How Orla handles your family's data

What we keep

Your family's name, time zone and language; the people you add; the events and tasks on your calendar; and the emails, photos and files you send to Orla so it can read them.

Forwarded emails and photos

We store what you forward only to find events in it. Only approved senders reach your calendar; anything else is dropped before it is stored.

The AI we use

Orla reads your emails and photos with Anthropic's Claude. Anthropic does not train its models on what we send it.

Google Calendar and your Google data

When the family's owner connects Google Calendar, Orla puts the family's events in a Google calendar and keeps them up to date. It asks Google only for what each step needs, and only when the owner takes that step.

What Orla receives from Google: the connected account's email address, to show which account is connected; whenever the owner chooses where the family's events go, the list of their calendars (each one's name, whether Orla can add to it and, for one shared with them, who shared it), shown so they can choose and not kept (we keep only the calendar picked); who the calendar Orla made is shared with, so the owner can add and remove people in People; and the events in the one calendar Orla writes to: all of them when it starts following that calendar's changes (and again whenever Google asks it to start over), then each event that changes there. Orla uses only the events it added, to copy a change or a deletion made to them in Google, and discards every other event without keeping anything about it.

What Orla writes to Google: a new calendar named after your family, unless the owner picks one they have; your family's events in it (the title with the people's names, the time, the place, how it repeats, a colour and a link back to Orla, never the email or photo the event came from); and, when the owner sets someone in People to see the calendar in Google, a read-only share of the calendar Orla made with their address.

Orla uses this data only for features you see in Orla: it keeps your family's events in your Google calendar, shares that calendar with the people the owner chooses and shows you what is connected. When someone changes the title, time or place of one of these events in Google, or deletes it, Orla makes the same change to the family's event, which from then on is handled like any other event. Mimi, for example, can read it when you ask about your week; to answer, Mimi sends it to Anthropic's Claude, which doesn't train on it. We never sell Google data, never use it for advertising and never use it to train AI models. No one at Orla reads it, except with your permission when you ask us for help, for security, or when the law requires it.

Orla's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The owner can disconnect Google Calendar at any time in Settings › Calendar: Orla withdraws its access at Google at once and stops reading and writing. Anyone can also remove Orla's access from their Google Account, under Third-party apps and services.

We keep the connected account's email address, the calendar's name and Google's ids for the calendar and for the events Orla added while your family uses Orla. Google's key to your account is stored encrypted and deleted when the owner disconnects. Just before, Orla removes the shares it added; if Google can't be reached at that moment, the owner can remove them in Google Calendar, under the calendar's Settings and sharing. Events already in your Google calendar stay there: they are yours, and you can delete them, or the whole calendar, in Google. When the owner deletes the family, everything Orla holds from Google is deleted with it. To have it deleted sooner, write to privacy@orla.family.

How long we keep it

Raw emails, photos and files are deleted after 90 days, or after 30 if nothing came of them. The events they created stay until you delete them.

Who sees it

Only the people in your family, with the permission the owner gave them. We never sell your data. Someone the owner lets see the calendar sees it one of two ways: a share of the Google calendar Orla made for the family, which shows its events in their own Google account until the owner changes it, or a calendar link, which shows one calendar to anyone who has the link until it is turned off.

Who processes it for us

These services run parts of Orla. Each one receives only what its part needs.

Supabase stores the family's data, files and accounts, and signs you in.

Vercel runs Orla's servers and web pages, and counts visits and measures loading speed on those pages.

Anthropic's Claude reads the emails, photos and messages you send, so Orla and Mimi can find events and answer you. Anthropic does not train its models on them.

Google: Google Calendar, when the owner connects it, and Sign in with Google, if you use it.

Apple: Sign in with Apple, if you use it; notifications on your iPhone or iPad; and the App Store, which takes payment for Orla Plus.

RevenueCat keeps track of the family's Orla Plus subscription: the plan, when it renews and the purchase history the App Store reports.

Postmark receives the emails forwarded to your family's address and passes them to Orla.

Resend sends Orla's emails: sign-in and password emails, invites and the reminder before your free month ends.

Sentry receives crash and error reports from the app and our servers, so we can fix them.

PostHog counts how Orla is used: visits to its web pages, and events from our servers that carry only ids and settings, never what is on your calendar.

Expo delivers updates to the iPhone and iPad app.

Leaving

You can export everything at any time. When the owner deletes the family, everything — events, files and the owner's account — is permanently deleted 30 days later.

Children

Orla is used by parents and caregivers. It is not directed at children under 13.

Questions

Write to privacy@orla.family.