Privacy policy
The data Oryva processes, why, for how long, and your rights.
This English translation is provided for convenience. The French version (Politique de confidentialité) is the one accepted and recorded, and it prevails.
1. Controller
MGCORP, postal details given upon written request to [email protected]. Contact for personal data: [email protected].
2. What Oryva does not see
The content you watch, the videos and your channel lists do not go through our servers: they go from your source to your device.
The configurations of your sources (addresses, credentials) are encrypted on your devices; when they are synced, they are end-to-end encrypted and we cannot read them. The same goes for sources typed on oryva.org/en/add.
3. Data processed
Account: email address, password (stored as a hash), Google identifier if you use it, creation and verification dates.
Devices and sessions: device name and type, app version, install identifier (kept as a hash), sign-in dates.
Plan: plan, trial, subscription and its status. For a purchase on oryva.org: the PayPal subscription reference and the payment notifications sent by PayPal (amount, date, status, payer identifier and name, PayPal email address). For a purchase in the app: the Google Play purchase token and order reference, and the subscription state sent by Google; Google Play receives an encrypted account identifier, never your email address. Never a card number.
Notifications (phones): the device’s Firebase notification token, the app language and the kinds of notifications chosen. Oryva’s messages shown in the app are never tracked.
Sign-in on oryva.org: one-time code sent by email, IP address and browser when ordering and cancelling.
Sync (Premium): favourites, profiles, playback positions and display settings, tied to technical identifiers; sources are end-to-end encrypted.
Proof of acceptance: the document or statement accepted, version and hash of the text, date and time, IP address, browser or app, device.
Support requests: email address, subject, messages exchanged, the device given and, from the app, the technical information attached (version, device, plan, state of the sources, never their addresses or credentials).
Technical and security logs: IP address, date, action performed.
4. Purposes and legal bases
Providing the Service and sync (performance of the contract). Managing the trial and the subscription (performance of the contract). Preventing trial abuse and securing accounts (legitimate interest). Keeping proof of acceptances to assert or defend our rights (legitimate interest and legal obligation). Collecting payments, handling refunds and payment disputes (performance of the contract, accounting obligations, legitimate interest). Answering support requests (performance of the contract and legitimate interest). Sending service emails: verification, security, end of trial, order confirmation, receipts, renewal reminder (performance of the contract and legal obligation). Sending the notifications you chose and information messages about the Service (performance of the contract and legitimate interest; can be turned off at any time in the app and in the phone’s settings). No advertising, no commercial profiling, no sale of data.
5. Retention periods
Account and related data: as long as the account exists; deletion on request, immediate from the app or on oryva.org/en/delete-account. Inactive account: deleted after 3 years without sign-in, after prior notice.
Proof of acceptance: 5 years after the end of the relationship (limitation period), including after the account is deleted, limited to what is needed as proof.
Support requests: 3 years after they are closed, including after the account is deleted.
Notification token: until the device is signed out or Firebase removes it. Security logs: 12 months. Administrator actions and subscription history: 5 years. Payment notifications and billing data: 10 years (accounting obligation), including after the account is deleted.
6. Recipients and hosting
The data is hosted on servers run by the Publisher and located in the European Union.
Processors: Cloudflare (secure routing of traffic to our servers; transfers outside the EU covered by the standard contractual clauses and the Data Privacy Framework), Brevo (sending emails, EU), Google (Google sign-in, Google Play payments, notifications through Firebase Cloud Messaging, without audience measurement), PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg (payments on oryva.org, as controller of its own processing). No other recipient, except where the law requires it.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to set instructions for your data after your death.
Export and deletion of the account are available directly in the app (My account); deletion is also available on oryva.org/en/delete-account, without the app. For any other request: [email protected] or oryva.org/en/help. You may lodge a complaint with the CNIL (www.cnil.fr).
8. Cookies and trackers
The oryva.org website and the app use no advertising cookie and no audience-measurement tracker. Only what is strictly needed is used: the language chosen on the website and the sign-in session on oryva.org, kept in your browser.
9. Security
Passwords and identifiers stored as hashes, encrypted connections, end-to-end encryption of sources, encrypted backups, restricted access to the servers.