OhmPrivacy Policy
We believe in honest, plain-English privacy.
Effective 24 June 2026
Introduction
Ohm is a DJ field recorder and live streaming app for iPhone. This policy explains what data the app collects, where it goes, and what rights you have over it.
Ohm is built for European users. We take privacy seriously — not because we have to, but because it is the right way to build software. We do not have an account system, we do not build profiles on you, and we do not sell or share data with advertisers.
The data controller for this app is Ohm. Contact: privacy@ohm-rec.app
What we collect
Analytics
We use TelemetryDeck to collect anonymous usage signals — things like "recording started", "stream ended", "settings changed". These signals tell us which features are used and help us prioritise improvements.
What TelemetryDeck receives:
- —A random device identifier derived by TelemetryDeck from your device. It is not linked to your Apple ID, name, or any personal account and cannot be traced back to you.
- —Product interaction signals — names of app actions (e.g.
recording.started). Signals never include file names, track titles, artist names, or any content you create. - —Your iOS version and app version, sent automatically by the TelemetryDeck SDK.
TelemetryDeck is a privacy-focused analytics service based in Germany and is GDPR-compliant. Legal basis (GDPR): Legitimate interest — Article 6(1)(f).
Website analytics
This website uses Google Analytics 4 to understand how visitors use the marketing site. Google may process page views, referrer information, approximate location, browser and device details, and online identifiers. Google may store cookies or use similar technologies. This website analytics service is separate from the privacy-preserving telemetry used by the Ohm app. See Google's privacy policy for more information about Google's processing.
Diagnostics and performance
We use MetricKit, Apple's built-in diagnostics framework, to receive anonymised crash logs and performance metrics. These are aggregated by Apple before delivery and are not linked to you personally. Legal basis: Legitimate interest — Article 6(1)(f).
Security signals
When a jailbroken or tampered device is detected, a signal is sent to TelemetryDeck containing a risk score and signal names (for example: rootless_mount). This contains no personal data and is used only to understand the security posture of the device population.
What we don't collect
- —No name, email address, phone number, or any other personal identifier
- —No account — Ohm has no user registration system
- —No location data
- —No contacts or address book access
- —No device advertising identifier (IDFA)
- —No tracking across other apps or websites
- —No audio files, recordings, or track metadata uploaded to our servers
- —No browsing history
Third-party services
Receives anonymous usage signals and a privacy-preserving device identifier as described above. Data is processed in Germany and is GDPR-compliant.
Aggregated crash and performance reports processed by Apple before being made available to us. Governed by Apple's privacy policy.
When you enable Shazam track ID and connect a USB mixer, short audio fingerprints (not raw audio) are sent to Apple's ShazamKit servers for identification. You can disable Shazam at any time in Settings → Track Detection.
When you connect a Beatport account and enable Beatport track ID, a short WAV audio snippet (~5 seconds) is sent directly to Beatport's recognition API using your authenticated OAuth session. No data passes through Ohm's servers for this call. You can disconnect your Beatport account at any time in Settings → Destinations.
When you go live, your audio and video stream is sent directly to Twitch's RTMP ingest servers. Your OAuth tokens are stored in the iOS Keychain. Token exchange uses our Cloudflare Worker proxy (see below) because Twitch's API requires a server-side secret. OAuth scopes: user:read:email, channel:manage:broadcast, channel:read:stream_key.
When you go live, your stream is sent directly to YouTube's RTMP ingest servers. Token exchange uses PKCE directly — no Ohm server is involved. OAuth scopes: youtube.force-ssl, profile.
When you upload a recording, the WAV file, mix title, description, and optional track list are sent to SoundCloud's API using your authenticated session. Token exchange routes through our Cloudflare Worker proxy.
When you upload a recording, the audio (transcoded to AAC on-device), mix title, and description are sent to Mixcloud's API using your authenticated session. Token exchange routes through our Cloudflare Worker proxy.
We operate a server-side proxy hosted on Cloudflare's network. Its sole purpose is to hold platform client_secret values so they are never stored in the app binary. The Worker receives OAuth authorization codes and forwards them to Twitch, SoundCloud, or Mixcloud with the appropriate secret. The Worker does not log or store your tokens, audio, or any personal data. Each request includes an Apple App Attest assertion to verify the request originates from genuine Ohm software.
Your audio recordings
Audio recordings, video files, and WAV metadata are stored entirely on your device in the app's Documents directory. They are never uploaded to Ohm's servers or any third party unless you explicitly choose to upload them via the Upload sheet in the Library.
When you go live on Twitch or YouTube, your audio and video stream is transmitted directly to that platform. Ohm does not receive or retain a copy of your stream.
When you use Beatport track ID, a short audio snippet is sent to Beatport's API for recognition. The rest of your recording stays on your device.
Platform connections
When you connect a platform account (Beatport, Twitch, YouTube, SoundCloud, Mixcloud), the resulting OAuth access and refresh tokens are stored in the iOS Keychain on your device with the protection class kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. Tokens are not synced to iCloud, not visible to other apps, and are encrypted by the Secure Enclave when your device supports it.
You can remove any connected account at any time in Settings → Destinations. Disconnecting deletes all Keychain entries for that platform immediately.
Your rights under GDPR
If you are in the European Economic Area or United Kingdom, you have the following rights:
To exercise any right, contact privacy@ohm-rec.app. We will respond within 30 days.
Data retention
| Data | Where stored | Retention |
|---|---|---|
| Your recordings | On your device | Until you delete them |
| OAuth tokens | iOS Keychain on your device | Until you disconnect the account |
| App Attest key record | Cloudflare KV | 30 days, then automatically deleted |
| TelemetryDeck analytics | TelemetryDeck servers | Per TelemetryDeck's retention policy |
| MetricKit crash data | Apple's infrastructure | Per Apple's retention policy |
We do not operate databases containing your personal data.
Children
Ohm is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has used this app and you have a concern, contact us at privacy@ohm-rec.app.
Changes to this policy
If we make material changes to this policy, we will update the effective date and note the changes prominently. For significant changes we will notify you in the app. We will not retroactively weaken the privacy protections described here without explicit notice.