Oriko Privacy Policy

1. Data processed by Oriko

1.1. Account data

When registering and using an account, Oriko may process:

• email address
• phone number
• unique username
• display name
• password in protected hashed form
• technical account identifiers
• account creation and modification dates

User passwords are not stored in plaintext.

1.2. Profile data

Users may voluntarily provide additional information, including:

• a profile photo (avatar)
• profile description (bio)
• public profile banner image
• date of birth

Some profile information may be visible to other Oriko users depending on the purpose of the relevant field and Service functionality. A user's avatar may be used in the public profile and in personal and group chats.

1.3. User publications

When using the public feed, Oriko may store and process content published by the user, including post text, images, information associated with the publication, publication date and time, and technical identifiers of the publication and author.

Content published by a user may be available to other Oriko users in accordance with the Service functionality.

1.4. Personal and group messages

Oriko allows users to exchange personal and group messages.

Text messages in supported personal and group conversations are protected by end-to-end encryption on users' devices. The Oriko server receives and stores the encrypted content of such messages and does not receive users' private cryptographic keys.

If the keys required for encryption are temporarily unavailable or encryption cannot be performed, the message text is not transmitted to the Oriko server. Such a message may be temporarily stored locally on the user's device until the user retries sending it. A new encryption attempt is performed before transmission to the server.

Media files and attachments in chats are processed separately and are not currently protected by the end-to-end encryption mechanism described above.

1.5. Media files and chat attachments

Users may send images, files, voice messages, video messages, and video notes through Oriko.

Such materials may be uploaded to and stored on Oriko servers as files.

The end-to-end encryption applied to supported text messages does not currently automatically apply to media files and attachments.

1.6. Group chats

When creating and using group chats, Oriko may process the group name, description, image, membership and roles, invitation code or link, group messages and attachments, and technical information required for group chat functionality.

1.7. Device contacts

With the user's permission, Oriko may access phone numbers stored in the device address book to help find contacts who already use Oriko.

For this function, phone numbers are read on the user's device, normalized into a format suitable for matching, temporarily transmitted to the Oriko server, and used to search for registered users. Oriko does not retain a permanent copy of the user's address book.

Contact names and labels from the address book are not transmitted to the Oriko server as part of this process.

Access to contacts is provided only after the relevant operating-system permission is granted. The user may decline or later revoke this permission in device settings.

1.8. Push notifications

To deliver push notifications, Oriko may process a technical device token.

Third-party infrastructure services may be used to deliver notifications, including Apple Push Notification service (APNs), Firebase Cloud Messaging (FCM), and Expo Push Notification Service.

Depending on the platform, technical information required for notification delivery may be transmitted to the relevant provider solely for that purpose.

1.9. Technical information

When interacting with the Service, Oriko servers may automatically receive technical information required for connectivity, security, and stable operation, such as IP address, request date and time, request information, technical identifiers, information required for authorization and session maintenance, and server error diagnostics.

2. Data Oriko does not request

As of the last update of this Policy, Oriko:

• does not request access to device geolocation
• does not use user geolocation to provide Service functionality
• does not use Firebase Analytics
• does not use Google Analytics
• does not use Yandex AppMetrica
• does not use Sentry or Crashlytics for behavioral analytics
• does not use advertising networks for personalized advertising
• does not sell users' personal data

If the technologies used or the nature of data processing changes, this Policy may be updated.

3. Purposes of processing

Oriko processes user information to:

• register and maintain accounts
• identify and authenticate users
• provide personal and public profiles
• operate the public feed
• publish user content
• operate personal and group chats
• send and receive messages
• upload and retrieve files and media
• find known users with device-owner permission
• deliver push notifications
• maintain Service security
• prevent abuse and unauthorized access
• diagnose technical issues
• provide user support
• comply with applicable legal requirements

4. Sharing with third parties

Oriko does not sell users' personal data.

Certain information may be shared with technology infrastructure providers only to the extent necessary to provide relevant functions. Such providers may include Apple, Google, and Expo in connection with push-notification infrastructure.

Information may also be disclosed to competent public authorities where required by applicable law and a valid legal request.

5. Public user content

Oriko combines communication and social-platform functionality.

Information that a user chooses to publish in public areas of Oriko, including a public profile and posts, is intended to be displayed to other users of the Service.

Users are responsible for the content they publish and should not post information they do not wish to make available to the relevant audience.

Private messages are not public posts.

6. Security and encryption

Oriko applies technical and organizational measures designed to protect user information against unauthorized access, alteration, disclosure, or destruction.

User passwords are stored as cryptographic hashes.

End-to-end encryption is used for supported text messages. Encryption is performed on the user's device before the message is transmitted to the Oriko server. Private cryptographic keys remain on users' devices.

If a text message cannot be encrypted, it is not transmitted to the server and may remain locally on the user's device until the user retries sending it.

End-to-end encryption of text messages does not mean that all Oriko data is protected in the same manner. In particular, images, files, voice messages, and video messages in chats may currently be stored on the server without end-to-end encryption.

No method of storage or transmission over the Internet can guarantee absolute security.

7. Data retention

Account information and user content may be retained for the lifetime of the user's account or until there is no longer a need to retain them.

Certain technical records may be retained for a limited period for security, troubleshooting, and abuse prevention.

After account deletion, associated personal data and user content are subject to deletion except where Oriko is required to retain information under applicable law or where limited retention is necessary for security, fraud prevention, dispute resolution, or legal obligations.

Backups, if used, may remain for a limited period until scheduled overwrite or deletion.

8. Account and data deletion

A user may request deletion of their Oriko account and associated personal data.

A deletion request may be initiated through the account settings in the Oriko application and processed by Oriko after confirmation.

A user may also contact alexey.prostovlasov@gmail.com to request deletion of an account or personal data.

To protect the account, Oriko may request reasonable verification that the request was submitted by the account owner.

When an account is deleted, associated personal data and user content, including publications and other materials, are deleted except where retention is required by applicable law or otherwise permitted on a lawful basis.

9. Device permissions

For certain functions, Oriko may request system permissions such as:

• access to contacts for finding known users
• photos or files for selecting and sending user content
• camera access for photo or video functions
• microphone access for recording voice or video messages
• permission to send notifications

Granting a permission does not mean permanent access to all data in that category. Users can manage Oriko permissions in their device operating-system settings.

10. Children

Oriko is not intended for independent use by persons who, under the laws of their country of residence, have not reached the age at which they may independently provide valid consent to the processing of personal data.

If Oriko becomes aware that a child's personal data was obtained without required consent from a legal representative, Oriko may take steps to delete the relevant information and account in accordance with applicable law.

11. International data processing

Depending on the technical infrastructure used, certain data may be processed by service providers in countries other than the user's country of residence.

In such cases, Oriko takes reasonable measures to use services that provide an appropriate level of data protection, taking applicable legal requirements into account.

12. User rights

Depending on applicable law, users may have the right to:

• obtain information about processing of their personal data
• request access
• request correction of inaccurate data
• withdraw consent where processing is based on consent
• restrict certain processing
• request deletion
• delete their account
• submit a question or complaint regarding personal-data processing

To exercise relevant rights, users may contact alexey.prostovlasov@gmail.com.

13. Changes to this Policy

Oriko functionality may change and develop. This Privacy Policy may therefore be updated periodically.

The current version is published on the official Oriko website. If the ways in which user data is processed change materially, Oriko may additionally notify users through available means.

14. Contact information

For questions concerning privacy, processing, or deletion of personal data, users may contact the owner of the Service:

Service: Oriko Owner: Alexey Sergeevich Vlasov Email: alexey.prostovlasov@gmail.com Website: https://oriko.space/en

The current version of this Privacy Policy is published on the official Oriko website.