Privacy Policy

Inceptix LLC, a Wyoming limited liability company doing business as OmniFlag (“the Company”), is the data controller for personal data processed through omniflag.app. Contact for anything in this policy: cyrus@omniflag.app.

• Account data: your email address and authentication identifiers (password hash or Google account identifier). Passwords are handled by the authentication provider and never visible to the Company.
• Intake answers: what you provide in the planning wizard, such as citizenships, current tax residency, city, motivations, income and savings bands, family situation, constraints, and free-text context. Bands are used instead of exact figures by design.
• Where you arrived from: with an intake, the Company keeps how you first reached the site, either the campaign tag on the link you followed or the name of the website that linked to it, or that you came directly. It records a channel, never a page you read elsewhere.
• Alerts data: your email address and whether you are subscribed to OmniFlag alerts, the rule-change newsletter. An account is subscribed once its email address is confirmed; you can also subscribe without an account. The Company records whether you subscribed yourself or were enrolled with your account, and when you unsubscribed. Every alert carries an unsubscribe link.
• Payment data: if you buy anything from the Company, Stripe processes the payment. The Company receives a record that the payment happened, its amount, and Stripe’s identifiers for it. Your card number is given directly to Stripe and never reaches the Company.
• Pulse subscription: if you subscribe to Pulse, a record of the subscription holding Stripe’s identifiers for it, its status, whether it bills monthly or yearly, when the current period ends, whether it is set to cancel, and which season it is in.
• Vault documents: the files you upload to the Vault, each with the file name you gave it, the document type you chose, its format, its size, and when you uploaded it. Files sit in private storage that only the Company’s server can open, and nothing in the Vault is ever sent to a language model.
• Day counts and costs: the days you record in each jurisdiction for each tax year, and the monthly costs you enter in the Cost Tracker, including what a month cost before your move.
• Current stay: if you record one, the jurisdiction you say you are in and the day you arrived, and which day thresholds the Company has already emailed you about for that stay. The Company never reads your device’s location. The stay is only what you type.
• Citizenship clocks: for each destination you add one to, the day you say your residence there began, and when the Company emailed you about it.
• Exit Plan progress: which steps of your Exit Plan you have marked done and when, and, once your Exit season ends, a dated copy of your Exit Plan as it stood that day.
• Passage applications: if you apply for Passage, the move you asked about, your timeline, whether you have your own professional or want a shortlist of them, and any notes you add.
• US Exit season list: if you ask to be told when the US Exit season opens, a record that you asked and when.
• Origin list: if you ask to be told when the Company covers the country you are leaving, a record of that country, that you asked, and when.
• Community: if you take part in the community, the handle you choose, the threads and posts you write (with the destination and observed date on a field report), any report you make about a post and its optional note, and whether you have turned off reply emails.
• The OmniFlag app in ChatGPT: if you use OmniFlag inside ChatGPT, ChatGPT sends the Company what the app needs to answer, such as where you pay tax now, an income figure or band, your citizenships, and what matters to you in a move. The Company uses them to compute the answer and keeps none of them. Each use records one event saying which tool ran, whether it returned an answer, and the origin country named. It never records your income or citizenship, and no account, name, or email address is involved.
• Technical data: standard server logs (IP address, user agent, timestamps) kept by the hosting providers for security and operations.
• Session recordings: a record of how you move through the pages, covering clicks, scrolling, and where you pause. Every piece of text and every input is replaced with a blank block in your browser before anything is sent, so a recording shows the shape of the page and what you did on it, never what you read or typed. Your intake answers, your name, and your email address are not in it.
• Advertising click data: if you arrive from a Google ad or an ad in ChatGPT, the link carries that network’s own click identifier. The network’s tag reads it in your browser so that a later submission can be attributed to that ad. It is not stored in the Company’s database.

Intake answers are used to produce your free report and, if you subscribe to Pulse, to build and re-run your plan in Pulse. Your account email receives what you asked for and messages about your submission. When you submit, an email with your address and a summary of your answers, including anything you typed in your own words, goes to the Company’s administrators. Intake answers are never used for the newsletter and are never sent to an advertising network. Personal data is never sold. If you hold Pulse and record a current stay, the Company reads it with your day counts once a day and emails you, once for each day threshold, before the stay reaches it. If you hold Pulse and record a citizenship clock, the Company emails you once, 180 days before the date it counts to.

While the site is running ads, the fact that a submission happened is reported to the ad network that ran them, Google or OpenAI, with no answers attached. OpenAI also receives a random code your browser makes up the first time you submit, so that a second submission from the same browser is not counted twice. The code is not your account, your submission, or anything else the Company holds.

Every account with a confirmed email address receives OmniFlag alerts: email when a rule the Company tracks changes, when a destination is added, and news about the Service and its paid plans. The Company sends them on the basis of its relationship with you as an account holder. Unsubscribing, from the link in any alert, stops them, is never overridden, and does not affect your account, your report, or any subscription. An alerts subscription is used only to send alerts.

The free report involves no language model at all. It is assembled directly from the Company’s own researched material, so nothing you submit is sent to a model to produce it.

Pulse uses a large language model, provided by Anthropic, to build and re-run a Member’s plan, with two protections. First, only categorical answers such as citizenships, income band, timeline, and motivations are sent: your email, your name, and anything you typed in your own words are removed before any model call. Second, the model provider operates under a zero-data-retention agreement, meaning submitted content is not stored by the provider or used to train models.

When a statement in a plan cannot be matched word for word to the government source it quotes, a second model call checks it against that source. That call is given the statement and the public source text, not your answers.

The OmniFlag app in ChatGPT runs no language model of the Company’s. Its answers are computed from the same researched material as the free report. The model you talk to there is OpenAI’s, and what you type into ChatGPT, including what the app is asked, is governed by OpenAI’s privacy policy, not this one. OpenAI is not a processor for the Company.

Session recordings are reviewed automatically, to find the places where people get stuck. That review is performed by a Google model through the analytics provider. Because a recording is masked in your browser before it is sent, what reaches the model is a wireframe of clicks, pauses, and scrolling with no readable content in it.

The Company uses a small set of service providers to run the Service, each processing data only on the Company’s instructions:

• Supabase (database and authentication hosting, United States)
• Vercel (web hosting, United States)
• Resend (transactional email and the newsletter, United States)
• Stripe (payment processing, United States): used only if you buy something. Card details go to Stripe directly and are never held by the Company.
• Anthropic (language model processing under zero retention, United States)
• Google (United States): used if you choose Google sign-in, while the site is running paid search ads for advertising measurement, and for the automated review of masked session recordings described in section 4. The advertising tag reports that a submission happened and reads Google’s own ad-click identifier from the link you arrived on. It is never given your name, your email, or any intake answer.
• OpenAI (United States): while the site is running ads in ChatGPT, for advertising measurement. Its tag reports that a submission happened, with the random code described in section 3, and reads OpenAI’s own ad-click identifier from the link you arrived on. It is never given your name, your email, or any intake answer.
• PostHog (product analytics and session recording, United States): page views, product events such as which step of the intake was completed, which controls you clicked, and the masked recordings described above. A click records which control it landed on, never the words on it. Neither the events nor the recordings include your name, email, or intake answers. An event from the ChatGPT app carries the origin country named there and nothing else from the conversation.

If you are outside the United States, your data is transferred to and processed in the United States by the providers above.

Account data and intake answers are kept while your account exists. Email cyrus@omniflag.app from your account address to request a copy of your data or deletion of your account and submissions; deletion is completed within 30 days, except records the Company must keep to meet legal obligations, including sanctions-screening records and records of payments, which tax and accounting rules require the Company to retain. After an account is deleted, its email address stays on a do-not-email list only so that it is never emailed again. You can also delete the account yourself from the Your data section of your account page, after confirming your password or a fresh emailed link.

You can delete a Vault document at any time while your subscription is active, which deletes the file itself as well as its record. After your subscription ends, your Vault documents stay available to download, and only to download, for 30 days. The Company then deletes them permanently, each file and its record, and cannot restore them.

You can delete your own community post at any time. Deleting erases its words rather than hiding them, and deleting the post that opened a thread erases the thread’s title too. A post the Company hides for moderation keeps its words, unshown, so it can be restored. If your account is deleted, your posts and the titles of threads you opened are erased the same way and stay in place with no name attached, and your handle, your reports, and your reply-email setting are deleted.

The site sets cookies for four purposes. The first is keeping you signed in (authentication session). The second is advertising measurement: while the site is running paid search ads, Google’s tag sets a cookie so Google can tell that a visit which followed one of its ads later completed the planning wizard. While the site is running ads in ChatGPT, OpenAI’s tag stores its own click identifier in your browser for the same purpose. What either network receives is that a submission happened. Neither is given your name, your email, or any answer you gave.

The third is traffic measurement: while it is enabled, Google Analytics sets cookies to count visits, tell returning browsers from new ones, and show which pages are read and whether the planning wizard gets finished. What Google receives is how this site is used. It is not given your name, your email, or any answer you gave.

The fourth is your journey home remembering your last visit. Once you are signed in, it sets one cookie of its own that holds the time you last opened it, so the page can say what changed since: sources re-verified on your matches, new threads in the room. It holds two dates and nothing else, it is read only by OmniFlag, and deleting it only means the page stops saying what is new.

Wizard progress before you sign in is stored in your own browser’s local storage and never leaves your device until you submit. Product analytics and session recording use local storage rather than cookies, and do not track you across other sites.

If you are reading this in the United Kingdom or the European Economic Area, neither the advertising cookie nor the analytics cookies are set at all. The site tells Google to withhold them for those regions before any Google tag loads, and it does not ask you to agree to anything to make that happen. OpenAI’s measurement tag does not load there either.

Everywhere else, you can block the advertising and analytics cookies with any standard ad or tracker blocker, or by refusing third-party cookies in your browser. Nothing on this site stops working if you do.

Material changes to this policy are posted on this page with an updated date. If a change meaningfully affects how existing data is used, account holders are notified by email first.