Privacy Policy

0.9 — Pre-release (pending legal review)Updated March 13, 2026

Under legal review

This page reflects our current data practices accurately but is pending formal legal review. A fully reviewed document will replace this page before ORAN accepts general public traffic at scale. For data requests in the meantime, use our contact form.

Overview

ORAN collects and processes data to connect you with verified services. This page explains what we collect, how it is used, who may have access, and how to exercise your rights. Where practices are still being formalized, we say so plainly.

Data we collect

Category	Detail	Purpose
Location data	Approximate location (city / ZIP level) used by default for service matching. Precise location is only used when you explicitly grant browser permission and is not stored after your session.	Service matching
Session identifiers	Pseudonymous identity token managed by Microsoft Entra ID and NextAuth.js. Not linked to your real name within ORAN.	Authentication
Service interactions	Services you search for, save, or rate. Feedback scores submitted on service listings.	Platform quality
Optional profile data	Display name, city preference, and locale — only if you choose to save a profile. Opt-in, not default.	Personalization
Usage patterns	Anonymized telemetry for platform performance and reliability. Error traces are anonymized before transmission to Sentry.	Platform integrity

Collection scope may expand as the platform grows. Material changes will be communicated via a revised version of this page with an updated date.

How we use your data

Service matching — finding the most relevant verified services for your location and needs.
Platform integrity — detecting and preventing abuse, spam, and fraudulent submissions.
Data quality improvement — aggregated, anonymized usage patterns to identify service coverage gaps.
Authentication and session management — verifying your identity when you sign in.
Communications — responding to support, accessibility, and data subject inquiries.

Additional uses of collected data — including any that may arise from future business arrangements — will be disclosed in a revised version of this policy before they take effect.

Data retention

Session tokensExpire at browser close; inactive sessions purged after 30 days

Profile dataRetained until account deletion or deletion request

Service interactionsRetained up to 12 months; anonymized thereafter

Usage telemetryUp to 90 days in Sentry; aggregated metrics retained indefinitely

Location dataPrecise location not stored beyond the active session; approximate location embedded within service interaction records only

Retention periods are reviewed as part of our data governance process and may be adjusted. Reductions in retention are applied automatically.

Third-party processors

ORAN uses the following third-party services. We do not currently share data with advertisers or data brokers. Any data-sharing arrangement beyond those listed below will be disclosed in this policy before it takes effect.

Microsoft Entra ID

Identity management and authentication

Sentry

Anonymized error monitoring — no PII transmitted

Azure (Microsoft)

Cloud hosting, database, and application infrastructure

Azure Maps (Microsoft)

Map tiles, geocoding, and location search

Your rights

Depending on your jurisdiction (including GDPR and CCPA), you may have the following rights regarding your personal data:

AccessRequest a copy of the data ORAN holds about you.

CorrectionRequest correction of inaccurate data.

DeletionRequest deletion of your profile and associated data.

PortabilityRequest your data in a machine-readable format where technically feasible.

Opt-outWithdraw consent for optional data collection at any time via your profile settings.

To exercise any of these rights, use our contact form and select “Data Request” as the category. We will respond within 30 days.

Cookies

ORAN uses a single session cookie managed by NextAuth.js, required for authentication. This cookie is strictly necessary and does not track you across other sites or sessions. We do not use advertising cookies or persistent third-party tracking cookies. If analytics cookies are introduced in the future, this policy will be updated and explicit consent will be sought before they are placed.

Children

ORAN requires users to be at least 13 years old to create an account (in compliance with COPPA). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us and we will delete it promptly.

Policy updates

We will update this page when our data practices change. Material changes — including changes to data use purposes, third-party sharing, or retention periods — will be communicated with a revised version number and updated date. If you have an account, we will notify you by email for material changes.

Questions or data requests?

We aim to respond to data inquiries within 30 days.