Privacy policy
Last updated October 29, 2026
This policy explains how Harmonicode SL handles your personal data when you use omnionengine.com, your Omnion ID and the Omnion services, under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Who is responsible
Harmonicode SL, NIF B22588917, Calle Tagamanent, 9, 08396 Sant Cebrià de Vallalta (Barcelona), Spain. Contact: [email protected].
What we keep and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email, username, display name, password (stored only as a secure hash) | To create and run your Omnion ID | Contract (GDPR art. 6.1.b) | While your account exists |
| Security: IP address and browser of each session, signed-in editors, sign-in and security events | To keep your account safe and prevent abuse | Legitimate interest (art. 6.1.f) | Sessions: up to 30 days after their last use. Security events: up to 12 months |
| Two-step verification: the secret of your authenticator app and your recovery codes (hashed) | To check your sign-in codes | Contract | Until you turn it off |
| Downloads: which version and when | To count downloads and fix problems | Legitimate interest | While your account exists |
| Early access: your place in line, when you got access and, if you tell us, what you want to make and your computer (Windows or macOS) | To invite people in waves and email you when it’s your turn | Contract | While your account exists |
| Newsletter: whether you want it and when you said yes. If you subscribe without an Omnion ID, only your email and when you confirmed it | To send Omnion news (new features, releases and tips) | Consent (art. 6.1.a), which you can withdraw at any time | Until you withdraw it. Without an Omnion ID, we delete your email when you unsubscribe, and unconfirmed sign-ups after 30 days |
| Emails we send you (confirmation, password reset, security alerts, your early access invite) | To run your account | Contract | Not kept beyond sending |
We don’t sell your data, we don’t use it for advertising and we don’t build profiles about you.
The forum
When you sign in to the forum, we send it your username, display name, email and account number, so it can create your forum profile. What you post on the forum is public.
Who processes data for us
We use providers that process data only on our instructions, under data processing agreements:
- Hosting of the website and its database, in the European Union.
- Cloudflare, for the domain, security and content delivery.
- An email provider to send account emails and, if you want it, the newsletter.
- When paid services open, Stripe will process payments. We never see or store your full card number.
If a provider processes data outside the European Economic Area, it does so with the safeguards the GDPR requires (such as the European Commission’s standard contractual clauses).
Cookies
We only use the cookies needed for the website to work. See the Cookies page.
Your rights
You can access, correct, delete and download (portability) your data, object to or restrict how we use it, and withdraw consent at any time. Most of this you can do yourself:
- Edit your profile and newsletter choice in your Omnion ID, or use the unsubscribe link at the end of any newsletter.
- Download a copy of your data with Download my data.
- Delete your account with Delete my Omnion ID.
For anything else, write to [email protected]. We answer within one month. You can also complain to the Spanish Data Protection Agency (AEPD, aepd.es).
Children
You need to be at least 14 to create an Omnion ID. If we learn that a younger child created an account, we’ll delete it.
Security
Passwords are stored with Argon2id. Session and editor tokens are stored only as hashes. Connections use HTTPS, and you can turn on two-step verification for your account.
Changes
If we change this policy in an important way, we’ll tell you by email or on the website before it applies.