Privacy Policy

Effective date: 24 October 2026.

Oriwa is made by Final Leap, run by Satyajeet Deshmukh, based in India. For any question or request, email finalleapai@gmail.com.

Oriwa is in early testing. This policy describes what Oriwa does today. We will update it as Oriwa changes.

What Oriwa is

Oriwa lets you make small personal apps by describing them, and ask one assistant across all of them. The apps you make, and the data you put in them, are yours.

What we collect and why

• When you sign in: your email address. If you use Google or Apple sign-in, we also receive your name and basic profile. We use these only to create and run your account.
• Your account details: a display name you can set, which sign-in methods you use, the devices you sign in on (a name and platform), and simple monthly counts of how many apps you have built or edited (to apply free-tier limits).
• Your app data: the apps you build and the records you keep in them.
• Files you add inside an app (for example a photo, a PDF, or an audio clip), if the app supports files.

We do not ask for anything we do not need to run Oriwa.

Where your data lives

Your app data lives on your device first. If you are signed in, a synced copy is kept on our servers so it reaches your other devices and can be recovered:

• Account details: a Neon Postgres database in the EU (Frankfurt, eu-central-1).
• Your app data: our sync server on Fly.io in Frankfurt, with a nightly backup copy to Cloudflare R2.
• Your app code: Cloudflare R2.
• Files you add inside an app: Cloudflare R2, and cached on your devices. You can delete a file inside the app; the stored copy is then removed.

The companies that process your data, and why

• Anthropic runs the AI model that builds and edits your apps and answers your questions (see the two sections below). Anthropic does not use what we send it to train its AI models.
• Resend delivers your sign-in link emails.
• Google and Apple handle their sign-in, if you choose it.
• Cloudflare and Fly.io host our servers and storage; Neon hosts the accounts database.
• Upstash (Redis) holds short-lived abuse-protection counters. Each counter key is a one-way hash of your IP address, email, or account id with a secret, so Upstash never receives any of those in readable form.
• Sentry receives a technical error report if something fails. We do not attach your name, email, or account id to it. An error report may occasionally include a small fragment of the data being processed when the error happened.

We do not use advertising or analytics that identify you across the web.

Building and editing apps

When you build an app, we send your description (the words you type) to Anthropic, which runs the AI model that writes the app. No existing data of yours is sent.

When you edit an app, we also send the app's current code and up to three sample records from each of its data collections, so the change fits your data. We never send your full data set, and we do not send your name, email, or account id to Anthropic.

Ask Oriwa

When you ask Oriwa a question, we read the records of the apps your question is about from your device and send them, with your question, to the AI model (Anthropic) to answer. We keep nothing from an assistant conversation on our servers beyond 24 hours; the conversation itself stays in your app data on your device. We do not send your name, email, or account id.

Voice input

Voice input is not yet offered to anyone other than the developer. Before we offer it to users, we will update this policy to name the speech-to-text provider we use and explain how your audio is handled.

Sign-in

We sign you in with a one-time email link (delivered by Resend), or with Google or Apple. We do not use passwords. A signed-in session lasts 30 days.

If you sign in with Google, we receive your name, email address, and basic profile, and nothing else, and we use them only to create and run your Oriwa account. Oriwa's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

On your device

The desktop and mobile apps keep your sign-in token in your device's secure store (the system keychain). The web app keeps you signed in with a secure, HttpOnly cookie that scripts on the page cannot read; it does not store your sign-in token or email in your browser's local storage.

You can use Oriwa without an account. Then nothing syncs, and your app data stays only on your device. Building or editing an app still needs an account, because the request goes to Anthropic.

Device permissions an app can ask for

An app can ask to use your camera, microphone, location, notifications, or clipboard. Each one is granted per app, by you, after we show a card naming the app and the reason. We record nothing from these: what the camera or microphone captures, your location, and clipboard text stay inside the app on your device and are never sent to our servers or to Anthropic. Local reminders are scheduled on your device; this version never sends you a push notification from our servers. You can remove any of these permissions from the app at any time, and your browser or system settings can revoke them at the device level.

Link previews in Wishlist

When you paste a product link into the Wishlist app, the server fetches that link to read its title, price, and image so the card fills in for you (apps on your device have no internet access of their own, so we do this for them). We fetch only the exact address you paste, over a secure connection, with no cookies; we keep the title, price, and image with your wishlist item and store nothing else about the page. If a site blocks us or has no details, the card is filled in from the link text instead.

No ads, no selling

We do not show ads. We do not sell your data. We share it only with the service providers listed above that we need to run Oriwa.

How long we keep it

We keep your account and app data for as long as your account exists. Sign-in links are single use and expire quickly. A signed-in session lasts 30 days. We keep nightly backups of app data for recovery; backup copies are kept for up to 30 days. When you delete an app or a record, it is removed for good after a 30-day grace period. Technical usage records that have no app content in them are kept for up to 90 days.

Deleting your account

To delete your account, open Settings, then Account, then Delete account, in the app or at app.oriwa.app. You can also email finalleapai@gmail.com. We delete your account and app data within 30 days, and remaining backup copies expire within a further 30 days.

Age

Oriwa is for people aged 18 and over.

Changes to this policy

If we change this policy, we will update this page and change the date at the top. For significant changes we will also tell signed-in users by email.