This Privacy Policy explains how OryanApp (“OryanApp,” “we”) collects, uses, stores, and protects your personal data when you use the Service, and your rights over that data. It is written to be consistent with applicable data protection and privacy laws.
1. What Data We Collect
- Google login information — when you sign in with Google, we may receive your name, email address, profile identifier, and profile image.
- Email address — used to identify your account and communicate with you.
- Uploaded files and User Content — the files, documents, media, and prompts you upload or create.
- Usage analytics — aggregate information about how the Service is used, such as pages visited, device and browser type, referring site, and country. We use Cloudflare Web Analytics for this purpose.
- Cookies and similar technologies — see the Cookie Policy.
- Payment information — we do not currently collect or process payment information because OryanApp does not yet offer paid plans.
2. How We Use Your Data
We use your data to create and manage your account, provide and operate the Service, process the files and prompts you submit, generate the outputs you request, provide support, monitor and improve the Service, prevent fraud and abuse, and comply with legal obligations. Where necessary, your content may be processed by third-party AI providers to provide AI-powered features.
3. How Data Is Stored and Who Processes It
We use trusted third-party service providers to operate and provide the Service. Depending on the features you use, your data may be processed by:
- Google — authentication, if you choose to sign in with Google
- Neon — database services
- Cloudflare R2 — file and object storage
- Cloudflare Web Analytics — aggregate website usage analytics
- Anthropic and Zhipu AI (Z.ai) — AI processing of content you submit when using AI-powered features
- Crossref and OpenAlex — reference and citation searches
- Vercel — application hosting and infrastructure
- Resend — transactional email services
- Upstash — rate limiting and abuse prevention
- Stripe — payment processing, if paid plans are introduced
Depending on the provider and the feature being used, your data may be processed on servers located in different countries, including the United States, the European Union, China, and other jurisdictions. Each provider processes data under its own terms and privacy practices. We apply reasonable technical and organizational safeguards, including encryption in transit and access controls, to protect your data. However, no method of transmission, storage, or processing is completely secure, and we cannot guarantee that your data will be protected against every possible security threat or unauthorized access.
4. Sharing of Data
We do not sell your personal data. We share data only with: the processors listed above (to run the Service); authorities where required by law; and any successor entity in the event of a merger or acquisition. Each processor is bound by its own obligations to protect data.
5. Data Retention
We keep your personal data for as long as your account is active or as needed to provide the Service. Specific periods:
- Account data, projects, and uploaded files — kept until you delete them or delete your account.
- Deleted content — removed from active systems immediately, and no longer accessible to you or to us through the Service. Uploaded files are deleted from object storage straight away. Residual copies of database records may persist briefly in routine backups and are overwritten as those backups age out, after which the content cannot be restored.
- Login sessions — the session cookie expires 30 days after it is issued.
- Email verification links — expire after 24 hours. Password reset links — expire after 30 minutes. Both are single-use.
- Rate-limiting identifiers (such as a hashed email address or IP address) — stored temporarily by Upstash for rate limiting and abuse prevention.
- Consent records — the record of which Terms and Privacy Policy version you accepted, and when, is kept while your account exists as proof of consent, and is deleted with your account.
We may retain limited data longer where required for legal, accounting, security, or fraud-prevention purposes.
6. Security and Data Breaches
We apply reasonable technical and organizational security measures, including encryption in transit, hashed passwords, access controls, and rate limiting on authentication. No system is perfectly secure, and we cannot guarantee absolute security.
If a personal data breach occurs, we will notify affected individuals and, where required by applicable law, the relevant data protection or regulatory authorities within the legally required timeframes. Our notice will describe, to the extent known, the nature and extent of the breach, its likely consequences, the measures we have taken or plan to take, and steps you can take to protect yourself.
7. Your Rights
Subject to applicable law, you may have the right to:
- access the personal data we hold about you;
- correct or update inaccurate data;
- delete your personal data or account;
- withdraw consent where processing is based on your consent;
- object to or restrict certain processing activities; and
- lodge a complaint with a relevant data protection authority.
You can exercise many of these rights directly in the app. Under Settings → Your Data, you can:
- Export my data — download a machine-readable copy of the account data we hold about you, including your projects and consent settings.
- Delete all uploaded files — remove your uploaded files from our storage.
- Delete my account — permanently delete your account, projects, uploaded files, and consent records. This action cannot be undone.
You may withdraw optional marketing or model-training consent from the Settings page. For other requests, concerns, or complaints, please contact us first at oryansupport@gmail.com so that we have an opportunity to review and resolve the matter. We may verify your identity before processing certain requests and will respond within the time required by applicable law.
If you are not satisfied with our response or how we have handled your request or complaint, you may, where permitted by applicable law, contact the relevant data protection or supervisory authority in your jurisdiction.
8. Optional / Separate Consents
Any marketing communications, and any use of your content to improve or train models, are optional and controlled by separate opt-in settings. They are never bundled into your general acceptance, and you can turn them off at any time.
We do not use your projects, uploaded files, or prompts to train or improve models unless you have switched the model-training opt-in on. That setting is off by default. Content you submit is still sent to the AI providers listed in Section 3 so they can generate the output you asked for; how those providers may use content submitted through their APIs is governed by their own terms, which we do not control.
9. Children and Minors
OryanApp is a tool for preparing research presentations and posters. It is intended for researchers, academics, and students in higher education, and it is not directed at children — we do not design, market, or advertise the Service to them.
Users must meet the minimum age required under applicable law, as set out in Section 2 of the Terms of Service. Where applicable law requires the consent of a parent or legal guardian for a user under 18, that consent must be in place before the Service is used, and the parent or guardian is treated as the person exercising the rights in Section 7 on that user’s behalf.
We do not knowingly collect personal data from anyone below the minimum age that applies to them, and we do not knowingly use a minor’s personal data for advertising, behavioural tracking, or profiling. If we become aware that we hold such data without the consent required by law, we will delete it and close the associated account. A parent or legal guardian who believes we hold their child’s personal data can contact oryansupport@gmail.com and we will act on it.
10. Changes to This Policy
We reserve the right to modify this Privacy Policy at any time. We will update the version and “Last updated” date, and for material changes we may require renewed consent before you continue using the Service.
11. Privacy Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, please contact us at:
We may request information reasonably necessary to verify your identity before processing certain requests. We will review and respond to privacy-related requests in accordance with applicable law.
We encourage you to contact us first so that we have an opportunity to understand and address your concern. Where permitted by applicable law, you may also contact the relevant data protection or supervisory authority in your jurisdiction.