Scope and contact
This policy covers the website at odict.touchany.com, its online services, ODict macOS clients connected to those services, and the ODict Chrome extension. The service is maintained by independent developer oKing. For privacy questions, contact [email protected]. Operators of self-hosted or modified versions are responsible for explaining their own data practices.
Accounts and Google sign-in
Email registration processes your email address, display name, and password. The server stores a password hash for verification, not a readable password. Verification codes are stored as purpose-specific digests. For Google sign-in, the service verifies the identity credential provided by Google and uses the account identifier, email address, email verification status, and display name to create or link your account. We do not receive your Google password or request Gmail or Google Drive access for sign-in. Google identity information is used for authentication and account linking, not advertising profiles, and is not sent to dictionary-generation services. In Profile, you can optionally choose a gender (undisclosed by default) and a built-in avatar, and update your display name. These choices are stored with your account and used to display your profile. Avatar choices are bundled with ODict; this feature does not upload your photos or load a third-party avatar service.
Sessions and account security
The service stores sessions, credential digests, expiration times, and revocation status to restore sign-in, refresh credentials, sign out, and prevent replay. The website uses an essential HttpOnly cookie to maintain your session; short-lived access credentials are held only in page memory. macOS credentials are stored in the local Keychain. Resetting your password revokes existing account sessions. Signing out normally revokes only the current client session.
Online lookups and AI processing
Online lookups send the query text and selected languages to the dictionary service. When dictionary enrichment is enabled, the query and related dictionary content may also be sent to AI services that evaluate or generate definitions, and retained in dictionary entries, jobs, revisions, or diagnostic records. Server diagnostics can retain request and response bodies from third-party calls. Submit only the content you need to look up. The separate AI feature in the macOS app sends input to the service you configure, whose own data practices apply.
Browser storage
The website stores recent queries, a small dictionary cache, and language and layout preferences in your browser. A Service Worker caches application resources for return visits and some offline use. These local records are not currently synchronized to your account as personal history. Administrative credentials are stored only in sessionStorage for the current browser session. You can clear cookies, local storage, IndexedDB, and caches in your browser settings; doing so removes local records and may sign you out.
macOS device statistics and account linking
By default, the macOS app sends basic usage statistics on normal startup. You can turn this off in the privacy settings. The device ID is derived locally by combining the hardware UUID with an ODict-specific prefix and hashing it with SHA-256; the raw hardware UUID is not uploaded. This is a stable device identifier, not fully anonymous information. Reports include the app version and build, macOS major and minor versions, and process architecture. The server records the first and most recent report times. Installation public keys and sequence numbers validate reports. Signing in links the device to the most recently signed-in account. Disabling statistics stops startup activity and system-information reports, but device linking for sign-in remains available. The statistics endpoint does not receive screenshots, clipboard contents, files, or dictionary queries.
Chrome Extension Privacy
The ODict Chrome extension processes text you type, select, or look up by hovering with the configured modifier key. Depending on your selection settings, selecting text may start a lookup automatically. Page access supports these lookup features and the in-page panel; the extension does not upload entire pages or browsing history as part of a lookup. Local MDX/MDD dictionary files are read on your device and are not uploaded by the local dictionary feature. Online dictionary, AI, translation, and pronunciation sources have different data flows, described below.
Chrome extension permissions
Content scripts run on supported HTTP and HTTPS pages to detect selections and hovered words and display results. Access to file URLs requires Chrome's separate Allow access to file URLs setting. The storage permission saves settings and credentials; contextMenus adds selection lookup to the right-click menu; offscreen supports local dictionary processing and audio playback; identity opens the browser-based account sign-in flow; and tts provides browser speech. Host access to odict.touchany.com supports ODict services. Optional access to other HTTPS origins or local development endpoints is requested for configured services such as AI and network pronunciation. You can manage site access, optional permissions, and incognito access in Chrome's extension settings.
Chrome extension local storage
The extension stores preferences, service configurations, configured AI API keys, and account session credentials in chrome.storage.local. IndexedDB stores lookup history, saved answers, dictionary metadata and indexes, and handles to dictionary folders you authorize. These records are stored in the extension's browser profile rather than synchronized through chrome.storage.sync. Lookup history is not uploaded as personal account history. When history is enabled, up to 500 dictionary records and 100 AI records are kept locally; new history is not saved in incognito contexts. Local credential storage is restricted to trusted extension contexts, but is not an operating-system credential vault or a promise of encryption at rest.
Chrome extension online and third-party processing
Signing in uses the ODict website and exchanges authorization credentials with the configured ODict service. Online dictionary requests send the query, language parameters, and account authorization to that service; the online lookup and retention practices elsewhere in this policy also apply. Using a configured AI source sends the query, configured prompts, model and language choices, and that source's API key directly to its endpoint. Network pronunciation sends the text to the selected audio endpoint. These providers receive network information such as your IP address and apply their own retention and privacy practices. The built-in translation option uses the browser's Translator API and may require the browser to download language models. Browser speech uses the selected voice, whose processing may depend on the browser, operating system, or voice provider.
Chrome extension data security
Configured remote AI endpoints use HTTPS; HTTP is limited to supported local development endpoints. AI requests omit browser cookies and referrer information and reject redirects. API keys and account credentials are handled in extension contexts rather than exposed through the page-facing settings response. These measures reduce exposure but cannot guarantee absolute security. Only grant access to services you trust, avoid submitting sensitive text, and protect the browser profile and device where local records are stored.
Chrome extension controls and deletion
You can disable selection or hover lookup, turn off future history recording, delete individual history records or clear a history category, remove configured sources, unlink local dictionaries, and sign out through the extension. Removing a dictionary link does not delete the original files from your device. Uninstalling the extension removes its browser-managed local storage, but does not delete your ODict account or information already sent to online providers. Turning off history does not erase existing records. For server-side account or personal-data requests, use Account & Data Deletion or contact [email protected]; contact a separately configured provider about data held by that provider.
Pronunciation services
Playing network audio sends the current word to the selected provider, including Youdao dictionary audio or Ogden TTS. That provider also receives network request information. Whether browser speech is processed locally depends on your system, browser, and selected voice. Pronunciation processing is separate from Google identity information.
Service providers and network information
Google processes Google sign-in when you choose it. Resend processes recipient addresses and verification emails for email delivery. Enabled AI services process the relevant query and dictionary content. Hosting, CDN, or font-resource providers may also deliver website resources. Connections expose network information such as IP addresses to the corresponding providers. Ordinary access and security logs can contain IP addresses, request paths, timestamps, and errors; query paths may contain query text. The device statistics table does not store IP addresses or infer location.
Retention
Account information is retained until a deletion request is processed or it is no longer needed to provide the relevant service. Verification codes and credentials expire, but expiration does not mean immediate database deletion; temporary records are removed through maintenance. Device deduplication records are retained long term to avoid counting a returning device again. Expired sessions and installation keys unused for an extended period may be removed. Retention of queries, revisions, diagnostics, and infrastructure logs depends on their purpose and maintenance policies. We do not currently promise a single automatic deletion period for all records.
Your choices and data requests
You can use web dictionary lookups without signing in, sign out of the current session, clear browser site data, or disable macOS startup statistics. To request account deletion, deletion of personal information, removal of a device-account association, or information about data handling, contact the developer using the Account & Data Deletion page. There is currently no self-service account deletion feature. Disabling statistics does not erase existing records, and revoking Google authorization does not delete your ODict account.
Policy updates
This page will be updated as features and actual data practices change, with the revision date shown above. New uses of information or changes to third-party authorization scopes will be explained in the relevant feature, with a choice provided where required.