Privacy Policy
The short version. Orma shares your location with the people in your circle, and nobody else. Your location, places, alerts, photos and names are encrypted on your iPhone before they leave it, and only phones in your circle hold the key. We can't read them. There are no ads, no data selling, no tracking across other apps and no analytics in the app. This website counts visits without cookies.
Who we are
Orma is made by VivTech Solutions, Greater Noida 203141, India, the controller of your personal data under the GDPR and UK GDPR. Write to us any time at support@ormacircle.com.
What's end-to-end encrypted
Each circle has its own key. It's created on a phone and passed only from phone to phone, through invite links or approvals on your own phones. Our servers store only ciphertext of:
- your live location and your location history
- saved places, and arrivals and departures at them
- SOS alerts
- profile photos, people's names and circle names
Push notifications carry generic text, such as "Someone in your circle needs help". Your iPhone fills in the names after decrypting them.
What we can see
To run the service, our servers need some information that isn't encrypted:
| Data | Why |
|---|---|
| Your email address, from Sign in with Apple (it may be an Apple private relay address) | Your account |
| Your account ID, and which circles you're in | Sending your encrypted data to the right people |
| Your phones: a device ID, each phone's public key and its push token | Passing keys between your phones and sending notifications |
| When things change, such as when a location update or alert was sent, and check-in times | Delivering updates, alerts and check-in reminders |
| IP addresses, in short-lived server logs | Keeping the service running and secure |
We use this only to provide Orma. We don't sell it, share it for advertising, or combine it with data from other companies.
Location permission
Orma asks for your location so your circle can see where you are. If you allow Always, your circle keeps seeing your location, and gets arrival and departure alerts, while Orma is closed. You can choose While Using instead, share for a set time, or stop sharing at any time. Your circle sees that you stopped sharing.
Who else handles your data
- Supabase hosts our database, sign-in and server functions. Our project runs in Seoul, South Korea. South Korea has an adequacy decision from both the EU and the UK, so data moved there keeps GDPR-level protection.
- Apple provides Sign in with Apple, push notifications and maps.
- Cloudflare serves this website and delivers messages you send through our contact form to our inbox.
Some things leave Orma only when you choose them. If you open directions in Google Maps, that place's coordinates go to Google. If you share an invite through another app, like WhatsApp, the link goes through that app. The circle key in the link is never sent to our servers.
This website
The Orma app has no analytics. This website uses Piqo in cookieless mode to count visits and see which pages are read. It sets no cookies. Piqo tells us it never stores IP addresses, recognises a returning visitor only within one day (by a hash that changes daily), and keeps data in the EU, with Hetzner in Germany.
If you use the contact form, we receive your name, email address and message by email, and use them only to reply. We delete them when they're no longer needed to help you.
How long we keep it
- Location history: 30 days, then it's deleted.
- Invite links: they expire after 7 days.
- Leaving a circle deletes your locations, history and photo in that circle.
- Deleting your account (Settings › Delete account) removes you from every circle and permanently deletes your account, phones and shared locations. Copies in our hosting provider's backups are deleted when those backups expire.
Your rights
Depending on where you live, including under the GDPR, the UK GDPR and California law, you can ask to see, correct, export or delete your data, or object to how we use it. You can delete everything yourself in the app. For anything else, email us and we'll reply within 30 days. If you're in the EU or UK, you can also complain to your data protection authority.
We process your data because it's needed to provide the service you asked for (GDPR Article 6(1)(b)), and keep short-lived logs for security, which is our legitimate interest (Article 6(1)(f)).
Children
Orma isn't meant for children under 13. Where local law requires a parent's consent for teenagers, for example under 16 in parts of the EU, a parent needs to agree before the teenager uses Orma.
Changes
If we change this policy, we'll update the date above. If a change affects what we can see or how we use it, we'll tell you in the app before it takes effect.