✓Direct Answer

Oyma complies with GDPR and CCPA by design. Because Oyma operates zero central servers and collects zero personal data, there are no remote databases to breach, no personal profiles to delete, and zero third-party data transfers.

Privacy Compliance by Inherent Design

The General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) establish comprehensive legal frameworks to protect personal data. For cloud productivity companies, compliance requires complex Data Processing Agreements (DPAs), automated right-to-be-forgotten deletion workflows, cross-border data transfer mechanisms, and breach notification infrastructure.

Oyma satisfies these regulatory requirements through the ultimate architectural safeguard: data avoidance.

Core GDPR Principles Applied to Oyma

  1. Data Minimization (Article 5(1)(c)): GDPR requires that personal data collection be adequate, relevant, and limited to what is strictly necessary. Oyma collects zero personal data, zero analytics beacons, and zero telemetry.
  2. Storage Limitation (Article 5(1)(e)): Because Oyma operates no servers, your documents and audio files are stored exclusively on your own Mac storage for exactly as long as you choose to keep them.
  3. Right of Access & Portability (Articles 15 & 20): Because all notes are plain CommonMark text and standard audio files on your local drive, you already have instant access to your data in standard, open formats.
  4. Right to Erasure / Deletion (Article 17): When you delete a note or move a folder to the macOS Trash, it is deleted instantly from your local disk. There is no remote cloud database, backup tape, or server replica where your deleted data lingers.
  5. No Cross-Border Data Transfers (Chapter V): Your notes never cross international borders or traverse overseas cloud regions, eliminating Standard Contractual Clause (SCC) compliance friction.

By removing the centralized cloud server entirely, Oyma delivers a privacy posture that exceeds conventional cloud compliance baselines.

Compliance Through Data Avoidance Architecture

Meeting privacy regulations by eliminating central data collection:

  • Data Minimization: Oyma collects zero personal data, zero analytics beacons, and zero telemetry.
  • Data Portability: Notes exist as standard CommonMark files on disk, ensuring permanent user access in open formats.
  • Immediate Right to Erasure: Deleting a file removes it from local disk instantly; no remote cloud replicas exist.
  • No Cross-Border Transfers: User data never traverses international borders or foreign cloud data centers.

Compliance by Architecture and Absolute Data Avoidance

By operating zero remote servers and collecting zero telemetry, Oyma eliminates personal data storage risks by design, satisfying GDPR and CCPA requirements through absolute data avoidance.

You never have to worry about data subject access requests, cross-border data transfer assessments, or breach notification protocols because your notes never touch external servers.

Regulatory Compliance Summary

  • Data Minimization (Art. 5): Collects zero personal data, zero analytics beacons, and zero telemetry.
  • Right of Access (Art. 15): Notes are standard CommonMark files on your disk, permanently accessible.
  • Right to Erasure (Art. 17): Deleting a note removes it from disk instantly with zero cloud backups.
  • Cross-Border Transfers: Zero data leaves your machine, eliminating international transfer risks.

Related Questions & Architecture Guides