Privacy policy
Last updated: November 9, 2026
OhMako is a platform for CI, code review, security testing and merging, with machines for coding agents, at ohmako.com. OhMako, based in Ontario, Canada, runs it and is the seller of record for it. This policy covers the website, the docs and the invite list. Nothing can be bought yet. When accounts and billing open, this policy will be updated to cover them before they go live.
What we collect
When you join the invite list, we store:
- your email address;
- the reasons you picked, any mix of CI Runners, Agent Machines, Snapshots, Code Review, Security Testing, Merge Queue and CI Optimization;
- the operating systems you picked, if any;
- the name of the site or campaign in the link that first brought you (its
utm_source), if the link had one; - when you signed up, when you confirmed, and when we last sent you a confirmation email;
- two random codes for the links in our emails: one to confirm, which we store only as a one-way hash, and one to unsubscribe.
We don’t ask for your name or your company. Before storing a sign-up, we look up your email’s domain in DNS to check that it can receive mail.
What we don’t collect
- No IP addresses on disk. Our servers see your IP address in order to answer a request. To stop a single address from filling the list, we allow five sign-ups per IP address every ten minutes, counted only in the memory of the server that answered. An address’s count is never written to the database or to a log. It’s dropped at the next sign-up after the address has been idle for 20 minutes, or when the server restarts.
- No cookies, analytics or tracking. The site sets no cookies and loads no analytics, advertising or other third-party scripts. Its fonts are served from our own site.
- Two things in your browser, both only to make the site work. The theme you pick (dark or light) is kept in your browser’s local storage. On the docs pages, which sidebar sections are open and how far the sidebar is scrolled are kept in session storage, which your browser clears when you close the tab. Neither is sent to us.
How we use it
We use your email address to send the confirmation email, and then to invite you to OhMako’s products as they open and tell you what you can use. The reasons you picked decide who we invite first to each product. We use your reasons and operating systems to decide what to build and open first, and the utm_source to see which links bring people to the site. We don’t sell your data, share it with advertisers, or use it to send you anything that isn’t about OhMako.
Confirming your email
A sign-up only counts once you confirm it. We send one email with a link to a confirm page, and the sign-up counts when you press Confirm there. Opening the link alone confirms nothing, so a mail scanner that opens links can’t confirm for you.
If you sign up again before confirming, we keep your newest reasons and operating systems, and send another email only if the last one went out more than an hour ago. Once you’ve confirmed, signing up again changes nothing.
If you never confirm, we delete your sign-up about 30 days after the last confirmation email we sent.
Unsubscribing
Every email we send has an unsubscribe link, and mail apps that offer a one-click unsubscribe button use it too. Unsubscribing deletes your sign-up straight away.
So that we never email you again, we keep two things after you unsubscribe: an unsalted one-way hash (SHA-256) of your email address in lower case, and when you unsubscribed. We can’t turn the hash back into your address, but we can tell whether an address we’re given matches it. That’s how we recognize it if it signs up again, and then we send nothing.
If mail to your address bounces, or you mark one of our emails as spam, Amazon SES adds your address to our account’s suppression list, and we can’t send to it again.
Who handles it
We run the site and the invite list on Amazon Web Services:
- the sign-ups are stored in a database in AWS’s us-west-2 region (Oregon, United States);
- Amazon Simple Email Service (SES) sends the emails, in the same region;
- the invite list’s servers also run in us-west-2;
- Amazon CloudFront serves the website.
If you’re outside the United States, your data is stored and processed in the United States.
If something fails while we handle your sign-up, such as the database or the email, our logs record the kind of error and the domain part of your address (for example gmail.com), never the whole address. If you reply to one of our emails, your reply goes to our mailbox at the address at the end of this page.
How long we keep it
- Unconfirmed sign-ups: deleted about 30 days after the last confirmation email.
- Confirmed sign-ups: kept until you unsubscribe or ask us to delete them. When the invite list ends, we delete them.
- The unsubscribe hash: kept indefinitely, so that we keep honoring the unsubscribe.
- Backups: a deleted sign-up can remain in our database’s automatic backups for up to a day.
Your choices and rights
You can unsubscribe at any time, which deletes your sign-up. You can also write to us to see what we hold about you, correct it, or have it deleted. We answer within 30 days. Wherever you live, you have these rights with us. That includes rights under the GDPR in the EU and UK, under the CCPA in California, and under PIPEDA in Canada. If you think we’ve handled your data wrongly, you can also complain to your local data protection authority.
Children
The service is for software teams. We don’t knowingly collect data from anyone under 16. If you think a child has joined the invite list, write to us and we’ll delete the sign-up.
Changes
If we change this policy, we’ll update the date at the top of this page. If a change affects how we use the data you’ve already given us, we’ll email the invite list before it takes effect.