Privacy Policy

Pre-release draft. This policy was written for a pre-release product and has not been reviewed by a lawyer. It is published so that anybody using OrderDen today can see what actually happens to their data, not as legal advice to you or to anybody else. It will be reviewed and reissued before OrderDen takes money or serves customers outside the United States.

Version 2026-09-13. This policy is issued alongside the Terms of Service and shares its version.

The short version

• No analytics. No third-party trackers. No advertising technology. No third-party cookies. None. The only cookies OrderDen sets are the ones that keep you signed in.
• We do not sell your data, share it with advertisers, or use it to train models.
• You can export everything, at any time, on every plan.
• Receipt scanning runs on our own server. Your receipts are not sent to a third-party OCR service.

1. Who is responsible for what

OrderDen, LLC, a Tennessee limited liability company ("OrderDen") runs the service.

There are two kinds of personal data here and they are governed differently:

• Your account data — your name, your email address, your password hash, your workspace's settings, your billing details if paid plans ever exist. For this, OrderDen is the controller: we decide why it is held and how.
• Your customer data — the clients, contacts, addresses, orders, invoices and files you put into your workspace. For this, OrderDen is a processor: it is your data about your customers, held on your instructions. You decide what goes in, how long it stays and who sees it. We hold it, protect it, and act on your instructions.

If somebody's details are in your workspace because you put them there, they should ask you first. We will help you answer them.

2. What we collect

Because you gave it to us

• Account: name, email address, password (stored only as a hash), and the workspace name and locale you chose at signup.
• Workspace content: everything you type or upload — clients, items, quotes, orders, invoices, payments, projects, stock, files, notes.
• Settings and connections: your mail server details (the password encrypted at rest), carrier and payment connections, API keys (stored as hashes).
• Anything you send us through /feedback, and your email address if you ask to be told when OrderDen is released.

Because the software runs

• Operational logs: one row per call to the public API — the time, the path, the status, how long it took, which workspace and which key. Server logs of errors. These exist to make the thing work and to find out why it did not.
• The activity trail: who changed what and when, inside your workspace, shown to you in the app. It is a product feature, not surveillance — you are the audience for it.
• Session records: so that signing out on one device works, and so an operator can end a session that should not be live.
• A keyed hash of the IP address on the public forms and on password-reset requests, used only for rate limiting. Not the address itself.

What we do not collect

No analytics events. No page-view tracking. No session recording. No fingerprinting. No advertising identifiers. No third-party scripts of any kind on the marketing site, the app, or the client portal.

3. Cookies

Only what authentication needs: a session cookie so that you stay signed in, and the short-lived cookies better-auth uses during sign-in and two-factor. They are first-party, they are not shared with anybody, and there is no consent banner because there is nothing to consent to.

The app also stores a few preferences in your browser's own local storage — a dismissed prompt, a remembered list view. That never leaves your browser.

4. Who else touches your data

Every one of these is a service we use to run OrderDen. None of them is an advertiser, a data broker, or an analytics vendor.

Stripe, in two directions. If paid plans ever exist, Stripe processes the card you pay us with; we never see the number. Separately, if you connect Stripe to bill your own customers, that is a Stripe Connect Standard account belonging to you, under your own agreement with Stripe, charged directly on your account. OrderDen never holds your customers' money and takes no application fee. Their card details go to Stripe, never to us.

If you connect your own mail server, your outgoing documents go through it instead of ours, and AWS never sees them.

Receipt scanning stays here. Photographed receipts are read by Tesseract running on our own server. The image is not sent to Google, AWS, or any other OCR service.

5. How long we keep things

Real periods, not "as long as necessary":

Rows that pass their window are archived to object storage as compressed files before they are deleted from the database, and the delete only happens after the archive has been written and read back at the right size. An operator who has not configured object storage cannot silently prune anything: the job refuses to delete rather than lose the history.

The activity trail's one-year floor exists because it is the record of who changed what in your own business. A window shorter than a tax year would make it useless for the question people actually ask of it.

6. Deleting your workspace

You can delete your workspace from the app. When you do, its content is removed from the live database. Backups and any archives written under section 5 age out on their own schedule rather than being reached into, so a deleted record may persist in a backup for a short period after it is gone from the product.

Because this is pre-release software, do not treat deletion as the way to be certain something is gone, and do not put anything into OrderDen that would be a problem if it survived somewhere for a while.

7. Your data may not survive

This is a privacy policy, so it is worth saying here as well as in the Terms: OrderDen is pre-release and there is no guarantee that your data will be preserved. It may be lost, reset or migrated without notice, and the service may be discontinued. Export anything that matters and keep your own copy — Company → Data → Export, on every plan, or through the API. See Your data.

8. Your rights

Whatever your jurisdiction, you can do all of this yourself, today:

• See it — everything you gave us is visible in the app.
• Export it — all of it, any time, on every plan, as files you keep.
• Correct it — edit any record, including your own profile and email.
• Delete it — delete records, or the whole workspace.

If you would rather ask than click, or you want something we have not listed, write to us through /feedback and say what you want. If somebody's data is in a workspace we host for one of our users, ask that user; if they route the request to us, we will help them answer it.

9. Security

Passwords are hashed. Mail server passwords and connected credentials are encrypted at rest. API keys are stored as hashes, so a key is shown once and never recoverable. Sessions can be revoked. Two-factor authentication and passkeys are available and worth turning on. Every query for workspace data is scoped to your workspace by the database client itself, not by remembering to add a filter.

None of that is a promise that nothing will ever go wrong. See section 10 of the Terms.

10. Children

OrderDen is a business tool. It is not for anybody under 16, and we do not knowingly collect data from children. If you think a child's data has ended up here, tell us and we will remove it.

11. Where the data lives

The service runs in the United States, and your data is stored and processed there. If you use OrderDen from somewhere else, you are sending your data to the United States. We have not yet put the transfer mechanisms in place that serving customers in the EU or the UK properly requires, which is one of the reasons this policy says it must be reviewed before that happens.

12. Changes

When this policy changes in substance we bump the version at the top, and — as it is issued with the Terms — you will be asked to accept the new version the next time you sign in.

13. Contact

/feedback reaches a person. Formal notices go to OrderDen, LLC, at the address on file with the Tennessee Secretary of State.