Privacy policy

Who is responsible

The controller of your personal data is GRASU'S LAB SRL, a company registered in Romania (registration number J2025052251008; registered office Șoseaua Nordului, Nr. 66-70, Ap. B 08, București Sectorul 1, România), trading as ogoria.

Write to contact@ogoria.com about anything in this policy. We have not appointed a Data Protection Officer, because at our size we are not required to.

What this policy covers

• the ogoria app on iPhone, iPad and Android, the web app at app.ogoria.com, and the account behind them;
• this website, ogoria.com;
• the ogoria waitlist, which some pages of this website still run.

The app and its account come first, because that is where nearly everything is. Where this policy says "the app", it means the web app too: the same app, in a browser. The website and the waitlist have their own section near the end.

Where your data lives

ogoria needs an account. First run — the habits you pick, and on a phone the notification answer you give — comes before there is one, and is kept on the phone or in the browser until you make the account on the screen after it. Nothing from first run reaches us until then.

From then on, everything lives in your account. Every task, habit and project is held in it on our servers, in the European Union, and the app reads them from there each time it shows them — so they are the same wherever you sign in, on a phone or in a browser, and the app needs a connection to show them. The phone or the browser keeps only its own settings and the sign-in.

You can take everything you wrote out at any time, without asking us. Export everything in Settings writes every task, habit and project in the account to a file — one JSON file, or one CSV per table — and hands it to your phone's own share sheet, or in a browser downloads it, so it goes wherever you send it rather than through us. The free plan exports the same everything ogoria Pro does.

What we hold, and why

This is the list for your account, and none of it exists until you make one.

What	Why
Your email address	It identifies the account, it is where a sign-in code is sent, and it is how we reach you about the account.
Your password, hashed — if you set one	Never the password itself. It is stored as an Argon2id hash, a one-way transformation: we cannot read it, and nor can anybody who takes a copy of the database.
An Apple or Google identifier — if you sign in that way	The identifier the provider uses for you, which provider it is, and the address it verified. We never receive your Apple or Google password, and we ask for nothing else — no name, no photo, no contacts.
What you write in ogoria	Task titles and notes, the day, time or deadline you gave them, a reminder time, priority, who you are waiting on, and why something was closed; habits, their cadence, when they start and end, the days you kept them and the days you paused them; projects, their why, their colour and their due date; and when all of it was created and changed.
Sign-in and confirmation codes	When you ask for a sign-in link or confirm your address, we store a one-way hash of the link and the code — never the code itself — so we can recognise it when you use it. A sign-in code works once, for 15 minutes; a confirmation link for 24 hours.
Your notification settings	Whether the morning digest is on and at what time, whether per-item reminders are on, whether you have answered that question at all, and your time zone — which is what decides when 8:00 is for you.
A push registration per installation — if the morning digest is on	The token Apple or Google gives this install, which platform it is, and when it last checked in. It addresses a device, not a person, and it is how a digest reaches you.
A record of the digests we sent	The day, the words that were sent, and how many devices they went to, so the same morning cannot be sent twice. The words can include the title of one task — the day's focus.
Your subscription, if you buy ogoria Pro	Which entitlement and product, where it was bought — the App Store, Google Play or the web app's checkout — and the dates a subscription started, renews, lapses or was refunded, plus the purchase events that reported them — and a note of which emails about it we have sent you, so none goes twice. We never see your card, your Apple ID or your Google account.
Ordinary server logs	The request, the time, the status it answered and the IP address it came from — what any web server keeps, and what we need to find a fault or to see an attack.

The phone keeps only its own settings and the sign-in: your session token, in the iOS keychain or the Android keystore; whether you chose to confirm your address later; whether this phone has had an account; what first run decided, including the habits it holds until your account exists; your notification switches; and light or dark. Per-item reminders are scheduled with your phone's own operating system from your account's tasks, and a reminder itself is not known to us at all.

The web app keeps the same kind of thing in the browser, all of it in the browser's local storage for app.ogoria.com: your session; whether you chose to confirm your address later; whether this browser has had an account; what first run decided, including the habits it holds until your account exists; and light or dark. That is strictly necessary storage — the web app cannot work without it — and there is nothing else: the web app sets no cookies and runs no analytics.

What we do not collect

This list is as much of the policy as the one above, and none of it is in the app:

• No analytics, product-metrics or session-recording service. We do not know which screens you open or how long you spend on them.
• No advertising, no ad networks, no advertising identifier, and no tracking across apps or sites.
• No location, contacts, calendar, photos, microphone or health data. The app does not ask for those permissions.
• No crash-reporting or attribution service.
• No profiling, scoring or automated decision-making of any kind.
• No selling or sharing of your data, and no use of what you write to train machine-learning models.

The only permission ogoria asks you for is notifications, and only when you turn a channel on. The web app asks for none.

The emails we send

ogoria emails you only about your own account, and only these:

• Confirm your email address — when you create an account with an email address and a password. The link works for 24 hours.
• Your sign-in link — when you ask to sign in by email: a link and a six-digit code, which work once, for 15 minutes. It is only ever sent to an address that already has an account.
• About ogoria Pro — when a free trial starts, two days before it ends, when Pro starts, when it is set not to renew, and when it ends.

These are service messages, not marketing: there is no newsletter, no re-engagement mail, and nothing about anybody else's product. They are sent through Resend, below. A subscription bought in the web app also has its receipt, and any notice about its payment, sent to the same address by RevenueCat, which runs that checkout for us. Anything else from ogoria in your inbox was written by a person at contact@ogoria.com — or, if you joined the waitlist, is one of the two emails the waitlist section describes.

The legal basis for each of them

What	Basis
Your account and everything you write in it	Performance of a contract — Article 6(1)(b) GDPR. Holding it is how the service you asked for works.
The emails about your account	Contract. Signing in, confirming your address and knowing what is happening to a subscription you pay for are part of the service.
The morning digest and per-item reminders	Contract, for a channel you switched on, together with the permission your device asked you for. Both are off until you turn them on, and turning them off in Settings stops them.
Subscriptions and what they entitle you to	Contract, and legal obligation — Article 6(1)(c) — where tax or accounting law requires a record of a purchase.
Security, abuse prevention, and keeping the service up	Our legitimate interests — Article 6(1)(f). We weighed it: the data is a log line, the alternative is a service anybody can knock over, and nothing in those logs is used to learn anything about you.
Answering an email you send us	Contract, or our legitimate interest in replying to the person who wrote.

Who else sees it

A short list, and it is the whole list. Each of these acts under a data processing agreement or as its own controller, as noted, and the processors may only do what we ask them to.

• Amazon Web Services (AWS) — runs the servers and the database your account sits on, in the European Union, and serves the web app's files and this website through its CloudFront network, from whichever of its locations is nearest to you.
• Resend (Plus Five Five, Inc., United States) — sends the app's emails: the confirmation, sign-in and ogoria Pro emails above. It receives your email address and the message. It also holds the waitlist and sends its two emails.
• RevenueCat (RevenueCat, Inc., United States) — turns a purchase into the answer the app acts on: whether your account is entitled to ogoria Pro. It receives the store's receipt data and your ogoria account id, which is how a purchase is tied to your account. It also runs the web app's checkout, so for a subscription bought there it receives your email address, which the receipt is sent to, and the details of the payment — never the card.
• Stripe (Stripe Payments Europe, Ltd., Ireland) — takes the payment for a subscription bought in the web app. It receives your card details, which never reach us, your email address, and your billing country, which decides the VAT. It processes them for us to take the payment, and as its own controller, under its own privacy policy, to prevent fraud and to meet the law on payments. When the checkout opens, Stripe's script loads in the page, so Stripe also receives your IP address and your browser's details.
• The App Store and Google Play — they sell and bill ogoria Pro on a phone and hold the payment data. They are their own controllers for the purchase, under their own privacy policies.
• Apple and Google, as sign-in providers — if you use Continue with Apple or Continue with Google, they know you signed in to ogoria. They are their own controllers for that. In a browser, the screens that offer Continue with Google load Google's sign-in script from Google as they open, whether or not you use the button, so Google receives your IP address, your browser's details, that the request came from ogoria's web app, and any cookies Google has already set in your browser.
• Google (Firebase Cloud Messaging) and Apple (Push Notification service) — deliver the morning digest, if you turn it on. They receive the push token and the words of the digest, which can name one task. Per-item reminders never leave your device.

An export is not on this list. The file is written on the phone and handed to your phone's own share sheet, so where it lands is your choice and nothing we are part of.

Beyond that, we disclose data only where the law compels us. If we ever receive such a demand we will tell you, unless we are forbidden from doing so.

Where it goes

Your account data is held in the European Union. Resend, RevenueCat, Apple and Google are United States companies, and Amazon Web Services and Stripe are each part of one, so an email, a push notification, a subscription receipt, a payment in the web app, the web app's sign-in screens, or a visit to this website or to the web app involves a transfer outside the EEA. Those transfers rely on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the company is certified under it. Ask us and we will point you at the mechanism for each.

How long we keep it

What	How long
Your account and everything in it	For as long as the account exists. Delete account & data in Settings ends it the moment you confirm; ask us by email instead and it goes within 30 days. Either way it is out of any backup within a further 30.
Sign-in and confirmation codes	They stop working after 15 minutes and 24 hours. The spent record goes with the account.
Push registrations	Until the installation stops answering — Apple or Google tells us a token is dead and we delete it — or until the account is deleted.
The record that a digest was sent	With the account, and it is deleted with the account.
Subscription records	With the account. The purchase events behind them are kept for as long as tax and accounting law requires a record of a payment, but deleting the account removes the link to you from them.
Server logs	Briefly, for security and debugging, and then they rotate away.
What your phone keeps	For as long as the app is installed. Signing out clears the session. Deleting the account clears that and what first run decided. Deleting the app takes the rest.
What your browser keeps	For as long as you keep this site's data in your browser. Signing out clears the session, which stops working after 24 hours in any case. Deleting the account clears that, whether this browser has had an account, and what first run decided. Clearing the site's data in your browser takes the rest.

Deleting your account

Open Settings from the Today tab, tap your address under Account, then Delete account & data. ogoria says what goes before anything does and offers you the export first; confirming ends it there and then. If you can't reach the button, write to contact@ogoria.com from the address on the account and we do it within 30 days. Delete your account has the steps, and exactly what is deleted and what is kept.

Cancel an ogoria Pro subscription as well, wherever you bought it: deleting an ogoria account does not stop the billing. Bought on a phone, the store, not us, holds that arrangement, so cancel it in the App Store or Google Play. Bought in the web app, cancel it from Manage subscription there before the account goes, or write to us afterwards and we cancel it.

Your rights

Under the GDPR you can ask us to:

• give you a copy of what we hold about you (access, Article 15);
• correct anything that is wrong (rectification, Article 16);
• delete it (erasure, Article 17);
• restrict or object to how we use it (Articles 18 and 21);
• send it to you or to somebody else in a portable format (Article 20);
• withdraw a consent you gave, at any time (Article 7(3)).

Much of it you can do yourself, immediately. Every task, habit and project can be edited in the app, and deleting one keeps no record of it. Export everything hands you a machine-readable copy of everything you wrote, free. Erasure is in Settings too. For anything else on this list — including a copy of what the account holds beyond what you wrote — write to contact@ogoria.com, and we answer within 30 days, free.

If you think we have handled your data badly, you can complain to the Romanian supervisory authority, ANSPDCP — dataprotection.ro — or to the authority where you live. We would rather you told us first, but that is your choice and not a condition.

How it is protected

• Everything between the app and our server travels over TLS.
• Passwords are stored as Argon2id hashes, and sign-in codes as one-way hashes — never as themselves.
• The session token lives in the iOS keychain or the Android keystore, not beside ordinary preferences.
• In a browser, the session sits in local storage that only app.ogoria.com can read. Any script running there could read it too, so the web app runs only its own code, with RevenueCat's checkout among it, Google's sign-in script, and Stripe's payment script once the checkout opens, and its Content Security Policy refuses every other. Anybody who can use your browser can use a signed-in session, so sign out on a computer you share.
• Every query is scoped to the account that owns the row, and an id that belongs to somebody else answers exactly as an id that does not exist — so nothing can be probed for.

And the part a security list usually leaves out: ogoria is not end-to-end encrypted. We hold the keys to the database, which means we could technically read what you write. We build so that we do not need to, and we say so here rather than let "encrypted" imply something it does not.

No system is perfectly secure. If a breach affects your data we will tell the supervisory authority within 72 hours where the GDPR requires it, and tell you directly where the risk to you is high.

Notifications, and what they show

The morning digest is composed on our server and delivered through Apple's and Google's notification services. It says how much the day asks of you and, when there is one, names the task worth doing first — so your own words can appear on your lock screen and pass through those two companies on the way.

Per-item reminders are different: your phone schedules and shows them itself, from your account's tasks while you are signed in, and nothing about a reminder is sent to us.

Both are off until you turn them on, both have a switch in Settings, and your device's own notification permission can be withdrawn in its settings at any time. We never send streak-guilt messages, and we never use a notification to advertise.

The web app shows no notifications of either kind.

This website, and the waitlist

This website sets no cookies and runs no analytics. Amazon Web Services, which hosts it, receives your IP address with every request, as any web server does; we keep no access logs, and do not use the address to identify anyone. Joining and leaving the waitlist each count how often one address has done so in the last minute, to slow down abuse. That count is kept under a one-way code made from the address, never the address itself, and is deleted automatically, usually within a day or two.

Some pages still carry a waitlist form. Joining it stores your email address, which page and campaign you signed up from (utm_* values, if present), and the date and version of the consent text you agreed to. We deliberately do not store your name, your IP address or your device details alongside it. Your consent — Article 6(1)(a), given by ticking a box that is never pre-ticked — is the basis, and the waitlist sends exactly two emails: a confirmation now, and one when ogoria is out. Every one carries a one-click unsubscribe link, or write to us; withdrawing does not affect anything done before. We keep the address until 12 months after launch, or until you leave, whichever comes first. It is held by Resend, and it is separate from any app account.

On a page with that form, if you arrived from an advertisement, the campaign name from the link is kept in your browser's own session storage so it survives you clicking around. It never leaves your browser unless you submit the form, and it is discarded when you close the tab. If we run advertising, a Meta (Facebook) measurement tag may be used on those pages; it will not load unless you explicitly allow it when asked, and choosing No thanks means nothing is loaded and nothing is stored.

Children

ogoria is not for children under 16, and we do not knowingly hold their personal data. If you believe a child has made an account, write to contact@ogoria.com and we will delete it and everything in it.

Changes to this policy

If this policy changes materially we will say so in the app before the change takes effect, and the date at the top will change with it. We will not quietly repurpose what we already hold: if we ever want to use your data for something other than running ogoria, we will ask you first, and no is an answer that costs you nothing.

Reaching us

GRASU'S LAB SRL, Șoseaua Nordului, Nr. 66-70, Ap. B 08, București Sectorul 1, România. Registration number J2025052251008. Email contact@ogoria.com — for a copy of your data, to have it corrected, to have it deleted, or to ask anything this policy did not answer.