Privacy Policy

1. How Orylo handles your data

Orylo is a local-first desktop application. Your conversations, attachments, captured context, workspaces, tasks, and memory are stored on your Mac. Our account backend provides account, purchase, licensing, and feedback services; it does not act as a proxy for your AI conversations or provide cloud backup of your local work.

Local-first does not mean that all processing takes place on your device. When you use connected AI services, messaging, or remote access, information needed for that feature may leave your Mac as described below. Information you choose to include in a support request is also sent to us.

2. Account and sign-in information

When you sign in with Google or Apple, we process your provider-issued account identifier and email address to create and authenticate your Orylo account.

• Google: your account identifier, email address, and account display name. A display name is not necessarily a verified legal name.
• Apple: your account identifier and the email address Apple provides, which may be your real email address or an Apple private relay address. We do not require your name for an Apple sign-in account.

Our authentication service also processes session credentials, authentication events, and provider metadata needed to manage sign-in. We do not receive your Google or Apple password. Your login provider separately handles information under its own privacy policy.

We associate your account with an internal identifier and records needed to manage access to the Services.

3. Purchases, licenses, and device information

Purchases and account access

When you purchase Orylo, we process information such as your billing email address, payment-provider customer and transaction identifiers, purchase date, amount, currency, payment status, refunds, disputes, and the license or subscription entitlement associated with your purchase. We also process subscription identifiers, billing periods, renewal and cancellation status, and keep trial records and purchase information used to determine your access.

If you request a refund, we store the payment reference, your reason, the request date, and our review decision and explanation. We review purchase and refund history to handle requests and detect misuse of our refund policy.

Payments are processed by Stripe. Payment details you enter at checkout are handled by Stripe; Orylo's account database does not store your full payment-card number or card security code. Stripe may collect additional information for payment processing, fraud prevention, tax, and regulatory requirements.

Device licensing and compatibility

To activate a device and enforce license limits, we process a device identifier, verification information, activation status, and related timestamps. This does not require your Mac's hardware serial number or custom computer name.

We collect the latest reported macOS version, processor architecture or chip information, Mac model identifier, and Orylo version and build. We use these details to understand compatibility and the distribution of supported configurations. These records are associated with your account and device; we do not describe them as anonymous data.

4. Content and connected services

When you use an AI feature, the assistant or provider you select may receive your message and relevant context, such as conversation history, attachments, or captured screen and voice content. Optional background features may send relevant content to your configured provider after you enable them. A locally running assistant may also use an online service.

Remote access and messaging integrations share content with the devices or services you choose to connect. A paired remote browser may access your existing, future, and archived conversations. You can disable these features or revoke access, but doing so does not recall information already received elsewhere.

These services process information under their own privacy policies, including their retention and model-training rules. Orylo's account backend does not receive this content as part of normal AI use. We do not use your conversations, attachments, or support submissions to train our own AI models.

5. Feedback, website storage, and operational information

When you submit feedback, we process your message, category, submission time, account identifier, submission source, and support status. If you allow a reply, we use your account email address to respond. Support submissions may be stored in our feedback database and sent to our support mailbox using our email service provider.

Optional diagnostic details are limited to information such as app and operating-system versions, assistant type and connection status, error codes, and the part of the app involved. They do not automatically include conversation text, screenshots, file contents or paths, window titles, API keys, or passwords. Your free-text message may contain personal information if you enter it yourself; please include only what is needed to explain the issue.

Our website uses browser storage to maintain your sign-in session and remember preferences such as your theme. You can manage or clear browser storage through your browser, although doing so may sign you out or reset preferences.

When you visit the website, sign in, download an update, or contact an online endpoint, the services delivering that request may process technical information such as your IP address, request time, browser or app information, response status, and security events. This information supports delivery, troubleshooting, service security, and abuse prevention.

6. Why we process information

We use the information described in this policy to:

• Authenticate accounts and provide the features you request.
• Process purchases, manage trials and licenses, and verify device access.
• Respond to support requests and resolve compatibility issues.
• Operate and secure our website and account services, prevent abuse, and investigate problems.
• Maintain transaction records, resolve disputes, and meet applicable legal obligations.
• Communicate necessary service, security, purchase, and policy updates.

Where applicable law requires a legal basis, we rely on performance of our contract with you for account, licensing, purchase, and requested support services; compliance with legal obligations for required records and disclosures; and our legitimate interests in security, abuse prevention, compatibility, and service administration where those interests are not overridden by your rights. Where consent is required, we obtain it for the relevant processing, and you may withdraw it. We do not rely on acceptance of this policy as blanket consent to every form of processing.

7. When information is shared

We use service providers to operate the Services, including:

These providers receive information relevant to the functions they perform. Google and Apple process sign-in information as your selected identity providers. Email providers may also process correspondence you exchange with us.

Services you choose to connect may receive content directly as described above. Their own terms and privacy policies apply; they are not all acting on Orylo's behalf.

We may disclose information when reasonably necessary to comply with applicable law or a valid legal request, protect people's safety, prevent fraud, or establish, exercise, or defend legal claims. We limit such disclosures to the circumstances requiring them.

Information may also be transferred as part of a merger, acquisition, or transfer of the business operating Orylo, subject to applicable law and appropriate notice of material changes to its handling.

We do not sell personal information or share it for cross-context behavioral advertising.

8. Retention and deletion

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including providing the Services, meeting legal obligations, resolving disputes, and maintaining security. The period depends on the type of record and the reason it is needed.

• Account and device records: retained while needed to provide and secure your account and license. Following an account-deletion request, records no longer needed for these purposes are deleted, subject to lawful retention requirements.
• Purchase, refund, and dispute records: may be retained after account deletion for accounting, tax, fraud prevention, or legal claims. Retained purchase records may still include your billing email address; unlinking a purchase from an account does not necessarily anonymize it.
• Support correspondence: retained as needed to resolve your request, provide related follow-up, and handle disputes. Database records and email correspondence may have separate retention lifecycles.
• Operational and security records: retained according to their diagnostic, security, or abuse-prevention purpose.
• Backups: deleted information may remain in protected backup copies until those copies are replaced or expire through the applicable backup lifecycle.

Your local content is under your control. Signing out, deleting your Orylo account, or uninstalling the app does not necessarily remove local files, credentials in system storage, backups, or records held by third-party services. Deleting your Orylo account does not delete your Google, Apple, AI-provider, or payment-provider account.

9. International processing

Our account and business database is hosted in the United States. Our infrastructure, payment, email, and other service providers may process information in other countries, including countries with data-protection laws different from those where you live.

Where applicable law requires safeguards for an international transfer, the transfer is subject to those requirements. Contact us for information about the arrangements relevant to your personal information.

10. Your choices and rights

You can manage optional features, system permissions, connected services, paired remote browsers, and device activations through the relevant settings. Disabling a feature stops its future use as configured; it does not recall information already sent to a third party.

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of your personal information; restrict or object to processing; withdraw consent; or complain to a data-protection authority. We respect these rights and will not discriminate against you for exercising them.

To make a request, use the contact details below. We may ask for information reasonably needed to verify your identity. Do not send us your account password or API keys. We respond within the time required by applicable law. If we cannot fulfill a request in full, we explain the reason and any available way to challenge the decision.

Deleting an account may affect future license verification or activation. We explain relevant consequences when handling a deletion request. Withdrawal of consent does not affect processing lawfully carried out before withdrawal or processing supported by another lawful basis.

11. Security

We use measures appropriate to the information we handle, including access controls, protected communications with our account services, and system credential storage where applicable. These measures do not mean that every local file is encrypted by Orylo or that every third-party or user-configured connection has the same protections.

No system can guarantee absolute security. We handle security incidents and provide notifications where required by applicable law.

12. Children

Orylo is designed for general work and productivity and is not directed to children. Users must meet the eligibility requirements in our Terms of Service. If you believe a child has provided personal information without the authorization required by applicable law, please contact us so we can address it.

13. Changes to this policy

We may update this policy as the Services or our practices change. We display the latest revision date above and provide appropriate notice of material changes. Where a change requires your consent, we obtain that consent before applying the relevant processing.

14. Contact

For privacy questions or requests concerning your personal information, contact Orylo at support@orylo.io or through our website support form. Select “Purchase or account” for account-related requests.