Privacy Policy.

Who we are

Ordo is operated by an individual, Aung Thein Sein, based in Virginia, United States (the "operator", "we", or "us"). For the purposes of the EU and UK General Data Protection Regulation, the operator is the data controller for the personal data described in this policy. You can reach us about privacy at support@useordoapp.com.

Overview

Ordo is a personal app for holding your schedule, practices, tasks, coursework, and journal, with an optional AI companion. This policy explains exactly what Ordo stores, what the companion sends to Anthropic, where your data lives, and the control you have over it.

What Ordo stores

Only your account and the things you create. Your account is your email address, a securely hashed password (handled by our authentication provider, Supabase), and your display name. Your content is your practices, calendar events (title, time, location, notes, recurrence), tasks and coursework (title, course, due date, priority), journal entries, and your settings such as persona and reminder style.

The companion may also store short facts you ask it to remember, like a preference for focused work in the mornings. It also notices patterns from how you use your schedule inside Ordo, for example which kinds of events you tend to move or keep; these stay on your device, and you can clear what it has noticed at any time from Settings. This on-device noticing is separate from the scheduling rhythms Ordo can learn from a connected calendar, which are described in their own section below. Ordo does not collect your contacts, photos, browsing activity, advertising identifiers, or background location.

The companion · what is sent to AI, and where

Ordo's companion is powered by Anthropic's Claude model, called through a secure Ordo server function so the AI key never lives in the app. When you send a message, use quick capture, or generate a reflection, Ordo sends Anthropic your message text, the current date and time zone, and the relevant slice of your own data needed to answer it: your upcoming events, tasks, practices, and any facts you have asked the companion to remember. It does not send your password or email, and it does not send your typed journal entries unless you put them into a message yourself. If you dictate a journal entry with the microphone, the transcribed text is sent to Anthropic only for the cosmetic tidy-up described under Voice input. If Ordo has learned patterns in how you use your schedule, a short summary of those may be included with your message so its read of your day is personal to you, under the same terms.

Anthropic processes this to produce the reply and any suggested changes. Any change that creates, edits, or deletes your data is shown for your confirmation before it is saved. Your prompts are handled under Anthropic's commercial terms for the Claude API, which means Anthropic does not use Ordo's API traffic to train its models, and Ordo itself does not use your data to train any AI model either. Companion requests are rate limited per account. You can choose not to use the companion at all; the rest of Ordo works without it.

Scheduling rhythms · what Ordo learns from your calendar

With your permission, Ordo can learn the rhythms of how you schedule, so it and the companion can plan with your real durations and usual times instead of asking. When you connect a calendar, Ordo's secure server reads your own past events, for example how long a study block or a run usually runs and which days and hours you tend to place them, and reduces them to a small profile of typical durations and timing. That profile is an aggregate, a set of rounded figures and patterns; it is not a copy of your calendar, and individual events are not kept in it. The raw events are used only to compute the profile and are then discarded. The profile is stored on Ordo's secure server under the same row-level security as the rest of your account, so only your signed-in account can read it. This is learning your scheduling rhythms, not tracking your time, and Ordo does not build a record of where you were.

When you or the companion plan with these rhythms, only that aggregated profile, not your raw events, is included with the request, under the same terms described above for the companion. Events that read as sensitive or personal, anything that looks relational, medical, or private, are left out of what Ordo learns from, so they never shape the profile. You are always in control of it: What Ordo has learned, in Settings, shows the profile in plain language and lets you pause the learning or forget it entirely. Pausing keeps what Ordo already knows but stops it learning anything new; forgetting deletes the profile from Ordo's server. This learning is never sold, never used for advertising, and never used to train any AI model.

Voice input · your voice stays on your device

Wherever Ordo offers a microphone — the companion, quick capture, the journal, and onboarding — speaking is optional, and you start it by tapping the mic. Your speech is transcribed into text entirely on your device, by Apple's on-device speech recognition. Ordo does not record, upload, or store your audio, and the audio never leaves your phone.

What happens next is exactly what happens when you type: the resulting text may be sent to Anthropic to tidy it up (removing filler words and fixing punctuation) and, if you send it, to act on it, under the same terms described above. To help the tidy-up keep your own names spelled correctly, a short list of words already in your data — such as names, places, course codes, and the titles of your events and tasks — may be included with that text; this is information you already created, and it is sent only to improve the result. Microphone access is requested only the first time you tap to speak, and you can use every part of Ordo by typing instead.

The morning briefing and its data sources

The morning briefing, when enabled, fetches a small amount of world data from third-party providers: weather and daylight from Open-Meteo, stock-market figures from a market-data provider, and one global news headline from a news provider. The briefing's text is then composed by Anthropic's Claude through the same secure server function and under the same terms described above for the companion, so your schedule context for the day is processed to generate the briefing.

Global market indices and the global news headline contain no personal data. If you add custom quotes, only the ticker symbols you choose are sent to look them up; a ticker symbol is not personal information. Weather and daylight use your device's approximate location only if you have granted location access. These third-party requests are made only to provide the briefing and are subject to those providers' own privacy practices.

Health and recovery · Apple Health and WHOOP

If you choose to, Ordo can read your sleep and recovery so it can gently shape your day, lighter after a hard night, fuller after a good one. This is off until you turn it on, asks for your explicit permission first, and can be turned off at any time. With your permission, Ordo reads your sleep and its stages, your resting heart rate, your heart-rate variability, and your respiratory rate from a connected wearable such as WHOOP, or from Apple Health when you wear an Apple Watch; from your iPhone alone it can read your steps and walking distance on your device. The rest of Ordo works exactly the same whether or not you turn this on.

When you connect WHOOP, you sign in on WHOOP's own page and grant access there; Ordo never sees your WHOOP password, and WHOOP's app credentials live only on Ordo's secure server, never in the app. Ordo fetches that day's recovery and sleep through a secure server function, reduces them to a short summary, and sends only that summary to Anthropic's Claude, in the same way and under the same terms as the companion, to write your reading and plan around your recovery. Ordo does not keep a lasting copy of your WHOOP data: the day's figures are used to produce your reading and then discarded, and only the secure connection tokens are stored so the link keeps working. Disconnecting WHOOP, in the app, deletes those tokens and stops all access at once, and deleting your account also revokes Ordo's access to WHOOP and removes the stored tokens.

Apple Health data is read on your device with your permission. So your day reads the same on your other devices, such as Ordo for Mac, a curated daily snapshot of that reading is stored on Ordo's secure server, linked only to your account under row-level security; it is never written to iCloud by Ordo, and it is deleted when you turn health off, switch accounts, or delete your account. Your health and recovery data is never sold, never used for advertising or use-based data mining, never used to train any AI model, and shared with no third party except Anthropic, the AI processor that writes your reading at your instruction.

Your outside calendars stay on your device

When you add an iCloud, Google, or Exchange calendar through your iPhone, Ordo reads it on your device only, to show those events alongside your own. Those mirrored events are never uploaded to Ordo's servers, and they are never sent to the companion unless they are part of something you ask about. You can turn this off at any time in iOS Settings.

Connecting a Google account to Ordo directly is a separate choice. When you do, Ordo's secure server reads that Google calendar to keep it in sync across your devices and, if you turn it on, to learn your scheduling rhythms as described under Scheduling rhythms above. Only the aggregate rhythm profile is stored; your Google events themselves are not kept on Ordo's servers. Disconnecting Google in Profile stops that access.

Editing your outside calendars

You can choose a default calendar in Profile, and new events you create in Ordo or ask the companion to create will be saved there, locally through iOS. Tapping an existing outside event opens iOS's own edit sheet, so Apple handles the change. To keep things safe, the companion will not edit or delete an event that has attendees, since that would silently send invite updates to other people; it will ask you to open that event in Calendar instead. Nothing about your iOS-mirrored calendars is sent to Ordo's servers.

Where your data lives and how it is protected

Your account and content are stored with Supabase, our database and authentication provider, under row level security so that only your signed-in account can read or write your data. Your sign-in tokens are kept in your device's secure keychain, not in plain storage, and connections use HTTPS. Your settings and a local copy of your data are also kept on your device so the app works smoothly.

Reminders, notifications, and location

Event reminders and the gentle time-to-head-out nudges are scheduled as local notifications on your device. Ordo has no push server and stores no push tokens. If you allow location access, it is used only to fetch your local weather and daylight for the Today screen and the morning briefing. Your approximate location is sent to the weather provider (Open-Meteo) for that lookup and nowhere else; it is not stored on Ordo’s servers and is never used for advertising.

Who processes your data

Ordo does not sell your information and does not share it for advertising. Your data is handled only by the providers needed to run the app: Supabase (database, authentication, and server functions), Anthropic (the Claude companion and the briefing text), Resend (transactional email delivery), and Expo (app delivery). If you connect WHOOP, WHOOP processes the recovery and sleep data you authorize so Ordo can read it on your behalf; Ordo does not store a lasting copy of it. The morning briefing also fetches world data from Open-Meteo (weather and daylight), a market-data provider (stock-market figures), and a news provider (a global news headline). Each one processes your data solely to provide its part of the service.

Ordo sends only essential account emails, such as sign-up confirmation and password reset; there is no marketing email.

Keeping and deleting your data

Your account and the content you create are kept for as long as your account exists. You can edit or remove any item in the app at any time. Delete account and data, in Profile, permanently removes your profile, practices, schedule, coursework, and journal from Ordo’s servers and clears this device. This cannot be undone.

Other data is kept only as long as it is needed. Connection tokens for a linked Google calendar or WHOOP are kept only while that connection is on, and are deleted when you disconnect or delete your account. Your WHOOP recovery data and the outside calendars you mirror on your iPhone are not kept on Ordo's servers. Your Apple Health reading is the exception: a curated daily snapshot is stored on Ordo's secure server, linked only to your account under row-level security, so your day reads the same on your other devices such as Ordo for Mac; it is deleted when you turn health off, switch accounts, or delete your account. When you delete your account, your data is removed from Ordo's live systems at once and clears from encrypted backups within about 30 days. Essential account emails and security logs are kept for a limited period so we can keep the service safe.

Security

We protect your data with measures such as row level security, encrypted storage of your sign-in tokens, and HTTPS connections. No method of storage or transmission is ever completely secure, so while we work to protect your information we cannot guarantee absolute security.

Where your data is processed

The providers Ordo relies on, including Supabase and Anthropic, may store and process your data on servers in the United States and other countries, which may have different data protection laws than where you live. Where your data is transferred out of the EEA or the UK, that transfer is covered by appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission and the UK equivalent, which our providers make available. You can ask us for a copy of those safeguards, or where to find them, by writing to support@useordoapp.com. By using Ordo you understand that your data may be processed in those locations.

Why we may process your data (legal bases)

If you are in the EEA or the UK, we process your personal data on these legal bases. To provide the app you signed up for, we process your account and the content you create in order to perform our contract with you. For the optional features you switch on, the companion, connecting a calendar, learning your scheduling rhythms, voice input, the morning briefing, and location, we rely on your consent, which you can withdraw at any time by turning the feature off; withdrawing consent does not affect processing already carried out. For health and recovery data, which is a special category of personal data, we rely on your explicit consent, given when you turn health on. We also rely on our legitimate interests in keeping Ordo secure and working correctly, weighed against your rights. You are never required to give consent, and the rest of Ordo works without the optional feature.

To have an Ordo account you need to give us an email, a password, and a display name; without these we cannot create or sync your account. Everything else, the companion, calendars, scheduling rhythms, voice, the briefing, location, and health, is optional, and turning one off simply switches that feature off.

Your rights

You can access, correct, or delete most of your data directly in the app by editing your items or using Delete account and data in Profile, and you can request a copy of your data or exercise any other right by contacting us at support@useordoapp.com. We respond within 45 days; if we need more time we will tell you, and we may take up to another 45 days. To protect your data, we confirm a request comes from you before we act on it, usually by matching it to the email on your account; if we cannot confirm it is you, we may not be able to complete the request, and we will tell you why. You can also have someone make a request for you, and we may ask them to show your written permission and confirm the request with you directly.

If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected or erased, to restrict or object to certain processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). We do not make decisions producing legal or similarly significant effects about you by solely automated means: the companion only suggests, and you confirm any change before it is saved.

If you are in California, Virginia, or another US state with a consumer privacy law, you have the right to know what personal information we hold, to access, correct, delete, and get a portable copy of it, and to be free from discrimination for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front, and we do not use your sensitive information, including any health data, beyond providing the features you turned on. Ordo does not profile you to make decisions with legal or similarly significant effects, so there is nothing to opt out of there either.

If you are in Virginia and we turn down a request about your data, you can appeal by emailing support@useordoapp.com with “Appeal” in the subject. We will respond within sixty days and explain the decision; if we deny the appeal, you can contact the Virginia Attorney General at oag.state.va.us/consumer.

Other services' policies

The services that help run Ordo, including Anthropic, Supabase, Resend, Apple and Apple Health, Expo, Open-Meteo, WHOOP, and the providers of the market figures and news headline in the briefing, handle some data under their own privacy policies. We encourage you to review those policies for how they process data on their side.

Children

Ordo is not directed at children. You must be at least 13 to use it, and in the EEA or the UK at least the age of digital consent where you live, which is 16 unless your country has set a lower age (as low as 13). We do not knowingly collect personal information from a child below the applicable age; if we learn that we have, we will delete it. If you are under 18, you should use Ordo only with a parent or guardian’s involvement.

Changes and contact

If this policy changes, we will update the date above and surface material changes in the app. Questions about your privacy can go to support@useordoapp.com.