Privacy Policy

01Who we are & what this covers

OMG is operated by AppLabsTabs, a company established in the United Kingdom ("AppLabsTabs", "OMG", "we", "us"). We are the data controller for the personal data described in this policy. OMG is a live video-chat app for adults: it connects you with other verified people for real-time video calls and direct messages.

This policy covers the OMG mobile app (iOS and Android), this website, and the support channels we operate (together, the "Service"). It should be read with our Terms of Use and our Community Guidelines & Safety Centre. Where we refer to the "app stores", we mean Apple's App Store and Google Play, which handle sign-in with Apple/Google and all payments under their own privacy policies.

02At a glance

The short version — every point is explained in the sections that follow.

• We do not sell your data and we do not use advertising or tracking SDKs. The app contains no third-party analytics or ad networks.
• Photos, selfies and text you submit are screened by AI. Profile photos, your username and bio, and the age-check selfie are analysed by automated systems run by Google (Gemini API), and in some cases Anthropic or OpenAI, then reviewed by our team where needed.
• Video calls are not recorded. Audio and video stream between participants through LiveKit's real-time infrastructure. When automated call moderation is active, individual frames may be sampled for safety review; evidence of violations is kept for up to 90 days.
• Age check selfies are deleted as soon as you pass. If a check fails or leads to an account closure, the frames are kept as evidence for up to 90 days. We never build a face template that could identify you.
• You can delete your account in the app (Profile → Settings → Delete Account). Photos, your username and your sign-in link are removed immediately; a limited record is kept to prevent banned users from returning (section 14).
• Your data is stored in the EU and the US (photos in AWS Stockholm, application data with Google Firebase and Heroku) with UK-approved transfer safeguards.

03Information we collect

We collect only what the Service needs to work, keep the community safe, and meet our legal obligations. The table lists each category, where it comes from, why we use it, and our legal basis under the UK GDPR / EU GDPR.

What we do not collect

• Precise or background location. The app does not request location permission. Your country is set from your device region or by you; your city is what you type.
• Contacts, photo library scanning, or clipboard. Photo library access is used only when you pick a profile photo.
• Advertising identifiers or cross-app tracking. We do not use the IDFA/AAID and do not track you across other companies' apps or websites.
• Card or bank details. Apple and Google process every payment; we only receive a transaction identifier and what you bought.

04Age assurance & selfie age estimation

OMG is for adults, so everyone confirms their date of birth and completes a one-time selfie age check before they can meet other members. Here is exactly what happens:

1. The app captures three short-lived frames from your front camera while you look at the screen.
2. The frames are sent over an encrypted connection to our server and passed to an automated age-estimation model operated by Google (Gemini API). A second model acts as a referee on borderline results. Neither model is asked to identify you — only to estimate whether you appear to be an adult and whether the selfie is a live capture.
3. If the check passes, the frames are deleted immediately. We keep only the outcome (verified) and the date.
4. If the check cannot confirm you are an adult, you can retry a limited number of times. If the result leads us to close the account, the frames are retained as evidence for up to 90 days so you can appeal and so we can answer any lawful request; they are then deleted automatically.

What we keep, and what we never create

• We do not create or store a face template, faceprint or any biometric identifier that could be used to recognise you. The check is an age estimate, not identification.
• We keep a perceptual hash of each frame (a short fingerprint that cannot be turned back into an image) so we can detect the same selfie being replayed on another account.
• If two independent members report that you appear to be under 18, we may ask you to complete the age check again before you can continue using OMG.
• The age-check images are never used for advertising, profiling beyond the age decision, or training our providers' models (see section 10).

05Photos & content moderation

Every profile photo, username, bio and caption is screened before or shortly after it becomes visible. This is how we keep sexual content, minors and other prohibited material off OMG.

• Automated screening. Photos and text are sent to an AI moderation model run by Google (Gemini API). Depending on our configuration at the time, Anthropic or OpenAI models may be used for the same purpose or as a second opinion. The model returns labels (for example whether a photo contains a face, sexual content, or a person who appears to be a minor); it does not identify you and has no memory of your data between requests.
• Publication gate. A photo may be visible briefly while the review completes; if the review finds a violation the photo is removed from your profile. Serious findings (for example apparent minors or sexual content) are escalated to a second model and, where an account closure follows, to our moderators.
• Human review. Our moderation team reviews reports, appeals and escalations. Moderators see only what they need for the case — the reported content, the profile, and the safety record.
• Evidence. When content leads to an account closure, we keep the relevant photo or frames for up to 90 days so the decision can be appealed and reviewed. Content that is illegal to possess is not kept for appeals; it is preserved only as the law requires and reported to the authorities (section 9).

06Video & voice calls

Calls run over LiveKit, a real-time media platform. Audio and video travel encrypted between you, the other participant and the media servers that relay them. We do not record calls, and there is no library of past calls anywhere in the Service.

• Call records. We store who called whom, when, how long the call lasted and its connection quality, plus the minutes charged against your balance. These records support billing, abuse investigations and the "recent calls" view.
• Safety sampling. The app is built so that, when automated call moderation is switched on, single frames from a call may be sampled and analysed by an AI model (operated by Anthropic and/or Amazon Rekognition) for prohibited content such as nudity or the apparent presence of a minor. Sampled frames are discarded within two days unless they show a violation, in which case they are kept as evidence for up to 90 days. Automated sampling is not always active; the report button is always available and reports are the primary way violations in calls reach us.
• Recording by others. Our Terms prohibit recording, screenshotting or streaming a call without the other person's consent, and doing so leads to a permanent ban. We cannot technically guarantee that another participant does not capture your image with another device — please read our safety tips.

07Messages & notifications

Direct messages and call invites are stored on our servers so they can be delivered and shown in your inbox. They are visible to you and the recipient, and to our moderators only when a report, an appeal, a safety investigation or a legal request makes it necessary. Every time a moderator opens a conversation it is recorded in an internal audit log. Deleting your account removes your access to your conversations.

Push notifications are transactional only — new messages, call invites, moderation and appeal outcomes, and purchase confirmations. We store the push token your device gives us and delete it when you sign out, remove the app, or delete your account. You can turn notifications off in your device settings at any time.

08Purchases, subscriptions, coins & gifts

OMG offers an auto-renewing Premium subscription and packs of coins. Both are sold exclusively through the App Store and Google Play, which handle payment, receipts and refunds. We receive a signed transaction record (a transaction identifier, the product, the purchase and expiry dates, and the country of the storefront) so we can unlock what you bought — never your card details.

• We keep a ledger of coins earned, bought, spent and gifted so your balance is correct and disputes can be resolved. Gifts sent in a call transfer coins from your balance to the recipient's.
• We verify subscriptions with Apple's and Google's servers and receive their renewal and refund notifications so your access matches your subscription status.
• Transaction records are kept for as long as tax and accounting law requires (currently six years in the UK).

09Safety: reports, enforcement, appeals & law enforcement

Keeping OMG safe requires us to process some data about behaviour, not just profiles. Here is what that involves.

• Reports and blocks. When you report someone, we record the reason, the time, and the context (for example the call or conversation it relates to). The person you report is not told who reported them. Blocking is stored so that you are never matched or contacted again.
• Automated enforcement. An account that receives reports from several independent members within a short window, or is blocked by many members alongside reports, may be suspended automatically pending review. Photo and age-check findings can also lead to automatic suspension. Every automated suspension can be appealed in the app and is reviewed by a person.
• Appeals. If your account is suspended, the app shows the reason and lets you submit an appeal. We keep the appeal, our decision and its reasons together with the safety record.
• Ban records. To stop banned users from simply creating a new account, we keep a hashed version of the sign-in identifier and the reason for the closure. This record is retained for as long as the ban is in force.
• Child sexual abuse material (CSAM). If we identify apparent CSAM we preserve the material as the law requires, report it to the National Center for Missing & Exploited Children (NCMEC) and/or the relevant national authority, and permanently close the account. Such material is never shown to other members and is not kept for appeals.
• Law enforcement and legal requests. We disclose personal data to authorities when we are legally required to, or when we believe in good faith that disclosure is necessary to prevent serious harm. Requests can be sent to hello@applabstabs.com; see the Safety Centre for what we need.

10Who we share information with

We never sell personal data and we do not share it with advertisers or data brokers. Personal data is shared only with the parties below, each bound by contracts that limit what they may do with it.

Other members

Your profile (username, age, gender, photos, city, country, interests, bio and, for Premium members, social links), your online status, and anything you say or show during a call or in a message are visible to the members you interact with. Your email address, date of birth, and safety records are never shown to other members.

Service providers (processors)

Legal, safety and corporate

• Authorities: to comply with law, court orders or lawful requests, and to report child sexual abuse material (section 9).
• Protection of rights and safety: where necessary to investigate fraud, security incidents, or threats to any person.
• Business transfers: if AppLabsTabs is involved in a merger, acquisition or sale of assets, your data may transfer to the successor, who must honour this policy; we will notify you of any change in control.

11International data transfers

We are based in the United Kingdom and our providers operate in the EU and the United States, so your data is transferred outside the UK. When we do this we rely on:

• the UK Government's adequacy regulations for the European Economic Area, and the UK–US Data Bridge for US providers certified under the Data Privacy Framework; and
• the International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum for all other transfers, together with technical measures such as encryption in transit and at rest.

For members in the EU, the same safeguards apply under the EU GDPR. You can request a copy of the relevant safeguards by writing to hello@applabstabs.com.

12How long we keep your data

We keep personal data only for as long as your account is active or as needed for the purposes above. The main retention periods are:

Content that is illegal to possess is preserved only as required by law for reporting to the authorities, and then destroyed.

13Your rights & choices

Wherever you live, you can access, correct and delete most of your data directly in the app. In addition, depending on your location, you have legal rights over your personal data:

• UK and EU (UK GDPR / EU GDPR): access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and the right not to be subject to solely automated decisions with legal or similarly significant effects — you can always ask for a person to review an automated moderation or age decision.
• Türkiye (KVKK, Article 11): the right to learn whether your data is processed, request information, learn the purpose, know the third parties it is transferred to, request correction or deletion, and object to results produced by automated analysis.
• California (CCPA/CPRA): the right to know, delete and correct, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising your rights.
• Brazil (LGPD) and other jurisdictions: the equivalent rights under your local law.

To exercise a right, email hello@applabstabs.com from the email address linked to your account, or tell us your username. We may ask you to verify your identity. We respond within one month (extendable by two further months for complex requests, in which case we will tell you). Requests are free unless they are manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ICO); EU residents can contact their national data protection authority, and residents of Türkiye the Personal Data Protection Authority (KVKK). We would appreciate the chance to address your concern first.

14Deleting your account

You can delete your account at any time from inside the app: Profile → Settings → Delete Account, then confirm. The step-by-step guide is at omgv3.vercel.app/delete-account.

What happens immediately

• Your profile disappears from OMG and can no longer be found or contacted.
• Your profile photos are deleted from storage.
• Your username is released and your Sign in with Apple / Google link is removed (we also revoke the Apple sign-in token).
• Your subscription record is unlinked from the account (manage or cancel the subscription itself in the App Store or Google Play — deleting the account does not cancel it).
• Any pending age-check images and evidence pointers on the account are removed.

What we keep after deletion

• A limited account record — the closed status, a hashed sign-in identifier, and the timeline of safety actions — so that a banned or suspended user cannot return by creating a new account, and so we can answer legal claims. We retain this record only for as long as those purposes require and then delete or de-identify it.
• Purchase records for the statutory period (section 12).
• Reports you filed about other members, with your identity removed from what moderators see.
• Messages you sent remain visible to the recipient in their inbox, attributed to a deleted account.

Suspended accounts

While an account is suspended, the in-app deletion option is unavailable so that the appeal process can run. If you would rather delete than appeal, email hello@applabstabs.com from the email address linked to the account. We complete the deletion once the appeal window has closed, keeping only the ban record described above.

15Security

We protect your data with encryption in transit (TLS) and at rest, signed and short-lived access to stored photos, server-side verification of every purchase and every sign-in, strict access controls and audit logs for our moderation tools, and rate limiting and abuse detection on our API. Moderators act under confidentiality obligations and see only the data needed for a case.

No system is perfectly secure. If we become aware of a breach that is likely to put your rights at risk we will notify you and the relevant authority as the law requires. Please report security concerns to hello@applabstabs.com.

16Children & the 18+ rule

The Service is not directed at, and may not be used by, anyone under 18. We use a date-of-birth check, the selfie age check described in section 4, photo screening for apparent minors, and member reports to keep under-18s off OMG. If we learn that an account belongs to a minor, we close it and delete the associated data, keeping only what the law requires.

17Cookies & this website

This website uses no advertising or analytics cookies and no third-party trackers. The only cookie we set is a strictly necessary session cookie for our staff moderation console, which is never set for ordinary visitors. Our hosting provider (Vercel) keeps standard server logs — IP address, browser type and the pages requested — for security and to keep the site running.

The mobile app does not use cookies. It stores a sign-in token and your preferences on your device so you stay signed in; signing out or deleting the app removes them.

18Changes to this policy

We will update this policy when our practices or the law change. The date at the top always shows the current version. For material changes — for example a new category of data, a new purpose, or a new AI provider that processes your content — we will notify you in the app before the change takes effect and, where the law requires it, ask for your consent again.

19Contact us

AppLabsTabs — United Kingdom. Data protection and rights requests, safety, child-protection and law-enforcement matters, and general questions: hello@applabstabs.com.

If you are in the EU and wish to exercise your rights under the EU GDPR, the same addresses apply; we respond in English and Turkish.