Privacy Policy

Who controls your data

The controller of personal data processed through Orillon is Czumin Wojciech Szumiński, a sole proprietorship operated by Wojciech Szumiński and registered in Poland's Central Register and Information on Economic Activity, CEIDG.

• Address: Grójecka 71/73 m. 44, 02-094 Warsaw, Poland
• NIP: 7011315886 · REGON: 544862631
• Email: wojciechszuminski0@gmail.com
• Phone: +48 660 344 552

The same email is the privacy request address. Orillon is offered through the United States App Store, but the controller is established in Poland.

Scope and age

This Policy covers the Orillon iOS app, its account and subscription services, this legal and support website, and support messages sent to us. Orillon is intended only for people aged 18 or older. We do not knowingly offer the service to children.

Before Orillon creates or restores a Supabase account or starts PostHog release checks, the first-run screen asks you to declare that you are 18 or older, agree to the Terms of Use and field-safety rules, and acknowledge this Privacy Policy. An under-18 declaration does not create an Orillon account and does not allow the service to start.

Data we collect

Depending on how you use Orillon, we process the following categories:

• Account and identity data. A pseudonymous Supabase user ID, authentication and security metadata, the Apple account identifier used for required Sign in with Apple, and any email address or private relay address Apple provides with your authorization. Apple sign-in is required before the baseline assessment. We do not receive your Apple password.
• Profile and preferences. Your chosen codename, training skills, self-selected coarse terrain, training cadence, onboarding state, notification choice, and narration preference.
• Training and progress data. Mission and drill identifiers, steps, choices, outcomes, deterministic scores, completion status, timings, latency, timezone, event IDs, and related synchronization evidence.
• Purchase and entitlement data. Product, subscription, receipt, transaction, entitlement, trial and renewal status, store environment, founding cohort status, and pseudonymous purchase lineage received from Apple and RevenueCat. We do not receive your full payment card number.
• Technical and service data. App and build version, operating system and device class, persistent installation and device/app identifiers, essential feature-flag requests and results, and authentication, subscription, HTTP, and security metadata. RevenueCat receives a vendor device identifier with native billing requests. Providers receive IP addresses to deliver and protect requests. If you enable product analytics, we process conversion steps, app return activity, and mission/drill use with your pseudonymous account ID. If you separately enable crash diagnostics, we process errors, stack information, app/build metadata, and your pseudonymous account ID. Performance monitoring is disabled.
• Deletion evidence. Account and deletion-request identifiers, a hash of the recovery credential, timestamps, provider-processing outcomes, and a separate deletion log used to prevent erased data returning in a restore. These records do not contain your training history or field-report prose.
• Support data. Your email address, message, attachments, and any troubleshooting details you choose to send.

We collect data from you, your use of the app, Apple, RevenueCat, and the providers listed below.

The app separately keeps a versioned first-run record in its local SQLite database. It records the adult declaration, accepted Terms and safety version, acknowledged Privacy Policy version, your independent analytics and crash-diagnostics choices, decision time, and receipt schema version. The installation-local record contains no account identifier, and Orillon does not upload it as a consent receipt. It remains until you uninstall the app or a required document-version change asks you to review the choices again.

Field notes and data we do not request

Free-text field-report prose is designed to remain temporary in app memory and is not intentionally uploaded to Orillon. Your device keyboard, dictation service, or a share destination you select may process what you type under its own policy. Avoid entering names or sensitive details about other people.

The current release does not ask Orillon for precise GPS location, contacts, camera or photo-library access, microphone recordings, advertising identifiers, public posts, or remote-push tokens. It does not sell personal data, act as a data broker, use cross-context behavioral advertising, or serve targeted ads.

How and why we use data

• create and secure your account and verify access through Sign in with Apple;
• deliver missions, drills, progress, export, synchronization, and personalization;
• process purchases, verify entitlement, restore access, and prevent fraud;
• operate release controls, diagnose faults, protect the service, and enforce Terms;
• calculate training results, progress, and personalization from required training measurements;
• with your consent, understand conversion, use and retention, and diagnose app crashes;
• maintain encrypted recovery copies and deletion evidence for safe outage recovery;
• answer support, privacy, safety, and legal requests; and
• meet tax, accounting, consumer, security, and other legal obligations.

Where European data-protection law applies, our legal bases are performance of our contract with you, our legitimate interests in operating, securing and improving a proportionate service, compliance with legal obligations, and consent where we ask for it. You may object to processing based on legitimate interests by contacting us; we will assess the request under applicable law.

Analytics, diagnostics, and automated output

After the required first-run acknowledgment, Orillon uses PostHog for essential release, incident-stop, minimum-build, content, and training-feature flags. These requests use a persistent pseudonymous device identifier and ordinary network metadata. They do not send product-event or feature-flag exposure events. Required flag processing continues while you use the service.

Product analytics and crash diagnostics are optional, off until you choose them, and controlled independently in the app. Product analytics records conversion steps, app return activity, mission and drill starts and completions, mission suspensions, resumptions and skips, and directive activation. Events may include stable content identifiers, content version and family, skill, chosen opener and coarse terrain, and notification-choice outcome. They do not include your answers, field notes, detailed scores or the full training record.

Optional product events go through our authenticated server to PostHog in the EU. Our server links them to your pseudonymous account ID, including an app-created account before Apple sign-in, so we can recognize return activity and handle deletion. This creates an account-linked analytics record without adding your email, codename or device identifier. We do not forward your IP address to PostHog through this analytics path. It is not anonymous processing.

If you separately enable crash diagnostics, Sentry receives errors/crashes, stack and debug information, app/build metadata, and a pseudonymous account ID used to handle deletion. Crash reports are grouped by account to keep deletion separate from other users. Performance monitoring, profiling, session replay, automatic session reporting, logs, screenshots, attachments, and breadcrumbs are disabled. Neither optional service uses autocapture or advertising tracking.

You can withdraw either choice in Config at any time. Withdrawal stops future optional collection and clears the app's pending optional data; a request already received by a provider may have completed. Withdrawal does not itself erase previously sent data or affect processing before withdrawal. Use the deletion or privacy-request controls below to request erasure. Old tester choices do not automatically enable this changed collection.

Required account, training, and purchase processing remains active. Supabase stores the training measurements needed for scores, progress, synchronization, and personalization. Apple and RevenueCat process purchases, restore requests, and entitlement checks; RevenueCat also provides purchase analysis. Essential flag, billing, update, and security requests can still use persistent account, installation, or device identifiers. This processing is not anonymous.

PostHog flag requests disable IP-derived location enrichment. Network services still receive an IP address to deliver a request, and their operational or security logs have separate purposes and retention. Disabling optional collection does not erase records previously sent by an older tester build. Contact us about those records using the request route below.

Orillon calculates training scores and learning feedback using deterministic rules. The launch release does not send your prompts or field prose to a conversational AI provider, and it does not make decisions that produce legal or similarly significant effects about you.

Providers and recipients

We use the following providers to operate Orillon:

• Supabase for authentication, database, storage, and server functions;
• RevenueCat for subscription and entitlement infrastructure;
• PostHog for essential release and training-feature flags, and optional account-linked product analytics;
• Sentry for optional account-linked crash and error diagnostics;
• Expo for app builds, compatible updates, and hosting of the legacy orillon-legal.expo.app website;
• Vercel for getorillon.com website hosting and delivery;
• Cloudflare for the independent deletion log that prevents erased accounts returning in a database restore, and as part of legacy website delivery and security;
• Google for the Gmail support inbox; and
• Apple iCloud Drive for encrypted database recovery copies, in addition to Apple's separate App Store, billing, and sign-in services.

Apple processes App Store, Sign in with Apple, purchase, billing, refund, and device information under Apple's Privacy Policy. We may also disclose information when required by law, to protect rights or safety, or in connection with a business reorganization subject to appropriate safeguards.

We limit the data sent to each provider to the purposes described above and apply the collection, access, and security controls described in this Policy. Orillon remains responsible for its collection and sharing of your data and for handling your privacy requests. Provider roles differ: some process information on our behalf, while others also process service or account information for their own purposes under their published privacy notices. The contractual and international-transfer protections that apply depend on the provider, service, and applicable terms. You may ask us for details of those protections.

International processing

The controller is in Poland, the app is offered in the United States, and providers may process data in the United States, European Economic Area, or other regions in which they operate. Applicable transfer protections can include an adequacy decision or standard contractual clauses under the relevant provider agreement. The mechanism depends on the provider, service, and destination; a provider's privacy-policy link alone does not establish that every transfer is covered. You may ask us for details and copies of applicable safeguards. Apple controls the locations used by iCloud Drive. We encrypt our recovery copies before upload, but do not promise EU-only storage for them or for every other provider path.

Retention

Retention depends on the record and its purpose. Active account, profile, training, and entitlement data is kept while your account exists and as needed to provide the service. When live account deletion completes, we remove the account-linked training history, including closed choices, scores, timings, and synchronization receipts, rather than keeping a detached event history. The separate periods below apply to necessary evidence and recovery copies.

• Training and account recovery copies: at most 30 days from capture. Encrypted database copies on the operator’s Mac and Apple iCloud Drive may contain account, authentication, profile, training, and purchase data as it existed at capture. The 30-day physical lifetime includes hidden or incomplete copies and recoverable or Recently Deleted copies. At least seven daily recovery points is a recovery minimum within that ceiling. Deletion does not immediately rewrite every copy; any restore must reapply recorded deletions and invalidate the deleted account before service reopens. A displayed expiry target is not evidence of earlier physical removal.
• Necessary purchase evidence. Minimal purchase-lineage hashes, access-period dates, and provider ordering/outcome records remain while they establish active access. Retired purchase evidence is scheduled for removal after the 90-day reconciliation period measured from the applicable access-period end or latest relevant provider event, whichever is later, once no active entitlement still relies on it. Later relevant provider evidence can change that date. Minimal webhook replay receipts expire 90 days after processing. Founding-offer capacity may remain as an occupied slot without the deleted account or purchase identifiers; it is not retained training history. We do not classify these hashes as anonymous or assume that they are tax records.
• Provider routing and deletion/status evidence. The customer identifier used to route provider cleanup is scheduled for removal 30 days after verification. The private deletion request, recovery-credential hash, and outcome receipt expire 90 days after operational completion, once completion is also acknowledged by the independent deletion log. Operational completion requires live removal and verified provider cleanup. Removal runs through scheduled maintenance. These live-system periods are separate from the 30-day lifetime of a recovery copy captured before the evidence was removed.
• Independent deletion log: normally up to 121 days after recorded completion. This separate Cloudflare log contains the account and request identifiers, a recovery-credential hash, verification metadata, and timestamps needed to prevent restoration of deleted data. It contains no training history, profile content, field prose, or payment-card details. Completed identifying entries become eligible for removal at 90 days and are removed at the next daily maintenance pass, normally within 91 days. Cloudflare’s recovery history can retain those earlier bytes for a further 30 days, making the normal total up to 121 days. Sequence markers that remain after this minimization do not contain account or request identifiers.

The completion periods start when the relevant work is complete, not when you first submit the request. Unresolved deletion or provider work retains only the evidence needed to finish and verify it. A held restore, failed maintenance, missed expiry, or overdue provider job is an operational incident that we monitor and resolve, not an indefinite routine retention category. Contact us for the status and reason for any delay affecting your request.

Export sessions stop working after one hour and are removed on a later export or account cleanup. Support correspondence is kept while the matter is open and afterward only where needed for a specific security, legal-claim, or compliance purpose. Where a particular legal obligation requires separate retention, we assess that record and explain the reason; the periods above do not claim to set Apple’s own billing retention or every provider’s independently controlled security-log period.

Optional PostHog product events are retained for up to one year, and optional Sentry crash reports for up to 30 days, unless erased earlier through a verified deletion request. These periods reflect the current provider plans. Previously sent tester records and provider recovery copies remain subject to their own verified cleanup; a new account-linked record or withdrawal of collection does not prove older records were erased.

The installation-local first-run record contains no account identifier and can survive account deletion so unchanged notices do not repeat. A separate deletion-status receipt contains a request identifier and secret credential and remains on this device until you choose to forget it; it is not an authentication account. Forgetting it removes your local status-access credential and does not change server deletion work or Apple billing.

Export and account deletion

Open Config → Account to export data or delete your account. Delete account is also available on the paywall before subscribing. When live removal completes, we delete the authentication account, profile, training-event history, synchronization receipts, personalization, and account progress from the live account systems. Applicable Sign in with Apple authorization is revoked. Device cleanup removes local account data and retires the old analytics and billing identity and caches; a failed local cleanup remains retryable.

The account-deletion confirmation establishes live account removal. Provider cleanup is a separate background process and continues without keeping the app open. RevenueCat customer deletion is requested only after the customer and aliases are matched to the deleted account. A shared or ambiguous customer needs scoped review. A provider’s queued response is not completion: absence must be observed on two separate runs at least 24 hours apart. Our operational target is verification within seven days of the deletion request, not a guaranteed deadline. Outages, missing authorization, or unresolved identity scope can take longer and remain visible as pending work.

The app keeps a separate status receipt so you can check account removal, verified provider cleanup, and the recovery-copy expiry target without signing in or creating another account. Keep its secret private. A pending status does not mean provider cleanup is complete; an unavailable or expired receipt does not establish a new deletion result. The status does not promise immediate deletion of every backup or of Apple’s independently controlled records. Section 9 explains the remaining evidence and recovery periods.

If a saved request can no longer be verified, an explicit device-only reset may clear local data. That action does not confirm remote account deletion, cancel the deletion request, or cancel a subscription. You may contact us to resolve an unavailable status or unfinished cleanup. The normal in-app deletion flow does not require an email.

Email wojciechszuminski0@gmail.com with the subject “Account deletion” for unfinished work, an inaccessible receipt, or a review of retained/provider records. Do not send passwords or your deletion-status secret. We assess the record, necessary remaining processing, and any specific legal retention reason and explain the outcome.

Deleting the app or Orillon account does not cancel an Apple subscription. Billing, cancellation, refunds, and Apple’s purchase records are handled separately by Apple. Manage billing at Apple Subscriptions. Orillon’s deletion status does not confirm deletion of Apple’s records.

Your privacy choices and rights

Subject to applicable law, you may request access, a portable copy, correction, deletion, restriction, or information about disclosure; object to certain processing; withdraw consent where consent is the basis; and appeal or complain to a regulator. We do not discriminate against you for exercising a privacy right.

Email wojciechszuminski0@gmail.com with the subject “Privacy request.” We may verify your identity and an authorized agent's authority before acting. You may also complain to the President of the Polish Personal Data Protection Office or another competent authority.

You can change notification permission in iOS Settings. These legal and support pages have no client-side analytics, optional cookies, forms, or browser storage. Because Orillon does not use cross-site advertising tracking, browser “Do Not Track” signals do not change its behavior.

In the app, Config → Privacy shows Product analytics and Crash diagnostics as independent optional choices. You can enable or withdraw either choice there. Essential flag checks, required training measurements, and purchase processing continue independently. The Privacy Policy and Terms of Use remain available under Config → Legal & Support.

Security

We use access controls, transport encryption, row-level database controls, pseudonymous identifiers, restricted event fields, and server-side entitlement checks. No system is completely secure, so please use device security, keep your Apple account protected, and contact us if you suspect unauthorized access.

Policy changes

We may update this Policy when the product, providers, law, or release territory changes. We will post the new version and effective date here and provide additional notice when required. Material new collection or use may require a new choice before it begins.

Version public-us-1.4, effective 15 September 2026, describes removal of live account and training data, provider verification and status access, required service processing, independent optional analytics/crash choices, and separate retention for recovery copies and necessary deletion/purchase evidence.

Contact

Questions, privacy requests, and complaints can be sent to wojciechszuminski0@gmail.com. See the Support page for billing, account, and technical help.