Opora — Privacy Policy

Effective date: 11 October 2026 · Version: 1.0 · Last updated: 11 October 2026

1. Who we are

Opora ("Opora", "the App", "we", "us") is an iOS application: an AI journal and companion you talk to every day about what is going on in your life.

The App is operated by:

Ivan Bannikov, Individual Entrepreneur (ინდივიდუალური მეწარმე) registered in Georgia

• Identification number: 304675625
• Registered address: Nino and Ilia Nakashidze Str. N1, Building N3, Apt. 3, Krtsanisi District, Tbilisi, Georgia
• Email: ivandiv13@gmail.com
• Website: https://ivandiv13.github.io/opora-legal

We are the data controller for the personal data described in this policy. That means we decide why and how your data is processed.

This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to the Opora iOS app and to https://ivandiv13.github.io/opora-legal.

2. Summary in plain language

• What you write or say to Opora is personal by nature. We treat all of it as sensitive, and we ask for your explicit consent before the first conversation.
• We do not keep your conversations. The full text of a conversation is kept only while it is needed to answer you and to write a short summary of your day, and is permanently deleted within 72 hours. After that, Opora keeps only the summaries, insights and short notes it uses to remember you (section 3.3).
• We do not read your conversations or your journal. The only exceptions are if you send us part of it yourself, or if the law requires it (section 6).
• Opora's replies are written by AI language models from third-party providers. To answer you, we send them your conversation and the name you asked Opora to call you — never your email, your Apple ID or your account identifier. They may not use it to train their models.
• We do not sell your data, we do not show ads, and we do not use the Advertising Identifier (IDFA).
• Everything is encrypted in transit and at rest. Voice messages are converted to text and the audio is never stored.
• You can delete your account and everything attached to it from inside the App at any time.

3. What data we collect

3.1 Account data

When you open the App for the first time, an anonymous account is created for you automatically, so you can start without giving us any contact details. You can later link it to Sign in with Apple so your journal survives a reinstall or a new phone. If you choose Apple's "Hide My Email", we only ever receive Apple's private relay address. We never issue or store passwords.

3.2 Profile

• How you would like Opora to address you — a name, a nickname, or anything else you choose. It does not have to be your real name.
• The grammatical gender you choose, so that Opora addresses you correctly in languages that need it
• Interface and conversation language
• Your device's time zone (not your location), so that your "day" and your reminders follow your local time
• The date and version of the documents you accepted, and the date you completed the intro conversation

3.3 Your conversations and journal

This is the core of the App and the data we are most careful with. It falls into two parts.

Conversation text — kept for no more than 72 hours.

• Messages you write or dictate to Opora, and Opora's replies, including the intro conversation
• We need this text for two things only: to show you today's conversation and continue it, and — once your day's conversation is over — to write the summary described below.
• After that, the full text is permanently deleted, no later than 72 hours after the conversation took place. We do not keep an archive of your conversations.

What Opora keeps to remember you — kept until you delete your account.

• Summaries of each day's conversation, with a few short quotes in your own words
• Insights — daily and weekly reflections, and observations about recurring patterns
• A short written profile: the facts and context Opora needs to remember you from one day to the next (for example, what you are working on or who the important people in your life are)
• From the intro conversation: the topic you chose, how you described what is bothering you, and its analysis
• Check-ups: the scores (0–10) you give to areas of your life in the balance wheel, and your notes on them

These are what you see in your journal, and what lets Opora pick up where you left off. You can delete them at any time by deleting your account.

Each reply also gets a short emotion label (so the companion character can react); this label is computed on the fly and not stored.

3.4 Sensitive information

Conversations with a journal companion naturally touch on your mood, your relationships, your health, and sometimes other very private matters. Under the GDPR and the Law of Georgia on Personal Data Protection, some of this may be special category data — for example information about your mental or physical health, your sex life or sexual orientation, or your religious beliefs.

We process it only with your explicit consent, which you give in the App before your first conversation, and only to provide the service to you. You decide what to share; nothing in the App requires you to disclose this kind of information.

3.5 Voice messages

If you choose to dictate a message, the App asks for microphone permission. You can decline it or withdraw it at any time in iOS Settings → Opora; typing works without it.

Your recording is sent over an encrypted connection to our server, which forwards it to our speech-to-text provider (section 5) and receives the text back. The audio is kept only in memory for the duration of that request. It is never written to disk or stored in our database. Only the resulting text becomes part of your conversation.

3.6 Notifications

If you allow notifications, we store your device's push token so we can send you reminders.

Some reminders are written by Opora based on your recent conversations and may address you the way you asked Opora to. Depending on your iOS settings, they can appear on your lock screen. You can turn notifications off, or hide previews, in iOS Settings → Notifications → Opora.

3.7 Purchase and subscription data

Subscriptions are sold through the Apple App Store and managed with RevenueCat. In connection with a purchase we or our processors receive:

• Subscription status, plan, expiry and renewal dates
• Transaction identifiers issued by Apple, price and currency
• Basic device, operating-system and app-version information collected by the RevenueCat SDK

We never receive your payment card details, bank details or billing address. Those are handled entirely by Apple.

3.8 Product events

We record a small fixed set of events around the subscription screen — that it was shown, closed, or failed to load, and whether a purchase or restore went through — together with your account identifier, the plan and where the screen was opened from. These events never contain anything you wrote.

We do not use Firebase Analytics, Amplitude, Mixpanel, AppsFlyer or any comparable third-party analytics SDK.

3.9 Technical data

• Your IP address, used in memory for rate limiting and abuse prevention, and recorded in standard web-server logs
• Account identifiers, timestamps and error context in our application logs, used to keep the service running

Our logs are designed not to contain the content of your conversations. In rare error cases a short fragment of AI-generated text may be recorded so that we can diagnose the fault; these logs are deleted on the schedule in section 8.

3.10 What we do not collect

• No advertising identifier (IDFA), no App Tracking Transparency prompt, no cross-app or cross-site tracking
• No location — only your time zone
• No contacts, photos, calendar, or data from Apple Health
• No payment instrument data
• No stored audio recordings

4. How AI processing works

Opora's replies, summaries and insights are generated by large language models run by third-party providers. We reach them through OpenRouter, a routing service. Currently the models come from Anthropic (Claude) and Google (Gemini).

What we send with each request:

• how you asked Opora to address you, your chosen grammatical gender and language;
• the text of the conversation the request is about (for the daily conversation, today's conversation so far);
• context Opora keeps about you: summaries and quotes from your recent sessions and your written profile (section 3.3).

What we never send: your email address, your Apple account, your account identifier, your IP address, or your payment data.

We send requests only to providers that do not use them to train their models. AI providers may retain requests for a limited period for abuse monitoring under their own terms; they do not receive anything that identifies your account.

Apart from these AI providers and the infrastructure providers listed in section 5, your conversations and journal are not shared with anyone.

AI-generated content can be inaccurate. Opora is not a medical or psychological service — see our Terms of Use and Safety page.

5. Who we share data with

We share personal data only with service providers who process it on our instructions ("data processors"), and only to the extent needed to run the App. We do not sell personal data and we do not share it for advertising.

We may also disclose data:

• where we are legally required to, by a competent authority acting lawfully;
• where we believe in good faith that disclosure is necessary to protect someone's life or physical safety;
• to establish, exercise or defend legal claims;
• to a successor entity in a merger or sale of the business, in which case you will be notified and this policy will continue to apply until replaced.

6. Who can read your conversations

Nobody at Opora reads your conversations or your journal. They exist so that the AI can answer you and so that you can see your own journal — not for us.

There are only two exceptions:

• you share something with us yourself — for example, you paste part of a conversation into a support request. We then use it only to help you;
• the law requires it — a competent authority makes a lawful request that we are obliged to comply with.

We do not use your conversations or journal for marketing, for research, or to improve our prompts. To understand how Opora is used, we look only at aggregate figures (for example, how many conversations took place on a given day), which do not involve opening anyone's conversations.

7. Why we process your data, and our legal basis

For users in the EEA and the UK, our legal bases under the GDPR are:

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited, expected, and does not override them. You may object at any time — see section 9.

You can withdraw your consent to the processing of special category data at any time by deleting your account (section 10) or by writing to us. Because talking to Opora is the service itself, we cannot continue to provide it without that consent.

For users in Georgia, the corresponding grounds are those set out in the Law of Georgia on Personal Data Protection: your consent (in written or equivalent electronic form for special category data), performance of a contract to which you are a party, and our legitimate interests.

8. How long we keep data

9. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — a copy of the personal data we hold about you
• Rectification — correction of inaccurate or incomplete data
• Erasure — deletion of your data ("right to be forgotten")
• Restriction — to have us pause processing while a dispute is resolved
• Portability — your data in a structured, machine-readable format
• Objection — to processing based on legitimate interests
• Withdrawal of consent — where processing is based on consent, without affecting processing already carried out. Microphone and notification permissions can be withdrawn in iOS Settings → Opora.
• Complaint — to a supervisory authority (section 13)

To exercise any of these, email ivandiv13@gmail.com. We respond within 30 days, and will tell you if we need to extend that period for a complex request. We do not charge for these requests unless they are manifestly unfounded or repetitive.

Because you can use Opora without giving us an email address, we may ask you to confirm control of your account — for example, by sending the request from the email linked to your Sign in with Apple account, or by following instructions we give you in the App — before acting on a request, so that we never disclose your journal to someone else.

9.1 Automated processing

Opora's replies, summaries, insights and your written profile are produced automatically by AI models. They affect what Opora says to you and nothing else: they produce no legal effects and no similarly significant effects on you within the meaning of Article 22 GDPR. If something Opora has written about you is wrong, tell it so in conversation, or ask us to correct or delete it.

10. Deleting your account

You can delete your account from inside the App: Settings → Delete account.

Deletion removes your account and, with it, everything attached to it: your profile, any conversation text from the last 72 hours, journal entries, check-ups, summaries, insights, your written profile, push tokens, product events and our copy of your purchase records. If you signed in with Apple, we also revoke Opora's access to your Apple account. This is immediate and irreversible — there is no restore.

Copies may remain for a short time in backups and logs, as described in section 8.

Deleting the App from your device does not delete your account. Your App Store subscription is managed by Apple and must be cancelled separately in iOS Settings → your name → Subscriptions.

11. Security

We apply measures appropriate to the sensitivity of the data, including:

• Data minimisation: the full text of conversations is deleted within 72 hours, so there is no long-term archive of what you said to be exposed
• Encryption in transit (TLS) for all communication between the App and our servers, and between our servers and our providers
• Encryption at rest for our database and its backups
• No direct database access from the App: every request goes through our server, which checks your session and only ever returns your own data
• Passwordless sign-in: an anonymous account or Sign in with Apple. We never issue, store or see a password.
• Access to production systems limited to the operator, and used only for operating the service

To be transparent: Opora is not end-to-end encrypted. For the AI to answer you, our server has to pass the text of your message to the model. This is why we keep that text for as short a time as possible.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay where the risk to you is high.

12. Age requirement

Opora is intended for adults aged 18 and over. Before the first conversation, the App asks you to confirm that you are. We do not knowingly collect personal data from anyone under 18.

If you believe someone under 18 is using Opora, write to ivandiv13@gmail.com and we will delete the account and its data promptly.

13. Supervisory authorities and complaints

If you have a concern, please contact us first at ivandiv13@gmail.com — most issues can be resolved directly. You also have the right to complain to a supervisory authority:

• Georgia: Personal Data Protection Service of Georgia — https://personaldata.ge
• EEA: the data protection authority of the member state where you live, work, or where the alleged infringement occurred. A list is maintained at https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom: Information Commissioner's Office — https://ico.org.uk

14. International transfers

We operate from Georgia. Our application server is in the Netherlands, our database is hosted in the European Union (Ireland), and several of our processors — including the AI providers — are located in the United States. Your data is therefore transferred outside your country, and outside the EEA, the UK and Georgia.

For transfers from the EEA and the UK we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) incorporated into our agreements with processors, or
• the processor's certification under the EU–US Data Privacy Framework where it holds one.

For transfers out of Georgia we comply with the transfer requirements of the Law of Georgia on Personal Data Protection, including appropriate safeguards in our contracts with processors.

You may request a copy of the relevant safeguards by writing to ivandiv13@gmail.com.

15. California residents

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We use sensitive personal information only to provide the service you request.

California residents may request to know, delete, or correct their personal information, and will not be discriminated against for exercising those rights. The categories of personal information we collect, the purposes, and the categories of recipients are set out in sections 3 to 5 above. To make a request, email ivandiv13@gmail.com.

16. Changes to this policy

We may update this policy as the App changes. When we do, we will update the "Last updated" date at the top and publish the new version at https://ivandiv13.github.io/opora-legal/privacy.

If a change materially affects how we use your personal data, we will notify you in the App before it takes effect, and where the law requires it we will ask for your consent again.

17. Contact

Questions, requests, or complaints about this policy or your data:

Ivan Bannikov, Individual Entrepreneur

• Nino and Ilia Nakashidze Str. N1, Building N3, Apt. 3, Krtsanisi District, Tbilisi, Georgia
• Identification number: 304675625
• Email: ivandiv13@gmail.com