Deutsch

Privacy policy

Effective November 11, 2026

This policy explains which personal data the Oria app and this website process, why, for how long, and what rights you have. In short:

1. Who is responsible

The controller under the GDPR is:

Konstandin Sargsyan, Visora Studios
Oberacherner Str. 94, 77855 Achern, Germany
Email: hello@visorastudios.com
Phone: +49 155 60776702

For anything about your data, write to us at the address above.

2. Your account and logging in

You need an account to use Oria. It lets you keep your data when you change phones and use Oria on more than one.

We use this data to create your account, log you in and keep the account secure. Legal basis: our contract with you (Art. 6(1)(b) GDPR) and, for securing logins and the logs, our legitimate interest in protecting accounts from misuse and finding errors (Art. 6(1)(f) GDPR). We keep your account data until you delete your account.

3. What you create in Oria

Oria stores what you create and choose in the app:

All of it is saved on your phone first and then synced to our server, so it’s the same on all your phones. Before a profile photo is uploaded, Oria removes its metadata, such as where it was taken.

Who can see it. Your data travels encrypted (TLS) and is stored encrypted on our server provider’s disks. It is not end-to-end encrypted, so we, as operator, and our server provider, under our instructions, can access it. We look at your data when running Oria requires it: for example to find and fix errors, to repair or restore your data, or to answer your questions. When we do, we keep to the data we need for it as far as possible and use it only for that purpose. Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in an app that works without errors (Art. 6(1)(f) GDPR). Apart from us and the providers named in section 9, we give no one access to your data unless the law requires us to.

Personal notes. What you write in Daily Clear can be very personal. You decide what you write. As with everything else in Oria, we process it only to store it, sync it between your phones and keep Oria working; we don’t analyze it or use it for advertising, and we share it only with the recipients named in section 9.

Deleting things. When you delete something in Oria, it disappears from all your phones, and its content is deleted from our server. So that your other phones delete it too, our server keeps a deletion marker with technical details: the item’s ID, when it was deleted and a random ID of the phone, for some entries, such as habit check-ins, also a date, and for focus points, rank and orbs their values. Focus sessions keep the titles of the tasks you worked on, and Daily Clear entries the titles of the tasks you created from them, even after you delete those tasks. The markers are deleted with your account.

Legal basis: our contract with you (Art. 6(1)(b) GDPR). We keep your content until you delete it or your account. Your answer on how you heard about Oria is optional. We use it to learn which ways of finding Oria work, which is our legitimate interest (Art. 6(1)(f) GDPR); if you object, we delete it.

4. Your subscription

You buy Oria Pro in the App Store or on Google Play. Apple or Google take the payment and see your payment details; we don’t. Apple and Google process your data for the purchase as controllers in their own right, under their own privacy policies.

So that Oria knows whether your subscription is active, we use the subscription service RevenueCat. Each time Oria opens, and when you buy or restore a subscription, RevenueCat receives your account’s random ID, your email address, the store’s records of your purchases (such as the plan, dates and price) and technical details: your phone’s model and system, the app version, your languages and your store’s country, and on iPhone the identifier Apple gives the apps of one developer. According to RevenueCat, it uses your IP address only to tell which country you’re in and doesn’t keep it. Legal basis: our contract with you (Art. 6(1)(b) GDPR). We give RevenueCat your email address so we can match purchases to your account when you contact our support, for example about a refund; for that, the legal basis is our legitimate interest in working customer support (Art. 6(1)(f) GDPR). After a purchase, our server asks RevenueCat, using your account’s ID, whether it was an App Store or Google Play purchase. This is how Oria’s first 20 customers get the Rainbow orb. For this we keep your account’s ID, the time and a one-way short form of your purchase (a hash) until you delete your account; after that only the time. Here too, the legal basis is our contract with you (Art. 6(1)(b) GDPR). When you delete your account, we also have your record at RevenueCat deleted.

5. On your phone

6. Email, Report a Bug and support

Report a Bug opens an email draft to hello@visorastudios.com in your mail app. It already contains the app version, your phone’s system version and your account’s email address, so we can answer without asking. You see everything before you send it, and you decide whether to send it.

When you email us, we use your email address, your message and anything you attach to answer you. Legal basis: our contract with you, where your question is about it (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering messages (Art. 6(1)(f) GDPR). We delete your emails when we no longer need them for your request and any follow-up questions, unless the law requires us to keep them. If you ask us to delete your account, we keep that request and our reply for three years as proof. Legal basis: our legitimate interest in being able to prove the deletion and to defend ourselves against claims (Art. 6(1)(f) GDPR).

7. Update check

If Oria can’t start, it checks whether a newer version is out that might fix the problem, so it can tell you. On iPhone, it asks Apple’s public App Store lookup, sending Oria’s app ID and your phone’s region; Apple receives your IP address. On Android, Oria asks the Google Play app on your phone. Legal basis: our legitimate interest in pointing you to an update that can get Oria working again (Art. 6(1)(f) GDPR).

8. This website

Our host Cloudflare delivers this website. When you open a page, Cloudflare’s servers process your IP address, the page you asked for, the time, and what your browser sends along, such as its type and the page you came from. This is needed to deliver the page and to protect the site from attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare keeps this data only as long as it needs to for that. We keep no access logs of this website ourselves.

This website sets no cookies of its own and uses no analytics, tracking or external content. Its fonts are served from this site itself. Only if Cloudflare finds a request suspicious and shows a security check does it remember the passed check in a strictly necessary cookie (cf_clearance), so the check isn’t repeated. That’s why you see no cookie banner.

9. Who processes your data

These providers process data on our behalf and only as we instruct them, under a data processing agreement (Art. 28 GDPR):

These providers are bound by contract to protect your data at least as this policy describes.

These receive data as controllers in their own right, under their own privacy policies:

We pass on data to authorities only where the law obliges us to. We don’t sell your data or share it for advertising.

Where your data goes. Our server stores your data in Ireland, and our email provider in Germany. RevenueCat stores subscription data in the USA. Supabase’s support and operations staff, in Singapore, the USA and other countries, can access data where their work requires it. Cloudflare, and Supabase for files such as profile photos, deliver content through servers worldwide.

Where data reaches a country outside the EU, it is protected like this: Singapore has no EU adequacy decision, and the USA has one only for companies certified under the EU–US Data Privacy Framework. So Supabase and RevenueCat have agreed to the EU standard contractual clauses with us (Art. 46(2)(c) GDPR). Cloudflare is certified under the Data Privacy Framework (Art. 45 GDPR); the standard contractual clauses apply if that adequacy decision ever ends. For people in Switzerland and the UK, the Swiss and UK versions of these safeguards apply. You can ask us for a copy of these safeguards.

10. How long we keep your data

How deleting your account works, and what happens with what, is explained on Delete your Oria account.

11. Your rights

You have the right to:

You can delete your account in Oria at any time under Profile. While you have no active subscription, Export data is in the small print of the subscription screen; the export holds your tasks, lists, routines, habits, focus sessions and Daily Clear entries. For a complete copy of everything we hold about you (Art. 15(3) GDPR), with or without a subscription, and for everything else, email us at hello@visorastudios.com.

You can also complain to a data protection authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de).

Your right to object

Where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, for reasons arising from your particular situation (Art. 21(1) GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. To object, write to hello@visorastudios.com.

12. Anything else