Privacy Policy

This Privacy Policy explains how Oryxa ("Oryxa," "we," "us") collects, uses, shares, and protects information when you use our website and application at oryxa.app (the "Service"). By using the Service, you agree to the collection and use of information as described here.

1. Information We Collect

Account information

• Email address (used for login, account recovery, and transactional email);
• Username and any profile details you choose to add (display name, avatar, bio);
• Authentication data managed on our behalf by Supabase Auth.

Usage data

• Watch/listen history and episode progress, ratings, lists, and other tracking activity;
• Reviews, comments, and other content you post (subject to the spoiler settings you choose);
• Social activity such as friend connections and feed interactions.

AI chat data

If you use Oryxa’s AI features — including the expert chat, AI library import, or vibe search — we store the messages you send and the responses you receive. We explicitly disclose that these conversations are retained and used to power the AI features themselves and to improve the quality of our recommendations and AI responses over time.

Device and log data

• IP address, browser type, device identifiers, and operating system;
• Access times, pages viewed, referring URLs, and similar diagnostic/log data collected automatically for security and reliability purposes.

2. How We Use Your Information

• To provide, operate, and maintain the Service, including episode tracking, countdowns, and social features;
• To personalize recommendations, search results, and AI responses based on your activity;
• To develop and improve our AI features, including the accuracy and relevance of chat responses, recaps, and vibe search;
• To detect, prevent, and investigate fraud, abuse, and security incidents;
• To send transactional email, such as account verification, password resets, and important service notices;
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use advertising-tracking cookies (see our Cookie Policy).

3. Who We Share Data With

We share data only with service providers who help us operate Oryxa, and only to the extent necessary for them to perform their function. We do not sell personal information to third parties.

• Supabase — our hosting, database, authentication, and storage provider. Supabase stores your account data, tracking activity, and Row-Level Security (RLS) protected records on our behalf.
• TMDB (The Movie Database) — supplies catalog metadata (titles, artwork, episode information) for TV and movie content. We send TMDB the identifiers needed to fetch this public catalog data; we do not send TMDB your personal account information.
• Anthropic — powers our AI features. When you use AI chat, import, or vibe search, the relevant messages and context are sent to Anthropic for processing in order to generate a response. Anthropic processes this data to provide the AI service to us.
• Resend — sends transactional email on our behalf (e.g., verification links, password resets, notifications).
• Payment processor — once billing is live, a third-party payment processor will handle Subscription payments and related billing data; Oryxa does not store your full payment card details.

We may also disclose information if required by law, to protect the rights, property, or safety of Oryxa, our users, or others, or in connection with a merger, acquisition, or sale of assets (subject to this Policy continuing to apply to your information).

4. Cookies

We use a small number of cookies: an essential authentication session cookie (via Supabase) required for you to stay signed in, and a preference cookie that remembers your chosen theme. We do not currently use advertising or cross-site tracking cookies. See our Cookie Policy for details, and the cookie notice banner shown on your first visit.

5. Your Rights and Choices

Depending on where you live, you may have rights under frameworks such as the GDPR (EEA/UK) or the CCPA (California) and similar laws elsewhere. We aim to offer these rights, in a simplified form, to all users regardless of location:

• Access — request a copy of the personal data we hold about you;
• Correction — fix inaccurate or incomplete data, most of which you can edit directly in Settings;
• Deletion — request deletion of your account and associated data;
• Export — request an export of your data in a portable format.

You can exercise most of these rights directly from the "Your data" section in Settings. For anything not yet self-service, contact support@oryxa.app and we will respond within a reasonable time.

6. Data Retention

We retain account and usage data for as long as your account is active, and for a limited period afterward as needed to comply with legal obligations, resolve disputes, enforce our agreements, and maintain backups. AI chat history is retained to support the AI features described above until you delete it or delete your account, subject to reasonable backup retention windows.

7. Children’s Privacy

Oryxa is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. Our signup flow includes an age gate consistent with this policy. If you believe a child under 13 has provided us with personal information, contact support@oryxa.app so we can delete it.

8. Security

We use technical and organizational measures designed to protect your information, including encryption of data in transit, Row-Level Security (RLS) policies that restrict database access to the data each user is authorized to see, and secure password storage (we never store plaintext passwords). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Users

Oryxa is operated from Saudi Arabia, and the infrastructure we rely on (including our hosting and AI providers) may process data in other countries. By using the Service, you understand that your information may be transferred to and processed in countries other than your country of residence, which may have different data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

11. Contact

Questions about this Privacy Policy or your data can be sent to support@oryxa.app.