🔒 Your data
Version 2026-09-09.1 · Effective 9 September 2026
⚠ THIS DOCUMENT HAS NOT BEEN REVIEWED BY A LAWYER.
Every factual statement below was written from the actual database schema, the actual code paths and the actual third-party integrations of the running system — it describes what the software genuinely does, which is the part a lawyer cannot know without being told. It is not legal advice and it is not a substitute for review. Australian privacy law imposes obligations this document may state imperfectly, and the wording of a binding policy is a lawyer's work.
Do not publish this as final until counsel has reviewed it. See
TerracareVault/Ecosystem/Legal-Requirements-Ecosystem.md§4.
Oriana is operated by S.O.F.I.E Systems (ABN 62 123 808 678), trading as SOFIELabs ("we", "us"). Contact: info@sofiesystems.org.
Oriana is part of the TerraCare ecosystem, which also includes the TerraCare Ledger (the record of value and transactions), Pollen (the in-app currency), an encrypted messenger, and SOFIE (an automated system that monitors the health of the platform).
This policy is written to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our primary jurisdiction is Australia.
| Account | Email address, username, display name, password (stored only as a bcrypt hash — we never see or store your actual password), date of birth |
| Profile | Bio, profile picture, cover image |
| Content | Videos, photos, titles, descriptions, comments, live streams, the sounds you attach |
| Marketplace | Listings you create, purchases you make, delivery and fulfilment details you enter |
| Support & reports | Anything you write when you report content or contact us, including your email address if you report while signed out |
| Activity | Likes, comments, comment likes, reposts, follows, bookmarks, video views and watch duration, login streaks |
| Pollen | Your earned and purchased balances, gifts sent and received, transfers, marketplace payments, referral rewards |
| Referrals | Your invite code, who invited you, and who you invited |
| Devices | Push notification tokens and the platform (iOS/Android) they belong to |
| Audit | An internal record of significant actions on your account — what happened, when, and to which item |
Oriana asks for these only for specific features, and only when you use them:
Location is deliberately blunted before it is stored. When you log a wildlife or nature sighting, your coordinates are rounded to approximately a 0.1° grid square — roughly 11 kilometres — before anything is saved. We keep the grid square, the species, the time and the habitat type as conservation data. We do not store the precise coordinates of where you were.
You can refuse or later revoke any of these permissions in your device settings. The relevant feature stops working; the rest of Oriana does not.
The Hive Club membership is sold on our website (sofiesystems.org), and you can join before the apps are public — before you have an Oriana account. When you join:
Cancelling your membership stops future billing and future accrual. The membership record itself is a financial entry on the Ledger — see section 9 for what that means.
| Purpose | What it covers |
|---|---|
| Running the service | Signing you in, showing your feed, delivering messages, playing video |
| Paying people | Calculating and settling the revenue split, gifts, marketplace sales, creator payouts, referral rewards |
| Memberships | Taking Hive Club subscription payments and recording membership, founder number and Pollen entitlement |
| Safety | Enforcing the 18+ age requirement, acting on reports, removing harmful content, blocking abuse |
| Legal obligations | Financial record-keeping, AUSTRAC transaction reporting thresholds, tax, responding to lawful requests |
| Improving Oriana | Understanding which features are used — from our own data, not from trackers |
We do not use your personal information for automated decisions that produce a legal effect on you. SOFIE, our monitoring system, watches the health of the platform, not individual users.
We use a small number of providers, each for one job. They are bound by their own terms and by our contracts with them.
| Provider | What they receive | Why | Where |
|---|---|---|---|
| Amazon Web Services (S3, CloudFront) | Your uploaded videos and images | Storage and delivery | ap-southeast-2 (Sydney) |
| Stripe | Payment details, name, email, and for creators the identity documents required for payouts | Taking payments, subscriptions (including the Hive Club membership) and paying creators. Stripe, not us, holds card and bank details | Global; Stripe is the data controller for payment data |
| Google Firebase (FCM) | Your device push token | Delivering notifications | Google infrastructure |
| Apple / Google Play | Purchase receipts | Verifying in-app purchases | Apple / Google infrastructure |
| IPFS / Pinata | Content you publish, when pinned | Distributed content storage — see section 9 | Distributed |
Cross-border disclosure (APP 8). Some of these providers store or process data outside Australia. By using Oriana you acknowledge this. We take reasonable steps to ensure they handle your information consistently with the APPs, but we cannot control an overseas provider's handling to the same degree as our own.
We do not sell your personal information to anyone, for any purpose.
Direct messages in the TerraCare Messenger are encrypted on your device before they leave it, using X3DH key agreement and the Double Ratchet algorithm. The server stores your public keys so other people can start a conversation with you, and it stores the encrypted message bodies so they can be delivered.
We cannot read your messages. The keys required to decrypt them exist only on the devices in the conversation. If we were compelled by law to hand over message contents, we could hand over ciphertext and nothing else.
What we can see, and therefore what we hold: who messaged whom, and when. That metadata is necessary to deliver a message at all.
If you lose every device holding your keys, your message history is not recoverable. That is a consequence of the encryption being real.
Content you publish can be seen, screenshotted, downloaded and re-shared by other people. Once something is public, we cannot make it un-seen.
Oriana is for people aged 18 and over. This is enforced at registration: we validate your date of birth server-side and refuse to create an account for anyone under 18. This is a stricter bar than Australia's social-media minimum age of 16 — the 18+ requirement is our own.
If we learn that an account belongs to someone under 18, we will close it and delete the associated personal information, subject to the limits in section 9.
If you are a parent or guardian and believe your child has an account, contact info@sofiesystems.org.
This is the section most people skip, and the one you should read.
Oriana settles value on the TerraCare Ledger, an append-only record, and mirrors some entries to a blockchain. Both are designed so that entries cannot be altered or removed after the fact — that permanence is what makes the economy auditable and what stops anyone, including us, quietly rewriting who was paid what.
The consequence for you is real: when you send a gift, make a purchase, pay a membership, receive a creator payment or earn a referral reward, a record of that transaction is written somewhere it cannot be erased. Those records contain account identifiers and amounts. They do not contain your message contents, your email address, your password or your date of birth.
What we CAN delete: your account, profile, email address, date of birth, bio, images, videos, photos, comments, likes, follows, bookmarks, device tokens and message ciphertext.
What we CANNOT delete: ledger and blockchain transaction entries; and content that other people have already downloaded or re-shared.
Content published to IPFS is distributed across a peer-to-peer network. We can stop pinning it on our own infrastructure, but we cannot guarantee removal from every node that has copied it.
We consider this an honest limit rather than a loophole, and we would rather state it plainly than promise an erasure we cannot deliver.
| Account and profile | While your account is open, then deleted on closure (subject to section 9) |
| Content | Until you delete it or close your account |
| Membership | Your email is kept while your Hive Club membership is active and removed on request (subject to section 9); membership status and founder number are recorded on the Ledger permanently |
| Financial records | Retained as required by Australian tax and AML/CTF law — this can be seven years — and, on the ledger, permanently |
| Audit logs | Retained for security and dispute resolution |
| Message ciphertext | Until delivered and cleared by the devices, or account closure |
Under the Australian Privacy Principles you may:
To exercise any of these, contact info@sofiesystems.org. We aim to respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or by phone on 1300 363 992.
No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.
When we change this policy we publish a new version with a new version number and effective date.
If the change is significant, we will ask you to review and accept it in the app rather than quietly binding you to terms you have never seen. The version you accepted, and when, is recorded against your account.
S.O.F.I.E Systems — info@sofiesystems.org
This document describes Oriana and the TerraCare ecosystem as at version 2026-09-09.1. It has not yet been reviewed by a lawyer and must be before launch.