Privacy Policy

1. What this document covers

1.1. This Privacy Policy (the "Policy") describes what data the ORRYX service (the "Service", "we", "us") collects, why it is needed, how it is stored and how you can manage it.

1.2. The Policy applies to the website orryx.org, the dashboard at app.orryx.org, the Telegram bot and the ORRYX apps for all platforms.

1.3. By using the Service you agree to the terms of this Policy. If you do not agree with them, please do not use the Service.

2. What we do not collect

2.1. The Service operates on a no-logs basis. We do not record or store:

• the IP addresses you connect to our VPN servers from;
• the websites, apps and resources you access through the tunnel;
• DNS queries;
• the contents of your traffic;
• session start and end times or their duration.

2.2. We do not request passport details, identity documents, photographs, phone numbers or any other information that is not required for the Service to work.

2.3. The technical architecture of our VPN servers does not provide for storing connection history: such data is written neither to the servers nor to backups.

3. What data we store

3.1. Account data — what is needed to sign in and restore access:

• your email address, if you provided one at registration;
• your Telegram identifier, if you sign in through the Telegram bot;
• the unique access key for your subscription.

3.2. Subscription data:

• the subscription term and status;
• the number of active devices (without the contents of their traffic);
• the fact and date of payment, the payment method, the amount and the transaction identifier. Bank card numbers and wallet details are never passed to us — they are handled by payment providers.

3.3. Aggregated technical metrics used for load balancing: overall server load and total traffic volume per subscription. This data contains no addresses, websites or connection contents.

3.4. Support correspondence: the messages you send to support chat and any files attached to them — so that we can resolve your issue and refer back to it if you contact us again.

3.5. Partner program data: the link between the referred and the referring user, reward amounts and payout details, if you have provided them.

4. Website and cookies

4.1. The website orryx.org uses only technical cookies and the browser's local storage: your chosen language and a flag that you have seen the cookie notice. This data never leaves your browser.

4.2. We do not use advertising trackers and do not sell visitor data.

4.3. Country flags on the website are loaded from flagcdn.com and fonts from Google Fonts. When these resources are loaded, their operators receive your IP address and standard browser headers in accordance with their own policies.

5. Why we use data

5.1. To provide the Service: to create your account, issue access keys, connect devices and renew your subscription.

5.2. To accept payment and to refund you if you change your mind.

5.3. To respond to your support requests.

5.4. To keep the Service stable and secure: to distribute load between servers and to prevent abuse.

5.5. To pay out partner program rewards.

5.6. For users in the EU and EEA, the legal bases for processing are performance of a contract (sections 5.1–5.3 and 5.5), our legitimate interest in the stable operation of the Service (section 5.4) and your consent where it is required.

6. Who we share data with

6.1. We do not sell or transfer your data to third parties for their own purposes.

6.2. Data may be received only by:

• payment providers — to the extent necessary to process a payment or refund;
• Telegram — if you use the bot or pay with Telegram Stars;
• infrastructure providers (hosting, email delivery of sign-in codes) that process data on our instructions and are not permitted to use it for any other purpose.

6.3. We may disclose account data where applicable law requires it and the request has been properly made. Because connection history is not stored, we are unable to provide it under any circumstances.

7. Retention periods

7.1. Account and subscription data is stored for as long as the account exists.

7.2. After an account is deleted, its data is erased within 30 days. Payment records may be kept longer where accounting or tax law requires it, in which case they are not linked to your activity.

7.3. Support correspondence is stored for 12 months from the date of the last message.

8. Your rights

8.1. At any time you may:

• find out what data we hold about you and obtain a copy of it;
• correct your email address or other account data;
• delete your account and all associated data;
• withdraw consent to processing where processing is based on consent;
• lodge a complaint with the data protection supervisory authority in your country.

8.2. To do so, write to support chat in your dashboard. We respond to such requests within 30 days, and usually much sooner.

9. Security

9.1. The connection between your device and ORRYX servers is encrypted with modern protocols (TLS 1.3, QUIC). Passwords are not stored: you sign in with one-time codes or keys.

9.2. Access to account data is limited to a small number of staff, and only for support and maintenance purposes.

9.3. We take reasonable technical and organisational measures to protect data, but no system can guarantee the absolute security of information transmitted over the internet.

10. Children

10.1. The Service is intended for persons aged 18 and over. We do not knowingly collect data from children. If you become aware that a child has provided us with data, let support know — we will delete it.

11. Changes to this Policy

11.1. We may update this Policy. The current version is always published at orryx.org/privacy/ together with its update date.

11.2. We give notice of material changes in your dashboard or by email at least 7 days before they take effect.

12. Contact

12.1. For any questions about your data, write to support chat: app.orryx.org/#/support-chat/new or the Telegram bot @orryxbot.