How Orviah handles your information

Contents

• Who we are
• What stays on your device
• Your account
• Private backup and your other devices
• Orviah's AI: what is sent, where it goes
• Voice
• Connected accounts: Google, Microsoft
• Shared spaces
• Feedback and support
• Beta invitations
• Siri and Shortcuts
• What Orviah does not do
• Retention and deletion
• Security, honestly
• Service providers
• International transfers
• Your rights
• Children
• This website
• Changes and contact

Who we are

Orviah is an AI chief of staff for your life, for iPhone and iPad. It is developed and operated by Orviah ("Orviah", "we"). For anything in this policy, write to support@orviah.app. Orviah is the controller of the small amount of personal data it holds about you (your account) and, where the law treats it that way, a processor acting on your instructions for the requests you send to its AI.

What stays on your device

Orviah is local-first. The working copy of your life is a single encrypted file on your iPhone or iPad, and it is the authoritative one. It holds:

• Everything you organise: areas, situations, to-dos and their order, notes, who you are waiting on, reminders, your main priority and what comes first today.
• Every conversation: what you said (as transcribed on the device, or typed), what Orviah replied, and the changes each turn made, so that Orviah can remember and you can undo.
• Durable things you asked Orviah to remember about how you work.
• Pictures and voice notes you chose to show Orviah, stored as encrypted files.
• The names you give your connected accounts, and the keys used for shared spaces.

The file and the attachments are encrypted with AES-256-GCM. The key is 32 random bytes made on the device and kept in the device's Keychain; on devices with a Secure Enclave it is wrapped by a key that never leaves the enclave, so a copy of the Keychain is useless elsewhere. On top of that, iOS complete file protection applies to every file. Orviah can also lock itself behind Face ID, Touch ID or your passcode after a time you choose.

Transcription of your voice happens on the device using Apple's speech framework. Audio is not sent anywhere. Some understanding also happens entirely on the device: rule-based reading of plain instructions, and Apple's on-device model when Apple Intelligence is on.

A diagnostics log on the device records when things happened (when listening started and stopped and why, what synced, what failed) and never what you said or anything from your life. It stays on the device unless you choose to share it with us.

Your account

You sign in with Apple. Orviah's account service (Supabase) then holds: an account identifier, the email address Apple shares (which may be Apple's private relay address), the name you gave, when the account was created, and the sealed backup described below. Accounts made before Sign in with Apple was available were made with Google sign-in; those hold the Google account's address and name instead, and can link Apple from Settings.

You can use Orviah on one device without signing in. Orviah then uses an anonymous identity for the AI service only; it holds no name or address, and your life stays on that device with no backup.

Lives created before private backup existed (early October 2026) also had a readable copy of their records in Orviah's database. Those rows are frozen, no longer written to, and are deleted with the account.

Private backup and your other devices

When you turn private backup on, your life is sealed on your device with a separate backup key before it is uploaded. Orviah's servers hold only ciphertext: a snapshot of your life, a journal of sealed changes from each of your devices, and sealed attachment files. The backup key is kept in your device's Keychain and in your iCloud Keychain (so an iPhone or iPad on the same Apple ID can open the same life), and is shown to you once as a 52-character recovery code. Orviah does not have the key and cannot read your backup. If you lose every device and the recovery code, the backup cannot be opened by anyone, including us.

Orviah's servers can see the size and timing of backup uploads and which of your devices wrote them. They cannot see what changed.

Orviah's AI: what is sent, where it goes

Understanding what you say, and answering questions, is done by a large language model. Orviah does not call a model directly from your phone; it runs its own processing service.

What is sent, per turn

Each time you talk (or type) to Orviah, your phone assembles one request containing: your words; the date and time; the parts of your life that matter for those words (your priorities, situations by name, the situation being discussed with its steps and standing, open to-dos and waits, notes that match, dated evidence recalled from older conversations); a rolling summary and the last few turns of the current conversation; what Orviah offered and is awaiting a yes on; and, when relevant, the open email draft, the emails or calendar events you asked about, and any picture you chose to show it. The whole request is bounded in size. Your phone never sends your whole history. Spaces you share with others are not included.

Where it goes

1. The request is written, over an encrypted connection, to a queue on Orviah's infrastructure (hosted by Supabase). Access rules let only your account read your own request, and nobody but Orviah's processing service can answer it.
2. Orviah's processing service, a computer Orviah operates, collects the request over an outgoing connection, runs it through the model in a fresh process with no tools and no memory of earlier requests, checks the shape of the answer, and posts the answer back. Its log keeps timings, hashed identifiers and outcomes, never your text.
3. The model is Claude, provided by Anthropic, which processes the request to produce the answer. When that model is unavailable, the same request is answered through GitHub Copilot; a request containing a picture is never sent to the backup.
4. Your phone reads the answer and deletes the request. A request that is never collected is removed within an hour. The answer is applied on your phone as typed actions, so the service never holds your life.

A picture you show Orviah is uploaded sealed to your own private folder for the minutes the model needs it, shared with the processing service through a short-lived link, and deleted after the turn.

Orviah does not use your words, your life, your mail or your pictures to train or improve AI models, and its model providers process each request only to answer it: Orviah's arrangements with them exclude training on your data.

Voice

Listening and transcription happen on the device, as above. Orviah can also speak its replies. With the device's own voice, nothing leaves the device. With one of Orviah's voices, the text of the reply (up to about 600 characters per reply) is sent to ElevenLabs through Orviah's server, converted to speech and streamed back; Orviah's key for that service is held on the server, never on your phone, and each account has a daily allowance. Reading aloud is off by default; you choose the voice and whether replies are read.

Connected accounts: Google, Microsoft

You can connect mail and calendar accounts from Settings. Sign-in happens on the provider's own page; Orviah never sees your password. The tokens that result stay in your device's Keychain and are never sent to Orviah's servers. On another device you sign in to each account again.

Orviah reads what you ask about and changes things only when you ask: it can search and read your mail, show the events on your calendar, draft emails you approve, send only an email you have read and tapped Send on, archive, label, move to Trash and mark read when you ask, create a filter when you ask, and create, move or remove calendar events when you ask for your calendar. It never deletes mail permanently, never sets up forwarding, and never changes sharing. Mail and events you ask about are included in the request to Orviah's AI described above, and are not stored on Orviah's servers. The full account of each Google permission, with its exact scope, is on the page Google mail and calendar in Orviah.

Orviah's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Orviah does not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine-learning models.

Outlook and Microsoft 365 accounts are built into Orviah but not yet switched on. When they are, they will follow the same rules, through Microsoft's own sign-in library and four delegated permissions (User.Read, Mail.ReadWrite, Mail.Send, Calendars.ReadWrite), each used only when you ask, with the tokens kept in your device's Keychain and nothing from the mailbox or calendar stored on Orviah's servers; this policy will be updated first.

Shared spaces

A shared space is a room several people are in. Its contents are sealed with a key the room's members hold, wrapped to each member's sharing key; Orviah's servers store only ciphertext. The servers do know who is in a space with whom, who wrote when, and how large each entry is: that is metadata, and we say so plainly. An invite is a one-use code that expires after seven days; it gives the server nothing that opens the room. A member who leaves or is removed keeps what they could already read; removal turns the key for everything after. Today a space holds its name and its people; shared content is being built and this policy will be updated when it ships.

Feedback and support

If you send feedback from Settings → About & support, Orviah emails your words to us (through Resend, an email delivery service) together with the app version, your device model and OS version, the time, a reference, your account identifier, and a reply address only if you offered one. Nothing from your life is included. If you choose to share the diagnostics log with us, it contains timings and event names only. Emails you send to support@orviah.app are kept in our mailbox for as long as needed to help you.

Beta invitations

If you ask for a beta invitation on this website, you give us your name and email address. They are sent to us by email through Resend (an email delivery service) and used only to reply to your request and send the invitation. They are not added to any list, not used for marketing, and not shared with anyone else. We keep the request in our mailbox until the beta is over or you ask us to delete it, whichever comes first. Write to support@orviah.app to withdraw a request or to ask what we hold. The form sends only what you typed, the time, and the address the request came from (to stop automated submissions); it sets no cookies.

Siri and Shortcuts

"Tell Orviah" captures your words from Siri or a shortcut, even while the phone is locked: the words are sealed into the queue and only ever add things; nothing is read out of your life until you unlock. "Ask Orviah" answers only after you have unlocked, and changes nothing. Siri's own processing of your speech is Apple's, under Apple's terms.

What Orviah does not do

• No advertising, and no tracking across apps or websites. The app declares no tracking and no tracking domains in its privacy manifest.
• No analytics or behavioural profiling. We do not know what you say to Orviah or what is in your life.
• No selling, renting or sharing of your data with data brokers or anyone else, except the service providers listed below, who act on our instructions.
• No human reading of your words, except the ones you send us as feedback or support requests.
• No training of AI models on your data.

Retention and deletion

• On your device: until you delete the app, delete your account, or start fresh.
• AI requests: deleted by your phone as soon as the answer is read, and in any case within an hour. The processing service keeps nothing between requests.
• Pictures shown to Orviah: the server copy is deleted after the turn; the sealed copy stays in your life.
• Sealed backup and journal: kept until you turn private backup off or delete your account. Turning backup off deletes the sealed copy from Orviah's servers and stops further uploads; your life stays on the device.
• Account: until you delete it. Signing out keeps your sealed backup for when you return.
• Deleting your account (Settings → Delete your Orviah account) removes, in one step and for good: your account, the sealed backup, journal and attachments, any queued requests, the frozen legacy records if you had any, your sharing key and your memberships of shared spaces. A space with nobody else left in it is deleted with you; a space others remain in keeps its sealed record with every reference to your account cleared. If you are the only owner of a space with other members, Orviah asks you to hand it over or delete it first. Deletion cannot be undone.
• Feedback and support emails: kept in our mailbox as long as needed to deal with them, then deleted.
• Beta requests from this website: kept in our mailbox until the beta is over or you ask us to delete them.

Security, honestly

Encryption on the device and in the backup is described above. In transit, everything uses TLS. On the server, row-level access rules keep each account to its own rows; the processing service signs in as an ordinary account that can claim and answer requests and nothing else, holds no AI key or server secret, and accepts no inbound connections. There is no server-side copy of your life in readable form.

What this does not protect against: code running on your own unlocked device; a member of a shared space who copies what they can already read; and the metadata of shared spaces described above. If you believe you have found a security problem, please write to support@orviah.app.

Service providers

Apple

What forSign in with Apple, iCloud Keychain for the backup key, on-device speech recognition, TestFlight distribution, Siri.

What they can seeYour Apple ID relationship with Orviah; your iCloud Keychain, which Apple protects end to end. Under Apple's own privacy policy.

Supabase

What forAccounts, the request queue, sealed backup and attachment storage, shared-space tables.

What they can seeAccount records, queue rows while a request is in flight, ciphertext, and the metadata described above.

Anthropic

What forThe language model (Claude) that answers your requests.

What they can seeThe content of each request while answering it.

GitHub

What forBackup answering through GitHub Copilot when the primary model is unavailable.

What they can seeThe content of a request while answering it; never pictures.

ElevenLabs

What forOrviah's spoken voices, when you turn reading aloud on with one of Orviah's voices.

What they can seeThe text of a reply being spoken.

Resend

What forDelivering in-app feedback to our mailbox.

What they can seeThe feedback email.

Google

What forOnly if you connect a Google account: Gmail and Google Calendar.

What they can seeOrviah's requests to your mailbox and calendar, under Google's privacy policy.

Microsoft

What forOnly if you connect an Outlook or Microsoft 365 account, once that is available.

What they can seeOrviah's requests to your mailbox and calendar, under Microsoft's privacy policy.

Vercel

What forHosting this website.

What they can seeStandard server request logs for the website (IP address, pages requested), kept briefly by Vercel.

International transfers

Some providers above process data outside the United Kingdom and the European Economic Area, including in the United States. Where that happens, we rely on the providers' standard contractual safeguards. Your life itself is never transferred in readable form; what leaves your device is the per-request content described above and ciphertext.

Your rights

Depending on where you live, you have rights over your personal data: to access it, correct it, delete it, receive a copy, object to or restrict processing, and complain to a supervisory authority (in the United Kingdom, the Information Commissioner's Office). Because your life is stored on your device and in a backup we cannot read, most of these you exercise yourself: everything is visible and editable in the app, and deletion is in Settings. For the account record we hold, write to support@orviah.app and we will answer within a month.

Our legal bases are: performing our agreement with you (providing Orviah), your consent where we ask for it (connecting an account, turning backup on, choosing a spoken voice), and our legitimate interest in keeping the service secure.

Children

Orviah is not directed at children. You must be at least 16 to use it. If you believe a child has created an account, write to us and we will delete it.

This website

orviah.app sets no cookies, loads nothing from third parties, and has no analytics or trackers. The only script it runs is its own, on the beta page, to send the form and show the result; the form works without it. Our hosting provider keeps standard request logs briefly for security and operation.

Changes and contact

When this policy changes, the date at the top changes and, for anything that affects how your data is handled, the app tells you before the change applies. The current version always lives at orviah.app/privacy.

Contact: support@orviah.app.