Privacy

When you join the beta we collect your email address so we can send your invite and updates about the beta.

When you sign up, we also check a CAPTCHA challenge (Cloudflare Turnstile) to prevent spam. Your IP address is shared with Cloudflare solely for that verification and is not stored by us for that purpose.

To protect the signup form from abuse we keep short-term rate-limiting logs that include your IP address and a timestamp. These logs are kept for 24 hours and then automatically removed.

We process personal data only where we have a lawful basis under Art. 6(1) GDPR. The table below maps each processing activity to its specific purpose, the data involved, and the legal basis we rely on.

Legitimate Interests Assessment (LIA). For anti-abuse and service-delivery processing, our interest is in keeping the site secure, available, and free from spam and automated abuse. This processing is necessary because no less intrusive means achieves the same protection, and the data involved (IP, request metadata, short-lived security tokens) is limited, not used for advertising or profiling, retained only as long as needed, and does not override your rights and freedoms. You can object at any time under Art. 21 by contacting us.

We use Mixpanel for product analytics. If you grant consent via the banner, Mixpanel receives event data such as:

• Page views (page path, URL, referrer)
• Beta signup completions
• UTM parameters (source, medium, campaign, etc.)
• Device and browser information
• IP address (used for approximate location)

Mixpanel may also record sessions (session replay) to help us understand how people interact with the site. Password fields and elements marked as sensitive are automatically masked and will appear as hidden blocks in any recording. We do not record the content of password inputs.

Analytics only starts after you click Accept on the consent banner. You can decline or withdraw consent at any time — see Your rights below.

Some of our processors — notably Cloudflare — are established in the United States, and Cloudflare additionally serves traffic from a global edge network. This means your personal data may be transferred outside the European Economic Area (EEA), the United Kingdom, and Switzerland.

For these transfers we rely on the following safeguards under GDPR Chapter V (and the equivalent UK GDPR and Swiss FADP provisions):

• EU–US Data Privacy Framework (DPF) — where the recipient is self-certified under the DPF and its UK Extension, providing an EU/UK adequacy decision basis for the transfer.
• EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914, Module 2 (controller-to-processor), where DPF coverage does not apply.
• UK International Data Transfer Addendum (IDTA) to the EU SCCs for transfers from the United Kingdom.
• Swiss addendum to the SCCs for transfers from Switzerland under the revised FADP.
• Supplementary measures — TLS in transit, encryption at rest, pseudonymisation of analytics identifiers, least-privilege access, and a transfer impact assessment for each non-EEA processor we engage.

You can request a copy of the relevant safeguards (SCCs, IDTA, or DPF certifications) by emailing hello@orionapp.co.

We keep personal data only for as long as needed for the purpose it was collected, plus any period required by law. Concrete periods per data category are listed below.

Where we are legally required to keep data longer (for example to defend a legal claim or comply with a tax or accounting obligation), we restrict processing to that purpose until the obligation ends, then delete it.

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for all traffic between your browser, our site, and our processors.
• Encryption at rest for data stored in our managed database and backups.
• Strict access controls: only a small number of authorised people can access production data, protected by strong authentication and multi-factor authentication.
• Use of vetted sub-processors with their own security certifications (e.g. SOC 2, ISO 27001) and Data Processing Agreements in place.
• Principle of data minimisation: we only collect what we need and delete it when it is no longer necessary.
• Regular review of access logs, dependencies, and security practices.

No system can be guaranteed 100% secure. If you believe you have found a security issue, please email us at hello@orionapp.co.

We take organisational and technical security measures to protect your personal data. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it (Art. 33 GDPR).
• Notify you directly if the breach is likely to result in a high risk to your rights and freedoms, unless we have implemented measures that render the data unintelligible to unauthorised persons or the notification would involve disproportionate effort (Art. 34 GDPR).

Any breach notification will include: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its potential adverse effects.

We respect the browser signals that communicate your privacy preferences automatically:

• Do Not Track (DNT) — When your browser sends a DNT signal (HTTP header DNT: 1 or the equivalent navigator property), we do not initialise analytics tracking and treat analytics cookies as declined.
• Global Privacy Control (GPC) — When your browser or extension sends a GPC signal (Sec-GPC: 1), we honour it in the same way: analytics cookies are declined and no analytics events are collected.

If you send a DNT or GPC signal, the consent banner will still appear briefly to confirm that analytics have been disabled based on your signal. You do not need to click "Reject" — the signal alone is sufficient.

You can learn more about enabling GPC at globalprivacycontrol.org.

To exercise any of these rights, email hello@orionapp.co. We respond within one month, as required by Art. 12(3). To withdraw analytics consent without contacting us, clear this site's local storage in your browser — the consent banner will reappear on your next visit.

We have not appointed a Data Protection Officer (DPO) under Art. 37 GDPR because we are not a public authority, and our core activities do not involve systematic monitoring of data subjects on a large scale or processing of special categories of personal data on a large scale.

We are established in the European Union and therefore do not require an Art. 27 EU representative.

For all privacy-related questions and requests, please contact us directly:

Orion Tasks
Email: hello@orionapp.co

We may update this privacy policy from time to time to reflect changes to our service, our sub-processors, or applicable law. The "Last updated" date at the top of this page always shows when the current version took effect.

For material changes that affect how we process your personal data, we will notify you in advance by email (to the address you provided when joining the beta) and/or by a prominent notice on the site, before the changes take effect. Where the change requires your consent under GDPR, we will ask for it again rather than rely on the previous one.