This is the same policy that ships inside the app under Settings.
Orvena is a private-by-default iPhone assistant. The app has no Orvena account, advertising SDK, analytics SDK, or intermediary Orvena server. Information is stored on the iPhone unless a feature clearly names an external destination and the user chooses to use it.
Orvena can store conversation history and message attachments, files and folders the user shares for search, queued requests, scheduled tasks, recovery records for interrupted actions, tool receipts, tool approvals, connector configuration, downloaded local models, and a local Activity history. Activity retains up to 30 days and 500 entries. Tool entries contain the tool name, outcome, destination, effect, and sensitivity classification. They do not include tool arguments, entered text, or receipt titles. The Activity screen has a confirmed control that clears the history and its backup copies. API keys, OAuth tokens, and other connector credentials are stored in Keychain. Protected files use iOS data protection.
MCP action approvals show the action details while masking credential-like fields; those approval values are not added to Activity. Orvena keeps local recovery records so an interrupted remote action is not repeated automatically. If a recovery record is damaged, remote actions remain blocked until the user checks the affected destinations and explicitly resets recovery. A protected diagnostic copy may remain on the iPhone and is excluded from backup.
Calendar, reminder, contact, health, location, photo library, camera, Music library, alarm, local-network, microphone, and speech access use Apple permission APIs. Orvena reads only the protected source needed for a feature or request after the corresponding system permission has been granted. Music search and playback control run through the system Music player on the iPhone.
Downloaded MLX inference runs on the iPhone. Optional features communicate directly from the iPhone to the provider named in the app:
When a user explicitly asks Orvena to run one of their named Shortcuts, Orvena hands that request to Apple's Shortcuts app. Any further data use is determined by the shortcut and apps the user configured.
When protected-source data from Calendar, Reminders, Contacts, HealthKit, Photos, or files the user shared with Orvena would leave the iPhone for a model or tool provider, Orvena presents the named provider/data-egress gate before sending it. Health-derived data is treated as sensitive. A user can approve ordinary provider access once, for the current conversation, or for all conversations. Health and financial data can only be approved for the current request. Other sensitive-source approvals can be saved; they appear under Data sharing in Settings and can be revoked there.
Public web searches and page reads are user-directed network requests and do not require a separate approval. If Orvena would include protected data from a previous tool result in an external request, the data-egress gate still applies.
Those providers process information under their own terms and privacy policies. Provider retention, account linkage, and training choices can differ by provider and account configuration. Orvena does not control those provider practices.
Depending on the feature, permissions, and provider a user chooses, information sent for app functionality can include Health, Fitness, Other Financial Information, Precise Location, Sensitive Information, Contacts, Photos or Videos, Emails or Text Messages, Audio Data, Other User Content, Browsing History, Search History, User ID, and Device ID. A receiving provider may link that information to its account or device. Orvena does not use these categories for tracking.
Users can decline provider consent or a tool action, revoke saved tool approvals, remove API keys, disconnect connectors, remove downloaded models, and delete conversations in the app. Saved provider and tool access appears under Data sharing in Settings and can be revoked individually. Access saved for one conversation is removed when that conversation is deleted; access saved for all conversations remains until it is revoked. System permissions can be changed in iOS Settings. Deleting Orvena removes its local app data. Items stored in the iOS Keychain, such as API keys and connector credentials, are managed by iOS and may persist after deletion; remove them in the app before deleting Orvena for immediate confirmation. Removing the OpenAI key also revokes saved OpenAI consent and deletes the random OpenAI safety identifier from Keychain.
Orvena does not sell personal information, track users across other companies' apps or websites, or use information for advertising.
Orvena is not directed to children. Users must satisfy the age and eligibility requirements of any optional model or service provider they choose.
The current policy is available in Orvena Settings and on this page. Material changes will update the date and published version of this policy. Orvena is published by Orvena Labs, Denmark (CVR 46664876). Questions: privacy@orvena.app. General support: support@orvena.app.