Privacy Policy

Vorder is a personal tracking service. You record how you spend your time and, if you choose to, what you eat, the routines and habits you keep, the work you do and the vehicles you own.

This policy explains what data is processed, why, on what legal basis, and what you can demand of us. It applies to vorder.io and to the apps that share your account: Vorder and Varage.

Vorder is still being built. This policy describes what exists today and is updated before anything new starts processing your data. That includes Vinance, which does not exist yet.

The controller of your data is Viktor Karpiński Technology (VK Technology), ul. Legionów Polskich 30/46, 32-300 Olkusz, Poland.

For anything concerning your data, write to privacy@vorder.io. A person answers, not a ticket system.

Account data: your first and last name, email address, password (stored only as a hash), language and interface preferences, and the plan you are on.

Time data: what you tracked, when it started and ended, the tags you attached, and any notes you wrote.

Work data: workspaces, folders, boards, tasks and their history - including workspaces shared with other people, where the content is visible to the members you invite.

Food and routine data: meals and their nutritional values, the foods and presets you save, and the routines and habits you keep.

Vehicle data, in Varage: your vehicles, odometer readings, fuel and charging, services, maintenance, expenses, and drives with their times, kilometres, purpose and the places you type in. Varage does not track your location.

Technical data: IP address, sign-in attempts, session tokens, basic device and browser information, server error logs and, if you turn notifications on, your push subscription.

Everything except the account and technical data exists because you entered it. Vorder does not import your data from other services, buy it, or enrich it from outside sources.

Meals, nutritional values and some routines can reveal things about your health, which makes them special category data under Article 9 of the GDPR - the most strictly protected kind there is.

Logging them is entirely optional, and Vorder processes them only on the basis of your explicit consent. You can withdraw it at any time by deleting the records. That stops the processing; it does not make earlier processing unlawful.

Time tracking, tasks, workspaces and vehicles work perfectly well without them.

To provide what you signed up for - your account, your tracking, your workspaces, your vehicles and your plan. Legal basis: performance of a contract, Article 6(1)(b).

To run food and routine tracking. Legal basis: your explicit consent, Article 9(2)(a).

To let an assistant you connected act on your account. Legal basis: your consent, Article 6(1)(a).

To keep the service secure and working - blocking abuse, throttling repeated failed sign-ins, fixing errors, answering your messages. Legal basis: our legitimate interests, Article 6(1)(f).

To send you the waitlist notice and product announcements you asked for. Legal basis: your consent, Article 6(1)(a).

To keep records the law requires us to keep, such as accounting records once paid plans exist. Legal basis: legal obligation, Article 6(1)(c).

Vorder adds up your own records to show you totals and patterns. These are observations, not verdicts.

Nothing in Vorder makes an automated decision that has legal effects on you or similarly significantly affects you, and nothing it works out is shared with anyone else.

You can connect an AI assistant such as Claude to your account through Vorder's MCP connector. Nothing happens unless you start it and approve it on a consent screen.

Once connected, the assistant acts as you: it can read and change what you ask it to in your account. What it reads goes to the assistant's provider (Anthropic, for Claude), under that provider's own terms and possibly outside the EU.

You can disconnect it at any time in your account, under Connected apps.

On our own servers in the European Union, backups included. There is no third-party analytics service, no advertising network, no CRM and no data broker anywhere in Vorder.

Email from Vorder - confirmations, password resets and the reminders you asked for - is sent from Vorder's own mailbox. If we ever measure traffic, we do it with self-hosted, cookie-free analytics that never sees the contents of your account.

Two things can leave our servers, and only if you choose them: what a connected assistant reads, and notifications, which reach your device encrypted through your browser's push service (run by Apple, Google or Mozilla).

Vorder sets only strictly necessary cookies: one that keeps you signed in - marked httpOnly, so no script on the page can read it - and the ones that remember your language.

Unsaved form drafts and what you had open are kept in your browser's own storage, on your device. If you install Vorder as an app, its files are stored there too, so it can open offline.

There are no tracking, advertising or profiling cookies, on the website or in the app.

Your records stay until you delete them or close your account. After you delete your account the data is erased within 30 days, and the backups holding it rotate out within a further 30 days.

Technical and security data - IP addresses, sign-in attempts - is kept for 90 days.

Waitlist emails are kept until Vorder opens or until you unsubscribe, whichever comes first.

Where the law requires us to keep something longer, such as accounting records, we keep it for that period and no longer.

Passwords are stored hashed and never in readable form. Sessions use tokens your browser's scripts cannot read. Traffic is encrypted in transit. Repeated failed sign-ins are throttled and then blocked.

No system is perfect. If a breach ever puts your rights at risk, you will be told without undue delay, and so will the supervisory authority.

You can ask for access to your data, correction of it, its erasure, restriction of its processing, and you can object to processing based on our legitimate interests.

You can withdraw any consent you gave, at any time, without giving a reason.

You can request a full copy of your data in a machine-readable format, at any time, and take it elsewhere.

Write to privacy@vorder.io and you will get an answer within 30 days.

You can also complain to the Polish supervisory authority - Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa - or to the authority where you live.

Vorder is for adults. You must be at least 18 years old to create an account.

We do not knowingly process the data of anyone younger. If we learn that we have, the account and its data are deleted.

Last updated: 6 November 2026.

When this policy changes in a way that affects you, you will be told in the app or by email before the change takes effect. Older versions are available on request.

Privacy matters: privacy@vorder.io.

Postal address and general contact details are in the imprint.