Orlio Privacy Policy

Effective and last updated: October 24, 2026

Orlio is a general-wellness and self-reflection app for adults. This policy explains what information Orlio processes, why it is processed, where it is kept, and the choices available to you. If language versions contain an irreconcilable conflict, seek legal advice about the version that applies in your market. This does not waive mandatory rights.

1. On-device-first design

Your durable personal record is stored on your Apple device. This includes journals, saved conversation history and transcripts, summaries, insights, moods, goals, action items, memories, preferences, and relationship context. If you enable iCloud backup, a copy is stored in your personal iCloud Drive under your Apple account.

Some features you request require secure cloud processing. For those features, Orlio sends the audio, text, and limited context needed to service that request. Cloud processing is not the durable source of your personal record.

2. Information processed

Account information

When you use Sign in with Apple, Orlio receives and stores an Apple-provided user identifier. Orlio also receives your name and email address only when Apple provides them and you choose to share them. Apple may provide a private relay address instead of your personal email address. Account information is linked to your Orlio account and used for authentication, security, support, and account lifecycle operations.

Content you create

Your local record may contain free-form journal text, voice notes, photos you select, live or typed conversations, summaries, insights, goals, preferences, and information about people you add. When you request a cloud feature, Orlio may process the specific audio, transcript, message, or context needed to respond.

After you accept the first-launch agreement, the People choice in Personalized Support is on by default. Relevant people context may be included in cloud requests without a separate approval for each request. The Journal entries choice is also on by default, but journal context requires your approval for that request before it can be sent. Turning either choice on does not itself send content. You can turn either choice off in Settings; the change applies to subsequent requests. Existing choices are preserved. Locked journal entries are excluded.

Apple Health

With your permission, Orlio may read mindful sessions, sleep analysis, State of Mind, heart rate, heart-rate variability, and step count. If you allow mindful-session writing, a completed session can be recorded in Apple Health. You control HealthKit permissions in iOS Settings or the Health app.

Health information is used on device unless you separately approve a feature-specific prompt to include a limited health signal in a cloud request. Orlio does not use Health information for advertising, marketing, or sale.

Operational and security information

Orlio's service may process account and session identifiers, timestamps, country or time-zone values supplied for safety localization, usage totals, service-cost estimates, network and access-log information, and error details that are designed to exclude conversation content. This information supports authentication, abuse prevention, service reliability, billing reconciliation, and security.

Crash and performance reports

While you are signed in, Orlio automatically sends crash and performance reports to help identify faults and keep the app reliable. These reports may contain technical call stacks, numeric crash details, report dates, and the app version and build. They are sent with your authenticated account and may be linked to you. We do not add conversation text, journal entries, or voice recordings to these reports. This version has no separate in-app switch for these reports. They are used to maintain app functionality, not for advertising or tracking.

Apple permissions and capabilities

Microphone: live voice sessions and voice notes.
Speech recognition: captions or fallback transcription when that feature is active.
Photos: journal attachments you select.
Calendar: events and reminders you choose to read or create.
Notifications: reminders and check-ins you enable.
Face ID or Touch ID: optional local privacy lock.
HealthKit: the Health data described above.
iCloud Drive: optional backup under your Apple account.

You can revoke system permissions in iOS Settings. Revocation may disable the related feature but does not delete information already saved locally.

3. How information is used

Orlio uses information to authenticate your account, provide requested voice and text features, personalize an approved request, create and return requested summaries or insights, operate export and deletion tools, prevent abuse, maintain service reliability, provide support, and meet legal obligations.

Orlio does not sell personal information, serve third-party advertising, or track you across other companies' apps or websites.

4. Processors and disclosures

Processor list

AI and voice processing providers receive the information needed for the feature you request. Cloud infrastructure and security providers operate the supporting service. This list distinguishes the current release from optional or inactive integrations.

OpenAI: live voice conversations and supporting response generation. When spoken voice-note replies are enabled, it also processes reply text needed to generate that audio. To read your weekly reflection aloud, it also processes the reflection text, which can happen as soon as the reflection is shown. The reflection may draw on your journal or on what you shared about your health. This uses the same permission as text replies.
Google: text replies, summaries, insights and other requested AI features using its services. If an optional spoken-reply fallback is enabled and separately allowed, it processes reply text for that fallback.
Amazon Web Services: hosting and permitted account, security, usage and diagnostic records, separate from your saved personal conversation record.
Apple: account sign-in, purchases and platform services, including optional speech recognition and personal iCloud backup, under its terms and your settings.
Supabase and Resend: the website's contact and waitlist form processing and email delivery. They process the information you submit for those purposes.
Lovable and Cloudflare: website hosting, page delivery, security and traffic measurement, including request metadata. Website measurement is described below.
Google Fonts: website font delivery. Your browser supplies request metadata when fetching those font files.
ElevenLabs: an older optional voice integration. It is not used by the current live-call path in this release. A change that enables it requires a new review of its processing, data-use and retention controls.
Hume AI: an optional voice integration that is disabled for this release. It is not a recipient of this release's live conversations.
Configured storage and diagnostics services: permitted account and operational records are handled by the hosting and database services used for Orlio. Any separately operated service must be identified here before use.
Google and Apple service-status feeds: service-health checks request public status information; they do not send conversation content.
Deepgram and Groq: unused legacy integrations. Neither is represented as a recipient of your conversations in this release. Enabling a new route requires a new review and disclosure.

Our processing agreements do not permit your conversation content to be used for the processing services' own model training. Retention depends on the service and controls that apply to the requested feature. The saved personal record remains on your device, with an optional copy in your iCloud account.

Orlio may disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. Questions about processors and your information: support@orlio.ai.

Voice-note speech choice

When this optional feature is available and you choose it, the following disclosure applies. It does not grant permission by itself.

OpenAI processes the reply text to generate the primary spoken reply using the guide’s call voice.

Google (Gemini) processes the reply text for speech only if you separately allow the optional fallback and the primary service cannot produce audio.

These permissions are separate from text-reply processing. Only the generated reply and information you selected for speech may be processed for this purpose. Journal and Health categories are excluded. Orlio does not store conversation content on its servers. Processing services may retain data under their applicable service terms and account controls; this choice does not promise zero provider retention.

5. Storage, security, and international processing

Local data is protected by Apple's platform security and any privacy controls you enable. Credentials are held in secure system storage. Data in transit is encrypted. Server-side account and permitted operational data are protected by access controls and encrypted infrastructure.

Orlio also offers an optional setting that applies additional encryption to Journal body text and Journal voice-note audio using a key held on your device. It applies to entries saved after the setting is turned on, so turning it on or off does not change entries already saved. Some fields such as titles, moods, tags, photos, and dates are not covered by this setting. Locking an entry with Face ID or Touch ID is a separate display control.

Cloud providers may process information in countries other than your own. When required, Orlio relies on appropriate contractual or legal transfer mechanisms. No method of storage or transmission is completely secure.

6. Retention

Local content remains until you delete it, delete your account in the app, or remove it through applicable Apple storage controls.
Your server account remains until account deletion is completed.
Operational, security, billing, and access-log information is kept only as long as reasonably necessary for the purposes described above and applicable legal obligations.
Apple retains App Store transaction records under Apple's terms.
Processor retention depends on the service used, its configured retention controls and the processing agreements that apply.
Backups and security logs may persist for a limited period before normal rotation, or longer when legally required.

7. Export, deletion, and other choices

Export: In Settings, choose Export My Data for JSON or CSV. Locked Journal entries, Journal photos and Journal entry audio are excluded. Unlocked Journal body text is made readable in the export. If encrypted body text cannot be opened, no export is created. A copy you save or send is controlled by you and the destination you choose.
Delete in the app: Settings, then Account, then Delete Account. Orlio requests deletion of your server-held account data and then removes the Orlio data held on your device and in Orlio's iCloud backup artifacts. If a step does not complete, Orlio tells you and lets you retry instead of reporting success.
Delete without the app: Follow orlio.ai/account-deletion. A verified external request can delete server-held account data, but cannot remotely erase data on your device or in your personal iCloud Drive.
Sign in with Apple: Orlio attempts revocation when the required Apple credential is available. Revocation is best effort and is not presented as a guaranteed result of every deletion request. You can also manage Orlio under your Apple ID settings.
Permissions and Personalized Support: Revoke system permissions in iOS Settings and change Personalized Support choices in Orlio Settings.

Deleting an Orlio account does not cancel an App Store subscription. Manage subscriptions in your Apple ID subscription settings.

Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing, or to receive a portable copy. Orlio may need to verify your identity before acting on a request.

8. Website, forms and measurement

This section describes orlio.ai separately from the app. The website uses security cookies and traffic measurement with a short-lived session identifier, page URL, referrer, browser information, locale and inferred country. Font requests also send ordinary request metadata. These functions support website operation and aggregate traffic measurement, not advertising profiles.

When you submit a contact or waitlist form, we receive the email address, name and message you provide, with the associated request metadata. We use them to answer you or send the early-access updates you requested. You can ask to leave the waitlist by emailing support@orlio.ai. The waitlist is for adults aged 18 and older. The relevant website providers appear in the processor list above.

9. Adults only and safety

Age confirmation records only whether you meet the minimum age and when you answered, on this device for your account. It does not request your birthday or identity documents. You can review the saved answer in Settings > Your data.

Orlio is for people aged 18 or older. If you are under 18, do not use Orlio. Orlio is not a medical device, healthcare provider, therapy service, emergency service, or substitute for licensed professional care. If you or someone else may be in immediate danger, contact local emergency services. Crisis resources shown in the app are informational and should be verified for your location.

10. Changes and contact

Orlio may update this policy as the service or law changes. Material changes will be reflected by a new effective date and, where appropriate, an in-app or release notice.

Questions and privacy requests: support@orlio.ai

Public privacy URL: https://orlio.ai/privacy