Privacy Policy

This policy explains what Oryoli keeps about your family, where it goes and how to remove it. Oryoli is a family organizer: a shared calendar, lists, chores, trackers and notes. This copy of Oryoli is run by Magnos LLC (“we”, “us”).

What a family keeps in Oryoli

Whatever your family adds:

• lists and their entries (groceries, pantry, meals, tasks, chores, notes, wish, watch, reading and bucket lists, and lists you make), with amounts, dates, notes and who did what
• calendar events and the notes you leave when one is done
• trackers and goals, projects, food preferences and reminder settings
• vault secrets (see The vault)
• members: a name you choose, whether they’re an adult or a kid, a color, what they’re allowed to do and, if you add it, a birthday
• devices: a name (“Kitchen hub”), whether it’s a phone or a shared hub, when it was added and last seen

We don’t ask for an email address, a phone number or a real name to create a family or add a member. A family signs in with its family name and family password, and members with their own PIN or password.

Kept on this device, or synced

You choose when you create a family:

• On this device only. Everything stays in this browser’s storage. The app itself is downloaded from our server, but your family’s data isn’t sent to it. Oli, reminders, the shared catalogue, links and sharing with other families need a synced family, so they’re off. A backup file you download from Settings is yours to keep.
• Synced with my family. Each change is sent to our server, which stores it and passes it on to the family’s other devices. The server reads your family’s data to check who may see what, send reminders, answer public links and run Oli. Data travels over HTTPS. It is stored in our database without separate encryption of its own, so we could read it, but we don’t look at a family’s data except to keep the service running or when you ask us to. The service runs on rented cloud servers and a managed database (DigitalOcean).

The vault

A vault secret’s contents (its fields and notes) are encrypted on your device before they’re saved. The key comes from the answers to the secret’s questions (AES-GCM, with a key made from the answers by PBKDF2). Our server never gets the answers or the key, so we can’t open a secret, and we can’t recover one if the answers are forgotten.

What isn’t encrypted: each secret’s name, its questions and their hints. The server also stores a salted check of each answer, made with the same slow method, so that a device can tell a wrong answer. Someone with a copy of the database could try to guess answers against those checks, so pick answers that others can’t look up or guess.

Oli, the assistant

When you talk to Oli, show it photos or ask for meal ideas, our server sends the request to AI models through OpenRouter, a service that passes requests on to model providers. Depending on what you ask, that includes:

• your voice recording, or what you typed, and the earlier messages in that conversation
• photos you take for Oli (pantry shelves, food, receipts)
• the family details Oli needs to act for you, limited to what you may see: members’ names and whether they’re adults or kids, the names of your lists and up to 60 open entries in each, tracker names, your food preferences, and what’s on the screen you asked from (for example an open entry and part of its note, or the events shown)

Oli doesn’t receive vault secrets. Our server doesn’t keep your recordings, photos or what you said. It keeps a record of each request for usage and billing: who asked, which feature, whether it worked, which model, what it cost and how many coins it used.

Oli uses paid AI models, reached through OpenRouter. Each family’s free daily coins and any coins it buys pay for them. The model providers handle what they receive under their own policies, and we don’t currently limit Oli to providers that promise to delete requests. So please don’t say anything to Oli that you wouldn’t want an outside company to see.

The shared item catalogue

When a synced family adds an entry to a groceries, pantry, meals, tasks, chores, wish, watch, reading or bucket list (or a list of your own that looks like one), our server adds the entry’s name to a catalogue shared by every family on this server. That’s how Oryoli suggests “milk” as you type. This happens on every list of those kinds, private ones too.

• The catalogue keeps the name, its category, the unit people usually use and counts. It doesn’t keep who added it, and nothing else from the entry.
• To count a family only once, the server keeps a one-way code made from the family’s id with a secret key, not the family itself.
• A name is suggested to other families only after several different families have added it (three, unless this server set another number), and only after it has been judged suitable for kids, for adults, or for nobody.
• To judge, the names (with their category) are sent to an AI model through OpenRouter, sometimes before enough families have added them. Names that look like private details (an email address, a phone number, a whole sentence) are never suggested to anyone and aren’t sent.
• If this server matches similar names (“tomatoes” and “roma tomato”), it uses a matching service run by the operator.
• Names that never reached enough families and that nobody added for a year are deleted. Names that did reach enough families stay in the catalogue.

There’s no per-family switch to leave the catalogue yet. Families kept on one device never add to it. Deleting a synced family removes its one-way code from every name it added, so it no longer counts toward any of them.

Outside calendars

Calendar addresses (iCal links). If you add one, our server keeps the address, reads it about every half hour and keeps a copy of its events (titles, times, places and descriptions) to show to your family. The address itself isn’t shared with your family’s devices.

Google and Microsoft sign-in. If you connect a Google or Microsoft account, Oryoli asks only for permission to read your calendars (Google: “See and download any calendar you can access”; Microsoft: read your calendars, and keep that access when you’re not using the app). Oryoli never adds, changes or deletes anything in those calendars. Our server keeps:

• the account’s email address, as the connection’s label
• the sign-in tokens, encrypted with a key of the server’s own
• a copy of the events of the calendars you pick, refreshed about every half hour, to show to your family

Information from Google is used only to show those events in your family’s calendar. It isn’t sold, used for ads or read by people. If you ask Oli something while those events are on screen, they can be part of what’s sent (see above). Oryoli’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect: Calendar → Connections → Remove. That deletes the copied events, and removing an account’s last calendar deletes its tokens from our server at once. For Google, Oryoli also asks Google to revoke its access. Microsoft doesn’t offer apps a way to give up their own access to an account, so Oryoli shows you where to remove it yourself: for a personal Microsoft account (Outlook.com, Hotmail) at account.live.com/consent/Manage, and for a work or school account at myapps.microsoft.com (some organizations let only their admins remove an app). You can revoke access at Google or Microsoft at any time; Oryoli then stops reading that account.

Public links

A parent can share a calendar, a list, an entry or a vault secret with someone outside the family by a link. The server keeps what the link is for, its filters, its label, when it ends, how many times it was opened and when it was last opened. It doesn’t store who opened it or their network address on the link. The address is counted for a few minutes to stop abuse, then forgotten. Changes made through a link are kept in the link’s history.

A vault secret’s link carries its key after the “#”, a part browsers never send to a server, so we can’t read what it shows. Links that ended or were turned off are deleted 30 days later, and change history after a year.

Invite links and referral rewards

A join link signs one person in as the member it was made for. It works once and ends after 7 days. A family invite link lets another family start on Oryoli, and the adult who shared it can earn Oli coins. To keep a family from rewarding itself, the server keeps:

• one-way codes of the network addresses each synced family used, one per day, deleted after 120 days. They’re made with two secret keys, one of them kept outside the database, so a copy of the database alone can’t turn them back into addresses.
• a one-way code of a random mark this browser keeps (oryoli.mark), and of the address an invited family signed up from. These aren’t deleted on a schedule yet, but they go when the family is deleted.

The codes are used only to decide referral rewards.

Oli coins and payments

Coins are bought on Stripe’s own payment page. Stripe collects and keeps your card and billing details under Stripe’s privacy policy. Oryoli never sees your card number. If this server works out sales tax, Stripe collects the address it needs for that.

We keep each purchase (who bought it, for whom, the amount, how it was split, Stripe’s reference, whether it was paid or refunded), every coin movement, kids’ requests for coins with their note, and the usage record described under Oli. These records are part of your family’s account. When a family is deleted, its coin movements and requests go; purchase records (amounts, dates, status and Stripe’s reference numbers) and the cost of each Oli request stay for accounting and refunds, with nothing left that says which family or member they were.

Reminders and notifications

If you turn on reminders on a device, our server keeps that browser’s push subscription (an address at your browser maker’s push service, its keys) and your time zone. Reminders carry the member’s name and event titles and times; coin notices carry amounts and names. They travel through your browser maker’s push service (Google, Apple, Mozilla or Microsoft), encrypted so that service can’t read them. A sent reminder is kept 7 days, then deleted. Signing out or turning reminders off deletes the subscription.

Signing in and security

• Family passwords and members’ PINs and passwords are stored only as slow, salted hashes (scrypt), never as they were typed.
• Each device gets a short-lived access token and a refresh token that changes every time it’s used. The server keeps only a hash of the refresh token.
• To stop guessing, sign-ins are limited per network address, per member and per family. Those counts hold the network address for minutes, then they’re deleted.
• There’s no password reset by email, because we don’t have your email. A family admin can set anyone’s PIN or password. If every admin forgets theirs, contact us.

Logs

The server logs technical events: the kind of request, whether it worked and how long it took, and for some events the family’s and device’s ids. Logs don’t include what you wrote, and they don’t include network addresses; the web server in front keeps no access log. Logs may be sent to a log-hosting service that keeps them for a short time (days to a few weeks).

Backups

The server’s database is copied every night to private storage at the same cloud provider, and copies are kept for 30 days unless this server set another number. Each copy is encrypted before it leaves the server, with a key only the operator holds (it isn’t on the server), so neither the storage service nor someone who got hold of a copy can read it. The database provider keeps its own backups for about a week, encrypted by them. So something deleted can stay in a backup until that backup expires. Backups are used only to recover from a failure.

On your device

• Oryoli uses no cookies.
• Your family’s copy is kept in this browser’s storage (IndexedDB), so it works offline.
• This browser’s sign-in (its tokens and which family and member it is) is kept in local storage (oryoli.session), along with small settings such as your theme, and the referral mark described above.
• The app’s files are cached so it opens offline. Your family’s data isn’t part of that cache.
• Fonts and icons come from our own server. No third-party scripts are loaded.

Signing out and removing things

• Signing out (Settings → This device) stops this device’s tokens and deletes the family’s copy from this browser. Changes it hadn’t synced yet are lost. The server keeps a record of the device (its name, kind, and when it was added and last seen).
• A parent can turn off another device from the Family page: it stops syncing at once and has to join the family again to come back.
• Removing a member stops them signing in and their devices syncing. What they made stays with the family, and their profile is marked removed rather than erased.
• Deleting an entry removes it from every device. To keep all devices in agreement, the server keeps a deleted copy for as long as the family exists.

Deleting your family

A family kept on one device: Settings → This device → Remove family from this device deletes it completely.

A synced family: a parent or admin can delete it from Settings → Delete this family, by typing the family name and the family password (or their own password or PIN if the family has none). It can’t be undone, so download a copy first if you might want it: Settings → Your data → Download backup. In one step our server deletes everything the family stored: entries, calendar, trackers, vault secrets, members, devices, PINs and passwords, public links, invite links and referral records, outside calendar connections and their copied events, reminders and push subscriptions, sharing with other families, Oli coin balances, movements and requests, and the one-way codes described above. Google is asked to revoke Oryoli’s calendar access; Microsoft doesn’t let apps do that, so remove Oryoli there yourself (see Outside calendars). Every device signed in to the family is signed out and deletes its copy the next time it’s online.

What stays, with nothing that says which family it was:

• purchase records (amounts, dates, status, Stripe’s reference numbers), for accounting and refunds, and what each Oli request cost
• names in the shared catalogue that other families also added (the family no longer counts toward them; a name only it added is deleted)
• on lists another family shared with you, what you added stays theirs; their history of it says “a family that left Oryoli”
• for 90 days, a one-way code of each of the family’s device ids, so a device that comes back online learns the family was deleted

Backups still hold the family until they expire (see Backups). You can also ask us to delete it at pdiffenderfer@gmail.com.

Kids

Families include kids, and an adult always sets up the family. A parent or admin adds each kid, chooses their name (a nickname works), sets their PIN and decides what they may do. Kids don’t give us any contact details. Kids can’t buy coins (they ask a parent), make links or invites, or register a shared hub, and they have a monthly coin limit on the family’s coins. Catalogue suggestions judged to be for adults aren’t shown to kids. If a kid talks to Oli, what they say is handled as described under Oli, and parents can see the family’s Oli use on the Coins page. We never show ads or sell anyone’s data, kids’ included.

If you believe a child’s information was added without a parent’s permission, contact us and we’ll delete it.

Who else handles your data

• our hosting provider (DigitalOcean): servers, database, backups
• OpenRouter and the AI model providers it uses, when you use Oli and for catalogue names
• Stripe, when you buy coins
• Google or Microsoft, when you connect their calendars, and the sites behind calendar addresses you add
• your browser maker’s push service, for reminders
• a log-hosting service, for the logs described above
• whoever you share with: other families you share a calendar or list with, and anyone holding a public link you made

We share data otherwise only if the law requires it. We don’t sell it.

Your choices

You can see and change your family’s data in the app, download all of it (Settings → Your data → Download backup), and delete it (Settings → Delete this family). Depending on where you live, you may have more rights over your data, such as asking what we hold. Contact us and we’ll help.

Changes to this policy

When Oryoli changes what it keeps or shares, we’ll update this page and the date at the top. Oryoli is still being tested, so expect changes.

Contact

Magnos LLC
pdiffenderfer@gmail.com