Privacy Policy

Ordesa is a family management application. This Privacy Policy explains what data we collect, why we collect it, and how you can control it.

We collect only what is necessary to provide the Service:

We do not collect device identifiers, location data, browsing history, or any data for advertising purposes.

• To provide and operate the Ordesa service.
• To authenticate you and keep your session secure.
• To sync your data across your family members in real time.
• To send transactional emails (e.g. password reset). We send no marketing emails.

We never sell your data. We never share it with third parties for advertising.

Your data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the EU region. All data is encrypted in transit (TLS) and at rest. Authentication is handled by Supabase Auth with industry-standard security practices.

Cookies we set are httpOnly, SameSite=Lax, and scoped to this domain only. They contain no personal information — only session tokens and preference flags.

We use the following sub-processors to operate the Service:

• Supabase — database, auth, and real-time infrastructure (supabase.com)
• Vercel — hosting and edge network (vercel.com)
• Telegram — only if you connect the optional Telegram bot integration

No other third parties receive your data.

If you are in the EU/EEA, you have the right to:

• Access — request a copy of the data we hold about you.
• Correction — update your name and email in Settings → Profile.
• Deletion — delete your account and all data permanently via Settings → Danger Zone → Delete Account.
• Portability — request an export of your data by contacting us.
• Objection — contact us to raise any concerns.

We will respond to all requests within 30 days.

Your data is retained for as long as your account is active. When you delete your account, all personal data is permanently removed within 30 days. Backups are purged within 90 days.

Ordesa is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via the app. Continued use of the Service after changes are posted constitutes acceptance.

For any privacy-related questions or requests, contact us at privacy@ordesa.app.