Privacy Policy and Personal Information Collection/Use Consent

Operator and global privacy contact

OrioChat is operated by an individual based in the Republic of Korea

OrioChat is operated by Holykhw Privacy, security, data-rights, account-deletion, abuse-reporting, and moderation-review requests can be sent to [email protected]

This policy reflects OrioChat's actual app functions: Cloudflare Workers for APIs, authentication, and authorization; Cloudflare D1 for account, session, friend, room, membership, billing, and report records; Cloudflare Durable Objects for real-time chat, presence, and push-to-talk control; Cloudflare R2 for media, custom emoji, and report attachments; Cloudflare Queues and D1 durable state machines for delivery and deletion jobs; Cloudflare observability and Cloudflare Pages; Cloudflare Realtime SFU for push-to-talk voice transport; local-first message storage on the user's device; optional user-started Orio Cloud backup and restore; Android push delivery through Firebase Cloud Messaging (FCM); iOS push delivery through APNs; Apple and Google sign-in; Qonversion for store entitlements where enabled; Google Mobile Ads / AdMob, consent-management signals, and advertising identifiers only where advertising is enabled

If you choose Google Sign-In, OrioChat receives only the basic Google account information authorized by you, such as your Google account identifier, email address, display name, and profile image OrioChat uses that information only for authentication, account identity, profile setup, account security, abuse prevention, customer support, and service operation The sign-in integration does not request access to Gmail, Google Photos, or other unrelated Google product data, and OrioChat does not sell Google user data or use it for advertising, unrelated profiling, or training generalized AI/ML models

Effective August 26, 2026, OrioChat stores, accesses, or collects information directly or indirectly on or from users' devices and allows its service providers to do so where applicable This includes placing, accessing, or recognizing cookies, local storage, advertising identifiers such as AdID or IDFA, SDK or device identifiers, and similar technologies on users' devices or browsers Depending on the feature, region, consent choice, and device settings, these technologies process device and app information, approximate region, advertising and consent choices, diagnostics, fraud-prevention signals, and feature state to provide, secure, measure, and operate the service OrioChat requires service providers and SDK operators to process this information only for the disclosed purposes and to provide the same or equivalent protection required by this policy and applicable law

Core retention and safety baseline

OrioChat keeps personal data only for as long as needed for the purposes described in this policy, including service delivery, local-first message delivery support, account security, content moderation, abuse prevention, legal compliance, dispute handling, billing and refund support, backup cleanup, and account deletion processing

Purchase, entitlement, cancellation, refund, and chargeback support may require transaction identifiers, entitlement state, delivery status, activation time, usage or consumption status, support history, and fraud-prevention records Safety reports, moderation actions, and safety records may be retained after content or account deletion where needed to prevent repeat abuse, handle disputes, comply with law, or protect users

For post-launch operation at scale, OrioChat may process report queues, moderation signals, appeal records, incident response records, lawful request records, account-compromise signals, rate-limit records, and transparency metrics where needed to protect users, comply with law, respond to authorities, and operate the Safety, Reporting, and Transparency Policy

AI voice model packs are downloaded from OrioChat's Cloudflare-hosted model service, integrity-checked, and stored on the user's device A model-download request may create ordinary network metadata such as an IP address, request time, requested model path, and security logs Voice conversion itself runs on the device Microphone audio is not uploaded to the model-download service or used to train a generalized AI model; only the resulting live audio follows the same Cloudflare Realtime SFU transport selected for push-to-talk communication

OrioChat will publish changes to this policy with an updated revision date It will provide advance notice or request renewed consent before a material change, a new collection or use purpose, or another change where applicable law requires notice or consent Mandatory privacy rights that cannot be waived remain unaffected

YouTube Music playlist sharing

When a user shares a public or unlisted YouTube Music playlist, OrioChat uses YouTube API Services to validate the playlist and show its playlist ID, title, owner name, item count, thumbnail, and most recent API refresh time in the user's profile capsule Opening a playlist may request its current item list from YouTube through OrioChat, but OrioChat does not store that item list or page tokens This feature does not use Google OAuth, does not receive Google account credentials, does not download or separate audio, and sends users to YouTube Music for playback

YouTube API-derived profile metadata is refreshed at least once every 30 calendar days If refresh is unavailable, OrioChat removes the API-derived title, owner, item count, thumbnail, and refresh time and keeps only the user-submitted playlist reference for a bounded retry A user can replace or remove the shared playlist in profile editing Related stored profile data is deleted through OrioChat account deletion as soon as reasonably possible and no later than 7 days after the deletion command is accepted

Learn how Google handles information in the Google Privacy Policy Google account permissions can be reviewed in Google security settings, although this playlist-sharing feature does not request Google OAuth access

Offline Emergency and online public rooms

Offline communication processes an installation/account-scoped peer identifier, display name, public keys, connection and delivery metadata, and the text, voice or location you send Keys and local history are stored on the device Bluetooth message transport does not upload that content to our delivery servers Display names and identifiers are not proof of identity or anonymity

Offline public chat and public voice can reach unknown users through relays, including devices joining later within the relay period They are not confidential Offline one-to-one payloads are encrypted for the chosen recipient; relays still process routing identifiers and metadata Recipients can save or share received content A security code verifies a key, not a real-world identity

Offline text, recorded voice and location messages remain eligible for relay for up to 24 hours from creation; live voice blocks for up to 5 minutes Local message history is eligible for cleanup after 30 days, or earlier under storage limits or local deletion Cleanup runs when the feature operates or its store reopens Peer identity keys and blocking choices remain for the lifetime of the local identity and are not deleted by clearing a conversation

Sending a location requires your action and location permission The message contains coordinates, accuracy, observation time and, when available, an address and map preview This is a sent point, not continuous location sharing With connectivity, address and map requests may send the point or displayed area to the map providers described below; opening external navigation sends its destination to that provider

Online public rooms process room titles, language, participant account/profile information, connection status and join/leave events to list rooms, control access and deliver voice and chat Other participants receive your shared content and participation events Existing Cloudflare transport and storage, push-provider and international-processing disclosures apply Chat delivery copies follow the 90-day maximum; room closure does not erase device copies or separately retained safety records

Shared policy for all supported regions

The shared policy applies across all supported regions Regional provisions are also shown in full to every reader and apply to the regions they name Mandatory local rights remain unaffected

OrioChat collects and uses personal information for account creation and sign-in, profiles, friends and contact-based friend discovery, chats, messages, media transmission, reporting and blocking, letters/mailbox, custom emoji, real-time Walkie Talkie voice communication, push notifications, security, customer support, incident analysis, and service improvement

Information processed may include email addresses, social sign-in identifiers, user IDs, personal serial numbers or friend-code identifiers, nicknames, profile images, contact-matching information, friend relationships, chat-room and message metadata, text and media sent by users, reporting and blocking records, letter/mailbox data, custom emoji data, information processed for voice communication through Cloudflare Realtime SFU, push tokens, device information, access records, and error and performance logs Depending on the features used, OrioChat may process camera, microphone, photos, videos, files, contacts, notification tokens, Bluetooth or audio-route status, Android foreground-service, overlay, and battery-optimization status, advertising IDs when ads are enabled, and biometric-authentication status for local app lock The OS processes biometric authentication; OrioChat does not receive or store biometric templates Legal-document pages may use GeoJS for IP-based country determination to display the regional document first, and users can switch regions manually on the page

Voice communications are processed to provide real-time transmission Chat messages, shared media, profile data, reports, blocks, and account records may be stored as needed to provide the service, enforce policies, prevent abuse, and comply with legal obligations

OrioChat is designed as a local-first chat service Chat history shown in the app is primarily stored in the local message database on your device Server systems are used for authentication, permission checks, push or wake signals, temporary per-recipient delivery, media transfer, delete or control events, and cloud backup or restore that you explicitly start After delivered messages are applied locally and acknowledged, server-side delivery copies may be deleted

Cloud storage and cloud backup are optional product features If you choose to upload a backup, the backup may contain selected local messages, media, message metadata, chat identifiers, room information, backup identifiers, file names, storage paths, sizes, timestamps, and transfer status Orio Cloud backups are controlled by OrioChat and can be deleted through the app's backup controls Final account deletion schedules that account's Orio Cloud backup records and stored objects for deletion as part of account-deletion processing

Secret rooms are excluded from chat export and cloud backup by design Supported secret-room text is stored and transmitted as client-side encrypted text, but secret rooms are not a promise that every communication is end-to-end encrypted or invisible to all service systems Membership, room identifiers, delivery and control metadata, timestamps, system messages, reports, security records, push and diagnostic logs, and media or voice information needed to operate the service may still be processed

Service providers may include Cloudflare for Cloudflare Workers API, authentication, and authorization; Cloudflare D1 records; Cloudflare Durable Objects real-time coordination; Cloudflare R2 object storage; Cloudflare Queues delivery and deletion jobs; Cloudflare observability; Cloudflare Pages; and Cloudflare Realtime SFU voice transport Google is used only for Android Firebase Cloud Messaging (FCM), Google sign-in, and Google Mobile Ads / AdMob and Advertising ID where advertising is enabled Apple is used for Apple sign-in, APNs, and Apple Music-related APIs selected by the user Qonversion manages subscription entitlements when paid features are enabled GeoJS may display the appropriate legal region, which users can change manually

If ads are enabled, OrioChat may process advertising identifiers, device and app information, approximate region, ad delivery and interaction data, fraud-prevention signals, and consent or privacy-choice signals Marketing-message consent is separate from advertising personalization choices See the Ads and Privacy Choices page for more detail

These providers may process or store data in the United States, Canada, Europe, Japan, Korea, and other infrastructure or subprocessor locations used to provide the service OrioChat uses these providers as service vendors or processors for hosting, storage, delivery, security, diagnostics, payments, ads where enabled, and legal-page region display

OrioChat uses reasonable technical and organizational safeguards appropriate to the service, including encrypted network transport, server-side authorization, least-privilege access controls, secure local storage, Cloudflare observability, abuse investigation, and client-side encryption at rest for supported chat text These safeguards do not mean that every message or communication is end-to-end encrypted

You may request access, correction, deletion, or other privacy assistance by contacting [email protected]

When you use GIF search or view GIF results, KLIPY may receive your search terms, a session-scoped pseudonymous customer ID, locale, IP address, viewed-content history, and, when GIF advertising is enabled, device display and ad-delivery parameters KLIPY uses this information to provide and localize GIF search and content, measure usage, prevent fraud, and deliver advertising where enabled

Purposes and legal grounds

Account identity, profiles, friends, message delivery, live voice transport and requested backups are processed to provide the service you request Security and abuse records support the legitimate interests of protecting accounts and users, subject to a balancing of rights where that legal ground applies Transaction and legally required records are processed to meet legal obligations Optional location sharing, marketing and advertising technologies use separate choices or consent where required Acknowledging this Privacy Policy is not blanket consent to every optional use Refusing an optional feature does not prevent use of unrelated features; withdrawing consent does not invalidate earlier lawful processing

Contact matching processes contact information you choose to make available for finding friends Access to your address book does not authorize unrelated advertising or disclosure of another person's details Microphone, camera, contacts, photos and location permissions can be changed in device settings Revoking a device permission stops future access through that permission; delete previously stored information through the relevant feature or request deletion separately

Retention and deletion by data type

Account, profile, friend and saved-content records remain while needed for your active account or until you remove them Account deletion has a 14-day recovery period, after which server deletion and de-identification jobs begin Deletion jobs retry failures; a recovery-period end is not a promise that every backup or external provider has completed deletion at that instant Server records of explicit legal acknowledgements are removed when account deletion is finalized Device copies, exports and recipients' copies have separate deletion controls

Temporary message-delivery copies expire no later than 90 days after the message's original delivery intent and may be removed earlier after receipt This limit concerns delivery copies, not your device history, recipients' copies, reports or optional backups Uploaded personal custom emoji become eligible for server cleanup after a 7-day grace period following entitlement expiry Deletion runs through queued cleanup; copies already sent to other users may remain on their devices Cancelling renewal alone does not begin this grace period Unfinished Orio Cloud uploads expire after 7 days After the paid cloud entitlement actually expires, the 7-day download grace period ends and retained cloud data enters cleanup; cancelling renewal alone does not start this period Deleting a backup or account also schedules the corresponding cloud records and objects for removal

Mobile diagnostic samples have a 14-day expiry; diagnostic receipt and sent-alert records have a 30-day expiry Push source-intent records have a 6-day retention threshold and terminal delivery records a 7-day threshold Expired records are processed by scheduled cleanup, which may retry after an interruption These periods do not describe every infrastructure provider's independent security logs Reports and support evidence are limited to the issue being handled and reviewed when it is closed; any continuing legal or safety need must have a recorded reason and review date Where Korean consumer-transaction retention rules apply, contract/withdrawal and payment/supply records are kept for 5 years, consumer complaint/dispute records for 3 years, and advertising records for 6 months Other legally required records follow the applicable rule These exceptions do not justify retaining unrelated conversations or location data indefinitely

Deletion removes applicable database rows and stored objects through the account or feature cleanup workflow; de-identification removes identifying links where records must remain Expired or deleted objects are removed through the relevant storage or queued-deletion mechanism rather than kept available for ordinary service use Required legal records are separated from routine use with restricted access A legal hold is limited to the relevant matter and is reviewed when the obligation ends Infrastructure backups and provider security logs may age out under separate provider-controlled cycles and are not represented as instantly overwritten You may ask which categories remain, why they remain, and the period or criteria governing their removal

Processors and international processing

Cloudflare receives the account, authentication, delivery, media, location and diagnostic data required by the feature being used, through encrypted API, storage and real-time transport requests Google receives sign-in data and Android push tokens and payloads; where enabled, Google Mobile Ads receives the advertising and consent information described on the Ads page Apple receives sign-in and iOS push data and requests to Apple Music features you select Qonversion receives account-linked purchase and entitlement information when that integration is enabled These functions have different purposes; a provider's name in this list does not authorize every listed category for every product

KLIPY receives GIF search and content-request data described above when that feature is used GeoJS receives an IP-based country lookup when the legal page needs automatic region selection Map-tile and font providers receive network requests for the map area displayed; Photon receives place-search text or the coordinates of a selected point for address lookup; an external navigation app receives the destination you open Email support is handled through Gmail, which receives the correspondence and attachments you send Do not include passwords, full payment-card details or unrelated sensitive information in a support request

Processing can cross national borders when you sign in, send or receive content, load third-party content, request support, make purchases or use optional features The infrastructure is distributed; an account's region label does not guarantee that all copies or network processing stay in that country The United States and provider infrastructure in Europe and Asia-Pacific may be involved Provider privacy, processing and subprocessor notices linked below describe their services and locations Where local law requires a more specific destination, recipient, transfer ground or consent before a transfer, that information must be provided for the affected processing You may request applicable transfer information or object by email; stopping an essential hosting or delivery transfer may require stopping the affected service You can decline optional features without declining unrelated services

International processing by provider

For Korean users, the disclosure-based exception for necessary contract-related processing or storage applies only when all legally required transfer details have been established and disclosed Advertising or recipient use for its own purposes requires its own applicable legal ground

The entries below separate the recipient location from the processing location Provider-controlled records can have different retention from OrioChat records The linked notice is also the provider contact route

Google advertising choices do not automatically authorize KLIPY advertising When advertising privacy choices are required or their status is unresolved, OrioChat does not request or display KLIPY embedded ads GIF search and content delivery still send the GIF-service data described above

Refusal and withdrawal

You can decline optional GIF, music, place-search, navigation or location-sharing features by not using them Advertising choices use the available ad privacy controls; changing a microphone or location permission uses device settings These choices concern different processing Refusing location sharing does not stop map-tile requests or an address lookup for a point you choose Ask the privacy contact to stop other international processing; essential account, hosting or delivery processing may need the affected service to stop Account deletion uses the recovery and cleanup periods above

Additional regional transfer provisions

EEA, United Kingdom and Switzerland

Where European transfer restrictions apply, the transfer requires an applicable adequacy decision or another valid safeguard EU standard contractual clauses, the UK Addendum or IDTA, and Swiss adaptations are distinct instruments You may request the applicable safeguards and a copy or description, with confidential information protected

Canada, including Quebec

Where Canadian privacy law applies, OrioChat remains accountable for personal information processed by a service provider abroad Foreign laws can permit authorities to access information Quebec requirements include assessing the protection of information before applicable communication outside Quebec and using an appropriate written agreement Contact the privacy email for questions about foreign processing and safeguards

Japan and Taiwan

Where Japanese law requires consent for provision to a foreign third party, the required country and protection information must accompany that consent; applicable exceptions and processor arrangements are assessed separately For Taiwanese users, the data categories, purpose, period, territory, recipients, methods, rights and refusal effects in this policy apply together with local transfer restrictions where relevant

Australia and New Zealand

Where Australian privacy law applies, overseas disclosure can require reasonable steps and accountability under APP 8 Under New Zealand law, an overseas agent that only processes information on behalf of OrioChat is distinguished from an overseas recipient using it for its own purposes; Principle 12 safeguards are assessed for applicable disclosures Choosing an app language does not decide which law applies

Privacy requests and complaints

Use the privacy email in this policy for access, a portable copy where applicable, correction, deletion, restriction, objection, consent withdrawal or a complaint Identify your account and the request; we ask only for proportionate verification and do not require your password We explain any refusal, retained categories and available review route For EEA and UK rights requests, the usual response period is one month; a permitted extension and its reasons are notified within that initial period Shorter local deadlines apply where required You may complain to the data-protection authority in your place of residence, work or alleged infringement Your ability to contact an authority does not depend on first accepting our response

For US residents, privacy rights depend on the law that applies to the business and the processing Where applicable, they include access, correction, deletion, portability, appeal and opting out of sale, targeted advertising or legally defined sharing, without unlawful discrimination A statement that data is not sold does not replace any required choice for targeted advertising or sharing Use the Ads page and available app privacy controls or send a rights request to the privacy email

Map, location sharing and memories

Location sharing is optional and starts only when you choose to share and grant the necessary permission While sharing is active, location updates may occur when the app is not on screen or the device is locked We process account and sharing-session identifiers, longitude/latitude, accuracy, observation and receipt times, and available movement or battery information to show the selected location and sharing status Device permissions, power management and connectivity affect updates You may browse the map without enabling friend location sharing

When you grant precise location and start sharing, OrioChat processes the device's precise coordinates to operate the sharing service even if a particular friend is configured to receive an approximate location Approximate or Fog sharing changes the point delivered to that recipient; it does not mean the original precise point was never processed Background location is used only while sharing is enabled and the required operating-system permission is granted Stopping sharing stops publication of new points after the stop request reaches the service, subject to the network-delivery and frozen-point rules below

A normal shared point expires after 5 minutes; adaptive background sharing uses up to 1 hour from the observation time A frozen point keeps the last shared position without that automatic expiry until a new sharing session or a successful stop request removes it Freezing stops movement updates, not visibility of the frozen position Closing the app or losing connection does not itself delete a frozen point Stop sharing from your map profile; if the request cannot reach the server, the earlier point remains subject to its actual expiry or frozen state

Current friendship and blocking rules determine who may receive a shared point You can choose exact, approximate or hidden location for individual friends Fog mode coarsens the location shown to friends to an approximately 2 km grid; it does not anonymize or erase the original point or conceal places you separately publish Membership of a public Crew alone does not grant access to your personal location Recipients may save or capture information they have already seen; changing a setting cannot recall those copies

Saved places include the name, coordinates, address, category such as home/work/school and save time; they stay until you delete them or the account is cleaned up Routine position updates do not create a visit-history log Journey sharing processes a chosen destination, recipient, travel mode, start time and travelling/arrived status for up to 4 hours Its expired record is removed by the location cleanup process and on later journey access; cancellation, sharing stop, a new sharing session or freezing also removes it Account cleanup includes locations, saved places, journeys and friend-specific visibility settings

A memory post can contain photos, text, place coordinates and an address and is visible to your current friends under the map's access rules Sharing it into a group chat separately exposes its preview and place information to that chat's participants Posts remain until removed or the account is cleaned up Deletion queues remove original photos and thumbnails and retry failures; copies already sent to chats or saved by recipients are separate Public Crew names, images, descriptions, chosen map places and membership information support discovery and Crew administration A Crew's chosen place is not a representation of its owner's live location Do not publish another person's private address or location without the required permission

Map tiles and place data use OpenFreeMap/OpenStreetMap and other identified map sources; external directions open the navigation service you choose or the platform default Friend coordinates are not separately sent to tile providers as a friend list Map advertising is arranged by placement, country and campaign period; this does not authorize providing friends' exact locations or private memories to advertisers Any new personalized location advertising requires its own lawful basis and applicable notice and choice

Provider privacy and processing information

Cloudflare · Cloudflare sub-processors · Google · Apple · Qonversion · KLIPY · GeoJS · OpenFreeMap · Photon