1. Scope
Orga is a personal space for capturing, organising and revisiting your life. It turns text, images and other input into structured records, summaries and insights.
This policy explains what personal information we collect when you use the Orga app, the Orga website at app.orga.day, and related services, how we use and share it, and the rights you have. It applies to users worldwide; regional supplements are in section 11.
2. Who we are
Orga is provided by Jimmy (“we”, “us”).
- Data controller: Jimmy
- Address: China
- Contact: gzy.guy@gmail.com
- Response time: within 30 days
If you are in the European Economic Area, the United Kingdom or Switzerland, the additional information in section 11.1 applies.
3. Information we collect
3.1 Account and identity information
When you create an account, we collect your email address, a hashed form of your password, and an optional display name. We also store your chosen language and time zone, the versions of this policy and the Terms you accepted and when you accepted them, and session and security records such as the time of sign-in, IP address and client information.
If you sign in with Apple or Google, we receive the account identifier, email address and, where Apple provides it on first authorisation, your name.
3.2 Content you submit
We collect the text you enter and the kind of record you are creating, such as a financial, emotional, journal, health, task or object record. If you upload images, we store the images you select and attach them to the relevant record. We also store the summaries, memories and insights generated from your input, and any feedback you send us.
Your content may include sensitive personal information, such as health, medical, medication, financial or emotional information. We collect it only when you choose to submit it and use it to provide the recording, organisation, statistics and review features. We do not ask for sensitive information that a feature does not need.
3.3 Technical and security information
We collect information needed to operate and protect the service, including IP address, app version, operating-system platform, request times and error logs. If you purchase a subscription, we receive subscription status, product identifiers and transaction identifiers. Payment card details are handled by Apple; we do not receive your full card number.
We do not use the advertising identifier, track you across apps, run personalised advertising, or sell your personal information.
3.4 Information kept on your device
Some information stays on your device: sample data shown in guest mode, preferences such as theme, language, amount colours and notification settings, and login tokens kept in the system secure storage. If you enable biometric unlock, fingerprint or face verification is performed by the operating system; we do not receive your biometric data.
3.5 Website and messages
If you contact us through the website or by email, we receive your email address and the message you choose to send, and use it to respond. The website may use local storage to remember your theme and language preferences. It does not use advertising cookies or third-party advertising or analytics scripts. Our hosting provider keeps standard access logs for security and troubleshooting.
3.6 What we do not do
We do not read your contacts, SMS, call logs or precise location. We do not record audio, take photos or record video in the background. We do not use your content to train our own models. We do not use your personal information for automated decision-making that has a legal or similarly significant effect on you.
4. How we use information
We use personal information to:
- create and manage your account, sign you in and keep your sessions secure;
- store your input and use AI to produce structured records, summaries, memories and insights;
- show you your history, statistics, trends and reviews;
- manage plans, usage limits and feature entitlements;
- send password-reset emails and service messages;
- keep the service secure, prevent abuse and diagnose failures;
- handle your feedback, support requests and data-rights requests;
- comply with legal obligations.
Where the law requires a legal basis, we rely on performance of our agreement with you, your consent, our legitimate interests in keeping the service secure and improving it, and legal obligations. Where we rely on consent, you can withdraw it at any time without affecting processing that happened before withdrawal.
5. AI processing
To turn your input into structured records, we send the text of the entry you submit, the entry time, your time zone, the output language and the type of analysis requested to the third-party AI providers configured for our deployment. Depending on that configuration, these may include OpenAI, Anthropic, Google (Gemini) and DeepSeek.
We do not send AI providers your password or login tokens, your contacts, device identifiers or precise location.
AI providers may be located outside your country, and their retention and training practices are governed by their own terms. Where available, we choose configurations that do not use API data for model training. AI output may be inaccurate, incomplete or out of date, and it is not medical, financial, legal, psychological or other professional advice.
We do not read your records manually unless you ask for support, we investigate abuse or a security incident, or the law requires it. If your text indicates a high-risk signal such as self-harm, suicide or violence, the system may create a safety alert visible only to you and show support resources. The alert does not enter your emotion statistics, and we will not contact you or a third party solely because of it unless the law requires it.
6. Sharing and service providers
We do not sell or rent your personal information, and we do not share it for advertising. We share information only as necessary with service providers that process it on our instructions:
| Type of provider | Purpose | Examples |
|---|---|---|
| AI providers | Text structuring and analysis | OpenAI, Anthropic, Google, DeepSeek |
| Cloud hosting and databases | Running the service | Our cloud infrastructure providers |
| Object storage and CDN | Image storage and website delivery | Cloudflare |
| Password-reset and service messages | Resend | |
| Sign-in providers | Apple or Google sign-in | Apple, Google |
| Subscription services | Subscription validation and status | Apple App Store, RevenueCat |
| Legal requirements | Compliance with lawful requests | Courts, regulators |
Access to account and content information by our personnel is restricted and is allowed only when handling a support request, investigating abuse or a security incident, or when required by law.
If we are involved in a merger, acquisition or asset transfer, personal information may be transferred as part of the transaction. We will notify you in advance and require the recipient to remain bound by this policy.
This policy does not govern what third parties do with your information. Apple, Google, the AI providers and any external sites we link to have their own privacy policies.
7. International transfers
Our servers are located in Malaysia. The AI, hosting and subscription providers listed above may be located in the United States, the European Union, Singapore or other countries. Where personal information is transferred outside your country, we apply the safeguards required by applicable law, such as standard contractual clauses and other contractual, technical and organisational measures.
8. Retention
| Information | Retention period |
|---|---|
| Account information and your records | Until you delete your account |
| Server logs | Generally no more than 30 days |
| Database backups | Generally no more than 30 days, expiring with the backup cycle |
| Subscription and transaction records | As required by law and Apple |
| Safety alerts | Until you delete your account, or until you clear them |
| Support and feedback records | Deleted within a reasonable period after your request is resolved, unless law or a dispute requires longer |
After you delete your account, we delete or anonymise your personal information within a reasonable period, normally no more than 30 days, except where the law requires retention. We may retain necessary information for longer to handle disputes, abuse investigations or security incidents, and will delete or anonymise it when that purpose is complete.
9. Security
We use reasonable technical and organisational measures, including HTTPS for all traffic, hashed passwords, secure storage for login tokens, short-lived sessions where appropriate, restricted access to servers and databases, least-privilege access, and security audit logs.
No system is completely secure. Please protect your device, credentials and verification codes. If a personal-data security incident occurs, we will notify you and the relevant regulators as required by law.
10. Your rights
Subject to applicable law, you have the right to access and copy your personal information, correct inaccurate information, delete your account and related data, withdraw consent, object to or restrict certain processing, receive a portable copy of your data, request an explanation of our processing rules, and complain to your local data protection authority.
You can delete your account directly in the app: Settings → User info → Delete account. You can also contact us at gzy.guy@gmail.com. To protect your account, we may ask you to verify your identity.
We normally respond to requests within 30 days, or within any longer period required by law.
11. Regional supplements
11.1 European Economic Area, the United Kingdom and Switzerland
If you are in the EEA, the UK or Switzerland, you have the rights granted by the GDPR or equivalent local law, including access, correction, deletion, restriction, objection, data portability and the right to lodge a complaint with your local supervisory authority.
Our legal bases include performance of a contract, consent, legitimate interests such as service security and abuse prevention, and legal obligations. We do not make decisions based solely on automated processing that have a legal or similarly significant effect on you.
Where required by applicable law, we will appoint an EU or UK representative and publish their contact details on this page.
11.2 California, United States
If you are a California resident, we do not sell or share your personal information, including for cross-context behavioural advertising. You have the right to know the categories and sources of personal information we collect, to request deletion or correction, to exercise your rights without discrimination, and to use an authorised agent. Contact us at the email in section 2.
11.3 Mainland China
If you are in mainland China, we process your personal information under the Personal Information Protection Law of the People’s Republic of China and related laws. The scope of information we process is described in section 3 and the purposes in section 4. We obtain your separate consent, or satisfy another lawful condition, before processing sensitive personal information or providing your personal information outside mainland China. You may exercise your rights to access, copy, correct, supplement, delete, withdraw consent, transfer and receive an explanation of our processing, and you may complain to the competent cyberspace or market-regulation authority.
11.4 Other countries and regions
If the law of your country or region gives you additional personal-information rights, we will respect and help you exercise them to the extent required by applicable law. This policy does not exclude any rights you have under mandatory local law.
12. Children
Orga is not directed to children. We do not knowingly collect personal information from children under 13. If the digital-consent age in your country or region is higher, that higher age applies, and minors below it should use Orga with the consent of a parent or guardian. If you believe we have collected a child’s personal information, contact us and we will verify and delete it.
13. Subscriptions and payments
If paid plans are available, iOS subscriptions are purchased through Apple’s App Store in-app purchase. Apple processes your payment information under its own privacy policy. We receive only the subscription status, product identifier and transaction identifier needed to grant or revoke your entitlement. RevenueCat is used to validate subscription status and synchronise entitlements and does not receive your full payment card details.
Deleting your Orga account does not cancel an Apple subscription. You must cancel it separately in your App Store subscription settings. See the Account Deletion page for details.
14. Changes
We may update this policy. We will notify you of material changes in the app or by email and update the effective date at the top of this page. If you do not agree with the updated policy, you may stop using the service and delete your account. Continuing to use the service after a change takes effect means you accept the updated policy.
15. Contact
- Operator: Jimmy
- Address: China
- Email: gzy.guy@gmail.com
- Response time: within 30 days
Appendix: one-page summary
| Question | Answer |
|---|---|
| Do I need an account? | Yes |
| Where is my information processed? | On our servers in Malaysia and by the service providers described in section 6 |
| Do you sell my information? | No |
| Do you run ads or track me across apps? | No |
| Do you train your own models on my content? | No. AI providers process it under their own terms |
| Is Orga a medical device? | No. AI output is not medical or other professional advice |
| How do I delete my account? | In the app: Settings → User info → Delete account |
| Does deleting my account cancel an Apple subscription? | No. Cancel it separately in the App Store |