Privacy Policy

Orden stores account details, preferences, workspaces, projects, tasks, captures, conversations, reminders, notification delivery records, planning metadata, audit logs, and automated-processing usage metadata. Push subscription credentials are encrypted at rest.

Data is used to authenticate you, manage tasks, create deterministic plans and reports, deliver reminders, secure the service, diagnose failures, and process requests you initiate. Workspace-specific reports remain scoped to that workspace.

Approved capture text may be sent from the backend to the configured DeepSeek service for extraction. API credentials remain on the backend. Browser speech recognition may be processed by your browser or device provider; review transcripts before submission. Hosting, database, Redis, and Web Push providers process data needed to operate their services.

Processing usage metadata is retained for 365 days; rejected-only captures and notification deliveries default to 90 days. Approved captures and conversations remain until deletion unless the deployment operator publishes a different lawful schedule. Backups may persist for their configured recovery period.

The service uses authenticated ownership checks, CSRF protection, encrypted push keys, structured audit records, and environment-managed secrets. You can disable notifications, remove the current browser subscription, and request account-data access or deletion through the deployment operator’s published support channel.

The PWA cache excludes authenticated API responses. Logging is designed not to include passwords, session tokens, prompts, or push authentication keys.