Privacy Policy.

Who we are

Ordo is operated by an individual, Aung Thein Sein, based in Virginia, United States (the "operator", "we", or "us"). For the purposes of the EU and UK General Data Protection Regulation, the operator is the data controller for the personal data described in this policy. You can reach us about privacy at support@useordoapp.com.

Overview

Ordo is a personal app for holding your schedule, practices, tasks, coursework, and journal, with an optional AI companion. This policy explains exactly what Ordo stores, what the companion sends to Anthropic, where your data lives, and the control you have over it. Ordo is built to hold your information quietly: it is never sold, never used for advertising, and never mined to profile you.

What Ordo stores

Your account, the things you create, and a small amount Ordo writes for you. Your account is your email address, a securely hashed password (handled by our authentication provider, Supabase), and your display name. Your content is your practices, calendar events (title, time, location, notes, recurrence), tasks and coursework (title, course, due date, priority), journal entries, and your settings such as persona and reminder style.

What Ordo writes for you is short and worth naming. The morning brief makes up to three plain claims about the shape of the day, and the evening writes a few lines reading them back; both are saved to your account so the loop closes on the right day. A claim can quote the time and title of one of that day's events, and that event can be one mirrored from an outside calendar, as described in its own section below. If you turn health on, a daily health snapshot is stored too, also described in its own section. There is nothing else: no analytics, no advertising identifiers, no profile built about you.

The companion may also store short facts you ask it to remember, like a preference for focused work in the mornings. It also notices patterns from how you use your schedule inside Ordo, for example which kinds of events you tend to move or keep. Those observations are kept on your device rather than on Ordo's servers, they go to Anthropic with a companion request as described in the next section, and you can clear what Ordo has noticed at any time from Settings. This on-device noticing is separate from the scheduling rhythms Ordo can learn from a connected calendar, which are described in their own section below. Ordo does not collect your contacts, photos, browsing activity, advertising identifiers, or background location.

The companion · what is sent to AI, and where

Ordo's companion is powered by Anthropic's Claude model, called through a secure Ordo server function so the AI key never lives in the app. When you send a message, use quick capture, or generate a reflection, Ordo sends Anthropic the conversation, all of it and not only your latest line, along with roughly the last twenty turns from your earlier conversations with the companion, and the slice of your own data needed to answer it.

That slice is: your display name, your persona and reminder style, the current date and time zone, your calendar names, your events with their titles, times, and locations (every repeating one and the eighty one-off events nearest today, which for most people is all of them), whether an event holds its time or may move, and between what hours, the outside calendars you mirror on this phone for the next two weeks, your events from the last seven days, the free time Ordo has worked out, your tasks with their courses and due dates, your practices with what is due today and how many days you have kept each one, how much you wrote in the journal on each of the last fourteen days, the facts you have asked the companion to remember, what Ordo has noticed about how you use your schedule, and, if you have turned them on, the rhythms Ordo has learned from your calendar and your health reading. If you have chosen the student persona, your term, courses, class times and rooms, instructors, office hours, and next exam go too.

It does not send your password or email. It does not send the notes or descriptions on your events. It does not send what you wrote in your journal: the companion is told which days you wrote and how much, never the words, unless you put them into a message yourself. If you dictate a journal entry with the microphone, the transcribed text is sent to Anthropic only for the cosmetic tidy-up described under Voice input.

The companion can also look further than the list it is given. When you ask about a date outside that window, it calls a lookup that Ordo's server answers, up to about four months of dates in one call, and sends back your events and class meetings with their locations, your tasks, your terms and breaks, and your exams. When it works out how long it takes to get somewhere, the two place names are sent to Apple's Maps service, as described under Who processes your data, and the travel time comes back to Anthropic with the rest of the answer.

Anthropic processes this to produce the reply and any suggested changes. Any change that creates, edits, or deletes your data is shown for your confirmation before it is saved. Your prompts are handled under Anthropic's commercial terms for the Claude API, which means Anthropic does not use Ordo's API traffic to train its models, and Ordo itself does not use your data to train any AI model either. Companion requests are rate limited per account. You can choose not to use the companion at all; the rest of Ordo works without it.

Scheduling rhythms · what Ordo learns from your calendar

With your permission, Ordo can learn the rhythms of how you schedule, so it and the companion can plan with your real durations and usual times instead of asking. Ordo's secure server reads your own events, from a connected calendar over the last six months, and from Ordo itself over the last six months and the next three, and groups them by title: how long a study block or a run usually runs, which days and hours you tend to place them on, how often, and how recently.

Naming what each group is takes a model, so this step also goes to Anthropic's Claude, under the same terms described above for the companion. Your event titles go with it: for each group, up to nine of the titles you actually used, along with those figures. A repeating event you created in Ordo is a group of its own, so its title goes on its own. No dates, no locations, and no notes are sent, and the events themselves are not sent, only their titles and those figures.

What comes back is stored on Ordo's secure server under the same row-level security as the rest of your account, so only your signed-in account can read it. It holds the name of each rhythm, the titles gathered under it, and any title given a length of its own, which means some of your own event titles are kept there. Your calendar itself is not: no event rows, no dates, and no places, so Ordo builds no record of where you were. Once the profile is written, the events the server read are discarded.

When you or the companion plan with these rhythms, only that stored profile, not your raw events, is included with the request. Titles that read as medical, religious, or legal are dropped before anything is sent, and activities the model reads as personal, relational, or private are dropped before anything is stored. That first check matches words in a title, so a private thing under an unusual name can get past it. You are always in control: What Ordo has learned, in Settings, shows the profile in plain language and lets you pause the learning or forget it entirely. Pausing keeps what Ordo already knows but stops it learning anything new; forgetting deletes the profile from Ordo's server. This learning is never sold, never used for advertising, and never used to train any AI model.

Voice input · your voice stays on your device

Wherever Ordo offers a microphone, the companion, quick capture, the journal, and onboarding, speaking is optional, and you start it by tapping the mic. Your speech is transcribed into text entirely on your device, by Apple's on-device speech recognition. Ordo does not record, upload, or store your audio, and the audio never leaves your phone.

What happens next is exactly what happens when you type: the resulting text may be sent to Anthropic to tidy it up (removing filler words and fixing punctuation) and, if you send it, to act on it, under the same terms described above. To help the tidy-up keep your own names spelled correctly, a short list of words already in your data may be included with that text: the people named on your events, the places on them, your course codes, your calendar names, and the titles of your events, tasks, and practices, along with your own name. This is information you already created, and it is sent only to improve the result. Microphone access is requested only the first time you tap to speak, and you can use every part of Ordo by typing instead.

The morning briefing and its data sources

The morning briefing, when enabled, fetches a small amount of world data from third-party providers: weather and daylight from Open-Meteo, stock-market figures from a market-data provider, and one global news headline from a news provider. The briefing's text is then composed by Anthropic's Claude through the same secure server function and under the same terms described above for the companion, so your schedule context for the day is processed to generate the briefing.

Global market indices and the global news headline contain no personal data. If you add custom quotes, only the ticker symbols you choose are sent to look them up; a ticker symbol is not personal information. Weather and daylight use your device's approximate location only if you have granted location access. These third-party requests are made only to provide the briefing and are subject to those providers' own privacy practices.

Health and recovery · Apple Health and WHOOP

If you choose to, Ordo can read your sleep and recovery so it can gently shape your day, lighter after a hard night, fuller after a good one. This is off until you turn it on, asks for your explicit permission first, and can be turned off at any time. With your permission, Ordo reads your sleep and its stages, your resting heart rate, your heart-rate variability, and your respiratory rate from a connected wearable such as WHOOP, or from Apple Health when you wear an Apple Watch; from your iPhone alone it can read your steps, active energy, and exercise minutes on your device. The rest of Ordo works exactly the same whether or not you turn this on.

When you connect WHOOP, you sign in on WHOOP's own page and grant access there; Ordo never sees your WHOOP password, and WHOOP's app credentials live only on Ordo's secure server, never in the app. Ordo fetches that day's recovery, sleep, and day strain through a secure server function, reduces them to a short summary (strain becomes a one-line training-load note), and sends only that summary to Anthropic's Claude, in the same way and under the same terms as the companion, to write your reading and plan around your recovery. Ordo does not keep a lasting copy of your WHOOP data: the day's figures are used to produce your reading and then discarded, and only the secure connection tokens are stored so the link keeps working. Disconnecting WHOOP, in the app, deletes those tokens and stops all access at once, and deleting your account also revokes Ordo's access to WHOOP and removes the stored tokens.

Apple Health data is read on your device with your permission. So your day reads the same on your other devices, such as Ordo for Mac, a curated daily snapshot of that reading is stored on Ordo's secure server, linked only to your account under row-level security; it is never written to iCloud by Ordo, and it is deleted when you turn health off, switch accounts, or delete your account. Your health and recovery data is never sold, never used for advertising or use-based data mining, never used to train any AI model, and shared with no third party except Anthropic, the AI processor that writes your reading at your instruction.

The outside calendars you mirror on your iPhone

When you add an iCloud, Google, or Exchange calendar through your iPhone, Ordo reads it on your device to show those events alongside your own, and stores no copy of those events on its servers. There is one exception, and it is worth stating plainly. The morning brief makes up to three short claims about the shape of the day, and those lines are saved to your account so the evening can read them back against what actually happened. A claim can name the event the day bends around, by its time and its title in quotation marks. When that event came from a mirrored calendar, that mirrored title and time are inside the line that is stored on Ordo's server. This happens once you are signed in, whether or not the companion is switched on, and those lines are deleted when you delete your account. Nothing else about a mirrored calendar is written to Ordo's servers. When you use the companion or the daily briefing, the titles, times, and locations of your coming events, including mirrored ones, are part of the schedule those requests describe: they pass through Ordo's secure server function to Anthropic's Claude to write the reply. That server stores none of it, and Anthropic does not use it to train its models. A mirrored event's location can also reach Apple. When Ordo works out the travel time between two of today's places, that location is one of the two place names sent to Apple's Maps service, as described under Who processes your data. You can turn the mirror off at any time in iOS Settings.

Connecting a Google account to Ordo directly is a separate choice. When you do, Ordo's secure server can see the calendars on that account and read events from the ones you keep visible, so your day reads the same on every device. The connection works in both directions. Ordo adds, moves, or edits events on your Google calendars only when you ask it to. If you turn on "Put Ordo events on Google too", Ordo places copies of your Ordo events there, and it may create a calendar in your Google account, named after the matching Ordo calendar, to hold those copies. Changes you make in Google Calendar flow back into Ordo. When someone invites you to an event, you can answer the invitation inside Ordo. Answering sends only your own response to Google: accepted, declined, maybe, or, if you propose another time, that proposal as a short note on your reply. The organizer sees your answer in Google Calendar the same way they would if you had answered there. Ordo never changes the meeting itself and never writes to anyone else's entry. Events from a connected Google account are part of your schedule, so the briefing and the companion can read them under the same rules as the rest of your day, and, if you turn scheduling rhythms on, they count toward the aggregate rhythm profile described above.

Ordo keeps only the secure connection token on its server while the connection is on; your Google events themselves are not stored there. Calendars you hide are not read. Disconnecting Google in Profile revokes Ordo's access and deletes the token, and deleting your account does the same. Ordo's use, and transfer to any other app, of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your Google data is never sold and never used for advertising.

Editing your outside calendars

You can choose a default calendar in Profile, and new events you create in Ordo or ask the companion to create will be saved there, locally through iOS. Tapping an existing outside event opens iOS's own edit sheet, so Apple handles the change. To keep things safe, the companion will not edit or delete an event that has attendees, since that would silently send invite updates to other people; it will ask you to open that event in Calendar instead. Ordo keeps no copy of your iOS-mirrored calendars on its servers. Their details leave your device in three ways, each described above. They go to Anthropic's Claude inside companion and briefing requests, and Ordo's server does not store them. A mirrored event's location can be one of the two places sent to Apple's Maps service for a travel time, and Ordo's server holds those two place names in memory for up to half an hour, as described under Who processes your data. And the lines the morning brief saves to your account, up to three a day, can quote one mirrored event's title and time, which are then kept with your account until you delete it.

Where your data lives and how it is protected

Your account and content are stored with Supabase, our database and authentication provider, under row level security so that only your signed-in account can read or write your data. Your sign-in tokens are kept in your device's secure keychain, not in plain storage, and connections use HTTPS. Your settings and a local copy of your data are also kept on your device so the app works smoothly.

Reminders, notifications, and location

Event reminders and the gentle time-to-head-out nudges are scheduled as local notifications on your device. Ordo has no push server and stores no push tokens. If you allow location access, it is used only to fetch your local weather and daylight for the Today screen and the morning briefing. Your approximate location is sent to the weather provider (Open-Meteo) for that lookup and nowhere else; it is not stored on Ordo’s servers and is never used for advertising.

Diagnostics when something goes wrong

When a fault happens in the app, Ordo records a report. The report holds the error message, the stack behind it, which part of the app it came from, the app version, the platform, and, once you are signed in, your account id, so a fault you write to us about can be matched to its record. Reports are kept in Ordo's own database. There is no analytics tool, no advertising tool, and no third-party crash reporting anywhere in Ordo, so a report goes to no one else.

Sending a report is an ordinary request to that database, so, exactly as with every other request the app makes, your device's IP address reaches Supabase, our database provider, and appears in its own request logs. It is not part of the report and is not stored in it.

Nothing is sent until you agree. Ordo starts watching for faults the moment the app opens, which is before you reach the agreement in setup, so a report from that time waits on your phone and goes nowhere. When you agree, the waiting reports are sent, and reports from then on are sent as they happen. If you never agree, none of them are ever sent. A waiting report is also dropped, unsent, when an account first signs in on the phone, and when the account is switched or deleted, so a fault recorded before an account can never be sent under it.

Ordo does not put your content into a report on purpose. It does not send your event titles, your tasks, your journal, or your companion messages as such. An error message and a stack are whatever the failing code produced, though, so a fragment of what that code was handling can appear in the text. Diagnostics, under About in Profile, turns this off at any time. Turning it off drops any report still waiting on your phone, and after that a fault is neither sent nor kept: Ordo records nothing about it, and turning Diagnostics back on later sends nothing from the time it was off. Reports are used only to find and fix faults. They are never sold, never used for advertising, never used to train any AI model, and never used to track you.

Who processes your data

Ordo does not sell your information and does not share it for advertising. Your data is handled only by the providers needed to run the app: Supabase (database, authentication, and server functions), Anthropic (the Claude companion and the briefing text), Resend (transactional email delivery), and Expo (app delivery). When Ordo estimates the travel time between two places, either two of your events or two places the companion is asked about, the two locations are sent to Apple's Maps service to get a driving, walking, transit, or cycling time; nothing else about you goes with them, not your name and not your account. Ordo's server holds those two place names in memory for up to half an hour so the same route is not looked up twice, and stores them nowhere else. Apple handles them under its own privacy policy. If you connect WHOOP, WHOOP processes the recovery and sleep data you authorize so Ordo can read it on your behalf; Ordo does not store a lasting copy of it. The morning briefing also fetches world data from Open-Meteo (weather and daylight), a market-data provider (stock-market figures), and a news provider (a global news headline). Each one processes your data solely to provide its part of the service. The fault reports described under Diagnostics are held in Ordo's own database, with Supabase, and go to no one else.

Ordo sends only essential account emails, such as sign-up confirmation and password reset; there is no marketing email.

Keeping and deleting your data

Your account and the content you create are kept for as long as your account exists. You can edit or remove any item in the app at any time. Delete account and data, in Profile, permanently removes your profile, practices, schedule, coursework, and journal from Ordo’s servers and clears this device. This cannot be undone.

Other data is kept only as long as it is needed. Connection tokens for a linked Google calendar or WHOOP are kept only while that connection is on, and are deleted when you disconnect or delete your account. Your WHOOP recovery data is not kept on Ordo's servers, and neither is a copy of the outside calendars you mirror on your iPhone, apart from the lines the morning brief saves to your account, up to three a day, which can quote one mirrored event's title and time and are removed when you delete your account. Your Apple Health reading is the other exception: a curated daily snapshot is stored on Ordo's secure server, linked only to your account under row-level security, so your day reads the same on your other devices such as Ordo for Mac; it is deleted when you turn health off, switch accounts, or delete your account. Fault reports carrying your account id are removed with your account; a report sent while you were not signed in carries no account id, so Ordo has no way to find it and remove it with your account. The request that delivered it still reached Supabase with your device's IP address, as described under Diagnostics. When you delete your account, your data is removed from Ordo's live systems at once and clears from encrypted backups within about 30 days. Essential account emails and security logs are kept for a limited period so we can keep the service safe.

Security

We protect your data with measures such as row level security, encrypted storage of your sign-in tokens, and HTTPS connections. No method of storage or transmission is ever completely secure, so while we work to protect your information we cannot guarantee absolute security.

Where your data is processed

The providers Ordo relies on, including Supabase and Anthropic, may store and process your data on servers in the United States and other countries, which may have different data protection laws than where you live. Where your data is transferred out of the EEA or the UK, that transfer is covered by appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission and the UK equivalent, which our providers make available. You can ask us for a copy of those safeguards, or where to find them, by writing to support@useordoapp.com. By using Ordo you understand that your data may be processed in those locations.

Why we may process your data (legal bases)

If you are in the EEA or the UK, we process your personal data on these legal bases. To provide the app you signed up for, we process your account and the content you create in order to perform our contract with you. For the optional features you switch on, the companion, connecting a calendar, learning your scheduling rhythms, voice input, the morning briefing, location, and sending fault reports, we rely on your consent, which you can withdraw at any time by turning the feature off; withdrawing consent does not affect processing already carried out. For health and recovery data, which is a special category of personal data, we rely on your explicit consent, given when you turn health on. We also rely on our legitimate interests in keeping Ordo secure and working correctly, weighed against your rights. You are never required to give consent, and the rest of Ordo works without the optional feature.

To have an Ordo account you need to give us an email, a password, and a display name; without these we cannot create or sync your account. Everything else, the companion, calendars, scheduling rhythms, voice, the briefing, location, health, and fault reports, is optional, and turning one off simply switches that feature off.

Your rights

You can access, correct, or delete most of your data directly in the app by editing your items or using Delete account and data in Profile, and you can request a copy of your data or exercise any other right by contacting us at support@useordoapp.com. We respond within 45 days; if we need more time we will tell you, and we may take up to another 45 days. To protect your data, we confirm a request comes from you before we act on it, usually by matching it to the email on your account; if we cannot confirm it is you, we may not be able to complete the request, and we will tell you why. You can also have someone make a request for you, and we may ask them to show your written permission and confirm the request with you directly.

If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected or erased, to restrict or object to certain processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). We do not make decisions producing legal or similarly significant effects about you by solely automated means: the companion only suggests, and you confirm any change before it is saved.

If you are in California, Virginia, or another US state with a consumer privacy law, you have the right to know what personal information we hold, to access, correct, delete, and get a portable copy of it, and to be free from discrimination for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front, and we do not use your sensitive information, including any health data, beyond providing the features you turned on. Ordo does not profile you to make decisions with legal or similarly significant effects, so there is nothing to opt out of there either.

If you are in Virginia and we turn down a request about your data, you can appeal by emailing support@useordoapp.com with “Appeal” in the subject. We will respond within sixty days and explain the decision; if we deny the appeal, you can contact the Virginia Attorney General at oag.state.va.us/consumer.

Other services' policies

The services that help run Ordo, including Anthropic, Supabase, Resend, Apple and Apple Health, Expo, Open-Meteo, WHOOP, and the providers of the market figures and news headline in the briefing, handle some data under their own privacy policies. We encourage you to review those policies for how they process data on their side.

Children

Ordo is not directed at children. You must be at least 13 to use it, and in the EEA or the UK at least the age of digital consent where you live, which is 16 unless your country has set a lower age (as low as 13). We do not knowingly collect personal information from a child below the applicable age; if we learn that we have, we will delete it. If you are under 18, you should use Ordo only with a parent or guardian’s involvement.

Changes and contact

If this policy changes, we will update the date above and surface material changes in the app. Questions about your privacy can go to support@useordoapp.com.