Privacy policy

Who we are

Ordo is operated by an individual, Aung Thein Sein, based in Virginia, United States (the "operator", "we", or "us"). For the purposes of the EU and UK General Data Protection Regulation, the operator is the data controller for the personal data described in this policy. You can reach us about privacy at support@useordoapp.com.

Overview

Ordo is a personal app for holding your schedule, practices, tasks, coursework, and journal, with an optional AI companion. This policy explains exactly what Ordo stores, what the companion sends to Anthropic, where your data lives, and the control you have over it. Ordo does not sell your information or use it for advertising. Its planning features can learn scheduling patterns for your own use, as described below.

What Ordo stores

Your account, the things you create, and a small amount Ordo writes for you. Your account is your email address, a securely hashed password (handled by our authentication provider, Supabase), and your display name. Your content is your practices, calendar events (title, time, location, notes, recurrence), tasks and coursework (title, course, due date, priority), journal entries, and your settings such as persona and reminder style.

What Ordo writes for you is short and worth naming. The morning brief makes up to three plain claims about the shape of the day, and the evening writes a few lines reading them back; both are saved to your account so the loop closes on the right day. A claim can quote the time and title of one of that day's events, and that event can be one mirrored from an outside calendar, as described in its own section below. If you turn health on, a daily health snapshot is stored too, also described in its own section. Focus history, saved companion memories, and learned scheduling patterns are also described below. If you connect an inbox, what Inbox keeps from your email is described in its own section. Ordo does not collect advertising identifiers.

The companion may store short facts you ask it to remember, such as a preference for focused work in the mornings. These saved memories sync with your account. It also notices patterns from how you use your schedule, including event changes, practice completion, and suggestions you accept or dismiss. Those observations are stored locally on your device and can be included in companion requests. When you enable health, observations may include broad body-state tags used to relate scheduling patterns to your recovery. You can clear what Ordo has noticed in Settings. This local noticing is separate from the server-stored scheduling rhythms described below. Ordo does not read your address book or your photo library, and does not collect browsing activity, advertising identifiers, or background location. If you choose one of your photos as a course banner, Ordo stores that one photo with your account so it appears on your other devices. Removing the banner deletes it, and deleting your account deletes it too.

When you use Focus, Ordo keeps the timer state locally so an active session can continue when you leave the screen. Saved focus history includes the session intention, start and end times, completed rounds, and recorded work intervals. It syncs with your account as part of your schedule. Ordo can use this history to recognize a long work session or a heavy workday and include that context when you use the companion.

The companion · what is sent to AI, and where

Ordo's companion is powered by Anthropic's Claude model, called through a secure Ordo server function so the AI key never lives in the app. When you send a message, use quick capture, or generate a reflection, Ordo sends Anthropic your message, a bounded portion of the current and recent conversation history, and context from your own data to answer it.

That context can include your display name, persona and reminder style, the current date and time zone, calendar names, upcoming events and recent schedule history, event titles, times and locations, scheduling constraints, available time, tasks and due dates, practices and completion history, and focus history. It can also include which days you wrote in your journal and how much, saved memories, local scheduling observations, and, if enabled, learned calendar rhythms and a health summary. Connected calendar events can be part of this context. Student context can include terms, courses, class times and rooms, instructors, office hours, and exams. The amount of history included is limited and can differ by app version and request.

It never sends your Ordo password. It sends nothing from your email unless you put it into a message yourself or you have connected an inbox. With an inbox connected, it can read what Ordo found there and the email behind a finding, as the next paragraph describes. It does not send the notes or descriptions on your events. It does not send what you wrote in your journal: the companion is told which days you wrote and how much, never the words, unless you put them into a message yourself. If you dictate a journal entry with the microphone, the transcribed text is sent to Anthropic only for the cosmetic tidy-up described under Voice input.

In versions of Ordo that include Inbox, once you have connected an inbox, the companion can look at your Inbox and, when you ask about an email, open the conversation behind a finding. That sends Anthropic up to 10 messages at a time from that conversation: their text with the older replies quoted in it, each sender's name and address, the subjects and dates, and the names of attachments. It opens only conversations behind your findings, only while you are talking with it, and never from an inbox you paused or disconnected. The Inbox section lists exactly what goes, and what Ordo keeps.

The companion can also look further than the list it is given. When you ask about a date outside that window, it calls a lookup that Ordo's server answers, up to about four months of dates in one call, and sends back your events and class meetings with their locations, your tasks, your terms and breaks, and your exams. When it works out how long it takes to get somewhere, the two place names are sent to Apple's Maps service, as described under Who processes your data, and the travel time comes back to Anthropic with the rest of the answer.

Anthropic processes this to produce the reply and any suggested changes. Any change that creates, edits, or deletes your data is shown for your confirmation before it is saved. Your prompts are handled under Anthropic's commercial terms for the Claude API, which means Anthropic does not use Ordo's API traffic to train its models, and Ordo itself does not use your data to train any AI model either. Companion requests are rate limited per account. You can choose not to use the companion at all; the rest of Ordo works without it.

Scheduling rhythms · what Ordo learns from your calendar

With your permission, Ordo can learn the rhythms of how you schedule, so it and the companion can plan with your real durations and usual times instead of asking. Ordo's secure server reads your own events, from a connected calendar over the last six months, and from Ordo itself over the last six months and the next three, and groups them by title: how long a study block or a run usually runs, which days and hours you tend to place them on, how often, and how recently.

Naming what each group is takes a model, so this step also goes to Anthropic's Claude, under the same terms described above for the companion. Your event titles go with it: for each group, up to nine of the titles you actually used, along with those figures. A repeating event you created in Ordo is a group of its own, so its title goes on its own. No dates, no locations, and no notes are sent, and the events themselves are not sent, only their titles and those figures.

What comes back is stored on Ordo's secure server under the same row-level security as the rest of your account, so only your signed-in account can read it. It holds the name of each rhythm, the titles gathered under it, and any title given a length of its own, which means some of your own event titles are kept there. Your calendar itself is not: no event rows, no dates, and no places, so Ordo builds no record of where you were. Once the profile is written, the events the server read are discarded.

When you or the companion plan with these rhythms, only that stored profile, not your raw events, is included with the request. Titles that read as medical, religious, or legal are dropped before anything is sent, and activities the model reads as personal, relational, or private are dropped before anything is stored. That first check matches words in a title, so a private thing under an unusual name can get past it. You are always in control: What Ordo has learned, in Settings, shows the profile in plain language and lets you pause the learning or forget it entirely. Pausing keeps what Ordo already knows but stops it learning anything new; forgetting deletes the profile from Ordo's server. This learning is never sold, never used for advertising, and never used to train any AI model.

Voice input

Voice input is optional and starts when you tap the microphone. In the native iPhone app, Ordo requires Apple’s on-device speech recognition and does not upload or store the audio. In the web and desktop experience, voice input uses your browser’s speech recognition service. Depending on the browser, that service may send audio to the browser provider for transcription under its privacy policy. Ordo does not store those audio recordings. You can type instead.

What happens next is exactly what happens when you type: the resulting text may be sent to Anthropic to tidy it up (removing filler words and fixing punctuation) and, if you send it, to act on it, under the same terms described above. To help the tidy-up keep your own names spelled correctly, a short list of words already in your data may be included with that text: the people named on your events, the places on them, your course codes, your calendar names, and the titles of your events, tasks, and practices, along with your own name. This is information you already created, and it is sent only to improve the result. Microphone access is requested only the first time you tap to speak, and you can use every part of Ordo by typing instead.

The morning briefing and its data sources

The morning briefing, when enabled, fetches a small amount of world data from third-party providers: weather and daylight from Open-Meteo, stock-market figures from a market-data provider, and one global news headline from a news provider. The briefing's text is then composed by Anthropic's Claude through the same secure server function and under the same terms described above for the companion, so your schedule context for the day is processed to generate the briefing.

Global market indices and the global news headline contain no personal data. If you add custom quotes, only the ticker symbols you choose are sent to look them up; these choices may reveal the instruments you follow. Weather and daylight use your device's approximate location only if you have granted location access. These third-party requests are made only to provide the briefing and are subject to those providers' own privacy practices.

Health and recovery · Apple Health and WHOOP

Health is optional and off until you enable it. With your permission, Ordo can use readings from Apple Health or a connected WHOOP account to display your health information and put your day in context. Available readings include sleep duration and stages, resting heart rate, heart-rate variability, respiratory rate, steps, active energy, exercise minutes, and WHOOP recovery and strain. Availability depends on the provider, your device, and the permissions you grant; Ordo does not receive every measure from every source. Apple Health access is read-only. You can turn health off and change the permissions in Apple Health or disconnect WHOOP.

When you connect WHOOP, you sign in on WHOOP’s own page and grant access there; Ordo never sees your WHOOP password. Ordo’s server stores the connection tokens and requests the readings needed for the feature. The app uses a reduced snapshot to display the readings and create a short health summary for the companion. The WHOOP snapshot is held temporarily in memory and is not saved as a health record in Ordo’s database. A health summary can be sent to Anthropic when you use the enabled AI features. Local observations may retain broad body-state tags, as described above. Disconnecting WHOOP removes the connection through Ordo’s server; account deletion also requests revocation and removes the stored tokens.

Apple Health samples are read and summarized on your iPhone. With health enabled, a curated daily summary is stored in your Ordo account, protected by row-level security, so supported readings can appear on your other devices. Raw HealthKit samples are not uploaded. Ordo uses its account backend, rather than iCloud, for this sync. Turning health off or disconnecting Apple Health clears the current local reading and requests deletion of the synced summary; completing server deletion requires a successful connection. Signing out or switching accounts clears the current session’s health state but does not delete the account’s server summary. Account deletion removes the account’s health summaries.

Health information is handled by Supabase to provide the server functions and Apple Health summary storage described here, and by Anthropic when an enabled AI request includes the health summary. Your health and recovery data is not sold, used for advertising or use-based data mining, or used by Ordo to train AI models.

The outside calendars you mirror on your iPhone

When you add an iCloud, Google, or Exchange calendar through your iPhone, Ordo reads it on your device to show those events alongside your own, and stores no copy of those events on its servers. There is one exception, and it is worth stating plainly. The morning brief makes up to three short claims about the shape of the day, and those lines are saved to your account so the evening can read them back against what actually happened. A claim can name the event the day bends around, by its time and its title in quotation marks. When that event came from a mirrored calendar, that mirrored title and time are inside the line that is stored on Ordo's server. This happens once you are signed in, whether or not the companion is switched on, and those lines are deleted when you delete your account. Nothing else about a mirrored calendar is written to Ordo's servers. When you use the companion or the daily briefing, the titles, times, and locations of your coming events, including mirrored ones, are part of the schedule those requests describe: they pass through Ordo's secure server function to Anthropic's Claude to write the reply. That server stores none of it, and Anthropic does not use it to train its models. A mirrored event's location can also reach Apple. When Ordo works out the travel time between two of today's places, that location is one of the two place names sent to Apple's Maps service, as described under Who processes your data. You can turn the mirror off at any time in iOS Settings.

Connecting a Google account to Ordo directly is a separate choice. When you do, Ordo's secure server can see the calendars on that account and read events from the ones you keep visible, so your day reads the same on every device. The connection works in both directions. Ordo adds, moves, or edits events on your Google calendars only when you ask it to. If you turn on "Put Ordo events on Google too", Ordo places copies of your Ordo events there, and it may create a calendar in your Google account, named after the matching Ordo calendar, to hold those copies. Changes you make in Google Calendar flow back into Ordo. When someone invites you to an event, you can answer the invitation inside Ordo. Answering sends only your own response to Google: accepted, declined, maybe, or, if you propose another time, that proposal as a short note on your reply. The organizer sees your answer in Google Calendar the same way they would if you had answered there. Ordo never changes the meeting itself and never writes to anyone else's entry. Events from a connected Google account are part of your schedule, so the briefing and the companion can read them under the same rules as the rest of your day, and, if you turn scheduling rhythms on, they count toward the aggregate rhythm profile described above.

Ordo keeps only the secure connection token on its server while the connection is on; your Google events themselves are not stored there. Calendars you hide are not read. Disconnecting Google in Profile in the app or Settings on the web revokes Ordo's access and deletes the token, and deleting your account does the same. Ordo's use, and transfer to any other app, of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your Google data is never sold and never used for advertising.

If you connect Outlook Calendar, Ordo asks Microsoft for read-only access to your calendars and your account's basic profile. Ordo shows the calendars you select and uses their events to plan your day. To change one of those events, you open it in Outlook. Ordo's server keeps the connection's tokens, encrypted, and the list of your calendars with the ones you selected; your Outlook events themselves are not stored there. You can disconnect at any time in Profile, under Calendars.

Editing your outside calendars

You can choose a default calendar in Profile, and new events you create in Ordo or ask the companion to create will be saved there, locally through iOS. Tapping an existing outside event opens iOS's own edit sheet, so Apple handles the change. To keep things safe, the companion will not edit or delete an event that has attendees, since that would silently send invite updates to other people; it will ask you to open that event in Calendar instead. Ordo keeps no copy of your iOS-mirrored calendars on its servers. Their details leave your device in three ways, each described above. They go to Anthropic's Claude inside companion and briefing requests, and Ordo's server does not store them. A mirrored event's location can be one of the two places sent to Apple's Maps service for a travel time, and Ordo's server holds those two place names in memory for up to half an hour, as described under Who processes your data. And the lines the morning brief saves to your account, up to three a day, can quote one mirrored event's title and time, which are then kept with your account until you delete it.

Sharing your calendar

You can share your calendar with someone who uses Ordo by inviting their email address. You choose what they see: busy times only, or full detail with titles, times and places. They see nothing until they accept, and notes are never shared. Ordo keeps the invitation, the address you entered and the level you chose. You can revoke access at any time, and they stop seeing your calendar at once.

Inbox · what Ordo reads in your email

Inbox is optional. It stays off until you turn it on and connect a Gmail or Outlook account. Ordo then reads your email to find what needs doing: requests, deadlines, meetings and changes to them, promises you made, and what someone promised you. It shows what it found in Inbox and suggests changes to your tasks and calendar. Nothing in your tasks or calendar changes until you approve it. Inbox is available in Ordo on the web and in the iPhone versions of Ordo that include it.

Ordo asks Google for read-only access to Gmail, and Microsoft for read-only access to Outlook mail, along with the account's address and, for Outlook, its basic profile, so it knows which account you connected. You sign in on Google's or Microsoft's own page, and Ordo never sees that password. Ordo only reads. It never sends, deletes, moves or marks your email. It keeps the access it is given encrypted, where only Ordo's server can use it.

When you connect Gmail, Ordo starts at once. It reads the last 30 days of your mail, except Spam and Trash, then new mail as it arrives. Under Sources you can limit it to labels you choose, such as Inbox, Starred or one of your own. Mail you sent is always included, because it holds the promises you made. When you connect Outlook, you confirm the folders Ordo reads. Ordo reads them from the last 30 days, then new mail. Junk Email, Deleted Items, Drafts and Outbox cannot be chosen. Ordo checks for new mail about once a minute.

Some mail never goes to an AI model. Ordo skips drafts, empty messages, mail in Gmail's Promotions, Social and Forums tabs, mail outside the labels or folders you chose, and mail sent before the period you shared. It reads a Gmail calendar invitation from its calendar details, without AI. Mail marked as sent to a list, such as a newsletter or an automated notice, goes first to a smaller Claude model. That check sends the same details as a full reading, apart from the rest of the conversation, and it answers only whether the email holds something you must do or attend. Ordo reads the email in full only if the answer is a clear yes.

To read an email, Ordo's server sends it to Anthropic's Claude. It sends the subject and the email's own text, up to about 12,000 characters, without the older replies quoted below it. It sends the sender's name and address, the names and addresses it was sent and copied to, when it was sent, and the names of any attachments. For Outlook, Ordo uses addresses without names, and notes only whether there are attachments. Ordo never opens attachments. It also sends the address of your connected account, the name you gave Ordo and your name as it appears on mail you sent, and your time zone. So that a reply makes sense, it sends up to six earlier messages from the same conversation, about 24,000 characters in all, and the first 2,000 characters of up to three later ones, each with its sender and date. These come only from the labels or folders you chose and the period you shared. It adds what Ordo already found in that conversation, the names of your current courses if you use Classes, and short summaries of related items from any of your connected inboxes: their titles, dates and status, and, if you allowed memory, matching facts Ordo remembers. If a reading fails, Ordo can send the same email again, up to three times in all.

Claude returns a short structured reading: what is asked, who should do it, and by when. In this step Claude has no tools and cannot change anything. Your email goes to Anthropic under the same commercial terms as companion requests, so Anthropic does not use it to train its models. Ordo does not use your email to train any AI model either.

Ordo does not keep the full text of your emails. Its server fetches an email when it needs it and does not store the text. For each item it finds, Ordo keeps a short title, usually written by Claude; a line saying who asked and when, such as "Asked by Dana Lee in an email on Oct 24."; the date or time involved; any question for you; and where the item stands. With it, Ordo keeps a record of the email: the sender's name and address, the subject, when it was sent, the account it came to, and a link that opens it in Gmail or Outlook. It keeps a quotation of up to 500 characters so you can see why, and deletes that quotation after 24 hours. It keeps the details Claude read, such as a date, a length or a place, without quotations, and the change it suggests to your tasks or calendar, with what happened when you approved it. For each email it has looked at, Ordo keeps the message's ID, a one-way fingerprint of its content and the result, for example that there was nothing to do, so it does not read an unchanged email again. It also counts the readings it makes for each inbox each day. All of this is stored with Supabase under row-level security, so only your signed-in account can read it. The email records and remembered facts are served only through Ordo's server.

If you allow Ordo to remember useful context from an inbox, it also keeps short facts it works out from what it found, such as the name that goes with an email address. Ordo writes these facts itself, without AI. It skips any fact whose words point to health, money, religion, politics, sexuality, or a password or code. This check matches words, so an unusual wording can get past it. A fact you have not confirmed is removed 90 days after Ordo learned it, unless later email repeats it. A fact you confirm stays until you forget it. Each fact is listed under What Ordo knows, where you can correct, confirm or forget it.

Ordo deletes each quotation after 24 hours. When you dismiss a finding, mark it handled, or a newer email replaces it, Ordo deletes its content 30 days later, along with any plan you did not approve, and keeps only a fingerprint so the same email is not suggested again. Findings that still wait for you, and findings you approved, stay until you clear findings, disconnect the inbox, or delete your account. If an email is deleted from your mailbox, Ordo deletes its quotation and withdraws any plan from it that you have not approved. A task or event you approve is ordinary Ordo data. It stays until you remove it, even after you disconnect the inbox.

You control Inbox under Sources. Pause analysis stops Ordo reading that inbox, withdraws plans waiting for approval, and stops the companion opening its email. The findings you already have stay in Inbox. When you resume, Ordo reads the mail that arrived in the meantime. Clear findings deletes the findings, plans, quotations and email records from that inbox, and the facts learned only from it unless you confirmed them. A plan that changed your tasks, calendar, practices or reminders stays as the record of that change, like the task or event it made. After that, Ordo reads only new email. Stop and disconnect deletes the same things and Ordo's access, and asks Google to withdraw Ordo's Gmail access. For Outlook, Ordo deletes its access but does not ask Microsoft to withdraw it, so you can also remove Ordo at account.live.com/consent/Manage or myapps.microsoft.com. Ordo keeps the address of a disconnected account so you can connect it again. Connecting it again starts over and reads the last 30 days again. You can also change which labels or folders Ordo reads, and turn memory off for an inbox, at any time.

Deleting your Ordo account deletes everything Inbox holds at once: your connected accounts, Ordo's access to them, findings, email records, quotations, plans, remembered facts and reading records. Ordo asks Google to withdraw its Gmail access. For Outlook, remove Ordo in your Microsoft account as described above. Ordo keeps only a one-way code made from your account ID, so that if a backup is ever restored, your Inbox data can be deleted again.

Your email, and what Ordo learns from it, is never sold, never used for advertising, and never used to decide on credit or lending. Ordo sends it to no one but Anthropic, as described here. If you allow Inbox notifications, they say only that something needs you, never a subject, a sender, or words from an email. No other Ordo account can see your Inbox. A task or event you approve becomes part of your plan like anything you add, so if you share your calendar with someone, they see an approved event as they see your other events: its title, time and place, or only Busy.

No person at Ordo reads your email or what Inbox keeps from it, unless you ask us to, for example to look into a problem you report, or it is needed for security or required by law. Ordo's logs record status codes and identifiers, not email text.

If an email contains a password, a sign-in code or a key, Claude receives it with the rest of the email's text. Ordo does not keep it. A finding, task title, quotation or question that would contain one is left out, and a subject or invitation title is kept with the code replaced by dots. This check looks for the usual ways these are written, so an unusual one can get past it.

When you ask the companion about your email, it can use Inbox in three ways. To list your findings, it sends Anthropic their titles, dates and status, with any email address in a title replaced by the words "an email address". To answer what an email says, it opens the conversation behind a finding and sends up to 10 messages at a time, and it can ask for earlier or later ones. For each message it sends the text, up to 12,000 characters for the email the finding came from and 4,000 for the others, with the older replies quoted in it, about 28,000 characters in all, along with the sender's name and address, the subject, the date, whether you sent it, the names of attachments, and the address of your connected account. It includes only messages from the labels or folders you chose, from the period you shared, and never Spam, Trash or drafts. To plan around a finding, it can look up related items from all your connected inboxes, which sends their titles, dates and status and, if you allowed memory, matching facts Ordo remembers, which can include a name and email address you confirmed. The companion opens only conversations behind your findings. It cannot search your mailbox or open email from an inbox you paused or disconnected, and it does this only while you are talking with it, never in the background. Ordo's server keeps no copy of the email text the companion reads. The companion's reply can repeat what an email says, and that reply becomes part of your conversation, which goes with your later messages as described under The companion. If the companion drafts a plan for you, Ordo keeps your request with the plan in Inbox for 24 hours. Nothing changes until you approve the plan.

Ordo uses what it receives from Gmail only to show you Inbox and the plans you ask for. It does not sell it, use it for advertising, or use it to train AI models, and no person at Ordo reads it except as described above.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Ordo uses what it receives from Microsoft only to provide Inbox, and never for advertising or marketing. You can withdraw the access you gave Ordo at any time at account.live.com/consent/Manage or myapps.microsoft.com.

Where your data lives and how it is protected

Your account and content are stored with Supabase, our database and authentication provider, with row-level security restricting access to the signed-in account. Connections use HTTPS. The native iPhone app keeps sign-in tokens in the device’s Keychain. The web and desktop experience keeps its session in browser storage so you stay signed in. Settings, local observations, conversation history, pending changes, and cached app content may also be stored on your device or in that browser. Signing out ends the session; it is not the same as deleting the account or all account-scoped local content.

Widgets and Live Activities

On iPhone, Ordo shares a local snapshot with its widget extension so widgets can show upcoming events, their times and locations, and due tasks. Focus widgets and Live Activities can show the session intention, timer state, and current round. This information can appear on the Home Screen, Lock Screen, or Dynamic Island outside the open app, depending on the features you enable and your device settings. Consider who can see those surfaces when adding a widget or using a Live Activity.

The app and widgets use a shared local storage area for these snapshots. Ordo clears the shared widget snapshot when the account changes or signs out. Widgets use saved snapshots and system-managed refreshes, so they may not reflect a change immediately.

Reminders, notifications, and location

Event reminders and the gentle time-to-head-out nudges are scheduled as local notifications on your device. If you allow Inbox notifications, Ordo's server keeps an encrypted address for that browser or device so it can tell you when something in Inbox needs you. These notifications never include a subject, a sender, or words from an email. If you allow location access, it is used only to fetch your local weather and daylight for the Today screen and the morning briefing. Your approximate location is sent to the weather provider (Open-Meteo) for that lookup and nowhere else; it is not stored on Ordo’s servers and is never used for advertising.

Diagnostics when something goes wrong

When a fault happens in the app, Ordo records a report. The report holds the error message, the stack behind it, which part of the app it came from, the app version, the platform, and, once you are signed in, your account id, so a fault you write to us about can be matched to its record. Reports are kept in Ordo's own database. There is no analytics tool, no advertising tool, and no third-party crash reporting anywhere in Ordo, so a report goes to no one else.

Sending a report is an ordinary request to that database, so, exactly as with every other request the app makes, your device's IP address reaches Supabase, our database provider, and appears in its own request logs. It is not part of the report and is not stored in it.

Nothing is sent until you agree. Ordo starts watching for faults the moment the app opens, which is before you reach the agreement in setup, so a report from that time waits on your phone and goes nowhere. When you agree, the waiting reports are sent, and reports from then on are sent as they happen. If you never agree, none of them are ever sent. A waiting report is also dropped, unsent, when an account first signs in on the phone, and when the account is switched or deleted, so a fault recorded before an account can never be sent under it.

Ordo does not put your content into a report on purpose. It does not send your event titles, your tasks, your journal, or your companion messages as such. An error message and a stack are whatever the failing code produced, though, so a fragment of what that code was handling can appear in the text. Diagnostics, under About in Profile, turns this off at any time. Turning it off drops any report still waiting on your phone, and after that a fault is neither sent nor kept: Ordo records nothing about it, and turning Diagnostics back on later sends nothing from the time it was off. Reports are used only to find and fix faults. They are never sold, never used for advertising, never used to train any AI model, and never used to track you.

Who processes your data

Ordo does not sell your information and does not share it for advertising. Your data is handled only by the providers needed to run the app: Supabase (database, authentication, and server functions), Anthropic (the Claude companion and the briefing text), Resend (transactional email delivery), and, for app versions that use it, Expo (app delivery). If you connect an inbox, Ordo's server reads your email from Google or Microsoft with the access you gave, and Anthropic reads it as described under Inbox. Inbox notifications pass through your browser's or Apple's push service and carry no email content. When Ordo estimates the travel time between two places, either two of your events or two places the companion is asked about, the two locations are sent to Apple's Maps service to get a driving, walking, transit, or cycling time; nothing else about you goes with them, not your name and not your account. Ordo's server holds those two place names in memory for up to half an hour so the same route is not looked up twice, and stores them nowhere else. Apple handles them under its own privacy policy. If you connect WHOOP, WHOOP processes the recovery and sleep data you authorize so Ordo can read it on your behalf; Ordo does not store a lasting copy of it. The morning briefing also fetches world data from Open-Meteo (weather and daylight), a market-data provider (stock-market figures), and a news provider (a global news headline). These providers handle requests under their own terms and privacy policies. Browser speech providers may also process audio when you use voice input on the web, as described above. The fault reports described under Diagnostics are held in Ordo's own database, with Supabase, and go to no one else.

Ordo sends only essential account emails, such as sign-up confirmation and password reset; there is no marketing email.

Keeping and deleting your data

Your account and the content you create are kept for as long as your account exists. You can edit or remove any item in the app at any time. Delete account and data, in Profile in the app or Settings on the web, permanently removes your profile, practices, schedule, coursework, and journal, and everything Inbox holds, from Ordo’s servers and clears this device. This cannot be undone.

Other data is kept only as long as it is needed. If you connect an inbox, what Inbox keeps, and for how long, is described under Inbox. Connection tokens for a linked Google calendar or WHOOP are kept only while that connection is on, and are deleted when you disconnect or delete your account. Your WHOOP recovery data is not kept on Ordo's servers, and neither is a copy of the outside calendars you mirror on your iPhone, apart from the lines the morning brief saves to your account, up to three a day, which can quote one mirrored event's title and time and are removed when you delete your account. Your Apple Health reading is the other exception: a curated daily snapshot is stored on Ordo's secure server, linked only to your account under row-level security, so your day reads the same on your other devices such as Ordo for Mac; turning health off or disconnecting Apple Health requests deletion of that summary, and account deletion removes it. Signing out or switching accounts clears the current session but does not delete the server summary. Server deletion requires a successful connection. Fault reports carrying your account id are removed with your account; a report sent while you were not signed in carries no account id, so Ordo has no way to find it and remove it with your account. The request that delivered it still reached Supabase with your device's IP address, as described under Diagnostics. When you delete your account, your data is removed from Ordo's live systems at once and clears from encrypted backups within about 30 days. Essential account emails and security logs are kept for a limited period so we can keep the service safe.

Security

We protect your data with measures such as row-level security, Keychain storage for native iPhone sign-in tokens, and HTTPS connections. No method of storage or transmission is ever completely secure, so while we work to protect your information we cannot guarantee absolute security.

Where your data is processed

The providers Ordo relies on, including Supabase and Anthropic, may store and process your data on servers in the United States and other countries, which may have different data protection laws than where you live. Where your data is transferred out of the EEA or the UK, that transfer is covered by appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission and the UK equivalent, which our providers make available. You can ask us for a copy of those safeguards, or where to find them, by writing to support@useordoapp.com. By using Ordo you understand that your data may be processed in those locations.

Why we may process your data (legal bases)

If you are in the EEA or the UK, we process your personal data on these legal bases. To provide the app you signed up for, we process your account and the content you create in order to perform our contract with you. For the optional features you switch on, the companion, connecting a calendar, connecting an inbox, learning your scheduling rhythms, voice input, the morning briefing, location, and sending fault reports, we rely on your consent, which you can withdraw at any time by turning the feature off; withdrawing consent does not affect processing already carried out. For health and recovery data, which is a special category of personal data, we rely on your explicit consent, given when you turn health on. We also rely on our legitimate interests in keeping Ordo secure and working correctly, weighed against your rights. You are never required to give consent, and the rest of Ordo works without the optional feature.

To have an Ordo account you need to give us an email, a password, and a display name; without these we cannot create or sync your account. Everything else, the companion, calendars, Inbox, scheduling rhythms, voice, the briefing, location, health, and fault reports, is optional, and turning one off simply switches that feature off.

Your rights

You can access, correct, or delete most of your data directly in the app by editing your items or using Delete account and data, in Profile in the app or Settings on the web, and you can request a copy of your data or exercise any other right by contacting us at support@useordoapp.com. Response deadlines depend on the law that applies to your request. To protect your data, we confirm a request comes from you before we act on it, usually by matching it to the email on your account; if we cannot confirm it is you, we may not be able to complete the request, and we will tell you why. You can also have someone make a request for you, and we may ask them to show your written permission and confirm the request with you directly.

EEA and UK. For requests under the EU or UK GDPR, a response is due without undue delay and normally within one calendar month, subject to the applicable rules for verifying identity and calculating the deadline. Where the law permits an extension because of the complexity or number of requests, the deadline may be extended by up to two further months. You must be told about the extension and the reasons within the initial one-month period.

California. Where the CCPA applies, receipt of a request to know, correct, or delete must be confirmed within 10 business days, and a substantive response is due within 45 calendar days of receipt. If necessary, that response period may be extended by up to another 45 calendar days, with notice and an explanation. Time spent verifying the request does not extend the initial 45-day period. Other requests follow the deadlines required by the law that applies to them.

If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected or erased, to restrict or object to certain processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). We do not make decisions producing legal or similarly significant effects about you by solely automated means: the companion only suggests, and you confirm any change before it is saved.

If you are in California, Virginia, or another US state with a consumer privacy law, you have the right to know what personal information we hold, to access, correct, delete, and get a portable copy of it, and to be free from discrimination for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front, and we do not use your sensitive information, including any health data, beyond providing the features you turned on. Ordo does not profile you to make decisions with legal or similarly significant effects, so there is nothing to opt out of there either.

If you are in Virginia and we turn down a request about your data, you can appeal by emailing support@useordoapp.com with “Appeal” in the subject. We will respond within sixty days and explain the decision; if we deny the appeal, you can contact the Virginia Attorney General at oag.state.va.us/consumer.

Other services' policies

The services that help run Ordo, including Anthropic, Supabase, Resend, Apple and Apple Health, Expo, Open-Meteo, WHOOP, Google and Microsoft if you connect an inbox, and the providers of the market figures and news headline in the briefing, handle some data under their own privacy policies. We encourage you to review those policies for how they process data on their side.

Children

Ordo is not directed at children. You must be at least 13 to use it, and in the EEA or the UK at least the age of digital consent where you live, which is 16 unless your country has set a lower age (as low as 13). We do not knowingly collect personal information from a child below the applicable age; if we learn that we have, we will delete it. If you are under 18, you should use Ordo only with a parent or guardian’s involvement.

Changes and contact

If this policy changes, we will update the date above and surface material changes in the app. Questions about your privacy can go to support@useordoapp.com.