PRIVACY POLICY
This Privacy Policy explains what Ordo Daily collects, why we collect it, who we share it with, and the control you have over it. Questions: ordodailyco@gmail.com.
1. What We Collect
Account information — your email address, name, an encrypted password (or a Google sign-in identifier), and your account preferences such as focus areas, working hours, theme, and main goal.
Your content — tasks, calendar blocks, sectors and sector tasks, goals, habits and habit logs, focus sessions, missions, check-ins, wins, journal entries, images you upload to a journal entry, Vault unlocks, and private per-page book notes.
Consent records — the fact that you accepted the Terms and Privacy Policy, the version accepted, and the timestamp.
Billing information — your subscription status, plan, renewal date, and Stripe customer and subscription identifiers. We never see or store your card number. Card data is collected and held by Stripe.
Technical data — device and browser type, IP address, and basic usage/error information needed to run and secure the Service.
2. Why We Use It
To provide and operate the Service, build and reschedule your calendar, keep your streaks and progress, process subscriptions, verify your email, secure accounts and prevent abuse, respond to support requests, and comply with legal obligations. Our legal bases (where GDPR applies) are performance of a contract, legitimate interests in securing and improving the Service, consent for optional features, and legal obligation.
We do not sell your data, share it with advertisers or data brokers, use your content to train AI models, or read your journal entries for marketing.
3. Optional Ordo AI Journal Access
Ordo AI journal access is off by default and strictly opt-in. Only if you switch it on in the Journal will journal content be sent to an AI provider to generate reflections and insights. You can switch it back off at any time; we record when your consent changed. AI output may be inaccurate and is not professional advice.
4. Who Processes Your Data
We share data only with service providers that help us run Ordo Daily, each bound by contract to protect it:
Supabase — database, authentication, and encrypted file storage. Stripe — subscription payments and the billing portal (Stripe is the controller of your card data). Cloudflare — hosting and delivery of the app. AI providers — only if you opt in to Ordo AI journal access, and only the journal content needed to generate a response; providers are contractually barred from training on it.
We may also disclose data where legally required, or to protect the rights and safety of users.
5. Leaderboard and Other Users
Your tasks, journal, goals, and notes are private to you and are enforced as private at the database level. The leaderboard shows only minimal, non-sensitive standing information; it never exposes your email address, journal entries, or the contents of your tasks.
6. Security
Data is encrypted in transit (HTTPS/TLS everywhere, HSTS) and at rest by our database provider. Every table carries row-level security so one account cannot read or change another account's data. Uploaded images and Vault files live in private storage buckets and are reachable only through short-lived signed links issued by our server after checking that you own the file or have unlocked the content. Secret keys are held server-side only and never shipped to the browser. Passwords are hashed, checked against known-breached password lists, and never logged. We do not log passwords, tokens, card data, or journal content.
7. Retention
We keep your data while your account is active. When you delete your account, your content is permanently removed within 30 days, and any active subscription is cancelled. Limited billing and tax records are retained by Stripe and by us where law requires.
8. Your Rights
You can access and correct your information in the app; export everything with "Download My Data" in Command → Your Data & Rights; and permanently delete your account and data with "Delete My Account" in the same place. You may also object to or restrict certain processing, withdraw consent for optional features, and lodge a complaint with your data protection authority.
EU/UK users (GDPR) and California users (CCPA/CPRA) have these rights, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law. Email ordodailyco@gmail.com for help.
9. International Transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.
10. Cookies
We use a small number of cookies and similar browser storage, mainly to keep you signed in. See our Cookie Policy.
11. Children's Privacy
Ordo Daily is for adults (18+). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes
We may update this policy. Material changes will be communicated by email or in-app, and the "last updated" date above will change.
13. Contact
Privacy questions and rights requests: ordodailyco@gmail.com
Questions? Email ordodailyco@gmail.com