Privacy Policy

1. Scope and responsibility

This Policy applies when Axolet determines how and why information is processed through Ordo Cloud or this website. Where data-protection law uses the term, Axolet is the controller of that information. This Policy does not govern third-party websites, app stores, update services, or independently hosted Ordo servers.

When you use an independently hosted server, consult its operator for applicable privacy terms. Switching servers does not copy your library between deployments.

2. Information we process

Depending on the features you use, Ordo Cloud processes:

• Account information: display name, email address, password hash, email-verification status, profile picture, reader preferences, and account timestamps.
• Your library: saved URLs, titles, descriptions, domains, extracted article content, folders, tags, highlights, notes surrounding highlights, reading progress, completion state, reminders, and import results.
• Security and session information: hashed session tokens, session expiry and activity, IP address, user agent, device name and type, multi-factor authentication settings, and one-time authentication records.
• Support and operational information: request and error details needed to diagnose failures, protect the service, and respond to communications you send to Axolet.
• Optional media: a profile picture you choose from your camera or photo library. Ordo requests device permission only when you use that feature.

Passwords are stored as password hashes rather than readable passwords. Authentication credentials on Android are normally stored using platform-protected secure storage.

3. How we use information

We process information to provide and maintain Ordo; create and secure accounts; save, organize, search, extract, display, import, and export bookmarks; synchronize reading state and reminders; send verification, recovery, and security messages; prevent abuse; troubleshoot errors; and comply with legal obligations.

Where applicable, our legal bases are performance of our contract with you, our legitimate interests in operating and securing Ordo, your consent for optional features, and compliance with law.

4. How saved links are processed

When you save a URL, your selected Ordo server may request that webpage to obtain its title, metadata, and readable article content. The destination website receives the server's IP address, the requested URL, and ordinary request headers. Redirected or alternate article pages may also be requested.

Extracted articles can contain remote images. Viewing those images or opening a live webpage can contact the source website from your device. Those websites may apply their own cookies, tracking, and privacy terms. Axolet does not control third-party website content or practices.

5. Service providers and external services

We do not sell personal information and Ordo does not include advertising or dedicated third-party analytics. Ordo may disclose or transmit limited information to:

• Infrastructure and email providers used to host Ordo Cloud and deliver account verification or recovery messages.
• Google Favicon Service, which receives a saved website's domain when the app requests a favicon.
• GitHub, when Ordo checks for or downloads an Android release.
• Expo/EAS Update, when supported builds check for or download application updates.
• Saved and opened websites, as described in Section 4.
• Authorities or other parties, when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business reorganization subject to appropriate safeguards.

6. Information stored on your device

The app stores authentication credentials in platform secure storage where supported. It also stores settings such as your selected server, appearance and reader preferences, update state, and reminder scheduling state on your device.

Bookmark reminders are scheduled locally through the operating system. Their title and domain may appear in device notifications according to your lock-screen and notification settings. Ordo does not use a remote push-notification service for bookmark reminders.

This website stores only your light or dark theme preference in browser storage. It does not use advertising cookies or analytics pixels.

7. Retention and deletion

We keep active account and library information while your Ordo Cloud account remains open or as needed to provide the service. Temporary bookmark-import data is ordinarily scheduled to expire after one hour of inactivity. Security records, service logs, and expired authentication records may be retained for a reasonable period for fraud prevention, reliability, and legal compliance.

You can export supported bookmark data and delete your account from the app. Account deletion removes the active account and associated library data from the live service. Residual copies may remain temporarily in protected backups or logs until they are rotated or no longer reasonably required. We may retain information where required by law or necessary to establish, exercise, or defend legal claims.

8. Security

Ordo uses measures designed to protect information, including password hashing, hashed server-side session tokens, short-lived access credentials, optional multi-factor authentication, encrypted storage of TOTP secrets, and platform secure storage for mobile credentials. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

More information, including how to report a vulnerability, is available in our Security Policy.

9. Your choices and rights

You can access and update account information in the app, manage active sessions, export supported bookmark data, change reminder permissions, switch servers, and delete your account.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent or complain to a data-protection authority. To make a request concerning Ordo Cloud, contact Axolet using the method in Section 13. We may need to verify your identity before completing a request.

10. International processing

Axolet and its service providers may process information in countries other than your own. Where required, we use appropriate safeguards for international transfers. A self-hosted server processes information wherever its operator chooses to host it.

11. Children

Ordo is not directed to children under 13, and Axolet does not knowingly collect personal information from children under 13 through Ordo Cloud. If local law requires a higher minimum age to consent to online services, you may use Ordo Cloud only with authorization from a parent or legal guardian. Contact us if you believe a child has provided information contrary to this section.

12. Changes to this Policy

We may update this Policy as Ordo changes. We will post the revised version here and update the effective date. If a change materially affects how we process existing Ordo Cloud account data, we will provide additional notice where reasonably practicable or legally required.

13. Contact

Ordo is made and operated by Axolet. For privacy questions or requests concerning Ordo Cloud, request a private contact through the Ordo repository. Do not include personal information in the public request. For independently hosted deployments, contact that server's operator.