This Privacy Policy applies to products and services operated by OBRIS GROUP PTE. LTD. ("Obris", "we", "us" or "our").
Obris is designed around data minimisation. We aim to collect only the information reasonably required to operate, secure and maintain Obris services.
Obris services use an Obris ID as the primary service identifier. An email address or phone number is not required to create an Obris identity.
This Privacy Policy explains what information we may collect, why we collect it, how it is used and the choices available to you.
1. Information We Collect
The information collected depends on which Obris products and services you use.
Obris ID
When an Obris identity is created, a randomly generated Obris ID is assigned. Your Obris ID is used to identify your account across supported Obris services without requiring your name, email address or phone number.
Device information
When a device is linked to Obris services, we may process information such as:
- an Obris generated device identifier;
- device public keys;
- linked device or device slot information;
- device model;
- operating system version;
- Obris application version;
- activation or entitlement status; and
- technical information required to provide and secure the service.
We do not require the device owner's real identity in order to link a supported device to an Obris ID.
Subscription and entitlement information
Where a paid Obris product is used, we may store information including:
- Obris ID;
- subscription product;
- subscription provider;
- subscription status;
- activation date;
- expiry or renewal date; and
- payment or purchase reference identifiers required to verify an entitlement.
Obris does not need to store your full payment card details.
Network and security information
Obris systems may process limited technical information required to establish connections, authenticate devices, prevent abuse and protect the service.
This may include:
- IP addresses associated with registration, activation, device linking or other service requests;
- timestamps;
- authentication or security events;
- request and response information;
- server or application errors; and
- information required for rate limiting, fraud prevention or service protection.
This information is not collected for advertising or behavioural profiling.
Obris VPN
When Obris VPN is used, the service must process technical information required to establish and maintain the VPN connection.
This may include:
- WireGuard public keys;
- assigned VPN addresses;
- selected VPN server or region;
- connection state; and
- technical information required to establish and maintain the encrypted tunnel.
Obris VPN uses the WireGuard protocol. WireGuard uses modern cryptographic primitives including ChaCha20 authenticated with Poly1305 to protect VPN traffic.
Obris does not use the contents of your VPN traffic for advertising, marketing or behavioural profiling.
Like any VPN provider, Obris VPN servers must handle network packets while routing an active VPN connection. This does not mean that the contents of those connections are stored as a browsing profile.
Obris Chat
Obris Chat is designed to provide end-to-end encrypted communications. Message, voice and video content is encrypted so that communications are intended to be readable by the participating users rather than by Obris.
The service may still process limited metadata required to operate communications, including:
- Obris IDs or other internal account identifiers;
- device and cryptographic identifiers;
- group or conversation membership information;
- delivery state;
- connection information; and
- timestamps required for service operation.
We do not use private communication content for advertising or profiling.
Obris Vault
When Obris Vault or supported backup functionality is used, Obris may process encrypted data you choose to store or back up, together with limited technical metadata required to provide the service.
Where information is protected by client side encryption, Obris does not require access to the plaintext content in order to store the encrypted data.
Website information
When you access an Obris website, ordinary web infrastructure may process technical information such as:
- IP address;
- browser type;
- operating system;
- requested page;
- date and time; and
- technical request information.
This information may be used for website security, troubleshooting, reliability and protection against abuse. We do not use website or product usage information to build advertising profiles.
2. How We Use Information
OBRIS GROUP PTE. LTD. may use information described in this policy to:
- provide Obris products and services;
- create and operate Obris IDs;
- link authorised devices;
- enforce device limits;
- verify subscriptions and licences;
- provide Obris SecureOS activation and update services;
- establish VPN connections;
- operate Obris Chat and Obris Vault;
- maintain service reliability;
- detect and prevent abuse;
- investigate security incidents;
- troubleshoot technical problems;
- provide customer support;
- improve the reliability and security of Obris products; and
- meet applicable legal obligations.
We do not sell personal information.
We do not use Obris service information for targeted advertising.
3. Payments
Payments may be processed by external payment providers such as Google Play or Stripe, depending on the product and method of purchase. Those providers may collect information necessary to process the transaction under their own privacy policies.
Obris may receive information such as:
- transaction or purchase identifier;
- product purchased;
- payment status;
- subscription status;
- renewal status; and
- entitlement expiry date.
Obris does not need to receive or store your complete payment card number when payment is handled by a payment provider. Payment providers may separately require information that Obris itself does not require for creation of an Obris ID.
4. Information Sharing
OBRIS GROUP PTE. LTD. does not sell or rent personal information.
Information may be disclosed or processed where reasonably necessary in the following circumstances.
Infrastructure providers
Obris uses hosting, networking and infrastructure providers to operate its services. These providers may process limited technical information as part of providing infrastructure to Obris.
Payment providers
Google Play, Stripe or another applicable payment provider may process payment and subscription information.
Legal requirements
OBRIS GROUP PTE. LTD. may disclose information where legally required to do so by applicable law, court order or other valid legal process. Where permitted, we will seek to limit any disclosure to information that is lawfully required.
Business operations
If OBRIS GROUP PTE. LTD. undergoes a merger, acquisition, restructuring or transfer of part of its business, information associated with the affected service may be transferred as part of that transaction, subject to applicable privacy obligations.
5. International Infrastructure
Obris operates an international network. Depending on the services you use and the server location you select, information may be processed on infrastructure located outside your country of residence.
Obris network or infrastructure locations may include:
- Australia;
- Germany;
- Singapore;
- the Netherlands;
- the United States;
- Japan;
- Canada;
- the United Kingdom;
- India; and
- Brazil.
VPN traffic will ordinarily transit or exit through the VPN server location selected by the user. Infrastructure locations may change as the Obris network develops.
6. Data Retention
Obris aims to retain information only for as long as reasonably necessary for the purpose for which it was collected. Different information may have different retention periods.
For example:
- account and entitlement records may be retained while an Obris service remains active;
- device linking and security records may be retained where necessary to protect accounts and infrastructure;
- temporary authentication challenges may expire automatically;
- operational and security logs may be retained for a limited period for reliability, abuse prevention and incident investigation; and
- transaction records may be retained where required for accounting, taxation or other legal obligations.
Where information is no longer reasonably required, Obris may delete, anonymise or otherwise dispose of it where permitted by law.
7. Security
Obris applies technical and organisational measures intended to protect the information it operates.
These measures may include:
- encrypted network connections;
- cryptographic device authentication;
- public key authentication;
- restricted administrative access;
- access controls;
- infrastructure isolation;
- security monitoring;
- hardened server configurations; and
- encrypted communications where supported by the relevant Obris product.
Obris VPN uses WireGuard for encrypted VPN tunnels.
No system connected to the internet can truthfully guarantee absolute security. Obris therefore does not describe its products as unhackable and continually works to improve their security.
8. Automated Service Controls
Some Obris systems automatically apply technical rules.
Examples include:
- checking whether a subscription is active;
- enforcing permitted device limits;
- rejecting expired authentication challenges;
- applying rate limits;
- preventing unauthorised device linking; and
- restricting access when an entitlement has expired.
These controls are used to operate and secure Obris services. Obris does not use personal information to create advertising profiles or to make automated marketing decisions about users.
9. Access, Correction and Deletion
You may request access to personal information OBRIS GROUP PTE. LTD. holds about you, request that inaccurate information be corrected, or request deletion where applicable.
Because Obris does not rely on accounts based on email addresses, we may need to verify that you control the relevant Obris ID or device before providing, modifying or deleting account information.
Some information may need to be retained where required by law or where reasonably necessary to establish, exercise or defend legal rights.
Privacy requests can be made by contacting contact@obrisgroup.com.
10. Children
Obris services are not specifically directed at children. Where applicable law requires the consent of a parent or guardian for a young person to provide personal information or use a service, the service should only be used with the appropriate consent.
Obris does not knowingly use children's personal information for advertising or behavioural profiling.
11. Changes to This Privacy Policy
OBRIS GROUP PTE. LTD. may update this Privacy Policy when our products, infrastructure, information handling practices or legal obligations change.
When this policy is updated, the Last updated date at the top of the page will be changed. Material changes may also be communicated through an Obris product or website where appropriate.
12. Privacy Enquiries and Complaints
Questions, requests or complaints concerning privacy can be submitted to OBRIS GROUP PTE. LTD. using the contact details below.
Please include enough information for us to understand your request, but do not send passwords, private keys, recovery credentials or other secret authentication material.
OBRIS GROUP PTE. LTD. will review privacy enquiries and complaints and respond within a reasonable period.
OBRIS GROUP PTE. LTD.
160 Robinson Road, #14-04
Singapore 068914
contact@obrisgroup.com
Privacy by Design
Obris is built around a simple principle: collect less information in the first place.
An Obris ID allows supported Obris services to operate without requiring a traditional email or phone number account, while encryption, device authentication and separated service layers help reduce unnecessary exposure of user information.