Privacy policy

Who is responsible

The controller is Sander Pelgrims. Questions or requests about your data: help@orondia.com.

What we keep

• Your account: your email address, a hashed password (bcrypt; we never know the password itself), your language, time zone and settings, and what you want to plan with it (study, work, life) if you pick that when you start.
• Signing in with Google, if you do: the fixed number Google uses for your account, and the email address that goes with it. No password, and no access to anything else in that account.
• What you enter: blocks, tasks, habits, notes, places, colours and share links.
• Google Calendar, if you connect it: an encrypted access token, the list of your calendars, and the events in the calendars you let take part.
• Calendar links you subscribe to: the address and the events in them.
• Notifications, if you turn them on: the address your browser gives us to deliver a notification.
• Plan together: someone who asks for time or books a meeting through a share link leaves a name, an email address or phone number (or the link to the call), a message if they like, and their browser's time zone and language. The same goes for you when you ask through someone else's link. The link's owner sees it, so they can answer.
• Feedback you send with the button in the app: your message, with your email address, the page you were on, your language and the app version. It reaches us as an email and stays in our mailbox as long as we need it to answer and follow up.
• Security: sign-in sessions (as a hash), single-use links from emails (as a hash), and short-lived counters against abuse that only live in the server's memory.

Why, and on what basis

• To provide the service (performance of the contract): showing, planning, syncing and sharing your calendar, and sending the emails that come with your account (confirming your address, a new password).
• To keep the service safe and working (legitimate interest): preventing abuse when accounts are created, tracking down errors, making backups, and answering your feedback.
• Notifications on your device only happen with the permission your browser asks you for; you withdraw it with the same switch.

Your data is used for nothing else: not for ads, not for profiling, and not to train models.

Data from Google

If you connect Google Calendar, Orondia asks for access to your calendars and events, and to your email address to show which account is connected. Orondia reads the events in the calendars you switch on, to plan your week around them, and only writes to the calendars you switch writing on for.

Data from Google is not used for ads, not sold, not shared beyond what is listed below, and not read by people, unless you ask for it for support, it is needed for security, or the law requires it.

Orondia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you disconnect, the token is erased straight away and Orondia asks Google to revoke access. The events in your Google Calendar stay there.

If you sign in with Google, Orondia only asks who you are: your Google account's fixed number and your email address. That gives no access to your calendar; the connection above asks for that separately.

Who else handles it

A few services process data on our behalf, each for one job:

• Hosting: the server Orondia runs on. The database and the app live there.
• Resend (US) sends the app's emails. It receives your email address and the content of that email.
• Cloudflare (US) checks that a human is creating an account or asking through a share link (Turnstile; it sees your IP address and browser details, no calendar), and stores the encrypted backups (R2).
• Sentry (EU) receives a report when something goes wrong, stripped of titles, notes, addresses, email addresses and tokens.
• Google processes your calendar only if you connect Google Calendar.
• Google confirms who you are when you sign in with Google; it sees that you are signing in to Orondia.
• Stripe handles payments once you take a paid plan, as the seller; your payment details go to Stripe, not to us.

For services outside the EU, the European Commission's standard contractual clauses apply. We count visits with Umami on our own server: without cookies, without storing IP addresses, and without anything about your calendar.

How long

• Your data stays as long as your account exists. When you delete your account, we erase everything straight away.
• Backups are kept for 30 days, encrypted, and then roll off by themselves.
• What someone left through a share link (name, contact, message) is erased 30 days after the moment it was for. The block in the owner's calendar stays: it is the owner's.
• A sent email loses its content straight away; only the fact that it was sent remains.
• Links in emails work for an hour (new password) or 48 hours (confirming your address), and never again after that.

Your rights

You can see your data, have it corrected or erased, restrict or object to its processing, and take it with you. Most of it you do yourself:

• Download: Settings → Account → Download data gives you everything we keep about you, as one file.
• Erase: Settings → Account → Delete account erases your account and everything in it.
• For anything else: email help@orondia.com. We answer within a month.

If you disagree with how we handle your data, you can complain to the Belgian Data Protection Authority or the supervisory authority in your own country.

Cookies

Orondia only uses cookies it needs to work: your sign-in session, a security cookie while connecting or signing in with Google, and your choice of language, theme and sidebar. There are no cookies that follow you, and so no cookie banner.

Security

This is how we protect your data, and above all what we receive from Google:

• Encrypted in transit. All traffic with Orondia, and between Orondia and Google and the other services above, goes over HTTPS (TLS).
• Stored access encrypted. Google access tokens are stored encrypted with AES-256-GCM. The key is not kept in the database.
• Passwords and sessions as hashes. Passwords are hashed with bcrypt; sessions and emailed links are stored only as hashes (SHA-256), never as themselves.
• Your account only. Every database query is limited to your own account. Other users see nothing of your calendar, except what you share yourself through a share link.
• Nobody reads along. We do not look into your calendar. Administration sees only counts, dates and error messages, never what your events say. Only when you ask for it for support, when security requires it or when the law does is anything looked at, and then only what that needs.
• Error reports without content. What goes to Sentry when something fails is first stripped of titles, notes, addresses, email addresses, tokens and passwords.
• Backups encrypted. Backups are encrypted (age) before they leave the server and deleted after 30 days.
• Protection against abuse. Sign-up and sign-in are rate-limited per address, requests from other sites are refused, and pages run only their own scripts (Content Security Policy).
• No more than needed. Orondia asks Google only for the access it needs. Disconnect Google and the access is deleted and revoked, and what was read from it leaves. Delete your account and everything goes; backups follow within 30 days.
• If something goes wrong anyway. If a breach affects your data, we report it to the data protection authority and, where the risk is high, to you, as the GDPR requires.

Age

You must be at least 13 to create an account. If you are younger than the age at which you may consent yourself in your country, ask a parent to look along.

Changes

If something material changes in this policy, we tell you by email before it applies. The date at the top says when it last changed.