Privacy

Built in, not switched on.

A protection that depends on you finding it is not a protection.

Protections

What each one actually does.

Each is marked with where it really stands. Most of Oplo is in development, and a page that wrote all of this in the present tense would be describing a company that does not exist yet.1

On-device intelligence

The model that reads your messages, files and calendar runs on your hardware. It has access because the device is yours — not because it uploaded anything to earn it.In development

Minimum collection

A feature asks for what it needs to work and nothing next to it. Location for the map, not location for everything else that happens to be running.A design rule from the start

No silent departures

When something has to leave the device, the interface says so as it happens and the request can be refused without the feature pretending to be broken.In development

No advertising profile

Oplo has no ad business, so there is no profile to assemble and no commercial reason to keep what you did last week.In effect now

Ephemeral by default

Requests are answered and dropped. A history exists because you asked for one, and deleting it deletes it rather than hiding it.In development

Your content is not training data

What you write, store and say to Oplo is not used to train models — not anonymised, not aggregated, not sampled.In effect now

Sign in without spreading out

One account used to reach your own things, rather than an identity handed to every site that would like to know who you are.In development

Encrypted sync and backup

Content encrypted on the device before it syncs, with the keys staying on your hardware. It is the reason we would be unable to read it, not merely unwilling.In development, an Oplo+ capability

Not here yet

The parts we cannot claim.

These are the things that turn a stated intention into something you can verify. None of them exists today, and listing them is the only way to be held to them.

Independent auditNo third party has reviewed any of this. When one has, the report is published here whole, not summarised.
Published threat modelWhat Oplo defends against, and what it does not, written down. Not written yet.
Security bountyNo programme, so no way for a researcher to be paid for finding us wrong. In preparation.
Shipping codeNearly everything above is a design decision rather than a running system. Ship dates are not set.

How control is meant to work

Notes
  1. These pages state how Oplo intends to build and what it has committed to. They are not the binding document; the privacy policy is, and it is in preparation. Where a protection is not built yet, it is labelled as such rather than described in the present tense.