so cancel that in your store settings to avoid further charges. We keep the top-up purchase and ad-reward records described above. They contain only an internal identifier, a transaction identifier, and the product or ad unit and time, and they stop a late ad confirmation or purchase notification from granting credits twice. Purchase records held by Apple, Google, and RevenueCat, and data already processed by other providers, are not erased by this and follow their own retention.
Backend usage records and operational logs are separate from your local project library. We keep them only as long as needed to operate the service, enforce limits, prevent abuse, and troubleshoot errors, and we keep support messages only as long as needed to respond to you. A rolling hourly usage counter is a rate-limit window, not a deletion schedule.
6. This website
The site uses Firebase Hosting when deployed. Hosting providers process requests and related technical information to deliver pages and maintain security. Images, fonts, and video assets are served with the site. Firebase Analytics loads only after you select “Accept analytics” in our cookie popup. Rejecting analytics leaves it disabled and does not limit access to the website. AdMob is used in the mobile apps; this website does not display AdMob ads.
After acceptance, Google Analytics can set first-party cookies such as _ga and _ga_8LLY7NEXQN to distinguish visitors and sessions. Google’s default cookie expiration is two years and may renew with activity. Our consent choice is stored separately in your browser’s local storage for six months, after which we ask again on your next visit. This preference storage is used only to remember your choice. Website advertising storage, advertising user data, advertising personalization, and Google signals are disabled.
Use “Cookie settings” in the footer to change your choice at any time. Rejecting after accepting stops website analytics, clears accessible Google Analytics cookies for this site, and reloads the page. Withdrawing consent does not delete data Google has already received. Clearing browser storage or using another browser or device may cause the popup to appear again. Website consent does not control analytics or ads in the mobile apps. Analytics event retention depends on our Google Analytics property settings.
The contact form prepares an email in your chosen email application. Nothing is sent until you send that email.
7. Your choices and rights
You choose which photos to provide. Avoid uploading sensitive details or images of other people without permission. You can delete saved projects, delete your account in the app, and revoke photo permissions in your device settings.
Depending on your location, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict or object to processing, and withdraw consent where processing relies on it. Some backend records may be difficult to identify without your anonymous app identifier. To make a request, email yolo@illebra.app. If you have an account, write from the email address you signed in with so we can find your data.
For mobile advertising, you can manage tracking permission in iOS Settings and advertising privacy controls in Android Settings. These controls may restrict identifiers or personalization; they do not necessarily stop all ad delivery or data collection. Mobile consent controls are handled separately from the website.
You may lodge a complaint with your local data protection authority. In Norway, this is Datatilsynet.
8. Changes to this policy
We will update this page when our practices change. The date above identifies the latest version. Material changes will be communicated where required.