Privacy Policy

Orchy is operated by Openhours Private Limited, India. This policy covers the Orchy mobile app, orchy.in, the waitlist, support, and the early Bengaluru beta.

The current app is an 18+ voice-and-text social concierge beta. It helps you talk through plans and preferences. Events, public people discovery, payments, advertising, and push notifications are not active in this release.

We collect the phone number used for SMS sign-in, or the email address used for the alternate email sign-in path. We also keep an internal account identifier and authentication metadata needed to secure and operate your account.

During onboarding, we collect your name, date of birth, gender, selected Bengaluru area, location-check result and method, consent record, main profile photo, and verification status. Date of birth is used for the 18+ eligibility gate. Your profile photo is private in this beta.

If you ask the app to check your location, it requests an approximate foreground location and classifies the result on your device. Orchy does not send or store the raw latitude or longitude. We store the resulting Bengaluru eligibility state and the area or city you enter. You can use the manual Bengaluru confirmation path instead of giving location permission.

We process the text you type, live microphone audio during a call, Orbie's responses, final conversation transcripts, timestamps, and technical request records. Voice audio is carried in real time and is not intentionally recorded by Orchy in the current release. Final text or transcript content may be saved so the conversation can continue across sessions.

Orchy can save useful preferences and facts as account-bound memory. These may include food needs, interests, planning preferences, and weekend intent you confirm. You can review and delete saved memory in the app, and profile information can be edited separately.

Before the first Orbie interaction, the app asks for permission to share the information needed for that interaction with third-party AI providers. You can decline. If you later withdraw that permission, AI chat and voice cannot operate, but privacy and account-deletion controls remain available.

The beta uses a private main profile photo as the reference for face verification. When you start the live check, AWS processes the profile photo and live camera frames to check liveness and whether the person matches the selected photo.

Orchy stores the profile photo and the verification result and related metadata. Orchy does not store the live-check video. AWS may retain limited operational or security records under its service settings and policies; we do not claim a shorter provider retention period unless it has been verified in the relevant account.

If you report an Orbie response or another safety concern, we collect the selected reason, optional note, relevant response reference, status, and audit information. Restricted safety reports may be reviewed by authorized operators and used to investigate misuse, protect users, or meet legal obligations.

We also process content-minimized service logs, timing and error data, abuse-prevention counters, hashed phone or network subjects, and call or request identifiers. The mobile beta has no advertising SDK and does not use your data for ads or cross-service advertising tracking.

If you contact support, we receive the information in your message and the contact details you use. Never send us an OTP, password, or payment credential.

If you join the waitlist, we collect the details and preferences you submit. The website may also process browser, device, referral, page-interaction, security, error, and rate-limit information through its hosting, analytics, error-monitoring, anti-abuse, and delivery services.

Website analytics are used to understand performance and improve Orchy. They are not used for advertising or to sell personal information.

We use Supabase for authentication, database, and private photo storage; MessageCentral for SMS OTP; Cloudflare and AWS for network delivery, hosting, operations, and security; LiveKit for real-time voice transport; Microsoft Azure OpenAI for voice processing; OpenAI for text, memory extraction, and embeddings; and AWS Rekognition for face liveness and comparison.

The website also uses Vercel for hosting, Cloudflare Turnstile and rate-limiting infrastructure for abuse prevention, PostHog for product analytics, and Sentry for error monitoring where enabled. An authentication or email provider may deliver account email codes.

These providers process only the data needed for their role. Some may process data outside India. Their own security, abuse-prevention, and backup records can follow provider-controlled schedules that Orchy cannot delete instantly. We do not sell personal information and do not share it with advertisers or data brokers.

Account, profile, photo, conversation, memory, and beta-intent data are generally kept while your account is active and removed through account deletion, subject to the exceptions below. Replaced photos are removed through backend cleanup. Authentication and storage cleanup can finish asynchronously after the in-app account record is removed.

Routine AWS service logs are currently configured for 30 days. Raw restricted safety-report text is currently designed to expire after 365 days. Short abuse-prevention counters and hashed OTP-limit subjects expire or are pruned on shorter operational schedules. Support email remains subject to the mailbox provider and our support needs.

After account deletion, limited pseudonymized safety, fraud-prevention, dispute, legal, and deletion-proof records may remain. Provider logs and backups may remain until their configured or provider-controlled expiry. A deleted account cannot be restored from those limited records.

You can edit profile information, review and delete saved memory, decline optional location and microphone access, report an Orbie response, sign out, and request account deletion from Privacy & data in the app.

You can also request account deletion without the app at orchy.in/delete-account. You may ask us to access or correct your information, or withdraw consent, by emailing hello@orchy.in. We may need to verify that you own the account before acting on a request.

We use encrypted transport, authenticated APIs, access controls, private storage, and restricted operator paths. No service is perfectly secure. Please report a suspected security or privacy issue to hello@orchy.in.

Orchy is for adults aged 18 and over and is not directed to children. If we learn that a person under 18 created an account, we may restrict and delete it.

We may update this policy as the beta changes. We will update the date above and provide additional notice or ask for new consent when required.

Openhours Private Limited, India. For privacy, support, correction, consent, or deletion questions, email hello@orchy.in.