Last updated: 5 September 2026
Orma uncovers a map as you walk. To do that it records where you go, continuously, including while the app is closed. That location history is the core of the product — it is what draws your map — and it is stored on your device and in your account.
We do not sell your data. We do not run ads. We do not share your location with anyone except the friends you personally accept, and the parts of communities you personally post to.
You can delete your account, and everything in it, from inside the app at any time.
This is the sensitive one, so it comes first.
Used to detect when you are stationary so tracking can throttle down and save battery. Processed on your device by the location library. Not stored on our servers.
Email address (for sign-in), username, display name, and an optional profile picture.
Photos you choose to capture in the app, together with the coordinates where they were taken, and any caption you write. Photos you attach to a community comment are visible to every signed-in user.
Friend relationships, comments and likes, beacons and postcards, community memberships, meetup RSVPs, and “explorers’ thoughts” left on places. Comments and thoughts posted in a community are visible to all signed-in users of the app.
If you allow them, a push notification token so we can tell you when a friend sends you something.
Diagnostic data when the app crashes, so it can be fixed. This can include device model, OS version and a stack trace.
We use these services to run the app. Each one is listed with what it actually receives.
| Service | What it receives | Why |
|---|---|---|
| Supabase | Your account, explored areas, photos, and everything you post | Database, file storage and authentication |
| Mapbox | Map requests for the area you are viewing | Drawing the map |
| Expo | Your push notification token | Delivering notifications and app updates |
| Sentry | Crash diagnostics | Fixing crashes |
| OpenStreetMap (Nominatim, Overpass) | Coordinates, to look up place names and nearby places | Naming where you are, and finding cafes and landmarks |
| Apple | Purchase and installation data governed by Apple’s own policy | Distribution via the App Store |
We do not sell personal data, and we do not share it with advertisers or data brokers.
Photos are stored with unguessable random filenames and served over HTTPS from public URLs, so the app can display them quickly. This means anyone who obtains the full URL of a photo can view it, even without an account. The URLs are not listed or discoverable anywhere, and cannot be browsed or enumerated.
We are telling you this because it is true, not because it is ideal. If you would not want a photo seen by someone who somehow obtained its link, do not post it.
As long as your account exists. Delete your account and it goes.
Settings → Safety & privacy → Delete account.
This removes your profile, explored areas, photos, comments, beacons, postcards, friendships, community posts and notification tokens, and deletes your stored image files. It is immediate and cannot be undone. Local data on your device is cleared at the same time.
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. The delete-account button covers deletion in full. For anything else, email us and we will action it.
Legal bases, where UK/EU GDPR applies: consent for location, camera, photos and notifications (each requested explicitly, each revocable in your device Settings), and legitimate interests for security, abuse prevention and crash diagnostics.
Orma is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
If this policy changes materially, we will update the date at the top and notify you in the app.
Orma is operated by Rayan Aman. Questions about this policy or your data:
rayan2004aman@gmail.com