Privacy Policy

For adults only

The Service is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has used the Service, contact us and we will delete the account.

Information we collect

• Account information: your email address and display name from your sign-in provider (Google or email/password), and an internal account identifier.
• Your conversations: the messages you exchange with Orenna, retained so it can remember context across sessions. Some of Orenna’s replies are also generated as a spoken voice note, which we store as audio so you can replay it.
• Microphone and dictation: in the mobile app you can tap the microphone button to speak instead of type. If you do, your device asks your permission and then uses your phone’s own built-in speech-to-text (Apple’s on iOS, Google’s on Android) to turn your speech into text. Depending on your device and settings, that audio may be sent to Apple or Google to be transcribed, and their privacy policy governs that step, not ours. We never receive or store the audio. We only receive the text, and only once you send it as a message. Nothing is captured unless you tap the microphone, and you can revoke microphone access at any time in your device settings.
• Sensitive personal information: because Orenna is a reflection and coaching tool, what you share may reveal information about your mental and emotional state. We collect and process this only to provide the Service to you, and you provide it voluntarily.
• Your derived memory (“the Mind”): insights, patterns, open threads, and a current read that Orenna forms from your own messages. Every pattern is anchored to verbatim excerpts of what you actually said.
• Profile and preferences: the life areas, settings, posture, and consents you choose.
• What you write about your own life: the goals you name and why each one matters to you; and, if you choose to write them, your purpose, the values you are moving toward and away from, the story you say you are writing, who you want beside you, and what you are aiming at over the next ninety days. These are your words, not anything we inferred. You can edit or delete any of them at any time.
• Your record of what you have done: entries you add yourself about things you have accomplished or moments that mattered to you. We keep them so we can show them back to you, which is the entire reason the feature exists.
• Mood and activity signals: coarse mood/energy signals derived from your conversations. If we offer an Apple Health connection and you explicitly enable it, we would collect only normalized aggregates (for example, average sleep over the last seven days); raw biometrics would not be collected.
• Billing information: if you subscribe, our payment processor (Stripe) handles your card details. We receive a customer and subscription identifier and your plan status; we never see or store your full card number.
• Device and technical data: a push-notification token (if you enable notifications), and standard log and diagnostic data needed to operate and secure the Service.

How we use your information

• To provide the Service: respond to you, build and maintain your Mind, and remember context.
• To send the proactive and reminder messages you have consented to.
• To send you one weekly message that quotes back something you wrote in your own record of what you have done. It is selected automatically, it uses only your own words, and it never fires if you have written nothing. The notification itself never carries those words: what appears on your lock screen is deliberately generic, so nothing private is readable by someone else holding your phone. You can turn proactive messages off at any time.
• To detect signals of acute distress or crisis and respond safely (see Safety below).
• To process payments and manage your subscription.
• To secure the Service, prevent abuse, debug errors, and meet legal obligations.
• To understand product usage in aggregate. When product analytics are enabled, they are configured to exclude your message content and recordings.

Artificial intelligence

Orenna uses third-party large language models to generate its responses and to form your Mind. Your messages are sent to our AI provider solely to produce your results. Our AI provider does not use data submitted through its API to train its models, and we do not sell your data or use it to train third-party models.

Coaches and shared access

If you choose to connect with a coach, you control exactly what they can see through granular, per-category consent that you can change or revoke at any time. A coach never sees your verbatim words: Orenna forms the coaching insight from your conversations using AI (as described above) and shares only that derived insight with your coach. The one exception is safety: if our system detects an acute crisis, we notify your coach only while your coaching relationship is active and you have opted in to safety sharing. Crisis resources remain available to you regardless of that choice. We will never quietly expand a coach’s access without your consent.

Connecting your own AI (portability)

You may generate a personal access token to let another AI you use (such as Claude or ChatGPT) read a scoped view of your Mind. When you do this, you direct us to share that data with the service you connect, under your control. You can revoke a token at any time. Your crisis history is never included in any export. What you write about your own life and your record of what you have done are excluded too: your goals, your vision, and your entries never leave through a connected AI. That exclusion is enforced in our code and covered by automated tests, not just stated here.

Who we share data with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use a small set of service providers who process data only on our instructions to run the Service:

• Cloud hosting and database (United States)
• Our AI model provider, to generate responses
• Authentication (Google Firebase)
• Payments (Stripe)
• Transactional email, push delivery, and, where enabled, error monitoring and product analytics

One thing that is not on that list, because it is not us sharing it: if you dictate a message, your phone’s own speech-to-text may send that audio to Apple or Google to transcribe. That is your device acting for you under their privacy policy. The audio never reaches Orenna.

We may also disclose information if required by law, to protect safety, or in connection with a merger or acquisition (with notice to you).

How long we keep it, and deletion

We keep your information only as long as needed to provide the Service to you. Your conversations, your Mind, and your profile are retained while your account is active and are deleted when you delete your account. You can export a copy of your data or permanently delete your account at any time from Settings; deletion erases your conversations, your Mind, and your profile, and removes your sign-in identity, and the deletion request is honored promptly (typically within 30 days). After deletion, limited records (such as billing records required by tax and accounting law, or security and fraud-prevention logs) may be retained for up to the period required by law, or kept in de-identified form.

We do not sell or share your data

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. Because we do not sell or share, there is nothing to opt out of, but you may still contact us to confirm this at any time.

Your sensitive personal information

What you share with Orenna may be sensitive. We use and disclose your sensitive personal information only as reasonably necessary to provide the Service you have asked for and to keep it safe, and not for any other purpose. California residents have the right to limit our use of sensitive personal information to those purposes; because we already limit it to them, no further action is needed, but you may contact us to confirm.

Consumer health data (Washington and similar states)

What you share with Orenna can reveal your mental and emotional state, which is treated as consumer health data under Washington’s My Health My Data Act (RCW 19.373) and comparable laws. We ask for your opt-in consent before collecting it, and a separate consent before it is processed by our AI provider and sub-processors. Full details, including how to withdraw consent and exercise your rights, are in our Consumer Health Data Privacy Policy.

Cookies and tracking

We use only what is needed to run and secure the Service and, where enabled, privacy-preserving product analytics and error monitoring that are configured to exclude your message content and recordings. We do not use third-party advertising trackers.

International data

We operate the Service from the United States, and your information is processed there. If you use the Service from outside the US, you understand that your information will be transferred to and processed in the US; where required, we rely on appropriate safeguards such as standard contractual clauses for any cross-border transfer.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to opt out of any sale or sharing (we do not sell or share); and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. You can act on most of these directly in Settings, or contact us; we will respond within the time the law requires (generally 45 days for California requests and 30 days under GDPR, with an extension where permitted).

Safety

Orenna is not a crisis service and is not a substitute for professional care. If our system detects signs of acute risk, it may surface crisis resources to you and, if you are paired with a coach, notify that coach. If you are in immediate danger, call your local emergency number or a crisis line such as 988 (US Suicide & Crisis Lifeline).

Security

We protect your data with encryption in transit, scoped access controls, and provider-level safeguards. Push credentials are stored sealed. No system is perfectly secure, but we work to hold a high bar for a product that handles sensitive material.

Changes

We review this policy at least annually and will update the date above when it changes. For material changes, we will provide notice in the app or by email before they take effect.

Contact

For any privacy request — access, export, correction, or deletion — reach us at privacy@orenna.ai.