Privacy Policy

Effective Date: October 11, 2026 | Last Updated: October 11, 2026

1. Overview & Architecture

Oryn ("we", "us", or "our") develops and operates the Oryn mobile ecosystem, built specifically for the students, faculty, and community of the Indian Institute of Information Technology, Design and Manufacturing (IIITDM). Oryn is designed with a privacy-by-default architecture: sensitive personal information and private communications remain on your physical device, while campus-wide features (timetables, room locator, mess menus, lost & found, and creator broadcasts) operate smoothly and reliably.

2. Google OAuth 2.0 & Gmail Access

When you sign in using your campus Google Account, Oryn requests the following OAuth 2.0 scope:

• Gmail Read-Only Scope (https://www.googleapis.com/auth/gmail.readonly): Used solely on your device to read incoming academic announcements, class schedules, timetable revisions, placement notifications, hostel circulars, and mess updates.

What we NEVER do with your Gmail access:

• We do not request send, write, draft, or delete permissions (no gmail.modify or gmail.compose).
• We do not upload raw email text, sender lists, recipient addresses, attachments, or message bodies to any central database or cloud server.
• We do not use your email data to train cloud-based AI or machine learning models.

3. On-Device Machine Learning & Local Storage

To ensure strict confidentiality, all text analytics, entity extraction, and category classifications execute locally on your device runtime:

• On-Device Machine Learning Engine: Email text is categorized using client-side TF-IDF vector space modeling and Naïve Bayes algorithms into discrete campus channels (Placements, Academics, Mess, Hostels, and Events).
• High-Speed Binary Storage (MMKV): Extracted schedule items, room mappings, meal menus, and user preferences are persisted in encrypted, sandboxed local binary storage using MMKV and SQLite.
• Home Screen Widgets: Glanceable Android and iOS widgets read cached schedule and menu data directly from local device storage without initiating background cloud transmissions.

4. Campus Radar & Device Telemetry

To ensure app stability, monitor fleet health, verify over-the-air update rollout, and deliver push notifications, the app periodically transmits an encrypted telemetry heartbeat to our secure backend (https://api.cruxel.xyz/oryn/telemetry/heartbeat).

The telemetry payload comprises:

• Unique Device Identifier: A randomly generated installation identifier (e.g., oryn_android_... or oryn_ios_...) stored in your device's private MMKV storage to distinguish individual installations.
• Hardware & System Metrics: Device model name, manufacturer brand, operating system name and version (e.g., Android 15, iOS 18).
• Application Runtime Metadata: Installed app version (e.g., 1.1.0), runtime bundle hash, and build fingerprint to ensure compatibility with Over-The-Air code patches.
• Push Notification Tokens: Expo Push Token and native Firebase Cloud Messaging (FCM) / APNs device tokens, used strictly to dispatch verified institute announcements, timetable shifts, and urgent campus alerts.
• Session Identity (When Signed In): Display name, institute email address, and avatar URL associated with your active session to deliver personalized notifications and verify campus membership.

What is NOT collected: Telemetry does NOT track GPS coordinates, real-time physical geolocation, browsing history, camera, microphone, or external files. Telemetry data is never sold or shared with third parties.

5. Campus Community Features

Oryn provides integrated community tools designed to streamline student interaction:

• Campus Lost & Found: Users may submit listings for lost or found personal belongings on campus (e.g., identity cards, keys, electronic devices, books). When creating a post, users voluntarily provide item descriptions, location tags, photographs, and optional contact details (email, phone number, or hostel room). This information is visible to verified campus peers on the Oryn network to facilitate the return of items. Users can edit or mark listings as resolved at any time.
• Creator Studio & Campus Event Broadcasts: Authorized student clubs, cultural councils, technical societies, and event coordinators can publish campus event schedules, venue announcements, posters, and registration links. Broadcast information is distributed campus-wide through the events feed and push alerts.
• Academic Timetables & Mess Menus: Campus course slot mappings, room locator data, and daily mess menus are synchronized from the Oryn College Portal (web/admin) and cached locally for instantaneous offline access.

6. Over-The-Air (OTA) Live Code Engine

Oryn incorporates an automated Over-The-Air (OTA) update mechanism to rapidly deploy bug fixes, security enhancements, and timetable updates without requiring manual app store downloads:

• The client checks for approved release manifests from https://api.cruxel.xyz/oryn/ota.
• Update checks transmit only the current bundle hash, target platform, and application version.
• All OTA update bundles and differential patches undergo cryptographic SHA-256 checksum verification before being applied to the mobile runtime.

7. Data Security & Protection of Sensitive Information

We implement rigorous technical and organizational security standards to safeguard user information:

• End-to-End Encryption in Transit: All communication between the app and external services (Google APIs and api.cruxel.xyz) occurs exclusively over secure, authenticated TLS 1.3/HTTPS channels.
• Secure Key Storage: Google OAuth tokens and credentials are encrypted using hardware-backed OS security primitives (Android Keystore and iOS Keychain) via Expo SecureStore and are inaccessible to other applications.
• Memory Isolation: Email parsing and machine learning inference run in sandboxed JavaScript memory spaces and are flushed when the app process terminates.

8. Compliance with Google API Services User Data Policy

Oryn's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Strict Functional Limitation: We access Google user data solely to deliver user-facing features prominently displayed in the app UI (campus email feeds, timetable extraction, and placement notifications).
• No Third-Party Transfers: We do not transfer Google user data to external third parties, advertising networks, or analytics providers.
• No Advertising or Profiling: We never use Google user data for serving personalized advertisements, retargeting, credit evaluation, or user profiling.
• No Human Inspection: No human ever inspects your raw email data, unless required for system security, to comply with applicable legal processes, or with your explicit consent for technical troubleshooting.

9. Third-Party Sharing & Commercial Non-Disclosure

Oryn does not sell, rent, license, or monetize personal data under any circumstances. We do not integrate third-party ad networks, tracking pixels, or commercial data broker SDKs into the mobile application.

10. Data Retention, User Rights & Deletion Controls

You retain comprehensive authority over your data at all times:

• Clear Local Cache: Navigating to Settings > Storage > Clear Local Cache permanently erases all downloaded email bodies, classified notices, timetable slot caches, and local MMKV tables from your device storage.
• Sign Out & Token Revocation: Tapping Sign Out immediately revokes your Google OAuth token, destroys cached session keys, and triggers an unregister heartbeat to clear your identity from active telemetry radar.
• Google Account Permissions: You can permanently disconnect Oryn at any time through your Google Account Security Portal.
• Data Deletion Requests: To request complete deletion of any telemetry logs or user-submitted community posts, contact us at support@oryn.app or oryn.iiitdm@gmail.com. Requests are honored within 30 days.

11. Contact & Governance

For questions, privacy inquiries, or security disclosures regarding this policy, please reach out to our team:

Email: support@oryn.app | oryn.iiitdm@gmail.com
Campus Address: Indian Institute of Information Technology, Design and Manufacturing (IIITDM), Off Vandalur-Kelambakkam Road, Melakottaiyur, Chennai - 600127, Tamil Nadu, India