Last updated: 22 October 2026 Vala, formerly called Olorin ("Vala", "we", "us"), is a contemplative inner-work app for journaling, dreamwork, and reflective practice. This policy explains what we collect, how it is protected, and the choices you have. Please read it alongside our Terms of Use.

• Your journal and dream content is private to your account. It is encrypted in transit and encrypted at rest, and database access rules mean no other user can reach it. Unlike a fully end-to-end-encrypted system, our servers can technically access it — which is what lets you sign in from any device and reset a forgotten password without losing your entries. • We do not sell your data or use it for advertising. • Some features send the specific text or image you choose to AI providers at the moment you invoke them, and the app asks your permission before the first time (see "AI features"). • Anything you deliberately publish to the Commons is public and is not encrypted. • If you buy a membership or credits, payment is handled by Paddle. We never see or store your card details. • You can delete your account and all associated data from within the app at any time.

Account information. When you create an account we store your email address (or Apple/Google sign-in identifier) and an internal account ID. This identity is never shown to other users. Early-access requests. If you ask for early access on our website, we store the email address you give and, if you add them, your name, the device you would use, how you heard about Vala and your note, with the time you asked and the website or campaign link that brought you, if there was one. We use them to reply about access and to send you an invitation, and, counted together with other requests, to learn how people find Vala. We receive an email about each new request in our support inbox. Write to support@olorin.store and we will delete your request. Website visits. When you open the front page of olorin.store, we add one to that day's count of visits, filed under the website or campaign link that sent you, if any. The count holds no cookie and nothing that identifies you. To stop one source inflating it, your network address is kept for up to two days as a rate-limit key, as it is for the website's forms. Your private entries. Journal entries, dream entries, dream conversations, interpretations, tags, images, and inner-dialogue sessions are stored on our servers and are visible only to you. They are transmitted over TLS and encrypted at rest by our hosting provider, and row-level security rules restrict every one of these records to the account that created it, so no other user can read them. Commons (public) content. If you create a public presence and publish a dream or comment, that content — including any text, images, and your chosen public handle and display name — is stored in readable form and shown to others according to the audience you select (everyone, close friends, or followers). Purchases and billing. If you buy a membership or a pack of credits, the payment is taken by Paddle, who act as merchant of record. Paddle collects the details needed to take payment and charge the correct tax — typically your name, email address, country and card details. We never receive or store your card number. What we keep is the record needed to honour what you bought: which membership or pack it was, when, the credits or tier it granted, and identifiers linking it to your account so a refund can be matched to the right purchase. Technical data. Basic operational data needed to run the service (e.g. authentication tokens and error logs). Usage records. We record each day you open Vala and the kind of device you used (iPhone, Android or web), and we count, by day and by kind, what you create, such as dream entries and meditation sessions. These records hold dates and counts and none of what you wrote. We use them to understand which parts of Vala help people keep coming back, and to notice when someone may want a hand getting started. When we analyse them with AI tools, including Claude by Anthropic, they carry no name or email address. They are deleted with your account.

Your entries are protected by three layers: TLS while in transit, AES-256 encryption at rest in our hosting provider's database and storage, and row-level security rules that tie every record to the account that created it. No other Vala user can read your entries. What this does not mean. Vala is not end-to-end encrypted. We hold the keys to the database, so our systems — and a small number of authorised personnel with production access — are technically capable of reading your entries. We access them only where necessary to operate the service, respond to a support request you make, or comply with a valid legal obligation. We do not read entries for any other purpose, and we never sell them or use them for advertising. This is a deliberate trade. It is what allows you to sign in from any device, recover a forgotten password without losing your dreams, and use interpretation and image features. If you need a system where no operator can ever read your content, Vala is not that system.

Earlier versions of Vala encrypted entries end-to-end with a key held only on your device. We moved to the model described above so that ordinary sign-in and password recovery work the way people expect. Existing entries are converted on your own device the next time you open the app, because only your device could read them. A small number of entries may not be convertible; these stay unreadable and are removed in due course.

When you request an AI action — such as a dream interpretation, a generated image or video, tags, or a dialogue reply — the specific content you are acting on is transmitted, encrypted in transit, to our AI processing providers (currently Anthropic, Google, OpenAI, Together AI and xAI) to generate the result. Text is written by Anthropic's Claude and Google's Gemini models. Dream images are drawn by image models served through Together AI, or by OpenAI when those are unavailable, and figure portraits by OpenAI. Dream videos are generated by xAI's Grok Imagine model from the dream's image. The app asks for your permission before it first sends anything to these providers. The result is returned and stored encrypted. These providers process the content to produce your result and do not use it to train their models under our configuration. Features you do not use send nothing.

We use Supabase (database, authentication, storage) as our backend infrastructure provider, and the AI providers named above. Anthropic's Claude also helps us analyse usage records, which reach it without names or email addresses. Email is sent through Resend (sign-in messages, invitations, renewal reminders and notices of early-access requests), and our support inbox is hosted by Zoho. Lessons on the learning platform are hosted and streamed by Mux: when you play one, your device fetches it from Mux, which sees your IP address and which lesson was asked for, as any video host does. Which lessons you have opened, and how far into each you got, is kept with your account so a lesson can resume where you left it, and it is deleted with your account. These processors act on our behalf and are bound to protect the data they handle. Payments are handled by Paddle.com Market Ltd, who act as the merchant of record and are the seller for every purchase. Paddle is responsible for the payment transaction itself — taking your card details, charging the correct tax, and handling disputes — and processes your billing information for that purpose under its own privacy notice, not merely on our instructions.

Vala sets no cookies of its own. To work, the website and web app keep a few things in your browser's local storage: your sign-in session, your language, your settings and unsent drafts, cached copies of pictures you have opened, your cookie choice, and, while a purchase completes, a short-lived marker. The phone apps keep the same kinds of data on your device. None of it is used for advertising or to follow you elsewhere, and our count of front-page visits uses no cookie. Other companies set their own cookies only when you use their part of Vala: Paddle, when you open a checkout, to take your payment and prevent fraud; and YouTube, Vimeo, Loom or Wistia, when you play a lesson they host. If you choose "Accept all" on the website's banner, Cloudflare Web Analytics also counts your visit: it measures which pages you view and how quickly they load, sets no cookie, stores nothing in your browser, and does not fingerprint you. With "Necessary only" it does not run, and each video from those hosts waits until you tap it. You can change your choice at any time under Cookie settings, at the foot of our front page or below.

When you start a course on Vala, its teacher can see that you started it, how many of its lessons you have finished, when you were last active in it and whether you finished, beside the name and picture of your Home profile. Posts and replies you write on a teacher's learning wall, including those about a lesson, are visible under your Home profile name to everyone in that teacher's community: the teacher and the members whose plan includes them. They are checked by automated moderation before they appear, and the teacher can remove them. A reflection you send from a lesson reaches the teacher as a direct message, and a course's welcome and completion messages reach you the same way. Teachers' course text is translated between English and Spanish by Anthropic's Claude. All of this is deleted with your account.

• Delete your account. In the app, open Privacy → "Delete my account". This permanently erases your account and all associated data, including Commons content and stored files. Deletion is irreversible. • Access and correction. You can view and edit your content in the app. • Payment records. Deleting your account erases your content from our systems, but it does not erase the transaction records Paddle must keep to meet its own tax and accounting obligations. Those are held under Paddle's privacy notice, not ours. • Contact us at support@olorin.store with any privacy request.

Vala is not directed to children. You must be at least 18 years old to use it.

Vala does not currently read from or write to Apple Health or any other health data source.

We may update this policy; material changes will be reflected by the "last updated" date above.

Vala is made by Olorin Technologies LLC. Questions about this policy: support@olorin.store.