Privacy Policy

Effective date: 4 October 2026.

Oriwa is made by Final Leap, run by Satyajeet Deshmukh, based in India. For any question or request, email hello@oriwa.app.

Oriwa is in early testing. This policy describes what Oriwa does today. We will update it as Oriwa changes.

What Oriwa is

Oriwa lets you make small personal apps by describing them. The apps you make, and the data you put in them, are yours.

What we collect and why

• When you sign in: your email address. If you use Google or Apple sign-in, we also receive your name and basic profile. We use these only to create and run your account.
• Your account details: a display name you can set, which sign-in methods you use, the devices you sign in on (a name and platform), and simple monthly counts of how many apps you have built or edited (to apply free-tier limits).
• Your app data: the apps you build and the records you keep in them.

We do not ask for anything we do not need to run Oriwa.

Where your data is stored, and who processes it

• Account details: a Neon Postgres database in the EU (region eu-central-1).
• Your app data: our sync server on Fly.io in Frankfurt, with a nightly backup copy to Cloudflare R2.
• Your app code: Cloudflare R2.
• Sign-in link emails: sent through Resend.
• Google sign-in and Apple sign-in: handled by Google and Apple.
• Abuse protection: Upstash (Redis) briefly holds your IP address, email, or account id as a rate-limit counter, so no one can flood sign-ups or sign-in links.
• Crash reports: if something fails, a technical error report may go to Sentry. It does not include your name or email.

We do not use product analytics that identify you.

Building and editing apps

When you build an app, we send your description (the words you type) to Anthropic, which runs the AI model that writes the app.

When you edit an app, we also send the app's current code and up to three sample records from each of its data collections, so the change fits your data. We never send your full data set. We do not send your name, email, or account id to Anthropic.

Google sign-in data

If you sign in with Google, we receive your name, email address, and basic profile, and nothing else. We use them only to create and run your Oriwa account. Oriwa's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

On your device

The desktop and mobile apps keep your sign-in token in your device's secure store (the system keychain). The web app keeps your sign-in token and your email in your browser's local storage so you stay signed in.

You can use Oriwa without an account. Then nothing syncs, and your app data stays only on your device. Building or editing an app still needs an account, because the request goes to Anthropic.

No ads, no selling

We do not show ads. We do not sell your data. We share it only with the service providers listed above that we need to run Oriwa.

How long we keep it

We keep your account and app data for as long as your account exists. Sign-in links are single use and expire quickly. A signed-in session lasts 30 days. We keep nightly backups of app data for recovery.

Deleting your account

Email hello@oriwa.app and ask us to delete your account. We will delete your account and its app data within 30 days.

Age

Oriwa is for people aged 18 and over.

Changes to this policy

If we change this policy, we will update this page and change the date at the top. For significant changes we will also tell signed-in users by email.