Oriana Privacy Policy

Effective date: 6 October 2026 · Controller: Fırat Aktaş, Midyat / Mardin, Türkiye · Contact: aktasfirat682@gmail.com · App: Oriana (com.firataktas.israk)

1. Who is responsible

Oriana is made and run by one person: Fırat Aktaş, Midyat / Mardin, Türkiye. He is the data controller under the GDPR and the veri sorumlusu under Turkish Law no. 6698 (KVKK). Write to aktasfirat682@gmail.com about anything in this policy.

2. What data is involved

2.1 On your phone and in your phone’s own backup

Unless you ask for a story or a voice, what you write does not leave your phone; the only other things our server receives are the short records described in section 5 (the days you open the app, anonymous usage counts, error reports, and your feedback if you send it). Stored locally: your name; your goal or goals; the profile details you choose to fill in (city, work, the people who matter, lifestyle, what is blocking you, the first thing you will do, topics to keep out of the story); your age if you enter it; the story texts and the mp3 files that were produced for you; the sentences you recorded in your own voice; affirmation cards; journal, gratitude and manifestation entries; listening history; settings and reminder time; and a random device ID (an ID created the first time you open the app; on iPhone it is kept in the keychain, on Android it is a one-way hash of the phone’s app-specific ID. It stays the same if you delete and reinstall the app, so the free first story can be used once per phone. It contains nothing about you and is tied to no account, but because it stays the same, the records kept with it on our server and at RevenueCat and Superwall (sections 2.3 and 5) are linked to your phone, so we treat them as personal data).

Phone backup: from version 1.1.2 of the app, the data listed above is also included in your phone’s own backup if you have it turned on (iCloud Backup on iPhone, Google backup on Android), so it comes back when you set up a new phone from that backup. The backup belongs to your Apple or Google account: we cannot see it, and nothing in it reaches our server. On Android the audio files are left out, because Android limits each app’s backup to 25 MB; the stories themselves come back. The phone’s secure storage (the installation key in section 5) is never part of the Android backup. To remove the copy, delete it in your phone’s backup settings.

Cover photo: A photo you add to your story stays only on your phone (and, on iPhone, in your iCloud backup); it is never sent to us.

2.2 Sent to our server when you ask for a story or a voice

• For the text: your name, your goal, the profile details you filled in, a short summary of the previous version of the story, your change request if you wrote one, the chosen focus and tone, the language, and the random device ID in a request header.
• For the voice: the story text you approved, the narrator you picked, the language, and the random device ID.
• For a sentence read aloud (“Read aloud”): the single sentence you asked to have read out, the narrator you picked, the language, and the random device ID. The sentence is not stored on the server; the generated audio only goes back to your phone.

Apart from these and the short records described in section 5, nothing is sent; other than those short records, nothing is uploaded in the background.

2.3 Payments and subscription

Apple, Google or Amazon processes the payment inside their own store. We never see your card, your billing address or your store account. RevenueCat, the service that tells the app whether a subscription is active, receives the random device ID and the purchase status reported by the store. Superwall, the service that can show the subscription screen, receives the same random device ID, whether a subscription is active, technical details such as phone model, operating system version, app version and language, and which subscription screen was shown and what you did on it (closed it, bought, restored).

2.4 Ordinary technical data

Like any internet request, a request to our server carries your IP address, the time, the path and the response status to us and to our hosting provider. We use this only to keep the service running and to stop abuse; we do not build a profile from it, and our request logs do not contain your story text. The app also checks for updates through Expo’s update service (u.expo.dev), which receives technical values such as platform, app version and runtime version, plus a random identifier created for this installation; it is not linked to your name or anything you write.

Usage measurement (PostHog): so that we can see where people get stuck, the app sends PostHog, on its servers in the European Union, the names of the screens you open (the screen type only, never a story ID), the same step names as the anonymous usage counts in section 5, and when the app is opened, updated or moved to the background, together with technical details such as phone model, operating system version, app version and language. PostHog links these to a random ID it creates for this installation. It does not receive our device ID, your name, your goal, anything you write or your location, it does not keep your IP address, and nothing on the screen is recorded. Legal basis: legitimate interest (GDPR art. 6(1)(f)). From version 1.1.2 these events also carry their detail (for example the hour a listen started; see section 5).

Turning usage analytics off (from version 1.1.4): The “Usage analytics” switch on the Me screen is on by default. If you turn it off, this phone sends nothing to PostHog and does not send our server the anonymous usage counts or step signals described in section 5 (such as a first listen, opening the payment screen or a purchase). Requests needed for stories, audio and purchases carry on. The record of the days you open the app also keeps going, without the country code and install source (language, app version, whether it is a store or test version, phone type, store and, if you are in a trial, which version you were given), because the app receives its settings in the reply to it. Your choice is stored only on your phone and is kept even when you use “Delete everything.” Because the random ID PostHog keeps for this installation stays the same, we treat this measurement as linked to you, and the App Store privacy label shows it that way. There is no screen recording: nothing on the screen is recorded.

Goal area and “How did you hear about us?” (from version 1.1.4): If you pick an area when you write a new goal (Love, Money, Home, Health, Travel or Peace; “none” if you don’t), that area goes with the first story request for that goal, and the server only adds it to that day’s total, by language. After you have listened to your first story, the app asks one question, once, which you can skip: where you heard about Oriana (TikTok, YouTube, Instagram, a creator, a friend or family, App Store or Google Play search, somewhere else). Your answer is only added to that day’s total, by app language and version. Neither keeps your device ID, the text of your goal or anything you write, and the totals can’t be linked to anyone. If usage analytics is off, the area isn’t sent and the question isn’t asked. Legal basis: legitimate interest (GDPR art. 6(1)(f)).

2.5 Never collected

Location, contacts, camera, photos, calendar, health data from the phone, advertising identifier. The microphone is used only when you start a recording in “Your own voice,” and only while you record; the recording stays on your phone and is never sent to our server or to any provider. The app contains no advertising SDK, and the only measurement it does is the anonymous usage measurement described in 2.4. Reminders are scheduled locally on your phone: there is no push server and no push token.

3. Why we process it, and on what legal basis

Sensitive details. Your goal is free text, so it may contain health, belief, political, sex life or similar details. We do not ask for them and we suggest leaving them out. Where such content does appear, it is processed only to write the story you requested, on the basis of your explicit consent under GDPR art. 9(2)(a), which you give by choosing to send that text. You can withdraw it at any time by not sending such content and by deleting your data in the app.

Türkiye (KVKK)

Under Law no. 6698, processing rests on art. 5(2)(c) (necessary for a contract) and art. 5(2)(f) (legitimate interest), and for special categories of data on your explicit consent under art. 6. Transfers abroad (our AI service providers, Railway, RevenueCat, Superwall, PostHog) are made with your explicit consent under art. 9, which you give when you choose to generate a story; without that transfer no story can be produced. You may exercise the rights in art. 11 by writing to the address above and may complain to the Personal Data Protection Authority (KVKK).

4. Who else processes your data

International transfers. These providers sit outside Türkiye and mostly in the United States, so your data is transferred there while a story is produced. For the EEA and the UK the transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) included in each provider’s data processing terms; for Türkiye they rely on your explicit consent under KVKK art. 9.

5. How long anything is kept

• On your phone: until you delete it. Me › Your data › Delete everything removes your data from the phone at once (for the technical IDs that stay, see section 6), and uninstalling the app also removes it from the phone. A copy already in your phone’s own backup (see 2.1) stays there until that backup is replaced or you delete it in your phone’s backup settings. On iPhone the random device ID stays in the keychain even after the app is deleted.
• Story text and audio on the server: not stored at all. The text passes through memory, the answer goes back to your phone, and it is gone. There is no story database and no audio archive.
• Counters on the server: a small file holds, for each random device ID, that day’s text and voice counts and a lifetime voice count. The daily counts reset each day. The record is deleted automatically after 90 days without use, and you can ask us to delete it sooner. It holds no name, no goal and no story text.
• Hosting logs: kept by Railway for a short period under their own standard retention.
• The days you open the app: to understand whether the app is useful to the people who use it, the server keeps, together with your random device ID, the days on which you opened the app, your language and your phone type (iOS or Android); at most one entry per day. It also keeps the day on which each of these steps first happened: first story text, first voice, first listen, opening the payment screen and a purchase (only that it happened, not what you wrote or bought). It is used only in aggregate, to look at numbers such as “how many people came back in the first week.” It contains no name, goal or story text. It is deleted automatically 90 days after you last open the app. Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• Error reports: if something unexpected goes wrong in the app, a short technical report is sent to the server so we can find and fix the problem: the error message and where it happened in the code, the app version, your phone type (iOS or Android) and a short hash of your random device ID. No name, goal or story text is sent. Reports are deleted automatically after 30 days. Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• Feedback: if you send it, the reason you picked, the text you wrote, the language, the app version and platform, whether you have a subscription, the story’s narrator, style, story number, listen count and language, and a short hash of the random device ID are kept on the server for 24 months; it contains no name, goal or story text. When you tap a feeling chip at the end of a story, that record is sent without a further button press. You can ask us to delete it.
• Safety flag on feedback: if the text of your feedback contains words suggesting you may be in danger, the record is marked with a yes/no safety flag. The flag is kept with that feedback record for the same 24 months and is used for nothing else.
• Anonymous usage counts: so that we can see which parts of the app help, the app also sends the names of a few events: a first story or first listen, a listen (and whether it was at night, in the morning or during the day), listening again within 7 days, opening the app from a reminder, opening the hard-day screen or the “the story describes a different day” screen, opening the payment screen (and from which screen), a purchase, and coming back after 7 days away. The server only adds each event to that day’s total (day, event, number). The random device ID comes with the request only to cap how many events are counted per day; it is not written to disk, and no name, goal, text or language is kept. Because these totals cannot be linked to anyone, they are not deleted. Legal basis: legitimate interest (GDPR art. 6(1)(f)). Exception: for a few of the events listed further below, the result is also written to the record of the days you open the app.
• Measurement details: The record of the days you open the app also includes your phone’s region setting (the country code only; not your location, and no permission is asked), which store you installed the app from, whether it is the store version or a test version, the app version, and the hour of your first open and of the first time each step above happened; like that record, it is deleted 90 days after you last open the app. The anonymous usage counts also include these events: your answer to the notification permission and AI consent questions (yes or no), listening to a story to the end or the quarter in which you stopped, closing the payment screen (with the screen it was opened from) and the type of plan you chose. For every story text and voice it produces, the server also adds only to that day’s total whether it was completed, the reason if it was not (for example the daily limit or an AI error), roughly how long it took (as a time range) and its language; these totals contain no device ID. Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• From version 1.1.3: on Android, the record of the days you open the app also includes where you installed it from, only as Google Play reports it: the source and campaign name (for example a store link), never a click ID or anything else about you. The anonymous usage counts also include: whether a story and its audio reached your phone and roughly how long you waited (as a time range), which screens you opened for the first time, the result of the store’s payment window (completed, canceled, pending or failed) and of restoring a purchase, when the app asked for a store rating, taps on share buttons, whether an Oriana widget is on your home screen or, on iPhone, your Lock Screen, and its size, how the app language was chosen and whether you changed it, the narrator you picked, the sleep timer you set, and adding cards or journal entries (only the count, never what you wrote). These counts are also split by app language and app version. Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• More usage counts (from version 1.1.2): the anonymous usage counts also include the following. Only the event and its detail are sent, never your name, your goal, anything you write, your photo or your location.
  • Listening: the hour on your phone’s clock when a listen started (the hour only, not the date), whether it reached the screen shown when the story ends, turning Repeat on or off, how a repeated listen ended (by auto-stop or by leaving the screen, with the hour), roughly how long it repeated (as a time range) and how many times it started over, when you next opened the app after repeating at night (at night, in the morning, during the day or later), and which day of listening to the same story this is and how many days have passed since the previous one. The story itself is not sent.
  • Steps before the first story: whether each question was shown, skipped or answered, or whether the app was left on it, and whether the name and goal fields were empty or filled when you left the first screen. Only the name of the step is sent, never your answer, your name or your goal.
  • Other steps: the notification question being shown and its outcome; whether a notification opened the app from closed or while it was running; turning daytime affirmations on or off and tapping one; adding your own cover photo for the first time (the photo is never sent); the obstacle step being shown, filled in or skipped (the sentence you write is never sent); and coming back in the second week (by listening, through a notification or with a new story).
  • Trials: in trials where we compare two versions (the obstacle step, and the offer after your first full listen), which version you were given and when the offer appeared.
  • Technical: how long the app took to show its first screen, the result and duration of the update check, and whether the app could not save or read its data on your phone.
  • The server’s own counts: a subscriber reaching the daily voice limit, a voice segment that timed out and was requested again, the backup voice model being used, and Apple reporting that the free first voice has already been used on an iPhone. The server also counts, per language, how many voice segments it made and how many of them ended unusually fast (a sentence may have been skipped), together with their length.
  For a few of these, the result is also written, next to your random device ID, to the record of the days you open the app: which trial version you were given and on what day, how far you got in the obstacle step, when the offer appeared, the day of your second listen after your first, the first day you listened to the same story on a second day, and the day this measurement began on your phone. Like that record, they are deleted 90 days after you last open the app. We use all of this only in aggregate, to see which parts of the app help people and where they get stuck; the same events, with their detail, also go to PostHog (see 2.4). Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• Cost record: to know what the service costs and whether the subscription price covers it, the server writes a line for each paid AI call (the time; the kind of job: story, voice, sentence or guide; the model; how much text went in and out; and whether it succeeded). It also writes a line for each story or voice delivered and when a subscriber reaches the daily limit. Since 29 September 2026 these lines also carry a hash of your random device ID made with a secret key, which cannot be matched to the device ID outside our server, and a mark showing whether the job was opened with a subscription. They contain no name, goal, story text or IP address. They are kept for as long as we need them to calculate costs and prices; you can ask us to delete the lines linked to your device. Legal basis: legitimate interest (GDPR art. 6(1)(f)).
• Story fingerprints: so that the voice service reads only stories our server wrote for your phone, the server keeps, next to your device’s counter record, a short one-way fingerprint (a hash) of each version of your recent stories, with the day it was made. The story cannot be rebuilt from the fingerprint. At most 12 are kept per phone, each for at most 30 days, and they are deleted together with the counter record. Legal basis: legitimate interest in preventing abuse (GDPR art. 6(1)(f)).
• Installation key: the first time the app talks to our server it receives a signed key derived from the random device ID. The key is kept in your phone’s secure storage and sent with each request, which, together with the daily counts described below, limits how often the free first voice and the daily allowances can be claimed with made-up device IDs. It contains nothing about you, and the server does not store it. For the same reason the server counts requests per IP address for the current day, in memory only; these counts are never written to disk.
• Apple DeviceCheck: on iPhone, the request for the free first voice also carries a single-use token created by Apple, which our server uses to ask Apple whether this iPhone has already had its free first voice and, once the voice is ready, to tell Apple that it has; Apple keeps only this yes/no mark for our app, even if the app is deleted, the token contains nothing about you, and our server does not store it.
• Emails you send us: kept while we handle your request and for up to 24 months afterwards.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to portability, to withdraw consent, and to complain to a supervisory authority.

Because there is no account, most of this you can do yourself and immediately: Me › Your data › Export gives you a copy of everything on the phone, and Me › Your data › Delete everything erases your data from the phone: your name, goals and profile, your stories, their audio and your own voice recordings, cover photos, cards, journal and settings, the backup copies the app keeps internally, and its scheduled reminders and notifications. What stays are technical IDs that say nothing about you: the random device ID (so the free first story can be used only once per phone), the installation key (to stop the free audio from being abused), and the IDs that the services in 2.3 and 2.4 keep for this installation. For the server-side counter record, email aktasfirat682@gmail.com and include the device ID shown in the export; we reply within 30 days. Complaints can go to the Turkish Personal Data Protection Authority (KVKK) or, in the EEA or the UK, to your local supervisory authority.

7. California notice (CCPA/CPRA)

In the last twelve months we collected these categories: identifiers (a random device ID), commercial information (whether a subscription is active), user content that you type to have a story written or to send us feedback, and internet or network activity (ordinary connection logs, the days you open the app, error reports and anonymous screen use; see sections 2.4 and 5). The source is you, through the app. The purposes are listed in section 3.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for any purpose that would require an opt-out. There are no financial incentives. You have the right to know, delete, correct, and not be treated differently for exercising these rights; ask by email at the address above and we will verify the request through the device ID in your export. We do not knowingly collect personal information from anyone under 18.

8. Children

Oriana is for adults. You must be 18 or older to use it. The app asks for your age and stops if you are under 18. This is our own rule and it is also required by the terms of the AI services the app relies on. If you think someone under 18 has used the app, write to us and we will delete anything we hold.

9. AI processing

The story text and the speech are generated from what you write with our AI service providers’ models. Generated text is not researched or verified: it can be wrong, and it is not medical, psychological, legal or financial advice. A safety check runs on what you send and on what the model returns; if it points to harming yourself or someone else, the story is refused. No automated decision here produces legal effects for you within the meaning of GDPR art. 22.

10. Security

Traffic between the app and the server, and between the server and its providers, is encrypted with TLS. API keys live only on the server, never in the app. No story content is written to disk on the server. Data on your phone is protected by your phone’s own protections. No system is perfectly secure, and we will tell you in the app if a breach ever affects you.

11. Changes

If this policy changes, this page and the date at the top change with it, and anything significant is announced in the app.

12. Contact

Fırat Aktaş · Midyat / Mardin, Türkiye · aktasfirat682@gmail.com. Emails are usually answered within one business day.

This text is also published in other languages. If a version in another language differs from this English text, the English text applies.