Privacy Policy

Last updated: January 1, 2025

Effective date: January 1, 2025

Privacy-First Design

Orli is designed with your privacy as the top priority. Your tasks, notes, and personal data are stored locally on your device by default. You can use the app completely anonymously, and you have full control over your data at all times.

Table of Contents

1. Data Controller Information

Data Controller: [Your Legal Company Name]
Business Address: [Complete Business Address]
Contact Email: privacy@orli.app
Data Protection Officer: dpo@orli.app

Regulatory Registration

[Company Name] is registered as a data controller with applicable regulatory authorities. Our data protection registration number is [Registration Number] where required.

2. Definitions

Personal Data

Any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, device identifiers, and behavioral data.

ADHD Health Data

Information related to attention deficit hyperactivity disorder symptoms, cognitive states, focus patterns, and associated behavioral indicators that may reveal health conditions.

Processing

Any operation performed on personal data, including collection, storage, use, analysis, transmission, and deletion.

Data Subject

Any individual whose personal data is processed by Orli, including app users and website visitors.

3. Personal Data We Collect

Our Data Minimization Approach

Orli collects the absolute minimum data necessary to provide our service. Most of your personal information stays on your device and is never transmitted to our servers.

3.1 Data Stored Only on Your Device

Local Device Storage (Never Leaves Your Device):

  • Task content: All your tasks, notes, and subtasks remain on your device
  • Personal productivity data: Focus session history, completion rates, energy patterns
  • App preferences: Settings, themes, notification preferences, organizational choices
  • ADHD-related patterns: Energy level tracking, focus patterns, cognitive state information
  • Usage patterns: How you interact with the app, feature usage, session data

Complete Offline Functionality

Orli works entirely offline. Your tasks, notes, focus sessions, and all personal data stay on your device. No internet connection is required for core functionality.

3.2 Minimal Cloud Data (Only When Necessary)

Limited Cloud Storage (Only These Items):

  • Authentication tokens: Anonymous user identifier (no personal info) OR optional email if you choose to create an account
  • Subscription status: Premium subscription state (processed by RevenueCat/App Store/Google Play)
  • AI rate limiting: Usage counters to prevent abuse (no task content stored)

What We DON'T Store in the Cloud

  • Your tasks, notes, or any personal content
  • ADHD-related health data or patterns
  • Focus session history or performance data
  • App usage analytics or behavioral tracking
  • Device information beyond basic app functionality
  • Personal preferences or settings

3.3 Anonymous Usage by Default

Anonymous Authentication:

  • No email required: You can use Orli completely anonymously
  • Anonymous Firebase token: Random identifier with no personal information
  • Optional account linking: You can choose to link an email later (your choice)
  • Complete anonymity: No way for us to identify you personally unless you choose to provide information

3.4 Technical Data (Minimal)

Only for App Functionality:

  • App version: To ensure compatibility and provide updates
  • Platform type: iOS/Android to deliver appropriate app experience
  • Crash reports: Technical errors only (no personal data included)

No Analytics or Tracking

We do not use Google Analytics, Facebook Pixel, or any other tracking services. We don't track your behavior, create usage profiles, or monitor your activity patterns.

4. ADHD-Related Health Data

Your Health Data Stays Private

All ADHD-related information you track in Orli stays on your device. We designed the app specifically to keep sensitive health information private and give you complete control.

4.1 Local Health Data Storage

Stored Only on Your Device:

  • Energy level tracking: Your cognitive states (hyperfocus, regular, low, brain fog)
  • Focus session history: Duration, completion rates, break patterns
  • Personal patterns: How your energy correlates with different types of tasks
  • ADHD-specific insights: Time estimation, attention span, productivity trends
  • Session effectiveness: Your ratings and feedback on focus sessions

Complete Health Data Privacy

Your ADHD-related data never leaves your device. We cannot see your energy patterns, focus history, or any health-related information. This data belongs to you alone.

4.2 Why We Keep Health Data Local

  • Maximum privacy: Your sensitive health information never transmitted to servers
  • HIPAA-friendly: No risk of health data breaches since we don't store it
  • User control: You can export, delete, or keep your health data entirely under your control
  • No profiling: We can't create health profiles or share patterns with third parties
  • Offline functionality: Track your ADHD patterns even without internet connection

4.3 Your Health Data Rights

Complete Control Over Your Health Data

  • Export: Download all your ADHD tracking data in standard formats
  • Delete: Clear all health-related data with one tap in settings
  • Keep private: Share with healthcare providers only if you choose
  • No consent required: Since data stays local, no special health data consent needed

6. How We Use Your Data

6.1 Core App Functionality

  • Task management: Store, organize, and sync your tasks across devices
  • Energy-based matching: Suggest appropriate tasks based on your current cognitive state
  • Focus sessions: Track and optimize your focus and productivity sessions
  • Progress tracking: Analyze your productivity patterns and improvements
  • Personalization: Customize app experience based on your usage patterns

6.2 AI-Powered Features

  • Task breakdown: Use AI to split complex tasks into manageable subtasks
  • Smart suggestions: Recommend optimal task timing based on energy patterns
  • Pattern recognition: Identify productivity trends and optimization opportunities
  • Predictive modeling: Forecast cognitive states and task completion likelihood

6.3 Service Operations

  • Account management: Maintain user accounts and authentication
  • Subscription processing: Manage premium feature access and billing
  • Customer support: Provide technical assistance and resolve issues
  • Security monitoring: Detect and prevent fraudulent or malicious activity
  • Performance optimization: Improve app stability and responsiveness

6.4 Analytics & Improvements

  • Usage analytics: Understand how users interact with app features
  • Performance monitoring: Track app performance and identify issues
  • Feature development: Guide development of new features and improvements
  • ADHD research: Contribute to understanding of ADHD productivity patterns (anonymized)

7. Third-Party Data Sharing

7.1 Google/Firebase Services

Services Used:

  • Firebase Authentication (anonymous tokens only)
  • Firebase Crashlytics (crash reports only)

Data Shared (MINIMAL):

  • Authentication tokens: Anonymous user ID or optional email (only if you provide it)
  • Technical crash data: App errors and technical issues (no personal data)
  • App version info: To ensure compatibility

Data We DON'T Share with Google:

  • Your tasks, notes, or any personal content
  • ADHD health data, energy patterns, or focus information
  • Usage analytics or behavioral tracking data
  • Personal device information beyond basic app functionality
  • Your preferences, settings, or app usage patterns

Purpose:

Anonymous user authentication and crash reporting to fix app bugs

Privacy Policy:

Google Privacy Policy

7.2 RevenueCat (Subscription Management)

Data Shared (MINIMAL):

  • Anonymous user ID: Random identifier (no personal information)
  • Subscription status: Premium/free status only
  • Platform info: iOS/Android for proper subscription handling
  • Purchase receipts: App store transaction data (handled by Apple/Google)

Data We DON'T Share with RevenueCat:

  • Your personal information, email, or identity
  • App usage patterns or feature access data
  • Any content from your tasks or personal data

Purpose:

Process premium subscriptions securely across iOS and Android platforms

Privacy Policy:

RevenueCat Privacy Policy

7.3 OpenAI (AI Features - Premium Only)

Data Shared (ONLY When You Use AI Features):

  • Task text only: The specific task you ask AI to break down
  • Anonymous session ID: To prevent abuse (no personal identifier)
  • No personal context: No energy data, patterns, or personal information

Data We DON'T Share with OpenAI:

  • Your identity, email, or personal information
  • ADHD health data, energy patterns, or focus history
  • Other tasks or personal content beyond the specific AI request
  • App usage patterns or behavioral data

AI Privacy Protection

  • Your choice: AI features are optional premium features
  • Minimal data: Only the specific task text you choose to process
  • No storage: OpenAI doesn't store your task content long-term
  • Anonymous: No way to connect AI requests to your identity

Privacy Policy:

OpenAI Privacy Policy

7.4 Platform Providers

Apple (iOS):

  • App Store purchase data
  • Apple Sign-In authentication
  • Push notification tokens
  • App performance metrics

Google (Android):

  • Google Play purchase data
  • Google Sign-In authentication
  • Push notification tokens
  • Play Console analytics

7.5 Data Processing Agreements

All third-party data processors are bound by data processing agreements that require:

  • Processing data only according to our instructions
  • Implementing appropriate technical and organizational security measures
  • Assisting with data subject rights requests
  • Notifying us of data breaches
  • Deleting data upon termination of services

8. International Data Transfers

Cross-Border Data Processing

Your personal data is transferred to and processed in the United States by multiple service providers. The US does not have an adequacy decision from the European Commission.

8.1 Transfer Mechanisms

For EEA/UK Users:

  • Standard Contractual Clauses (SCCs): EU-approved contracts with data processors
  • Adequacy decisions: Where available for specific jurisdictions
  • Binding Corporate Rules: For multinational processor organizations
  • Explicit consent: Your consent for transfers where no other safeguards exist

Additional Safeguards:

  • Technical measures: End-to-end encryption for data in transit
  • Organizational measures: Strict access controls and data handling procedures
  • Legal measures: Challenging government access requests where legally possible
  • Contractual measures: Enhanced data protection clauses with processors

8.2 Countries Involved in Processing

Service Provider Data Processing Countries Transfer Safeguards
Google/Firebase United States, Ireland (for EEA users) SCCs, Technical safeguards
RevenueCat United States SCCs, DPA
OpenAI United States SCCs, Data retention limits
Apple United States, Ireland Platform-specific protections

9. Data Storage & Security

9.1 Technical Security Measures

Encryption:

  • Data in transit: TLS 1.3 encryption for all network communications
  • Data at rest: AES-256 encryption for cloud storage
  • Local storage: Platform-standard encryption (iOS Keychain, Android EncryptedSharedPreferences)
  • Database encryption: Firebase automatic encryption at rest

Access Controls:

  • Multi-factor authentication: Required for administrative access
  • Role-based access: Principle of least privilege for data access
  • Regular access reviews: Quarterly audit of system access permissions
  • Automated monitoring: Real-time alerts for unusual access patterns

Infrastructure Security:

  • Cloud security: Google Cloud Platform enterprise-grade security
  • Network segmentation: Isolated production environments
  • Regular security assessments: Annual penetration testing and vulnerability scans
  • Security monitoring: 24/7 security incident monitoring and response

9.2 Organizational Security Measures

Staff Training & Procedures:

  • Privacy training: Regular staff training on data protection requirements
  • Background checks: Security clearances for personnel with data access
  • Confidentiality agreements: Legal obligations for all staff and contractors
  • Incident response procedures: Documented breach response and notification protocols

9.3 Data Storage Locations

Data Type Storage Location Backup Location Security Level
Local app data User's device None (local only) Device encryption
Cloud-synced data Google Cloud (US/EU) Multi-region backups AES-256, access controls
Analytics data Firebase Analytics (US) Google Cloud backups Aggregated, pseudonymized
Payment data RevenueCat/Stripe (US) Provider redundancy PCI DSS compliant

10. Data Retention

Data Retention Periods

We retain your personal data for specific periods based on the purpose of processing and legal requirements. Retention periods vary by data type.

10.1 Retention Schedule

Data Category Retention Period Basis for Retention Deletion Process
Account data Active account + 30 days post-deletion Contract performance, user request Automatic deletion after grace period
Task content Active account + immediate deletion option Service provision, user control User-initiated or account deletion
ADHD health data 3 years or consent withdrawal Health data special retention, research value Automated deletion or user request
Analytics data 26 months (anonymized) Business analytics, GDPR compliance Automatic anonymization/deletion
Financial records 7 years Legal obligation (tax/audit requirements) Legal compliance schedule
Support communications 3 years post-resolution Customer service, legal protection Scheduled purge process
Security logs 12 months Security monitoring, incident response Automatic log rotation

10.2 Data Deletion Process

User-Initiated Deletion:

  • Immediate effect: Data marked for deletion within 24 hours
  • Grace period: 30-day recovery window for accidental deletion
  • Permanent deletion: Complete removal from all systems after grace period
  • Third-party notification: Deletion requests sent to all data processors

Automatic Deletion:

  • Scheduled reviews: Quarterly assessment of retention compliance
  • Automated purging: System-driven deletion based on retention schedules
  • Verification process: Confirmation of successful deletion across all systems
  • Deletion logs: Audit trail of all deletion activities

10.3 Legal Hold Exceptions

Data retention may be extended beyond normal periods in cases of:

  • Active legal proceedings or investigations
  • Regulatory inquiries or enforcement actions
  • Disputed transactions or chargebacks
  • Security incident investigations
  • Compliance audits or examinations

We will notify affected users when legal hold procedures require extended data retention.

11. Your Privacy Rights

You have comprehensive rights regarding your personal data. The specific rights available to you depend on your location and applicable privacy laws (GDPR, CCPA, etc.).

11.1 Universal Rights (Available to All Users)

Right to Access

What it means: Request a copy of all personal data we hold about you

How to exercise: Settings → Privacy → Export Data or email privacy@orli.app

Response time: Within 30 days

Format: Structured JSON/CSV format

Right to Rectification

What it means: Correct inaccurate or incomplete personal data

How to exercise: Update directly in app settings or contact support

Response time: Within 7 days for direct updates

Scope: All user-editable data fields

Right to Erasure

What it means: Request deletion of your personal data

How to exercise: Settings → Account → Delete Account or email privacy@orli.app

Response time: Within 30 days

Scope: All data except legal retention requirements

Right to Data Portability

What it means: Receive your data in a machine-readable format

How to exercise: Settings → Privacy → Export Data

Response time: Immediate download link

Format: JSON, CSV, or standard interchange formats

11.2 GDPR Rights (EEA/UK Users)

Right to Restrict Processing

What it means: Limit how we process your data in specific circumstances

When available: Accuracy disputes, unlawful processing, objections

How to exercise: Email privacy@orli.app with specific restrictions

Right to Object

What it means: Object to processing based on legitimate interests

Scope: Analytics, marketing, profiling activities

How to exercise: Settings → Privacy → Opt-out options

Automated Decision-Making

What it means: Right not to be subject to purely automated decisions

Our commitment: All AI features include human oversight options

How to exercise: Contact support for manual review

Right to Complain

What it means: Lodge complaints with supervisory authorities

EU Authority: Your local Data Protection Authority

UK Authority: Information Commissioner's Office (ICO)

11.3 Health Data Specific Rights

Special Protections for ADHD Data

  • Explicit consent withdrawal: Stop health data processing at any time
  • Medical professional access: Authorize healthcare providers to access your data
  • Research opt-out: Exclude your data from anonymized research studies
  • Therapeutic purpose override: Priority for health-related data access requests

11.4 How to Exercise Your Rights

Multiple Contact Methods:

  • In-app settings: Most rights exercisable directly through app interface
  • Email: privacy@orli.app (monitored 24/7)
  • Data Protection Officer: dpo@orli.app
  • Postal mail: [Complete business address]
  • Support ticket: Through app or website contact form

Identity Verification:

To protect your privacy, we may request identity verification for certain rights requests. Verification methods include account authentication, email confirmation, or government-issued ID for high-sensitivity requests.

Response Timeline:

  • Standard requests: 30 days (may extend to 90 days for complex requests)
  • Urgent requests: 7 days for security or health-related issues
  • Automatic processing: Immediate for certain in-app actions

12. Children's Privacy

Critical Children's Privacy Notice

ADHD affects many children and teenagers. We implement strict protections for users under 18, with enhanced protections for children under 13 (US) and 16 (EU).

12.1 Age Verification & Parental Consent

Age Verification Process:

  • Account creation screening: Age verification required during signup
  • Ongoing monitoring: Automated detection of potential child accounts
  • Parental confirmation: Email verification from parent/guardian email addresses
  • Account linking: Child accounts must be linked to verified parent accounts

Parental Consent Mechanisms:

  • Verifiable consent: Credit card verification (no charge) for identity confirmation
  • Digital signature: Cryptographically signed parental consent forms
  • Video verification: Optional video calls for high-risk account verification
  • Educational institution: School administrator consent for educational use

12.2 Enhanced Protections for Children

Data Minimization:

  • Limited data collection: Only essential data for app functionality
  • No behavioral profiling: Restricted analytics and pattern analysis
  • No marketing: Zero marketing communications to child accounts
  • Simplified privacy notices: Age-appropriate privacy explanations

Parental Rights:

  • Data access: Parents can view all data collected from their child
  • Data correction: Parents can correct or update their child's information
  • Data deletion: Parents can delete their child's account and all data
  • Communication control: Parents control all app communications
  • Feature restrictions: Parents can limit access to specific app features

12.3 Special Considerations for ADHD Children

ADHD-Specific Child Protections

  • Healthcare provider involvement: Optional integration with medical professionals
  • Educational use protections: FERPA compliance for school-based usage
  • Developmental considerations: Age-appropriate feature limitations
  • Crisis intervention: Mechanisms to involve parents/guardians in concerning patterns

12.4 Regional Children's Privacy Laws

United States (COPPA):

  • Age threshold: Under 13 years old
  • Parental consent: Verifiable consent required for data collection
  • Parental access: Review, delete, or refuse further collection
  • Safe harbor: Compliance with FTC COPPA regulations

European Union (GDPR-K):

  • Age threshold: Under 16 years old (may vary by member state)
  • Parental authority: Legal guardian consent for processing
  • Best interests: All processing must consider child's best interests
  • Data protection by design: Enhanced privacy protections built-in

Other Jurisdictions:

  • Canada (PIPEDA): Enhanced consent requirements for minors
  • Australia (Privacy Act): Special protections for children's personal information
  • Brazil (LGPD): Best interests standard and parental consent

13. California Consumer Rights (CCPA/CPRA)

California Consumer Privacy Act Notice

If you are a California resident, you have additional privacy rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

13.1 California Consumer Rights

Right to Know

  • What personal information we collect about you
  • Sources from which we collect personal information
  • Business/commercial purposes for collecting personal information
  • Categories of third parties with whom we share personal information
  • Specific pieces of personal information we have collected

Right to Delete

  • Request deletion of personal information we have collected
  • Exceptions for legal compliance, security, or legitimate business needs
  • Confirmation of deletion completion

Right to Opt-Out

  • Opt-out of sale of personal information (Note: We do not sell personal information)
  • Opt-out of sharing for cross-context behavioral advertising
  • Limit use of sensitive personal information

Right to Correct

  • Request correction of inaccurate personal information
  • Update outdated information
  • Verify accuracy of corrected information

13.2 Sensitive Personal Information

Under CPRA, the following data we collect is considered "sensitive personal information":

  • Health data: ADHD-related cognitive state and focus pattern information
  • Precise geolocation: We do not collect precise location data
  • Biometric data: We do not collect biometric identifiers
  • Genetic data: We do not collect genetic information

Right to Limit Sensitive Personal Information

You can request that we limit our use of sensitive personal information to:

  • Performing the services reasonably expected by you
  • Ensuring security and integrity
  • Short-term, transient use
  • Performing services on behalf of the business
  • Activities to verify or maintain the quality of our service

13.3 Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. We will not:

  • Deny goods or services to you
  • Charge different prices or rates for goods or services
  • Provide a different level or quality of goods or services
  • Suggest that you will receive different pricing or service quality

However, we may offer financial incentives for the collection, sale, or deletion of personal information if the incentive is reasonably related to the value of the personal information.

13.4 How to Exercise California Rights

Request Methods:

  • Email: privacy@orli.app (Subject: "California Privacy Rights Request")
  • Phone: [Toll-free number] (California residents only)
  • Web form: [Link to California privacy rights form]
  • Postal mail: [Complete business address, Attn: California Privacy Rights]

Required Information:

  • Your full name and email address associated with your Orli account
  • Description of the specific right you want to exercise
  • Sufficient information to verify your identity
  • If requesting on behalf of another person, proof of authorized representation

Response Timeline:

  • Acknowledgment: Within 10 business days
  • Response: Within 45 days (may extend to 90 days for complex requests)
  • Free of charge: Up to 2 requests per 12-month period

14. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and provide personalized features.

14.1 Types of Cookies We Use

Cookie Type Purpose Duration Third Party
Essential Cookies Authentication, security, core app functionality Session/Persistent Firebase Auth
Analytics Cookies Usage statistics, performance monitoring 2 years Google Analytics
Functional Cookies User preferences, personalization 1 year None
Performance Cookies Load times, error tracking 30 days Firebase Performance

14.2 Cookie Control

Managing Cookies:

  • Browser settings: Configure cookie preferences in your browser
  • App settings: Opt-out of analytics and tracking in app preferences
  • Cookie consent: Update preferences through our cookie consent banner
  • Do Not Track: We honor browser Do Not Track signals where technically feasible

Impact of Disabling Cookies

Disabling essential cookies may prevent core app functionality. Disabling analytics cookies will not affect app performance but may limit our ability to improve user experience.

14.3 Mobile App Tracking

iOS App Tracking Transparency:

  • ATT compliance: We request permission before tracking across apps/websites
  • IDFA usage: Used only with explicit consent for analytics
  • App Store guidelines: Full compliance with Apple's privacy requirements

Android Privacy:

  • Advertising ID: Used only for analytics with user consent
  • Play Store policies: Compliance with Google Play privacy requirements
  • Permission management: Clear explanation of all requested permissions

15. Policy Changes

15.1 How We Handle Updates

We may update this privacy policy to reflect changes in our practices, legal requirements, or service features. We are committed to transparency in all policy changes.

Types of Changes:

  • Material changes: Significant alterations to data processing, sharing, or rights
  • Minor updates: Clarifications, contact information updates, or formatting changes
  • Legal compliance: Updates required by new regulations or court decisions
  • Feature additions: New services or functionality requiring data processing

15.2 Notification Process

For Material Changes:

  • 30-day advance notice: Email notification to all registered users
  • In-app notification: Prominent notice in app interface
  • Website banner: Notice on website homepage and privacy policy page
  • Opt-out opportunity: Ability to delete account before changes take effect

For Minor Updates:

  • Updated effective date: New date posted at top of policy
  • Change log: Summary of modifications available upon request
  • Continued use acceptance: Continued app use constitutes acceptance

15.3 Your Options

When we make material changes to this policy, you have several options:

  • Accept changes: Continue using Orli under the updated policy
  • Reject changes: Delete your account before the changes take effect
  • Modify consent: Withdraw consent for specific types of processing
  • Contact us: Discuss concerns or seek clarifications about changes

15.4 Version History

Previous Versions:

  • Version 1.0: January 1, 2025 - Initial comprehensive privacy policy
  • Future versions will be listed here with change summaries

16. Contact Information

16.1 Privacy-Related Inquiries

Privacy Officer

Email: privacy@orli.app

Response time: 24-48 hours

For: General privacy questions, rights requests

Data Protection Officer

Email: dpo@orli.app

Response time: 72 hours

For: GDPR inquiries, data protection concerns

Legal Department

Email: legal@orli.app

Response time: 5 business days

For: Legal process, subpoenas, court orders

Security Issues

Email: security@orli.app

Response time: 4 hours

For: Data breaches, security vulnerabilities

16.2 Business Information

Legal Entity: [Your Complete Legal Company Name]

Registration Number: [Corporate Registration Number]

Business Address:
[Complete Business Address]
[City, State/Province, ZIP/Postal Code]
[Country]

Phone: [Business Phone Number]

Fax: [Business Fax Number] (for legal service)

16.3 Regulatory Authorities

If you are unsatisfied with our response to your privacy concerns, you may contact:

European Union

Your Local Data Protection Authority

Find your authority: EDPB Member List

United Kingdom

Information Commissioner's Office (ICO)

Website: ico.org.uk

Phone: 0303 123 1113

United States (California)

California Privacy Protection Agency

Website: cppa.ca.gov

For CCPA/CPRA complaints

Canada

Office of the Privacy Commissioner

Website: priv.gc.ca

Phone: 1-800-282-1376

16.4 Emergency Contacts

Data Breach or Security Emergency

24/7 Emergency Line: [Emergency Phone Number]

Emergency Email: security-emergency@orli.app

For: Immediate security threats, suspected data breaches, urgent privacy violations

Your Privacy Acknowledgment

By using Orli, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this comprehensive Privacy Policy.

Special Acknowledgment for Health Data: You explicitly consent to our processing of ADHD-related health information as described in Section 4, understanding that this data is considered sensitive personal information under applicable privacy laws.

This Privacy Policy was last updated on January 1, 2025