Privacy Policy

This Privacy Policy explains how Oriva ("we", "us", "our") collects, uses, and protects your personal information when you use the Oriva website at oriva.dev and the Oriva mobile apps for iOS and Android (together, the "Service"). Oriva is operated by David Jameson trading as DeskJockey Digital. For the purposes of UK GDPR and EU GDPR, we are the data controller of personal data processed through the Service.

The iOS and Android apps are thin native shells (built with Capacitor) around the same Oriva web experience. Everything in this policy applies equally to the web and the native apps, except where a section calls out a native-only or web-only difference.

1. Who can use Oriva

Oriva is intended for adults aged 18 and over. When you create an account you must confirm that you are 18 or older; this confirmation, together with its timestamp, is stored on your profile as an immutable audit record. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Creating an account, uploading content and taking part as a member (for example subscribing, vouching or reporting) require you to confirm that you are 18 or older. Public areas of Oriva — such as Discover, public profiles and Worlds, and published public memories — may be viewed without creating an account.

2. Information we collect

• Account data: email address and a securely hashed password, and short-lived one-time email codes used for verification and sign-in. On the website you may instead sign in with Google or Apple, in which case we store the linked provider identifier; the iOS app uses email sign-in only. We do not receive or store your social-provider password. We also store your 18+ age confirmation and its timestamp.
• Push notification tokens (iOS app, only if you turn them on): if you enable Push Notifications in Settings and allow them in iOS, we store the Apple Push Notification service (APNs) device token for that device, linked to your account, together with when it was registered. It is used only to deliver Oriva notifications to that device. It is not used for advertising or tracking, and is not shared with anyone other than Apple for delivery.
• Profile data: display name, username, biography, avatar image, profile header style, profile visibility setting (private/public), discoverability flag, and consent records (terms acceptance and privacy acknowledgement timestamps).
• Content you create: countries you mark as visited, lived in, or wishlisted; places (name, coordinates, country) resolved from third-party place-search results and cached; memories (title, notes, date, country, optional linked place); uploaded photographs (stored in a private object-storage bucket and only made accessible via time-limited signed URLs, or via public read paths when you have opted a memory into your public world); collections that group countries, places, or memories. Coordinates are only recorded for places you explicitly choose from search results — Oriva does not access your device GPS.
• Trust & safety data: reports you submit through the in-app "Report" action on a profile or memory (reason, optional detail, timestamp, and the account or content being reported), and the list of accounts you have blocked from Settings → Blocked accounts. Reports are visible only to us and are used to review potential policy violations. Authorised moderators may access the reported account and inspect the reported content, including a memory that is otherwise private, solely for trust and safety review.
• Share activity: a lightweight record of share actions you initiate (which share card, which surface) used to power personal referral attribution and abuse-prevention rate limits. We do not receive information back from the destination platform.
• Usage and device data: log data such as IP address, browser/user-agent string, device identifiers, requested pages, and timestamps, collected transiently by our hosting and CDN providers for security, abuse prevention, and operational diagnostics. On iOS and Android, the operating system may also collect standard crash and performance telemetry through the App Store / Google Play channels.
• Product analytics and error data (only with your Analytics consent): if you turn Analytics on, we use PostHog (EU-hosted endpoint) for product analytics. This covers three things: named product events we send deliberately — such as creating, updating or deleting a memory, changing a country status, updating your profile, changing profile visibility, completing onboarding, and sharing or exporting; page views within the app; and PostHog’s configured autocapture behaviour, which records generic interaction signals such as clicks on elements and the page they occurred on. We also send error/exception reports. Where you are signed in, these events are linked to your Oriva user ID and email address. Session recording (session replay) is not enabled, IP data is discarded by our PostHog project configuration rather than retained against your events, and we do not use PostHog for advertising, cross-site tracking or data brokerage. Under our current consent gate PostHog is not initialised and captures nothing at all before you grant Analytics consent; if you withdraw consent, capture is stopped and the PostHog identity is reset.
• Place search queries: when you search for a place, the text you type is sent server-side to the Photon geocoding service (operated by Komoot) to return matching results. We do not collect precise device location.
• Email and lifecycle data: we send your email address, first name, Oriva user ID, signup date, signup source, marketing subscription state, and limited lifecycle event names and properties (for example memory_created, memory_count_reached, country_completed, onboarding_completed, profile_updated, country_status_set, bucket_list_updated, inactive_14_days) to our email provider, Loops. Memory text, photographs and place coordinates are not sent to Loops.
• Communications: messages you send us through support, feedback, or bug reports (these open your own email client — Oriva does not host an in-app inbox).

Visitors without an account. If you browse public Oriva content without signing in, we do not create an account, profile or other database record for you, and you cannot post, subscribe, vouch or submit reports. The following is processed:

• Session navigation state: small values in your browser’s sessionStorage that keep you in browsing mode while the tab is open and remember which sign-up prompt you chose (see the Cookie Policy). These stay on your device and are cleared when the browser session ends.
• Consent preferences: your cookie/analytics choice, stored on your device.
• Connection data: the technical request data (such as IP address, browser and device information) that our hosting and content-delivery providers process to deliver pages and images, as described for all visitors in this policy.
• Exploration analytics (only with your Analytics consent): if you turn Analytics on, PostHog records your browsing under an anonymous identifier, including entering browsing mode, screens viewed, when a sign-up prompt is shown and which option you choose. Without Analytics consent none of this is captured.

If you granted Analytics consent and later create an account or sign in on the same device, that earlier anonymous PostHog activity may be associated with your Oriva account, so we can understand how people arrive at signing up.

Social features. Oriva offers a small number of social features, and stores the records needed to provide them:

• Subscribe: you can subscribe to a public traveller. We store the relationship (your account, their account, and when it was created). Who subscribes to whom is never shown publicly; a public profile shows only its total number of subscribers. The traveller receives an in-app notification that names you and links to your profile only if your own profile is public; otherwise it says that someone subscribed. Subscribers see the traveller’s future public memories.
• Vouch: you can vouch for another traveller’s public memory, up to a limit on active vouches. We store the vouch (your account, the memory, and when). Public surfaces show only vouch totals. The memory’s owner is notified and can see who vouched only where that person’s profile is public; private travellers are never identified.
• Activity: in-app notifications about your own account, such as new subscribers, vouches and travel milestones. They are visible only to you. If you have turned on push notifications in the iOS app, some of these (new memories from travellers you subscribe to, vouches, new subscribers and vouch milestones) are also sent to your device as push notifications. Lock-screen notifications contain only a short public-safe title and generic text — never memory captions, notes, photos or locations.

When a profile is switched to Private, it and its content are removed from public surfaces, it cannot gain new subscribers, and its memories stop appearing to existing subscribers. Existing subscriber relationships are kept rather than deleted, and only the owner can still see their own subscriber count. If the profile is switched back to Public, those relationships become active again. Blocking an account removes any subscription between the two accounts. Oriva does not offer in-app messaging, comments or likes.

3. Lawful bases for processing (UK & EU GDPR)

• Contract (Art. 6(1)(b)): to create and operate your account and deliver the Service you've signed up for.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent abuse, understand how the product is used, and improve it. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): for optional features such as making your profile public, and for any non-essential cookies or analytics where consent is required.
• Legal obligation (Art. 6(1)(c)): where we must comply with applicable law (for example responding to lawful requests).

4. Public profiles and discoverability

Each Oriva account has a visibility setting that you control in Settings → Profile visibility. By default profiles are private and are not publicly discoverable.

If you choose Public, you consent to your profile and any content you have marked as public being accessible:

• via a direct link to your public profile page, public country pages, and public place pages;
• through current and future search functionality within the Service;
• through Discover (Search Users, Featured Worlds, Recently Updated Worlds, and Recommended Worlds);
• through share cards you generate and share externally, and through the Open Graph / social preview metadata rendered for those public URLs;
• through indexing by search engines that crawl public pages in accordance with our robots.txt and per-page indexing directives.

When your profile is public, the following may be visible to anyone, including visitors who do not have an Oriva account: username, display name, avatar, biography, public memories, public photographs, your public World (country) data, public places, public collections, publicly displayed Travel Identity information, and public statistics. You can return your profile to Private at any time. Switching to Private removes your profile from discovery surfaces and future search-engine crawls; however, copies already shared externally (such as downloaded share cards, cached search results, or links a viewer has already saved) cannot be recalled.

The Oriva landing page at oriva.dev embeds a live, read-only preview of the Oriva app inside a phone-shaped frame. That preview loads the same public routes any visitor could open directly. It does not display private accounts or private content.

5. How we use your information

• to create and manage your account and authenticate sign-in (by email and password or one-time email code, or on the website via Google or Apple where you choose those providers);
• to send push notifications to your iOS device about activity on your account, where you have turned them on;
• to host, store, process, and display the content you create;
• to render public profiles, public country/place pages, and share cards when you choose to share;
• to send essential service emails (verification, password resets, magic-link sign-in, email-change confirmations, security notices) via our email delivery service, sent from oriva.dev;
• to send Oriva marketing and lifecycle emails (feature news, travel milestones, and occasional reminders when your World has been inactive) via Loops, where you have given marketing consent;
• to create a Traveller Story video when you ask for one (see “Traveller Story” below);
• to understand product usage and diagnose errors through PostHog, where you have given analytics consent;
• to return place-search results by sending your search text to the Photon geocoding service;
• to receive, triage and act on in-app reports and to enforce blocks between accounts;
• to provide support, respond to feedback, and process bug reports;
• to keep the Service secure, detect abuse, and enforce our Terms of Use and Acceptable Use Policy;
• to comply with legal obligations.

Traveller Story. When you choose to create a Traveller Story, Oriva uses information already in your World (your name and username, countries, Bucket List, memories and their photographs, places and travel identity) to make a short cinematic video. The video and its preview picture are made on your device, inside the Oriva app or your browser. They are not uploaded to Oriva and are not stored as part of your account. Oriva does not publish your Traveller Story anywhere. You decide whether to save it or share it; if you share it through another app or service, that service receives the video and its own terms and privacy policy apply. On iPhone, a temporary copy of the video is written to the app’s cache so the Share Sheet can use it, and is removed once the Share Sheet closes. Our analytics record only that the feature was used (for example, that it was opened), not your photos, text, locations or the video itself.

5a. Marketing email and consent

Marketing consent is off by default. It is stored against your account (profiles.marketing_consent), and if you make an explicit choice before your account exists, that choice is applied to your account after you sign up. When marketing consent is on, your Loops contact is set to subscribed and added to our “Oriva Users” mailing list; when it is off, your contact is set to unsubscribed and removed from that list. You can withdraw consent at any time from cookie preferences or by using the unsubscribe link in an email, which also clears the marketing consent state on your account. Essential transactional emails (verification, password reset, magic link, email-change, security notices) are sent separately and are not affected by marketing consent.

6. Sharing and sub-processors

We do not sell your personal data, we do not share it with data brokers, and we do not share it for cross-context behavioural advertising. We share data only with service providers ("sub-processors") who help us run the Service:

• Lovable Cloud (backed by Supabase, Inc.) — application backend, Postgres database, authentication, private object storage for uploaded photographs (memory-photos, avatars), and server-side functions. Primary processor for account data and Your Content.
• Cloudflare, Inc. — content delivery, DNS, edge runtime for our server functions, and DDoS/edge security. Processes request metadata (IP address, request headers) transiently.
• Lovable (GPTEngineer AB) — hosting and deployment platform for the web application at oriva.dev, and the transactional email delivery pipeline used for verification, password reset, magic-link, email-change, reauthentication, and other account emails, sent from oriva.dev.
• PostHog — product analytics and error/exception monitoring, using the EU-hosted endpoint eu.i.posthog.com. Only initialised after you grant Analytics consent. Receives named product events, in-app page views, PostHog’s configured autocapture interaction signals, and error/exception reports. Where you are signed in, events are linked to your Oriva user ID and email address. Session recording is not enabled, no PostHog integrations or destinations are configured, IP data is discarded by our project configuration, and PostHog is not used for advertising or cross-site tracking.
• Loops — lifecycle and marketing email delivery. Receives your email address, first name, Oriva user ID, signup date, source, marketing subscription state, and limited lifecycle event names with properties (including inactive_14_days). It does not receive memory text, photographs or place coordinates.
• Photon (operated by Komoot GmbH) — place/geocoding search. Receives the place-search text you type, sent from our servers. It does not receive precise device location.
• OpenFreeMap (OpenMapTiles OÜ) — serves the vector base-map tiles used inside the World map view. Tile requests include your IP address and the tile coordinates being requested; no cookies are set by the tile server. Map data © OpenStreetMap contributors.
• OpenStreetMap — where embedded or static map content is used, loading it may cause network requests to OpenStreetMap infrastructure, which will see your IP address.
• jsDelivr — public CDN used to deliver world-atlas / TopoJSON map geometry files. Requests include your IP address.
• Google Fonts — the app loads the Inter and Instrument Serif web fonts from fonts.googleapis.com and fonts.gstatic.com on every page load, so that Oriva renders in its intended typefaces. These requests include your IP address, user-agent and the referring page. No Oriva account data is sent, and Google Fonts is not used for advertising or analytics by us.
• Google and Apple — identity providers for “Sign in with Google” and “Sign in with Apple” on the website. They process your sign-in under their own privacy notices. They are not Oriva marketing or advertising providers.
• Apple Push Notification service (Apple Inc.) — delivers push notifications to iOS devices where you have turned them on. Apple receives your device token and the notification itself (a short public-safe title and generic text, plus an internal reference used to open the right screen). No memory captions, notes, photos or locations are included.
• Public share destinations — when you tap a share-card action (e.g. Instagram, TikTok, WhatsApp, Messages, Mail, or the system share sheet), the image and any link you send are handed to that destination and processed under its own terms and privacy notice. Oriva does not send anything on your behalf.
• Future payment processor (e.g. Stripe) if and when premium subscriptions are introduced, for payment processing only.

Sub-processors process personal data on our instructions under appropriate contractual terms. We may also disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of Oriva, our users, or others.

Oriva does not use advertising networks, cross-site trackers, fingerprinting, session replay, or data brokers, and there is no advertising identifier (IDFA / App Tracking Transparency) implementation in the iOS app.

7. International data transfers

Some of our sub-processors are located outside the UK and EEA, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or adequacy decisions.

8. Data retention and account deletion

We retain your account data and content for as long as your account is active. When you delete your account from Settings → Delete account, we remove your core account and content data from the live Service, including your profile, countries, memories, user-place links, share records, subscription record, uploaded avatar and memory photographs, registered push notification devices, and your authentication account. Signing out of the iOS app removes that device’s push registration, and turning push notifications off in Settings or in iOS stops delivery to that device.

Deleting your authentication account also removes records that are linked to it in our database, including reports you have submitted, your block list, your subscriptions and your subscribers, vouches you have given, your in-app activity notifications, and the lifecycle-event records used to avoid sending you the same milestone email twice. In other words, we do not keep a shadow moderation history about you in the live database after deletion.

Traveller Story videos and their preview pictures are never stored by Oriva, so there is nothing of them to delete from our systems. Any copy you saved to your device or shared with another service stays under your control and is not removed by deleting your Oriva account.

A limited set of records is not removed:

• Canonical place records — shared, non-personal reference data (a place name, coordinates and country) that other people’s memories also point at. These are not your personal account content.
• Email suppression / unsubscribe records and email delivery records — retained so that an unsubscribe or bounce continues to be honoured and so we can evidence deliverability. These hold your email address and the suppression reason, and nothing else about you.

Residual copies may also persist in encrypted backups for a limited period before being overwritten, and our processors run their own retention processes. In particular, deleting your Oriva account does not currently delete your contact record at our email provider, Loops — that contact (email address, first name, Oriva user ID, signup date and subscription state) may remain with Loops until it is removed separately. We cannot guarantee that every record held by every processor is deleted immediately. If you would like your processor-side records removed, contact us at hello@deskjockeydigital.co.uk and we will action it where we are able to.

9. Your rights

Under UK GDPR, EU GDPR, and applicable North American privacy laws, you have the following rights:

• access a copy of the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data (the "right to erasure");
• request that we restrict or object to certain processing;
• request data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local EU supervisory authority.

You can exercise most of these rights directly in the app (edit profile, change visibility, delete account). For other requests, contact us at hello@deskjockeydigital.co.uk.

10. Security

We use encryption in transit (TLS), database-level row-level security, and industry standard password hashing. Uploaded photographs are re-encoded on your device before upload using a canvas pipeline that writes out only the visible pixels, so embedded metadata such as EXIF GPS coordinates, camera identifiers and thumbnail chunks is not carried into the stored file. This behaviour depends on your device's browser or WebView and we cannot guarantee it in every environment. No service can be guaranteed 100% secure; please use a strong, unique password and keep your credentials confidential.

11. Cookies, local storage and native device storage

On the web, Oriva uses cookies and browser local/session storage to keep you signed in and to remember preferences. In the iOS and Android apps the equivalent state (auth session, preferences, guest world data) is held in the app's own sandboxed storage on your device rather than in browser cookies, but is used for the same purposes and is removed if you delete the app or your account. See our Cookie Policy for the full list.

iOS app features

• Push notifications are off until you turn them on in Settings and allow them in iOS. You can turn them off at any time in Oriva Settings or in iOS Settings.
• App ratings: the iOS app may occasionally ask iOS to show Apple’s standard rating prompt. Apple decides whether it appears and handles any rating or review you give; Oriva does not receive your rating, review or whether the prompt was shown.
• Links: Oriva links (for example to public profiles, places, countries and memories) may open directly in the iOS app instead of the browser. This is handled by iOS and no extra data is collected.
• Camera and photos are only accessed when you choose to add a photo. Oriva does not access your device location.

12. Future premium features

If and when Oriva introduces premium subscriptions or other paid features, payments will be processed by a third-party payment provider (such as Stripe). We will only receive the billing information necessary to manage your subscription; full card details are handled by the payment provider under their own terms and privacy notice.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where changes are material, notify you in-app or by email.

14. Contact

Questions about this Privacy Policy or your data can be sent to hello@deskjockeydigital.co.uk, or by post to David Jameson trading as DeskJockey Digital, Office 15396, 182–184 High Street North, East Ham, London, E6 2JA.