Privacy Policy

1. Service and operator

Ordovia is a cloud-first productivity and personal knowledge management service offered under the Chaotic Brain Studio brand.

Contact [email protected] for privacy requests.

2. Data processed

Account data: email address, authentication identifiers, and session information.

Product data: tasks, notes, rituals, projects, books, Challenges, settings, and progress.

Technical data: limited device, browser, request, security, and diagnostic logs.

3. Cloud-first storage

Account-based data is stored in Supabase-backed cloud infrastructure and may synchronize across supported devices.

Limited temporary device storage may support sessions, performance, and offline resilience. Browser cache is not the primary or only source of account data.

4. Ordo AI

Ordo runs only when you invoke it. Your prompt and selected Ordovia context, excluding Google Workspace API data, may be sent to an AI model provider to generate a response.

Google account data and raw or derived Google Calendar data are excluded from Ordo AI context and are not sent to any AI/ML model provider.

Ordo does not automatically take over your decisions. Avoid including sensitive medical or confidential information in AI prompts.

AI credits and variable-cost services remain subject to plan limits.

5. Google user data

When you sign in with Google, Ordovia requests only the openid, email, and profile scopes for basic authentication. These scopes allow Ordovia to receive account data such as your email address, basic profile information, and Google account identifier. We use this data only to create your account, authenticate you, and associate the session with the correct Ordovia account.

If you separately enable Google Calendar, Ordovia requests https://www.googleapis.com/auth/calendar.events. This permission is used only to provide the user-enabled Google Calendar connection, calendar selection, event display, and synchronization between Ordovia and Google Calendar.

Google Workspace API data is not used for Ordo AI, general personalization, advertising, marketing profiling, data resale, or product purposes unrelated to the Google-connected feature requested by the user. Raw or derived Google Workspace API data is not transferred to any AI/ML provider and is not used to develop, improve, or train generalized or non-personalized AI/ML models.

6. Sharing, transfer, and disclosure of Google user data

Google user data may be processed by Supabase for authentication, database storage, and synchronization, and by Cloudflare for hosting, security, and server-side API execution, only to the extent required to provide the requested Google-connected feature. For user-enabled Google Calendar synchronization, the event data required for that feature is transferred only between Ordovia and Google.

Google Workspace API data is not transferred to OpenAI or any other AI/ML model provider, advertising platform, data broker, or information reseller. Limited disclosure may occur when required by applicable law or when necessary to investigate security incidents.

Ordovia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data protection and security

Personal and sensitive data is protected in transit using HTTPS/TLS. Google Calendar OAuth code and token handling is performed server-side, and Ordovia rejects Google tokens supplied by the client.

When Google Calendar access or refresh tokens are stored, they are encrypted at rest using AES-256-GCM, with encryption keys kept in server-side secrets. Access is restricted to authenticated service paths and the system components required to provide the requested feature.

Limited technical logs may be processed to prevent or investigate security incidents, abuse, and unauthorized access.

8. Purpose

Ordovia product data may be processed to provide the service, secure accounts, synchronize data, provide support, prevent abuse, and meet legal obligations.

Google user data is kept separate from those general purposes: Google sign-in data is used only for authentication and account association, and Google Calendar data is used only for the user-enabled Calendar connection, display, and synchronization features. Google Workspace API data is not used by Ordo AI or unrelated product features.

9. Retention and deletion

Account data may be retained while needed to provide the service or meet legal obligations.

You may request account and cloud-data deletion in the product or by email. When you disconnect Google Calendar, stored connection credentials are no longer used for synchronization; account and data deletion requests are processed according to the applicable retention cycle. Removal from backups may follow the technical retention cycle.

10. Your controls

You may export supported data, disconnect Google and other third-party integrations, and request deletion.

Notes can be exported as Markdown and supported Codex data can be moved through supported export formats. Ordovia-specific XP, Gold, and game state may not behave the same in another tool.

11. What we do not do

We do not sell personal data or Google user data, and we do not create advertising profiles.

Ordovia is not a medical service and does not diagnose or treat ADHD, anxiety, OCD, or any condition.