Privacy Policy

1. Who we are

Axolet Private Limited is based in India. It decides why and how this information is processed. It is the controller under the GDPR, and the data fiduciary under the Digital Personal Data Protection Act, 2023.

This policy covers ordo Cloud, the official Android app from the ordo releases on GitHub, and ordo.axolet.com. It does not cover websites you save, or GitHub, Expo, Resend, Google, Cloudflare, or a server Axolet does not operate.

Privacy requests go to [email protected]. Do not send a password or a one-time code.

2. Account and library on ordo Cloud

Sign-up on ordo Cloud is open. A new account cannot use the library until its email is verified. Multi-factor authentication is available and is not required.

Account

An account holds a display name, an email address, a bcrypt hash of the password, whether the email address has been verified, the new address while an email change waits for its code, reader settings (font, size, line spacing, theme, and pure black), and the times the account was created and updated. If you set a profile picture, the app reads it from your camera or photo library only for that choice, and ordo Cloud stores it as a WebP image on the server. The password itself is not stored.

Library

The library holds saved URLs, titles, descriptions, site names, extracted article HTML, authors, folders, tags, highlights, reading progress, completion, reminder times, and import jobs. A highlight is the passage you marked, a short stretch of the article on either side of it, and a link if the passage had one. There is no separate notes field.

Tag suggestions are scored on the server from your own tags. They are not sent to a model provider. Search runs on the server. The words are not kept as a history, but they can appear in the access log in section 9, because they are part of the request address.

What is encrypted, and what is not

Before they are written to the database, these fields are encrypted with AES-256-GCM: the bookmark URL, title, description, site name, article HTML, author, and the snapshot used to undo a forced article extract; folder names; tag names; the highlight passage, its surrounding text, and its link; and the text of an import preview or result. Tag lookup uses a keyed hash of the tag name rather than the name in the clear.

These fields are stored in the clear: display name, email address, reader settings, and the profile picture; which folder a bookmark is in; reading progress and completion; the reminder time; extraction status; tag color; folder icon and lock settings; and the file name and format of an import.

Each library has a key. That key is wrapped with your password and also with a key held on the server. The server wrap is what allows a password reset by email to keep the library readable. This is not end-to-end encryption. Axolet can decrypt ordo Cloud library data in order to run the service, including fetch, search, import, export, and password reset.

3. Sessions, email, and multi-factor authentication

A session stores a keyed hash of the access token, a keyed hash of the refresh token, their expiry, the IP address, the user agent, and a device name and type when the app sends them. The access credential lasts 15 minutes. The refresh credential lasts 30 days. A session stops being accepted after 14 days without use. An account can have ten sessions; a later sign-in drops the oldest. If a refresh token is presented again after it has already been rotated, that session is revoked.

On the Android app, sign-in tokens are kept in the device keystore and are available after the device has been unlocked. A browser client uses cookies. Writes from a cookie session must echo a CSRF token. The Android app authenticates with a bearer token and does not use that cookie check.

Email codes for verification, email change, password reset, and multi-factor recovery are six digits, expire after 10 minutes, and are stored as a hash. ordo Cloud sends them through Resend, from ordo <[email protected]>. Resend receives the address and the message. The same channel sends a notice of an email change and of multi-factor recovery. Codes are not printed in the server console. A password-reset request does not reveal whether an account exists.

If you turn on multi-factor authentication, ordo Cloud stores an AES-256-GCM encryption of the TOTP secret and keyed hashes of the backup codes. While it is on, changing the email address or password, and deleting the account, requires that second factor.

4. Install records

The official production app sends this record to ordo Cloud on a day you open it, including when the app points at a server you host. A sign-in or a new account is sent the same day. Development builds do not send it. There is no switch to turn it off.

The record contains a random identifier created on the device and the UTC day. It does not contain a platform label, the user agent, the app version, or whether the app is using ordo Cloud or another server. It does not contain an account, an email address, a device name, the address of a server you host, or a library.

For that day it also records how many times the app was opened, how many sign-in attempts failed, how many requests to the server you are using timed out, and how many times that server returned a server error. Those are counts, capped at 500 for the day. Whether an account signed in or was created is visible only in the server's own account and session records, not in this record.

Axolet uses the identifier to count installations and to see whether the official app is opening and reaching a server. It is not attached to an account. The IP address is used only to rate-limit the request and is not stored on the record. A server you host does not receive these records. The records are anonymous daily counters and are not on a deletion schedule; there is no retention job.

5. Pages you save and open

When you save a link, ordo Cloud fetches that page from the public internet. The site sees the server’s IP address, the URL, and ordinary request headers. Redirects stay on public HTTP and HTTPS. Private, local, and link-local addresses are refused. The article is sanitized before it is stored, and the reader does not run the page’s scripts.

Opening the live page uses a browser view on your device. That site then sees your device and can set its own cookies under its own terms. Bookmark icons are loaded by the app from Google’s favicon service, https://www.google.com/s2/favicons. Google receives the site’s domain.

A reminder is scheduled on the device through the operating system. ordo does not use a remote push service for reminders. The notification can show the title and a short description or the site name, subject to your lock-screen settings. The reminder time is one of the fields stored in the clear with the bookmark.

6. Why this information is processed

Axolet processes it to provide the account and the library, fetch and extract pages you save, search, import and export, send the email the account requires, count installations of the official app and see whether they open and sign in, limit abuse, and keep the service operating.

Where the GDPR or the UK GDPR applies:

• the account, the library, and the email required to provide them are processed to perform the contract with you;
• security logs, rate limits, abuse prevention, and install records are processed for Axolet’s legitimate interest in operating and protecting the service. You can object to the install record, as described in section 11;
• a legal obligation is the basis where one applies.

Where the Digital Personal Data Protection Act, 2023 applies, Axolet uses this information for those same purposes.

ordo does not sell personal information, and it does not contain advertising.

7. Who else receives information

• Resend delivers ordo Cloud email, as described in section 3.
• Google receives a bookmark’s domain when the app requests its icon.
• GitHub receives the app’s update check or download when the Android app looks for a release. That request does not include your library.
• Expo receives the app’s update check or download when the official app looks for a signed script update. That request does not include your library or your password.
• Cloudflare provides DNS for axolet.com and proxies this website, so it sees the IP address and page for a visit to ordo.axolet.com. The ordo Cloud API is not proxied through Cloudflare.
• The site you save or open sees the request described in section 5.
• A public authority, or a buyer of the service, receives information when Axolet must comply with law, when it is necessary to protect people or the service, or when the service is transferred in a reorganization. A reorganization does not by itself change the limits in this policy.

8. Information that stays on the device

The Android app keeps sign-in tokens in the device keystore. It keeps the chosen server address, appearance, reminder state, and the install record in ordinary app storage. Sharing a link into ordo from another Android app is handled on the device. Quick Save keeps that handoff in encrypted app storage.

A folder can be locked with the device unlock, a pattern, a four- or six-digit PIN, or a password. The biometric or device passcode stays on the device. The server stores a bcrypt hash of the folder secret. A folder lock is an extra prompt inside the app. It does not encrypt the server’s disk.

This website keeps the theme you choose on it (dark or light) in your browser’s local storage, under the key ordo-site-theme. To show the right download, the page reads your browser’s user agent on your device; that check is not sent anywhere. The website does not run advertising or analytics, and its own pages set no cookies. Its fonts and images are files on this site.

9. How long information is kept

The account and the library are kept while the account exists. You can export bookmarks as JSON, HTML, or CSV from the app, for the folders you can open. You can delete the account in the app. Deletion requires the password and, when multi-factor authentication is on, that second factor. Deletion removes the account, the library, and the profile picture from the live database.

Other copies have their own lifetimes:

• An unfinished import is deleted about an hour after it was last updated.
• Install records are anonymous daily counters with no retention job, as described in section 4.
• A session remains until you sign it out, it fails the idle or refresh limit and is then removed, or the account is deleted.
• An email code is removed when a new code for the same purpose is created, and when the account is deleted. An unused code stops working after 10 minutes even if the row is still there.
• The API access log records the IP address, the time, and the request path. A search is included, because the search words are in the address. The log is rotated daily and kept for 14 days.
• Before a software update, a snapshot of the database may be left on the same server. Those snapshots are not deleted on a fixed schedule. Deleting an account removes the live rows. It does not erase a snapshot taken earlier.

Rate-limit counters are held in memory and are dropped when the server process restarts. Axolet may keep information for longer where the law requires it, or where it is needed to establish, exercise, or defend a legal claim.

10. Security

The controls Axolet actually uses are described in the Security Policy. No method of storage or transmission is free of risk, and Axolet cannot promise that it is.

11. Your rights

In the app you can see and change your display name, email address, password, profile picture, sessions, multi-factor authentication, and library. You can export bookmarks and delete the account.

Where the GDPR or the UK GDPR applies, you can ask for access, correction, deletion, restriction, or a portable copy, and you can object to processing that is based on legitimate interests, including the install record. You can complain to the data protection authority in the place where you live.

Where the Digital Personal Data Protection Act, 2023 applies, you can ask for the summary, correction, and erasure that Act gives you, and you can complain to Axolet. When the Act allows it, you can also go to the Data Protection Board of India.

Where a US state privacy law applies, you can ask for access or deletion, and you can appeal a refusal at the same address. Axolet does not sell personal information or share it for cross-context behavioral advertising.

Write to [email protected]. Axolet may need to confirm that the request comes from the account holder. For a server Axolet does not operate, write to that operator.

12. Where information is processed

Axolet is based in India. The database is on a server in Germany, and the API is served from there over HTTPS. People acting for Axolet can access that server from India, including library data the server can decrypt.

Resend, Google, GitHub, Expo, and Cloudflare may handle the information in section 7 in other countries. This policy does not describe a separate transfer contract with them. For someone in the EEA or the UK, access from India is part of that transfer. For someone in India, storage in Germany is part of it. A server you host keeps its library wherever that server is.

13. Children

ordo is not directed to anyone under 13. The app does not ask for a date of birth or check age. If a person under 13 has an account, write to [email protected] and Axolet will delete it.

14. Changes

Axolet will post changes on this page and change the date above. If a change materially affects information already held for an ordo Cloud account, Axolet will give a further notice when it reasonably can, in the app or by email.