ORA · LAST UPDATED OCTOBER 26, 2026
Privacy Policy
Your inner world deserves care. Here is what Ora processes, why, and the choices you have.
Guest experience and usage
Ora creates a random guest credential, stored in iPhone Keychain or browser storage, to recognize repeat visits without an email account. The server stores its hash and usage records for free Rara messages, reading gifts and Flow sessions. This is not an advertising identifier or a device fingerprint. On explicit sign-in, used allowances are linked to the account so the same gifts are not issued again. Guest access never grants account history, memory or Premium rights.
Guest drafts and explicit saving
Current guest conversations and unconfirmed readings are kept only in memory for this visit. They are not automatically saved to device history or cloud storage. If you choose Save and then successfully sign in, only the entry you asked to save is added to My Space. Closing login cancels that save request. AI still requires your separate consent; successful gifted replies may be briefly cached for retry handling as described below.
Your onboarding profile
If you choose to provide your gender, age range, preferred name, goals or current feelings, Ora saves these details to your signed-in account. Before sign-in, your choices stay on your device and are linked to the account you sign into next. You can skip these questions or edit them in Settings under Your Ora journey. Deleting your account deletes this profile. These choices do not automatically enable conversation memory.
Who operates Ora
Ora: Inner World is operated by Jiayi Sun. This policy covers the Ora website, iPhone app, paired Apple Watch app and widgets. For privacy requests, contact yaoyaohuayuan.us@gmail.com. You can read this policy without creating an account.
Accounts and sign-in
Ora uses a verified email and password. Resend delivers six-digit codes for registration, password reset, email change and account deletion. Codes expire in five minutes, have purpose isolation and attempt/request limits, and issue a short-lived single-use operation credential. Passwords use salted one-way scrypt hashes. Access sessions last 15 minutes; rotating refresh sessions last at most 30 days. The server stores token hashes. iPhone uses Keychain; Web uses HttpOnly cookies. Existing accounts prove control of their original verified email or username/password before completing migration with the same account ID. Profile photos and nicknames are optional.
Email verification
Resend sends purpose-specific verification codes. Codes and operation tokens expire after five minutes; the server stores only their digests, expiry and attempt data. Unverified profile addresses are not login identities. Apple sign-in and phone login are no longer offered. Historical contact and Apple linkage tables are retained as inactive migration structures.
Local records and optional cloud sync
Legacy guest records already on this device remain separate and are copied into an account only when you explicitly import them. Current guest drafts follow the guest-saving rules above. Signing in does not automatically enable cloud sync. If you enable cloud sync, Ora stores the current account’s conversations, saved moments, activity records, sound creations and preferences in its cloud database so you can use them across supported App and Web sessions. Switching cloud sync off deletes its current cloud snapshot while keeping local records.
Rara and DeepSeek processing
Only after you allow AI data sharing and request a response, Ora sends DeepSeek up to 30 recent messages, the original question, selected earlier conversation excerpts, relevant card readings, current activity and feeling context, your language and relevant enabled memories. This information is used to generate an AI response. Cloud sync and AI sharing are separate: using Rara sends this context even if cloud sync is off. Ora does not deliberately include your account identifier, email, phone number or IP address in the AI prompt. However, text you write can identify you. DeepSeek processes the information under its applicable terms and privacy policy; we do not promise zero retention or that information already sent can be recalled. Do not include passwords, payment details, recovery codes or information you do not want the provider to receive.
Optional Rara memory
Memory requires a separate opt-in. It can store up to 50 explicitly shared facts, such as your preferences or goals, with supporting quotations and timestamps. Review individual memories or use Forget all in Settings to delete them. Switching memory off stops new collection and use; it does not itself delete existing memories.
Subscriptions and Apple
Apple processes your payment; Ora does not store your payment-card details. To verify access, Ora stores transaction and original transaction identifiers, product, environment, expiry, renewal and refund or revocation status associated with your Ora account. Your account identifier is also sent to Apple as the appAccountToken. Server notifications update subscription status. Limited transaction records, without the deleted account identifier or account token, remain after account deletion to prevent reassignment and handle subscriptions or disputes. Deleting an Ora account does not cancel billing through Apple.
Watch, widgets and device permissions
The paired iPhone and Watch exchange an account or guest-space identifier, selected deck, language, quote theme, favorites, playback state and controls. Card, mood and breathing records are first saved locally and transferred to the corresponding Ora space on iPhone. They are uploaded only if that account has enabled cloud sync. Premium access is verified through Apple; designated internal owner and review accounts can also verify access through a limited server token. Quote widgets display public daily content rather than private chat messages. Ora does not read heart rate or Apple Health data. Motion data is used locally for card reflections and the sound bowl. Notifications support local reminders. Ora does not request contacts, photos or device location, or record microphone audio. Sound creations contain instrument settings and note sequences, not microphone recordings.
Security and diagnostic information
Servers receive network information such as IP addresses. Ora uses hashed IP and account-related keys, request counts and time windows for security and rate limits. Application error records contain request identifiers, error codes, upstream response status and retry information, without conversation text or explicit account identifiers. Hosting infrastructure may process additional request metadata to maintain and protect the service. There are no advertising or third-party behavioral tracking SDKs in the current implementation. Ora does not sell personal data or use it for targeted advertising.
Service providers and international processing
Ora runs its Web, API and account database on an independently hosted server in Singapore. Ora uses DeepSeek for requested AI responses, Apple for in-app purchases and Resend for email verification. Resend receives the email address and code needed to deliver your request. Support messages go to a Gmail mailbox, which receives your email address, message and attachments. We may ask for device and app versions, an error message and reproduction steps. Other service providers may process data outside Singapore or your country. Network transmission is encrypted. Provider-specific retention, infrastructure logs and backups are subject to applicable service arrangements and policies; this policy does not promise a fixed deletion period for all provider records.
Your choices, rights and retention
You can withdraw AI sharing in Settings to stop new AI requests on that device. You can switch off cloud sync, review and delete memories, and delete your account. Account data, synced content and memories are generally kept to provide your chosen features until you remove them or delete the account. Security information is retained for abuse prevention and service operation; limited transaction records are retained as described above. Depending on your location, you may have rights to access, correct, delete or obtain your data, object to or restrict certain processing, withdraw consent, or complain to a relevant privacy authority. Contact support for a request you cannot complete in the app. We may need to verify your identity. Necessary account and service processing supports the features you request; optional AI sharing, cloud sync and memory follow your separate choices.
Reading gift usage
To grant reading gifts once per account and handle failed or duplicate requests, the server stores campaign, reading and message identifiers, content hashes and usage status. Successful replies may be cached briefly; after 10 minutes, reply text is cleared on the account’s next allowance check or reading request. Usage records remain until account deletion. This does not save a reading to My Space or enable cloud sync or Rara memory.
Account deletion
Open Ora → Space → Settings → Delete account. Review the warning and confirm permanent deletion twice. Reauthenticate with your password or a delete-account email code before confirming. Deletion removes the account profile, sessions, linked verified contacts, memories and cloud-synced content, and clears current-device account content. Offline devices may retain local copies. Limited transaction, security and provider records described above may remain. Cancel Apple subscriptions separately.
Updates and contact
We update this policy and its date when practices change and seek additional permission when required. For privacy, access, correction or deletion assistance, email yaoyaohuayuan.us@gmail.com. DeepSeek’s policy is available at https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html and Apple’s at https://www.apple.com/legal/privacy/.
Questions? yaoyaohuayuan.us@gmail.com