Privacy Policy

1. Who we are

The operator of ovori.app is Artur E. Kalendzhyan, a self-employed individual registered in Russia (INN 235503700740). Contact for privacy questions: info@sovrest.com.

2. What data we collect

• Account data: email address, password (stored as an argon2id hash — we don't have access to it in plain text), display name, avatar.
• OAuth data: if you sign in through Google or Yandex, we receive from them your provider ID, email, name, and avatar.
• Technical data: IP address, user-agent, request timestamps — used to protect against abuse and for security logs.
• Content data: stories you create, comments, likes, ratings, bookmarks, reading history, internal currency balance.
• Payment data: when you buy coins via YooKassa — payment ID, amount, and status. Card details themselves are processed by YooKassa and never reach us.
• Cookies: for authentication (httpOnly) and locale selection. Bookmarks and reading progress for unauthenticated visitors are kept only in the browser's localStorage and aren't sent to our server until you register.

3. Why we collect it

• Identifying and protecting your account.
• Running the app: saving progress, serving content.
• Moderation and enforcement of platform rules.
• Crediting/debiting internal currency, processing purchases.
• Compliance with Russian law.

We don't sell your personal data and don't share it with third parties for advertising.

4. Third-party sub-processors

To run the service we use the following providers. Each receives only what's necessary for the function they perform:

• Timeweb Cloud — server hosting and S3 object storage.
• kie.ai — generation of scenarios, images, voice, and music. The user's prompt text and service identifiers are sent; personal data is not.
• Google / Yandex — only if you chose to sign in via their OAuth provider.
• YooKassa (YuMoney NKO) — payment processing for coin purchases. Card data is handled per YooKassa terms.
• Yandex.Metrica — web analytics. Anonymised visit data (IP, user-agent, URL, dwell time, clicks, session replay via Webvisor). Settings and policy at yandex.ru/legal/metrica_termsofuse.

5. Retention

Account data is kept as long as your account exists. On account deletion, your profile and personal data are removed. Service logs (IP addresses, moderator actions) may be kept up to 12 months for security. Payment records are kept 5 years per Russian tax law.

6. Your rights

• Export: the Settings page has an "Export my data" button — you get a JSON with everything we store about you.
• Delete account: also in Settings. Irreversible.
• Correction: change email, name, language, and avatar from your profile.
• Anything else: info@sovrest.com.

7. Security

Passwords are stored hashed (argon2id). Sessions live in httpOnly cookies inaccessible to page JavaScript. HTTPS is mandatory. Payments are processed by YooKassa, a certified payment operator.

8. Children

The service isn't intended for anyone under 14. If you're younger, don't use it. If you learn we're processing a child's data without their guardian's consent — email us, we'll remove it.

9. Changes

If we change this policy materially, we'll notify registered users inside the app. Continuing to use the service after the update means you accept the new version.