Back to getovi.in

Notices

Effective: 30 April 2026

This page covers Ovi's security posture and vulnerability-disclosure process, the open-source software we ship, and our accessibility status. It complements the Privacy Policy and the EULA.

Security

Security claims and what backs them

The marketing copy on getovi.in uses three claims that have compliance weight; here is what each one actually means in code.

How to report a vulnerability

Email [email protected] with the subject line Security report. Please include:

We aim to acknowledge reports within 3 business days and to triage based on severity. Please do not publicly disclose the issue before we have had a reasonable chance to fix it, unless law requires you to do so.

Please do not run destructive tests, pivot to unrelated systems, exfiltrate data beyond what is needed to demonstrate the issue, or use spam, malware, social engineering, or extortion. Acting in good faith and within these limits, we will not pursue action against you for your research.

A machine-readable copy of this contact is published at /.well-known/security.txt.

Baseline security measures

What we do not claim

Ovi is not certified for SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, or any other regulated compliance framework. We do not accept regulated personal data (health, financial, biometric, children's data, etc.) and the product is not designed to process it. Please do not paste regulated data into the application unless you have determined for yourself that local-only handling on your own machine is appropriate for that data class.

Breach notification

Because Ovi collects only a small set of anonymous usage events keyed to a random per-device UUID, the realistic blast radius of a security incident on our infrastructure is limited to that aggregate analytics data. If we become aware of a breach that nonetheless affects our users:

To suggest the existence of a breach you suspect, use the same email above with the subject line Suspected breach.

Open-Source Notices

Ovi is built on top of a great deal of open-source software. The list below covers the projects whose code we ship in the desktop application and on getovi.in, with versions, licenses, and source URLs. Each project remains governed by its own license. Where a project is dual-licensed, that is shown as A / B. Transitive dependencies are not enumerated here individually; the manifests in the source repository (package.json and src-tauri/Cargo.toml) are the authoritative source.

Desktop runtime — Rust crates

Desktop runtime — JavaScript core

Markdown rendering pipeline

Analytics and fonts

Website build (getovi.in)

Reporting an attribution issue

If you maintain one of the projects above and believe an attribution or license entry on this page is wrong or missing, please email [email protected] with the subject line OSS notice correction and we will fix it on the next release.

Accessibility

This section describes Ovi's accessibility target, the current conformance status, and the gaps we know about. We treat this as a living statement — when something improves or regresses, this is the first thing we update.

Target

The website at getovi.in and the Ovi desktop application both target WCAG 2.2 Level AA for the public-facing surfaces. Where AAA is reachable for a specific component without trade-offs against the rest of the experience, we aim for AAA.

Current status

Both surfaces are partially conformant with WCAG 2.2 AA. Conformance has been assessed by the developer through manual checks against the WCAG checklist, with assistance from the underlying component libraries (Radix UI on the desktop app, semantic HTML on the website). The product has not yet undergone an independent third-party accessibility audit.

The components we lean on most heavily — Radix UI primitives for dialogs, menus, tabs, switches, and select boxes — are designed to meet WAI-ARIA Authoring Practices, and we use them with their default keyboard and screen-reader behaviour intact.

Known gaps

Compatibility

The website is tested against current versions of Chrome, Edge, Firefox, and Safari. The desktop application is currently Windows-only and uses the system WebView2 runtime; macOS and Linux builds are on the roadmap and will be re-checked for accessibility before launch.

Feedback

If you run into an accessibility issue, please email [email protected] with the subject line Accessibility. Including the page or screen, the assistive technology you were using if any, and a short description of the issue helps us reproduce and fix it. We aim to respond within five working days.