Privacy Policy

ORU is a private journaling, archive, and personal correspondence service operated by Put Jaoroenrak (“ORU,” “we,” “us,” or “our”). Privacy is fundamental to how ORU is designed. This Privacy Policy explains what information ORU processes, why we process it, how it is protected, the service providers we use, and the choices and rights available to you. By using ORU, you acknowledge the practices described in this Privacy Policy.

1. What ORU Is

ORU lets you create and preserve private Journals, maintain a personal archive, exchange private Letters with people you choose, and preserve eligible encrypted media. ORU is designed so that private archive content is protected through encryption and access to that content depends on credentials and recovery mechanisms under your control. ORU does not sell advertising, sell your personal information, or use the contents of private Journals or Letters for advertising.

2. Information We Process

The information ORU processes depends on the features you use.

2.1 Account and authentication information

When you create or access an ORU account, we may process information such as:

• your account identifier;
• email address;
• name or profile information supplied through a sign-in provider;
• username;
• authentication and session information; and
• information necessary to secure and maintain your account.

Authentication may be provided through services such as Apple, Google, LINE, and Clerk. Those providers may separately process information according to their own privacy policies.

2.2 Journals and archive content

You may create Journals containing text and other information you choose to preserve. ORU is designed to encrypt private Journal content before it is stored remotely. We do not use the contents of private Journals for advertising or advertising profiling. Certain operational information may be processed separately from encrypted content where necessary to provide the service, such as record identifiers, ownership information, synchronization state, storage state, timestamps, and entitlement information.

2.3 Letters

ORU allows private Letters between eligible ORU accounts. For a new Letter to another person, ORU requires an accepted relationship between the sender and recipient. Self-Letters remain permitted. A pending request alone does not permit a new Letter. We may process information necessary to deliver and manage Letters, including:

• sender and recipient account identifiers;
• relationship state;
• delivery or release state;
• encrypted Letter content; and
• operational metadata required to deliver the Letter.

Removing a relationship prevents new Letters until the relationship is accepted again, but does not automatically delete Letters that were already delivered. ORU does not provide a public Letter feed, anonymous chat, or random matching service.

2.4 Blocking

ORU allows users to block another user. Blocking is persistent and enforced by the service. While a block remains active, new communication between the affected users is denied through normal ORU communication flows. Blocking does not automatically delete previously delivered Letters. ORU may process limited block information such as:

• the account that created the block;
• the blocked account; and
• the time or state of the block.

When an account is deleted, blocks owned by that account are removed. A block created by another account may remain where necessary to preserve that user's safety control.

2.5 Safety reports

Users may report a received Letter or its sender for reasons including:

• harassment or bullying;
• sexual or inappropriate content;
• threats or violence;
• spam or scams;
• illegal content; or
• another safety concern.

A report may include:

• the reporting account;
• the reported account;
• the relevant Letter identifier;
• the selected report reason;
• the date and status of the report; and
• information necessary to review the report.

Private Letter text is not included by default. If you choose Include Letter, the plaintext contents of that specific Letter are voluntarily disclosed to ORU for review. Choosing to include one reported Letter does not give ORU access to your unrelated Letters, Journals, or future communications. Reported Letter plaintext is scheduled to expire from ORU's active report records after approximately 30 days. Non-content report metadata is scheduled to expire after approximately 180 days. ORU uses automated cleanup processes to remove expired report information from active systems. Deletion from active systems may not necessarily cause immediate deletion from infrastructure backups. Backup-retention behavior depends on the applicable infrastructure provider and retention process.

2.6 Local outgoing safety checks

Before a Letter is encrypted and sent, ORU may perform a limited safety check locally on your device. This safeguard is designed to identify a narrow set of clearly prohibited or high-risk patterns. Depending on the result, ORU may warn you or prevent the Letter from being sent. The local safety check:

• runs on the device;
• does not send ordinary Letter plaintext to a remote moderation service;
• does not provide ORU with general access to private Letters; and
• is not intended to identify every possible form of harmful or prohibited content.

ORU does not continuously monitor the plaintext contents of private correspondence.

2.7 Photos, video, and audio

If you choose to preserve media, ORU may access photos, videos, camera input, or microphone input only when you use the relevant feature and grant the required device permission. Private Media Preservation follows a local-processing model. For V1:

• still images are processed locally into an archive-optimized JPEG representation;
• unnecessary private metadata may be removed during processing;
• Live Photos selected through the image workflow preserve the still-image component rather than the paired motion component;
• accepted video is limited to a maximum duration of two minutes;
• preserved video is limited to a maximum resolution of 720p while maintaining appropriate aspect ratio and orientation;
• audio may support longer recordings or files; and
• private media is encrypted locally before cloud preservation.

ORU does not promise to preserve the exact original file, format, metadata, resolution, encoding, or byte-for-byte source representation you selected. Cloud-preserved private media is stored as encrypted data rather than ordinary readable media.

2.8 Location

If you choose to add location information to a Journal, ORU may access your device location after you grant permission. Location access is optional and is used to provide the feature you requested. ORU does not use your location for advertising or cross-app tracking.

2.9 Purchases and subscription information

When you purchase ORU Lifetime or Media Preservation through Apple's App Store, Apple processes the payment. ORU does not receive your complete payment-card information. We may receive and process purchase-related information such as:

• the product purchased;
• entitlement status;
• transaction or purchase identifiers;
• subscription status;
• renewal or expiration state; and
• information necessary to restore purchases or prevent improper transfer of purchases between accounts.

RevenueCat may be used to help verify and manage App Store purchase and subscription status.

2.10 Device and technical information

ORU may process limited technical information necessary to operate, protect, troubleshoot, or synchronize the service. This may include:

• application version;
• operating system or device-related technical information;
• network request information;
• synchronization state;
• security state;
• error state; and
• server-generated operational identifiers.

ORU does not use device signals to fingerprint you for advertising.

3. How We Use Information

We process information where reasonably necessary to operate ORU, including to:

• create and authenticate your account;
• provide Journals, Letters, archive, and Media Preservation features;
• synchronize eligible information between devices;
• protect encrypted content;
• maintain purchase and subscription entitlements;
• enforce Journal and Media Preservation limits;
• restore purchases;
• prevent fraud, abuse, and unauthorized purchase transfer;
• enforce accepted-relationship and blocking rules;
• process safety reports;
• respond to support and privacy requests;
• maintain security and reliability;
• comply with applicable law; and
• protect the rights and safety of ORU and its users.

We do not use private Journal or Letter content to create advertising profiles.

4. Safety and Abuse Prevention

ORU is designed to reduce abuse while preserving the privacy of ordinary correspondence. Safety measures include:

• accepted relationships for new non-self Letters;
• blocking;
• reporting;
• limited local safety checks before certain Letters are sent; and
• manual review of information voluntarily submitted through a safety report.

ORU does not represent that these safeguards can identify or prevent every form of harmful content or behavior. Ordinary private Letters are not centrally scanned in plaintext.

5. Legal Bases

Where applicable privacy law requires a legal basis for processing, ORU may rely on one or more of the following:

• performance of a contract, where processing is necessary to provide ORU features you request;
• consent, including where you grant device permissions or voluntarily include a private Letter in a safety report;
• legitimate interests, where necessary to secure, maintain, prevent abuse of, and operate the service, provided those interests do not override your rights;
• legal obligations, where information must be processed or retained to comply with law; and
• other lawful bases permitted by applicable privacy law.

You may withdraw consent for permission-based processing through your device settings or other controls where available. Withdrawal does not affect processing that was lawful before withdrawal.

6. Encryption and Recovery

ORU uses encryption to protect private archive content. Your ability to access encrypted content may depend on your trusted device, authentication credentials, PIN, Recovery Words, encryption keys, or other recovery mechanisms provided by ORU. ORU is intentionally designed without a general administrative backdoor into your private encrypted archive. This means that if you lose all available recovery methods, some encrypted content may become permanently inaccessible. You are responsible for keeping your Recovery Words and other recovery credentials secure. Do not share your Recovery Words with anyone. ORU support will never need your Recovery Words to provide ordinary support.

7. Media Encryption and Cloud Preservation

Private media intended for Media Preservation is processed and encrypted locally before upload. ORU's Media Preservation architecture is designed so that the cloud object-storage provider receives encrypted media rather than ordinary readable private media. Separate cryptographic keys may be used for preserved media objects and protected through ORU's archive-key architecture. Cloud storage infrastructure is not intended to receive the archive keys required to decrypt your private preserved media.

8. Service Providers

ORU uses third-party infrastructure providers to operate the service. Depending on the features you use, these may include:

• Clerk — authentication and account infrastructure;
• Convex — backend application and synchronization infrastructure;
• RevenueCat — purchase, entitlement, and subscription infrastructure;
• Cloudflare — encrypted Media Preservation object storage;
• Apple — App Store distribution, payments, device services, and Sign in with Apple;
• Google — Google authentication, if you choose Google Sign-In;
• LINE — LINE authentication, if you choose LINE Login.

These providers process information to the extent necessary for their respective services and are subject to their own legal and privacy obligations. Private Media Preservation objects stored through Cloudflare are intended to reach Cloudflare only after encryption. We do not authorize service providers to use private ORU content for their own advertising purposes.

9. International Data Processing

ORU and its service providers may process or store information in countries other than the country where you live. Where applicable law requires safeguards for international transfers of personal information, we take reasonable steps to use service providers and transfer mechanisms intended to provide appropriate protection.

10. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy. In general:

• account information is retained while your account remains active;
• encrypted Journal and Letter data is retained while associated with your archive unless deleted in accordance with product behavior;
• operational information may be retained for as long as reasonably necessary to operate and secure the service;
• voluntarily disclosed reported Letter plaintext is scheduled for removal from active report records after approximately 30 days;
• safety-report metadata is scheduled for removal after approximately 180 days;
• block information is retained while the block remains active or while reasonably required to enforce a user's safety preference;
• purchase and entitlement information may be retained where necessary to restore purchases, prevent transfer or fraud, meet accounting requirements, or comply with law;
• Media Preservation data may be retained while your storage subscription is active and, following expiration, during an applicable grace or recovery period.

Expiration of Media Preservation does not itself delete your Journal text or ORU Lifetime ownership. After an applicable Media Preservation grace period, cloud-preserved media may eventually be deleted according to ORU's then-current retention procedures. ORU does not promise an indefinite grace period.

11. Account Deletion

ORU provides a way to initiate deletion of your account from within the app. When you delete your account, ORU will delete or de-identify personal data associated with the account from ORU-controlled active systems unless retention is reasonably necessary for:

• legal compliance;
• fraud prevention;
• dispute resolution;
• security;
• abuse or safety investigations;
• accounting;
• purchase restoration; or
• enforcement of non-transferable purchase ownership.

Blocks created by the deleted account are removed. Safety reports that remain within their applicable retention period, and blocks created by other users, may survive account deletion where necessary for safety, integrity, or enforcement. Certain transaction records may remain with Apple, RevenueCat, or other providers independently of your ORU account. Deleting your ORU account does not automatically cancel an App Store subscription. You should manage or cancel active subscriptions through your Apple account. Some information held temporarily on your device may remain in local application storage or cache until it is removed by ORU's cleanup process, application data is cleared, or the application is removed.

12. Media Preservation After Cancellation

Media Preservation is a recurring storage service separate from ORU Lifetime. If Media Preservation ends:

• new cloud-media preservation may stop;
• your ORU Lifetime ownership, if any, remains unaffected;
• Journal text remains unaffected; and
• existing preserved media is not intended to be immediately deleted solely because the subscription ended.

ORU may provide a grace period or opportunity to retrieve or export preserved media before eventual deletion. The exact grace period may change as the service evolves and will be communicated where appropriate.

13. Your Privacy Rights

Depending on where you live, including under Thailand's Personal Data Protection Act and other applicable privacy laws, you may have rights relating to your personal information. These may include the right to:

• request access;
• request correction;
• request deletion or erasure;
• request restriction of certain processing;
• object to certain processing;
• withdraw consent where processing relies on consent;
• request portability of eligible data;
• obtain information about how your data is processed; and
• lodge a complaint with an appropriate data-protection authority.

These rights may be subject to legal exceptions.

To exercise a privacy right, contact: puthj.z@gmail.com

We may need to verify your identity before completing certain requests.

14. Device Permissions

ORU may request access to device capabilities including:

• Face ID;
• location;
• photos;
• camera;
• microphone; and
• notifications.

Permissions are requested for the corresponding feature and may be disabled through your device settings. Certain features may not function if the required permission is denied.

15. Tracking and Advertising

ORU does not operate an advertising network. ORU does not sell your personal information. ORU does not use private Journal, Letter, location, or preserved media content for cross-company advertising tracking. If ORU's analytics or advertising practices materially change in the future, this Policy and applicable consent mechanisms will be updated where required.

16. Security

We use technical and organizational measures designed to protect ORU and the information processed through it. These include measures such as:

• encryption;
• authentication;
• access controls;
• owner-scoped data access;
• locally performed sensitive processing where appropriate; and
• limited access to production infrastructure.

No software, device, network, or storage system can guarantee absolute security. You are responsible for protecting your device, account credentials, PIN, and Recovery Words.

17. Children's Privacy

ORU is not designed to knowingly solicit personal information from children in violation of applicable law. Where parental or guardian consent is legally required, that consent must be obtained before using ORU. If you believe a child has provided personal information in circumstances that violate applicable law, contact puthj.z@gmail.com.

18. Safety Concerns

If you experience harassment, threats, abusive content, fraud, illegal conduct, or another safety concern involving ORU, you may use available in-app reporting and blocking controls.

You may also contact: puthj.z@gmail.com

ORU may review reports and take reasonable action where appropriate. Because ordinary private Letters are encrypted, ORU does not normally have access to their plaintext contents. A recipient may explicitly choose to include a specific Letter with a safety report for manual review.

19. Changes to This Policy

We may update this Privacy Policy when ORU changes, our service providers change, or legal requirements change. If a change materially affects how we process personal information, we will take reasonable steps to provide notice where required. The effective date at the top of this Policy shows when it was most recently updated.

20. Contact

Questions about ORU, this Policy, privacy rights, or safety concerns may be sent to:

ORU
Operated by Put Jaoroenrak
Thailand
puthj.z@gmail.com