Privacy Policy

1. Introduction and scope

This Privacy Policy describes how ORIA (“we”, “us”, or “our”) collects, uses, stores, and protects your personal information when you use the ORIA mobile and web application, accessible at https://oria.today and related subdomains (the “Service”).

By creating an account or using ORIA, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Data controller

The data controller responsible for your personal data is the ORIA project team. For any privacy-related questions, you can contact us at:

ORIA — A.yaakov@aditech.io

3. Information we collect

We collect only the information necessary to provide and improve the Service:

• Account information: email address, first name, and last name provided during registration or through Google OAuth.
• Profile information: city, Jewish tradition or movement, knowledge level, language preference, phonetic display preference, and other optional settings you choose to provide.
• User-generated content: completed routines, daily journal entries, selected prayers, saved items, and conversations with the ORIA AI assistant.
• Usage and technical data: device type, browser language, timezone, anonymized error logs, and aggregated usage statistics.
• Authentication data: encrypted session tokens and identifiers required to keep you signed in securely.

4. How we use your information

We use your personal data for the following purposes:

• To create, authenticate, and secure your personal account.
• To synchronize your routines, prayers, journal entries, saved items, and AI conversations across your devices.
• To personalize content such as the calendar, weekly Torah portion (Parasha), daily Halakha, daily Mitzvah, and AI responses.
• To provide prayer-time calculations based on your selected city.
• To improve the quality, reliability, and security of the Service.
• To send you important service-related notifications, when necessary.

5. Legal basis for processing

We process your personal data on the following legal bases:

• Performance of a contract: processing required to provide the Service to you under our Terms of Use.
• Consent: where you have explicitly agreed, for example to optional features or communications.
• Legitimate interests: to maintain security, prevent abuse, and improve the Service, provided your rights and interests are not overridden.
• Legal obligation: when required to comply with applicable laws.

6. Data retention

We keep your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account and profile data are retained while your account remains active.
• User-generated content is retained until you delete it or delete your account.
• Technical logs and anonymized analytics are retained for up to 12 months for security and improvement purposes.
• Deleted accounts and associated data are permanently removed within 30 days of your deletion request, except where longer retention is required by law.

7. Data sharing and subprocessors

We do not sell your personal data. We rely on trusted third-party service providers (subprocessors) to operate the Service:

• Lovable Cloud / Supabase: cloud infrastructure, database, authentication, and secure storage.
• Google: authentication via Google Sign-In, subject to Google’s Privacy Policy.
• AI providers: large language model services used to power the ORIA assistant, accessed through secure gateways.

These providers are contractually bound to process data only on our behalf and to maintain appropriate security measures.

8. Security measures

We implement industry-standard security measures to protect your data, including:

• Encrypted data transmission using HTTPS/TLS.
• Encrypted authentication tokens and secure session management.
• Row-level security policies so only you can access your personal content.
• Regular backups and monitoring to maintain service availability and integrity.

No method of transmission or storage is completely secure, but we continuously work to reduce risks.

9. Cookies and local storage

ORIA uses cookies and browser local storage to maintain your session, remember your preferences, and enable offline functionality. These technologies are strictly necessary for the Service to work and are not used for advertising or third-party tracking.

10. International data transfers

Your data may be stored and processed in data centers located outside your country of residence. We rely on appropriate safeguards, including standard contractual clauses and provider certifications, to ensure an adequate level of protection.

11. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete information.
• Erasure: request deletion of your account and data.
• Portability: receive your data in a structured, machine-readable format.
• Restriction and objection: limit or object to certain processing activities.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise your rights, contact us at A.yaakov@aditech.io. We will respond within the timeframes required by applicable law.

12. Account deletion

You can request deletion of your account and all associated data, including routines, journal entries, conversations, saved items, and preferences, from your profile settings or by contacting us. Deletion is irreversible and will be completed within 30 days.

13. Children's privacy

ORIA is not directed to children under the age of 13 (or the minimum legal age in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

14. Changes to this policy and contact

We may update this Privacy Policy from time to time. We will notify you of significant changes through the Service or by email. Continued use of ORIA after changes constitutes acceptance of the updated policy.

For any questions about this Privacy Policy or your data, please contact us:

ORIA — A.yaakov@aditech.io