Privacy Policy

iPhone real-time mail alerts (prepared for activation)

This feature is not yet publicly enabled. Before activation, this disclosure must be mirrored to the public privacy pages and the actual server region must match the in-app consent. The current deployment plan selects Osaka, Japan; changing the server or region requires renewed consent. When you enable new-mail notifications on iPhone, IMAP mailbox app passwords and Outlook refresh tokens are sent to Orvia's dedicated push server only after you explicitly agree to credential hosting. That consent also covers supported accounts added later. Credentials are encrypted on disk, but remain available in plaintext in server memory while checking mail. For users in mainland China, this transfers credentials and the mail metadata needed for alerts outside mainland China to the disclosed server region. Declining hosting leaves IMAP and Outlook on the existing iOS background-refresh path. The server reads the inbox metadata needed to identify new unread mail, apply sender filters and construct alerts. It does not host a full mailbox archive or upload attachments or message bodies. IMAP authentication can trigger a provider's login-location warning. Sender information and, only when previews are enabled, a limited subject are delivered through Apple Push Notification service. Previews are off by default. Muted sender addresses, opaque installation/account identifiers, APNs device tokens, unread counts, provider message identifiers and successful-delivery identities are processed solely to operate notifications, deduplication and fallback. Gmail OAuth tokens remain on the device and are never sent to the push server. The device requests a Gmail watch using its existing authorization. Google Pub/Sub sends the Gmail address and historyId through the push server; the address is matched using a keyed hash, and neither the plaintext address nor historyId is persisted or logged. The server sends a silent wake-up through Apple, and the device syncs mail directly with Gmail and issues local notifications. Force-quitting the app prevents this Gmail wake-up path. Disabling one device does not stop another device's Gmail watch. Turning off app notifications, returning to the app after disabling system notification permission, or deleting an account requests immediate hard deletion of its server records and stops its listeners. An offline or failed deletion remains queued on the device for retry. Microsoft subscription revocation is attempted separately; if Microsoft is unavailable, a remote subscription may remain until its original expiry, while removed local mappings prevent its callbacks from producing alerts. Installations without a PUT for 30 days are deleted. Delivery receipts are kept for seven days; credentials and sender lists are kept only while the installation/account remains registered. The database is not backed up. Apple App Attest is used to verify legitimate app installations before registration; its verification key and counter are used only for that security function. This feature is independent of optional cloud AI, usage analytics and advertising. It does not change Google Limited Use protections or permit Gmail data to be used for model training. The push gateway must be included in the next applicable CASA annual reassessment.

Your inbox is not Orvia's dataset

Orvia does not sync your mailbox into a server-side archive for analytics, advertising, data brokerage, or training an Orvia model. Mail stays on your Mac by default and communicates directly with the provider you choose. Only a feature you deliberately use—such as purchasing, license activation, account recovery, or optional cloud processing—handles the minimum data needed to perform that feature. Limited processing and redacted-result caching for optional cloud AI are described below.

Classic is a separate lifetime edition with optional Personal AI

Orvia Mail Classic is independently distributed as a one-time purchase and includes no Orvia-managed cloud AI or subscription. Message bodies, attachments, indexes, and local-rule results stay on the Mac by default, while mail connects directly to your provider. Only after you enable Personal AI - mailboxes are included with the connection you activate and you can turn any mailbox off at any time - does task-limited text for a summary, reply, or writing request pass the on-device privacy gates and go to the Personal AI connection you selected. Classic supports optional Personal AI in two forms: your own OpenAI-compatible API key or endpoint, or signing in with your own ChatGPT or Grok account. API credentials stay in macOS Keychain, while account connections are local device runtimes described below; this path does not use Orvia AI Proxy. Classic also uses necessary network services for checkout, license activation, and software updates.

How Classic Personal AI connections store credentials

Personal AI is optional in Classic. An API configuration uses your own OpenAI-compatible API key or endpoint, and its credential stays in Orvia's synchronizable Keychain envelope. A ChatGPT or Grok account connection runs a bundled official provider runtime on your device; the provider runtime stores and refreshes its account credentials inside the Classic app container, and Orvia does not read, copy, synchronize, log, or export those tokens. Disconnecting a ChatGPT or Grok account connection removes its local runtime data from the device.

ChatGPT and Grok account data controls

Consumer ChatGPT and Grok account data controls may allow the provider to train on or retain content. Until an official API can report that state authoritatively, Orvia treats it as unknown and does not claim training is disabled. These account connections cover every connected mailbox, including Gmail, under the same mailbox permissions. Mail sent through them, Gmail included, is governed by your own ChatGPT or Grok account terms; Orvia does not operate that transfer and does not control the provider's training or retention.

Why the App Store says “Data Linked to You”

The label belongs to the App Store edition and combines every optional data path; it does not describe the separately distributed Classic edition. Purchase history supports Apple / RevenueCat entitlement checks. Email address and user ID support optional account and entitlement recovery. “Emails or Text Messages” is Apple's combined category—Orvia does not access SMS—and refers to redacted email text only after a user enables eligible cloud AI. Product-interaction records support AI quotas and reliability, not advertising.

Installation-level anonymous and account-associated pseudonymous data are distinct

When usage statistics are enabled, Orvia sends only a random installation identifier, platform and distribution channel, version and build, coarse plan or entitlement, and connection counts grouped by mail-provider kind. It does not send mailbox addresses or domains, provider account identifiers, message or contact data, attachments, OAuth credentials, transaction or license identifiers, device serial numbers, or raw errors. The installation identifier does not identify a person on its own. After authentication through Orvia Account, an App Store subscription, or a Classic entitlement, the server associates the snapshot with an opaque account or entitlement identity, so that data is pseudonymous rather than strictly anonymous. Turning statistics off immediately stops new snapshots and requests deletion; temporary failures retain a deletion task for retry, and snapshots are retained for no more than 90 days.

Crash and reliability records contain no mailbox content

Release builds may send privacy-minimized operational and crash diagnostics associated with a random installation identifier. These records may include platform and distribution channel, app version and build, operation stage and outcome, coarse duration and item-count buckets, an allowlisted error category, and scrubbed exception frames needed for symbolication. Before transmission, Orvia removes exception messages, full paths, URLs, credentials, mailbox addresses or domains, provider account identifiers, message or contact data, attachments, transaction or license identifiers, device serial numbers, and fields outside the diagnostic allowlist. Diagnostics are used only to detect, investigate, and verify reliability problems—not for advertising or cross-app tracking. Remote diagnostics can be disabled without disabling local reliability records or core mail features.

Which features we record being used

When Help Improve Orvia is on, the app also sends product usage events to PostHog (EU region), associated with the same random installation identifier as a pseudonymous profile. Events record which features are used and how flows end, for example first launch and updates, app opens, onboarding steps, starting and finishing adding a mailbox, sending a message, viewing the upgrade page, and purchase or restore results. Each event carries only closed-vocabulary values, booleans, coarse count or duration buckets, platform, distribution channel, app version and build. Events never contain mailbox addresses or domains, message subjects or content, summaries, translations or other AI output, contacts, attachments or file names, URLs, search terms, provider or message identifiers, credentials, transaction or license identifiers, or any free text; every property is checked against an allowlist on the device before sending, and IP-based location is disabled. The profile is not linked to an Orvia Account, purchase, email address or name, is not used for advertising or cross-app tracking, is used only to understand and improve how Orvia is used, and is retained for no more than 365 days in PostHog. Turning Help Improve Orvia off stops sending immediately and discards queued events; to delete an installation's events, contact hello@orviamail.com.

Each service receives only what its function requires

Your mail provider handles mail sync and sending. Apple and RevenueCat handle App Store purchases and entitlements. Waffo Pancake handles Classic checkout. A transactional email provider delivers codes or notices you request. Only when you enable eligible cloud AI or Classic Personal AI does the configured model provider receive task-limited text that passed the privacy gates. Orvia includes no advertising network, data broker, or cross-app tracking SDK. Each third party processes the data needed to provide its service under its own terms.

What the website collects

When you register for launch notifications, we collect only the email address you submit. It is used for launch notices and important product updates. You can email hello@orviamail.com to request deletion.

What Gmail data Orvia Mail accesses

After you connect Gmail, Orvia Mail may access your account email address, mailbox labels or folders, message headers, snippets, message bodies, attachments you choose to open, read/unread state, starred state, and message metadata needed to provide email client features. Gmail follows the same mailbox rules as every other provider and is added within the ordinary mailbox allowance; Google or account requirements may still affect access.

How Gmail data is used

Orvia Mail uses raw and derived Gmail data, including local search indexes and triage state, only for user-facing mail client features: showing your inbox, rendering and sending messages, syncing read/unread and starred state, local search, and mail organization. Orvia Mail does not create, transfer, or sell aggregated or anonymized Gmail datasets.

Where Gmail data goes

Orvia Mail communicates directly with the Google Gmail API over HTTPS/TLS. Gmail OAuth tokens are never sent to Orvia servers or AI providers, and sending and receiving mail is not proxied through Orvia Mail-owned relay servers. Gmail message content stays on your Mac unless cloud AI is allowed for that mailbox. Cloud AI is off by default; when you turn on global cloud AI, Gmail inherits it like every other connected mailbox unless you turn that mailbox off. For a permitted Gmail mailbox, the optional cloud AI flow described below sends only the task-limited, redacted text needed for the feature you invoke through Orvia AI Proxy; the redacted result is then cached for idempotent retries as described below.

Remote images are blocked by default

Remote images and other sender-hosted resources are blocked by default. If the user explicitly loads them, the remote host may receive the resource URL, request time, and network or device information such as the user's IP address and user agent. Orvia does not control that host's retention practices.

Local storage and credential security

Message bodies, attachments, account settings, drafts, outbox queue, search indexes, and triage preferences are stored in app-specific local storage available to the current macOS user. Mail OAuth tokens are stored in macOS Keychain. Orvia does not place OAuth tokens or full Gmail message content in operational logs, analytics, or proxy records.

How long Gmail data is retained

Gmail content and derived local indexes are retained on the Mac until the user removes the Gmail account from Orvia Mail or deletes the app data. OAuth credentials are retained until the account is removed or the user revokes access in Google. Orvia servers do not retain full Gmail message bodies. The redacted AI task-result cache and reusable layout templates that prevent duplicate charges and keep client retries idempotent have no fixed deletion date; a verified deletion request removes them, together with the usage records of that subscription, within 30 days. Verified server-side deletion requests are completed within 30 days after identity verification, except for limited records that must be retained for legal or security obligations.

No model training

Orvia Mail does not sell Gmail data, transfer it to data brokers, or use it for advertising, credit, or lending decisions, and does not use raw or derived Gmail data to develop, improve, or train general-purpose AI/ML models. Orvia AI Proxy does not permit its model providers to use Gmail data for that purpose; task-limited redacted text is processed under the terms of the model provider configured for your AI Data Region. When you route mail through your own Personal AI connection, including a ChatGPT or Grok account, that provider's training and retention follow your own account terms.

Cloud features are off by default

Cloud AI is off by default, and connecting Gmail does not turn it on. When you turn on global cloud AI, every connected mailbox, including Gmail, inherits it unless you turn that mailbox off; a mailbox you turned off is not turned back on automatically. For a permitted mailbox, Orvia sends only the minimum redacted text needed for a requested task, never OAuth tokens, and only after the privacy gateway approves the request. Classic Personal AI is a separate direct-to-provider path described above.

Where cloud AI is processed

Cloud AI requests are routed by the AI Data Region you confirm in Orvia Mail: China Mainland, European Union, International, or United States, applied to every mailbox including Gmail. The provider configured for that region is currently Alibaba Cloud Model Studio (Qwen), and requests never fall back across regions. The region setting is not changed by travel or a VPN; you can move it in Settings, which briefly pauses new AI requests while the binding changes.

Audio for voice snooze

Voice snooze (say a time to set a reminder) is optional and starts recording only when you tap the microphone (on Mac, you can also double-press Option); the AI engine requires global cloud AI to be turned on first. The Mac local engine uses Apple speech recognition, on-device first, and may fall back to Apple's speech recognition service; that audio does not pass through Orvia. With the AI engine (Mac and iPhone), the recording (up to 2 MB, WAV or M4A) is sent through Orvia AI Proxy to the provider configured for the AI Data Region you confirmed (currently Alibaba Cloud Model Studio (Qwen)), transcribed to text, and the time is then extracted from that text; requests never fall back across regions. Orvia does not store the audio or the transcript and does not write them to logs. The Proxy keeps only the result (time and confidence) and a one-way hash fingerprint of the request, used to prevent duplicate charges and to support idempotent retries, under the same retention rules as the AI task result cache: no fixed deletion date, and verified deletion requests are fulfilled within 30 days. Each AI voice request uses 1 AI credit and does not read or send mail content.

Every cloud request is screened and redacted first

Before eligible text can leave the Mac, it must pass Orvia's privacy gateway. High-risk mail and content that cannot be processed safely are blocked. Allowed requests are stripped of unrelated material, and recoverable sensitive fields are replaced with random placeholders. The placeholder map stays in the current Mac session; the model provider sees only task-limited redacted text. If the response fails placeholder-integrity or safety checks, Orvia rejects it.

See how privacy redaction worksA complete walkthrough with an interactive example.

Quota and entitlement records contain no full message body

To verify subscriptions, enforce quotas, prevent duplicate charges, and keep the service reliable, Orvia may retain a purchase transaction identifier, requested feature, credit cost, status, latency, limited account or license-activation records, and a redacted model-result cache for idempotent retries. These records do not contain mailbox passwords, OAuth tokens, or the full original message body, and they are not used to build advertising profiles. The cache has no fixed deletion date and is removed on a verified deletion request as described under retention.

AI credits and the shared account wallet

AI credits are optional. Each active Apple Plus source provides 1,000 credits per UTC calendar month, and where the in-app store lists it, one-time packs of 500, 1,200, or 3,000 credits can be purchased; packs do not auto-renew and by default do not expire, and the actual product, price, and currency are those shown at checkout. Credits are held by your Orvia account and shared across Classic, the Mac App Store edition, and iPhone where the applicable source allows; restoring a purchase or linking an account does not refill a used cycle, and cycle credits do not roll over. Wallet records are linked to your Orvia account (the email address you sign in with) and contain only order, delivery, balance, and usage facts—never mailbox content, passwords, or OAuth tokens—and are used only to deliver purchases, enforce quotas, prevent duplicate charges and refunds, and keep the service reliable; they are retained as described under retention, and limited records needed for reconciliation or legal obligations may be kept longer. Refunds follow the original purchase channel (Apple purchases through Apple, browser checkouts under the processor's terms); unused credits are recovered from that order and never create a debt, offset other orders, or reduce future purchases. Deleting your Orvia account ends access to that wallet; later payments still attach to the original order and are not moved to a new account. A shortfall of credits only pauses AI features and does not affect sending or receiving mail.

Google Limited Use compliance

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

When a person may access data

Orvia personnel do not read Gmail content unless the user gives explicit, documented permission for support involving specific content, or access is necessary to investigate security abuse or comply with law.

How to turn off and delete data

You can turn off cloud AI and pseudonymous usage statistics in Orvia Mail Settings and delete local account data in Settings -> Accounts. Deleting a Gmail account in Orvia attempts to revoke its refresh token at Google. If the device is offline or revocation fails, you can remove Orvia access at https://myaccount.google.com/permissions. Turning statistics off stops new snapshots and requests deletion. Full deletion steps are available at data-deletion.html.

What you send through the feedback form

When you submit the feedback form on the website, we receive the reply email, name, category, subject, message, and any images you choose to upload. They are delivered as an email to hello@orviamail.com and used only to reply to and resolve that request; images are kept only as email attachments and are not stored elsewhere. When you open the form from Report a Problem in the app, it is prefilled with the app version, build, OS version, distribution channel, and language, and—if Help Improve Orvia is on—the random installation diagnostics identifier for that device. All of this is shown before you submit, and you can untick it. If you include the diagnostics identifier, we can match your report to that installation’s diagnostic records, so those records become associated with your reply email. Screenshots may contain message content; please cover anything you do not want to share before uploading. To delete a feedback record, contact hello@orviamail.com.

Privacy requests

To query or delete your launch notification email, request deletion of server-side subscription, quota, support, or AI proxy records, or ask a privacy question, contact hello@orviamail.com. When a request concerns an App Store subscription, include the Apple subscription transaction identifier so the records can be located.