Last Updated: August 7, 2026

This is the master privacy policy of OrsaNova Studios, LLC ("OrsaNova," "we," "us," or "our"). It governs every product, application, extension, plugin, service, and website we operate, and it is the standard the whole company is held to.

We build software across very different shapes — websites and hosted services, mobile and desktop applications, browser extensions, and software that runs entirely on your own machine and talks to your own hardware. Those products differ in what they technically can collect. This policy sets the ceiling: no OrsaNova product may collect, use, retain, or share more than what is described here, and where a product does less, it says so in its own documentation.

Individual products may publish a product supplement that describes their specific data handling in greater detail (for example, an app store may require product-accurate disclosures). A supplement may only be more restrictive or more specific than this policy. If a supplement ever conflicts with this policy, the more privacy-protective of the two governs.

1. Our Privacy Commitments

These are not aspirations. They are the constraints we design against, and every section below is an application of them.

We do not sell your personal information. We have never sold it, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California and other U.S. state privacy laws.
We do not run advertising. No OrsaNova product serves ads, embeds advertising SDKs, requests advertising identifiers, or builds a behavioral profile of you for ad targeting.
We do not sell to, or trade with, data brokers. Your records are not a product.
Local-first wherever the product allows it. If a feature can work on your device without sending data to us, that is how we build it. Data leaves your device when a feature you chose genuinely requires it — and we name those features.
Data minimization. We collect the least data that makes a feature work, for the shortest time it is useful.
Opt-in for anything sensitive. Network sync, cloud processing of your content, and any pooling of your data are off until you turn them on.
No surprises. We do not repurpose data you gave us for one thing into something you did not agree to.

2. Scope

This policy applies to:

our websites and hosted, multi-tenant web services;
our mobile and desktop applications;
our browser extensions;
our plugins, daemons, and other locally installed software;
our customer support, sales, and business communications.

It does not apply to third-party services you choose to connect to our products (see Section 9), or to third-party websites we link to. Those are governed by their own policies.

Where this policy applies. OrsaNova Studios, LLC is a United States company, and we offer our products in the United States and Canada. We do not target, market, or offer our products in the European Economic Area, the United Kingdom, or Switzerland, and this policy does not assert that the EU GDPR or UK GDPR governs our processing. Several of the commitments below are stricter than United States law requires — that is deliberate, and they apply to everyone regardless of where they live. What we do not do is claim a legal status under regimes that do not apply to us.

3. Information We Collect

We collect only what applies to the products you actually use. Not every category below applies to every product; several of our products collect nothing in most of these categories at all.

3.1 Information you give us directly

Account and identity data. Where a product offers accounts, we collect your email address and the authentication tokens that keep you signed in. Sign-in may be handled by an identity provider you choose, by a passwordless email link or code, or by a password. Where a password is used, we store only a salted cryptographic hash; we never see or store the password itself.
Profile and organization data. Display name, role, and — for business services — your company or organization details, its relationship to parent or child organizations, and your permissions within it.
Authentication factors. Where you enable multi-factor authentication, we store the material needed to verify it: a TOTP secret, or the public key and credential identifier of a passkey/security key. A passkey's private key never leaves your device and is never transmitted to us.
Support, sales, and contact data. What you write to us — inquiries, contact and request forms, support messages, and the correspondence that follows.
Content you create. Notes, records, documents, files, images, configurations, and other material you enter into or attach within a product.

3.2 Information created by using our products

On-device data. In local-first products, your working data — your records, settings, timers, history, statistics, workflows, task lists, site or application block lists, and attached documents — is written to storage on your own device. Unless a section of this policy names a specific feature that transmits it, that data is not sent to us and we cannot see it.
Synchronized data. Where a product offers cloud sync or backup and you turn it on, the records covered by that feature are stored on our infrastructure so you can reach them from your other devices and restore them. Sync is opt-in, is disclosed in the product, and is limited to the record types the product names.
Purchase and subscription data. Where a product is paid, we receive confirmation of your purchase or subscription status and the identifiers needed to attach it to your account. Payments are processed by the applicable app store or payment processor — we never receive or store your card number, bank details, or full payment credentials.
Session and activity records. For hosted services, we record sign-in events, session lifetime, and coarse activity signals needed to keep a session valid, expire it, and detect abuse.

3.3 Credentials for third-party services you connect

Some products let you connect an account you hold elsewhere. Where you do:

We store the access token or API key for that service so the product can act on your behalf.
These credentials are stored in the most protected store the platform makes available — in browser extensions, in local, non-synchronizing extension storage; never in cross-device browser sync, which is not encrypted.
They are never logged, never committed to source code, and never transmitted to us except where the product explicitly requires a server component to function (see Section 9).
You can disconnect the integration at any time, which discards the stored credential.

3.4 Technical and operational data

Diagnostics and telemetry. Where a product collects diagnostics at all, they are limited to crash and error reports and coarse feature-usage counts. Any such telemetry is anonymous and carries no personal information: no advertising identifier, no location, no account email, and none of your content. Where telemetry exists it is disclosed in the product and can be switched off, and the product remains fully functional with it off. Several of our products collect no telemetry whatsoever.
Server and security logs. For hosted services, our infrastructure records the technical metadata inherent in serving a request — IP address, timestamp, requested resource, user agent, and error state — for the purpose of operating the service, diagnosing failures, and detecting abuse.
Email delivery outcomes. Where we send you a sign-in code or a transactional message, our email provider reports back whether it was delivered, bounced, was delayed, or was marked as spam. We keep a minimal record of that outcome for a limited period, because a bounce or spam report silently blocks future messages to your address and without the record we cannot tell you why you are locked out or restore your access. We do not retain the contents of those messages or the codes themselves, and these records are never used for marketing or profiling.
Push notification tokens. Where you enable notifications, the platform issues a device token that we store so we can deliver the notifications you asked for, and nothing else.

3.5 Cookies and similar technologies

Our hosted services use cookies, local storage, and equivalent browser mechanisms for strictly functional purposes: keeping you signed in, preserving your session and security state, remembering your preferences, and enabling offline behavior. We do not use advertising cookies, cross-site tracking pixels, or third-party behavioral analytics tags. The one third-party component our website loads is the Cloudflare Turnstile anti-spam check on our contact form, described in Section 7.1; it is a bot check, not analytics.

3.6 Device permissions and hardware access

Where a product requests an operating-system permission, it is requested at the moment the feature needs it and used only for that feature:

Camera — for live, on-device scanning or capture that you initiate. Where a product only decodes a code from the live preview, no photo or video is captured, stored, or transmitted.
Microphone / speech recognition — for dictation you trigger. Where dictation is performed by your operating system on-device, no audio is uploaded to us.
Files and photos — to let you attach, open, and read back documents you choose. Attached files remain on your device unless you separately enable a backup feature that names them.
Bluetooth and local device connections — to communicate with hardware you own, directly and locally from your machine to your device. Products that control local hardware do not route that control, its telemetry, or its usage through our servers.
Notifications — to deliver alerts you enabled.

Declining a permission disables the specific feature that needs it, never the whole product.

4. Sensitive Information

Some of our products handle categories of information that deserve stricter treatment than ordinary account data — including health, symptom, wellness, and personal-consumption records, biometric-derived authentication material such as passkeys, and precise personal content.

For all such information:

It is treated as sensitive personal information under U.S. state privacy law, and we hold it to the stricter handling standard described below whether or not any particular law compels us to.
We process it only on the basis of your explicit consent, or as strictly necessary to deliver a feature you affirmatively enabled.
It stays on your device by default wherever the product's architecture allows.
It is never sold, never licensed in identifiable form, never used for advertising, never used to build a profile of you, and never disclosed to insurers, employers, marketers, or data brokers.
We do not use it to infer characteristics about you beyond what the feature you enabled requires, and we do not use it for any purpose other than delivering that feature.
Under U.S. state law you have the right to limit our use and disclosure of sensitive personal information; because we already limit it to what the feature requires, there is no secondary use to opt out of — but the right is yours to exercise regardless (Section 14).

5. How We Use Information, and Why

We use personal information only for the purposes below. For each one we name the reason it is permitted — either because delivering the product requires it, because you switched the feature on, because we have a narrow operational interest such as securing accounts, or because the law obliges us. We hold ourselves to naming a reason for every use even though U.S. law does not require us to publish one.

Purpose	Our basis for it
Provide, operate, and maintain the product or service you are using	Performance of a contract
Authenticate you, keep your session valid, and secure your account	Performance of a contract; legitimate interests (account security)
Synchronize, back up, or restore your data across your own devices	Consent (the feature is opt-in)
Process content through an optional cloud or AI feature you invoke	Consent (per use)
Deliver a purchase, subscription, or entitlement	Performance of a contract
Respond to your support, sales, or business inquiry	Performance of a contract; legitimate interests
Diagnose crashes and errors and improve reliability	Legitimate interests (anonymous telemetry); consent where required
Detect, prevent, and investigate abuse, fraud, and security incidents	Legitimate interests; legal obligation
Handle sensitive or health-related information for a feature you enabled	Your explicit consent, given per feature
Comply with law and respond to valid legal process	Legal obligation
Send you service and security notices about a product you use	Performance of a contract; legitimate interests
Send you marketing or product announcements	Consent, withdrawable at any time

We do not use your information for any materially different purpose without telling you first and, where the law requires it, obtaining your consent.

6. What We Never Do

To state the negative commitments plainly and in one place. We do not:

sell your personal information, or share it for cross-context behavioral advertising;
rent, trade, or disclose your information to data brokers;
serve advertising, embed advertising SDKs, or request advertising identifiers;
build or maintain a behavioral profile of you for anyone's marketing;
disclose your individual records to insurers, employers, landlords, or law enforcement absent valid, binding legal process;
use your private content to train our own or any third party's general-purpose AI models;
collect precise geolocation in any product;
read, mine, or analyze the content of your records for any purpose other than delivering a feature you enabled;
condition access to a product on your surrendering a privacy right, or degrade the product because you exercised one.

7. How Information Is Shared

We share personal information only in the four situations below.

7.1 Service providers acting on our instruction (processors)

We rely on infrastructure providers to deliver specific features. Each processes data solely to deliver the feature you requested, under a written contract that bars them from using your data for their own purposes, from selling it, and from using it for advertising. The categories are:

Cloud database, storage, and authentication — hosting accounts, synchronized records, and files you back up.
Hosting, CDN, and edge compute — serving our websites and services and running server-side functions.
Transactional email delivery — transmitting sign-in codes and service notices to your address.
Payment and subscription processing — handled by the applicable app store or payment processor; we receive entitlement status, not payment credentials.
AI model providers — only where you invoke an optional cloud AI feature (Section 8).
Bot and abuse protection on our web forms — our website contact form is protected by Cloudflare Turnstile. When you open a page containing that form, your browser loads Turnstile from Cloudflare and completes an automated check that you are not a bot — so the connection happens on page load, not only when you press send. Cloudflare receives your IP address and basic request metadata in order to perform the check. Turnstile is used specifically because it does not profile you, does not set advertising or tracking cookies, and does not require you to solve puzzles or label images. It is not analytics, and the result is a single-use token that tells us only "this submission looks human." Cloudflare also hosts and serves this website, so it already handles your request; no additional company is involved.

A processor returning a result you asked for is not a sale and is not a disclosure to a commercial third party.

7.2 Third parties you direct us to

Where you connect an external account (Section 9), the product transmits the data required to perform the action you asked for to that service, at your direction. That service's own privacy policy governs what it does with it.

7.3 Legal requirements

We will disclose information where we are compelled by a valid, binding court order, subpoena, or statutory requirement, or where disclosure is necessary to protect against imminent harm. Where we are legally permitted to do so, we will notify you before complying, and we will object to requests that are overbroad, defective, or unlawful. Given the sensitivity of some of the categories we hold, we construe such requests narrowly and produce the minimum the order actually compels.

7.4 Business transfers

If OrsaNova is involved in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of that transaction. Any acquirer remains bound by this policy for information collected under it, and we will give you notice and a meaningful opportunity to delete your data before any transfer changes how it is handled.

8. AI and Machine-Learning Features

Where a product offers an AI feature:

On-device first. We prefer models that run entirely on your device — on-device text recognition, on-device speech-to-text, on-device analysis. Those send nothing anywhere.
Cloud AI is opt-in and inert until used. If a feature requires a cloud model, it is disclosed as such and does nothing until you actively invoke it. If you never use it, nothing is sent.
Minimum content. Only the specific content required for that request is transmitted.
Contractual limits on the provider. Your submitted content may not be used to train the provider's models, may not be retained for the provider's own purposes, may not be sold, and may not be used for advertising.
We do not train on your content. OrsaNova does not use your private records, files, or messages to train models — our own or anyone else's.

9. Third-Party Services You Connect

Several products integrate with services you already use. Where you authorize a connection:

We request the narrowest scope of access the feature needs.
Where a service's OAuth implementation supports it, we use a public-client flow with PKCE, so no OrsaNova server is involved in your sign-in at all. Where a service instead requires a client secret that cannot safely ship inside a distributed application, a minimal, stateless server-side component performs only the credential exchange: it swaps the temporary authorization code for a token, returns that token to your device, and stores neither the code, the token, nor any personal data. It is not a general proxy for your data.
Where a product requests read-only access, we ask for a read-only scope and the product cannot write to that service.
The resulting credential is stored as described in Section 3.3.
We do not aggregate, mine, resell, or retain copies of the data those services return to you. It flows to your device to power the feature.
Disconnecting the integration discards the credential. Revoking access at the third-party service also terminates it.

10. Aggregated and De-Identified Information

Some products offer an opt-in, off-by-default feature that contributes to community-level aggregate statistics. Where such a feature exists, it is governed by these guarantees, and each is enforced technically rather than by promise alone:

Aggregate only. Your device contributes de-identified increments to shared counters. Your individual records are not stored on the server as part of it.
Unlinkable. There is no persistent contributor identifier; two contributions cannot be attributed to the same person or device.
Noised. Statistical noise is applied on your device before anything is transmitted.
Minimum cohort. No slice of an aggregate is stored, displayed, or licensed unless enough distinct contributors are combined that no individual can be singled out.
Coarse by construction. No geography finer than state level, and no precise timestamps.
Free text and purchase details are excluded entirely.
Off by default, opt-in, and reversible.

Only such aggregates — never your individual data — may ever be licensed to a third party. We may also create de-identified or aggregated information for our own analysis and product development; where we do, we maintain it in de-identified form, do not attempt to re-identify it, and contractually bind recipients not to.

11. Security

We protect information with measures appropriate to its sensitivity, including:

Encryption in transit (TLS) for all network communication, and encryption at rest for data stored on our infrastructure;
Per-account isolation enforced at the database layer (row-level security), so an authenticated session can reach only its own records; private file storage is isolated the same way and is not reachable by public URL;
Strong authentication options — multi-factor authentication and passkeys/WebAuthn, where the private key never leaves your device;
Least-privilege access. Access to production systems is restricted to personnel who require it, and secrets are held in a managed secret store rather than in code or configuration files;
Input validation at every boundary, and a documented vulnerability-reporting path.

No system is perfectly secure. Two responsibilities are genuinely yours: securing the device itself (screen lock, biometric lock, disk encryption, and OS updates), and safeguarding your account credentials. For local-first products, the copy on your device is the primary copy, and your device's own protections are what guard it.

12. Data Retention

We keep personal information only as long as it serves the purpose it was collected for:

Category	Retention
Account and profile data	While your account is active
Synchronized records and backed-up files	While sync is enabled and your account is active; deleted on account deletion
On-device data	Under your control; deleted when you delete it or remove the application
Third-party integration credentials	Until you disconnect the integration
Email delivery outcome records	A short, fixed period (90 days or less), then deleted
Website contact-form submissions	24 months from the date you submit them, then deleted automatically on a scheduled purge
Support and business correspondence	As long as needed to resolve the matter and meet legal and record-keeping obligations
Server and security logs	A limited operational period, then rotated and deleted
Anonymous telemetry	Retained in aggregate; it is not tied to you and cannot be traced back to you
Aggregated / de-identified data	May be retained indefinitely, because it cannot identify you

Deleting your account removes your synchronized records and any files you uploaded from our servers. Copies stored locally on your own device are yours and are unaffected. Residual copies may persist briefly in encrypted backups until those backups rotate out on their normal schedule.

13. Where Your Information Is Processed

OrsaNova Studios, LLC is based in the United States, and our infrastructure and service providers are located in the United States. If you use our products from Canada or anywhere else, your information is transferred to and processed in the United States, where privacy laws differ from those of your own province or country.

We do not move your information to a country outside the United States for our own processing purposes. Where a service provider we rely on operates infrastructure elsewhere, we contractually bind it to the restrictions in Section 7.1 and apply the same technical measures we apply everywhere — encryption in transit and at rest, and per-account isolation.

If you are in Canada, note that information held in the United States may be accessible to United States authorities under United States law, including through lawful process. Section 7.3 describes how we handle such demands, and Section 6 lists what we will not do regardless of who asks.

14. Your Rights and Choices

These rights are available to every user in the United States and Canada, whether or not the law of your particular state or province grants them. We do not means-test them by jurisdiction within North America, and we do not charge for exercising them.

You may:

Access the personal information we hold about you, and receive a copy;
Port it in a portable, machine-readable format;
Correct information that is inaccurate;
Delete your information and your account;
Object to or restrict processing based on legitimate interests;
Withdraw consent at any time, without affecting the lawfulness of what was done before you withdrew it;
Limit the use and disclosure of sensitive personal information;
Opt out of any sale or sharing for cross-context behavioral advertising — we do not do either, so there is nothing to opt out of, but the right stands;
Opt out of profiling that produces legal or similarly significant effects — we do not perform any such profiling;
Be free from discrimination for exercising any of these rights. We will not deny you a product, charge you a different price, or give you a lesser experience because you did.

You may also, directly in the product wherever it is offered: disable synchronization; remove files you uploaded; turn off optional contribution features; turn off telemetry; disconnect third-party integrations; disable notifications; and delete your account.

How to exercise a right. Email [email protected]. We will verify that the request genuinely comes from you — proportionately to the sensitivity of the data, and using information we already hold rather than new information collected for the purpose. We respond within 30 days, and where the law permits an extension for complex requests we will tell you before taking it. An authorized agent may submit a request on your behalf with written proof of authorization.

Global Privacy Control. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no such processing for a GPC signal to opt you out of. If that ever changes, we will honor the signal.

Complaints. We would rather hear from you first — write to us and we will take it seriously. If we cannot resolve it, you may complain to your state Attorney General (in the United States) or to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner (in Canada). Some state laws also require us to tell you that you may appeal a denied request; if we deny one, our response will explain how.

15. Children and Age Restrictions

Our products are not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it promptly.

Certain products relate to categories that are lawful only for adults and are restricted to users 21 or older in jurisdictions where the underlying activity is legal. Those products state their age requirement in their own listing and terms. We do not target minors, and we do not build products for them.

If you are a parent or guardian and believe a child has provided us information, contact [email protected] and we will remove it.

16. Automated Decision-Making

We do not make decisions about you that produce legal or similarly significant effects through automated processing alone, and we do not engage in profiling for such purposes. Where a product surfaces an automated analysis, correlation, or suggestion, it is informational, it is generated for you, and it does not determine your access to anything.

17. Security Incidents

If we become aware of a breach affecting your personal information, we will investigate promptly, take steps to contain it, and notify you and the relevant regulators without undue delay and within the timeframes the applicable law requires. Our notice will describe what happened, what data was involved, what we have done, and what you can do.

To report a suspected vulnerability or incident, write to [email protected]. We do not pursue legal action against good-faith security researchers who report responsibly.

18. Browser Extensions

For our browser extensions, we additionally commit to the platform limited-use requirements:

Data accessed through browser permissions is used only to provide or improve the user-facing feature that is the extension's single purpose;
It is not sold, not transferred to third parties except as required to deliver that feature or for legal reasons, and not used for advertising, ad targeting, or creditworthiness or lending determinations;
No human reads it except with your explicit consent, to resolve a security issue, to comply with law, or where it is aggregated and de-identified;
We request the narrowest set of permissions and host permissions the feature requires, and each is justified in the store listing;
Credentials and tokens are stored in local, non-synchronizing extension storage — never in cross-device browser sync — and are never logged.

19. Locally Installed Software and Hardware Integrations

Some of our products run entirely on your own machine — a plugin, a background service, a local daemon — and communicate with hardware you own.

For those products: the software talks to your device directly and locally. Configuration, logs, and state are written to your own filesystem, under your control. Commands you issue and the hardware's responses do not pass through, and are not reported to, any OrsaNova server. Usage of the hardware is not telemetry we receive.

Where such a product ever needs the network — for an update check, for example — that is disclosed in the product and is limited to that purpose.

20. Changes to This Policy

We may update this policy as our products change or as the law does. When we do, we revise the "Last Updated" date at the top.

For material changes — anything that expands what we collect, how we use it, or with whom we share it — we will provide prominent advance notice through the affected product or by email before the change takes effect, and where the change requires your consent, we will ask for it rather than assume it. We will not apply a materially expanded use retroactively to data we already hold without your consent.

21. Contact Us

OrsaNova Studios, LLC is the controller responsible for the personal information described in this policy.

OrsaNova Studios, LLC
15450 New Barn Road, Suite 200, PMB 1001
Miami Lakes, FL 33014
United States

Privacy inquiries, data requests, and deletion: [email protected]
Security reports: [email protected]
General: https://orsanova.com/contact

We read every message sent to these addresses. If you write about a privacy right, tell us which one and we will handle it as a formal request.

Privacy Policy