How ORDO handles your files

When you add a file, your browser reads it into memory and converts it in a background thread (a Web Worker) inside the same tab.

Results are created in memory too. Downloading saves them from your browser to your disk; no copy is sent anywhere.

Closing or reloading the tab discards everything. ORDO keeps no history of your files.

Every ORDO page is served with a Content Security Policy that only allows network connections back to ORDO itself, and ORDO has no endpoint that accepts files for these tools.

The only requests a page makes are for its own code and supporting data, such as the font files used to render PDFs, and the anonymous usage statistics described below — sent to ORDO itself and nowhere else.

To check: open your browser's developer tools, go to the Network tab, and run any tool. You'll see no request carrying your document.

ORDO is in public beta and needs to know which tools people use and where they succeed or fail. It records aggregate usage events: which page was opened, which tool was chosen, whether a conversion succeeded, and whether the result was downloaded.

Each event can carry only coarse, predefined labels: page language, device type (phone, tablet or computer), the family of your operating system and browser (iOS, Android, macOS or Windows; Safari, Chrome, Edge or Firefox — never a version number or device model), file type (such as PDF or CSV), a size range (such as under 1 MB), a page-count range, a duration range, an error category or the reason a file could not be used (such as empty, password-protected or an unsupported format), the country estimated from the network, and where the visit came from (such as Google, or direct).

Page speed (Core Web Vitals): load and responsiveness timings, so slow pages can be fixed.

After you finish reading an invoice with Smart Extract, ORDO may show one optional question with printed options: how often you do this kind of work, roughly how many invoices that is in a month, and what most of them arrive as. It has no text box, it is never required, and it stops appearing once you answer or dismiss it.

To tell first-time use from repeat use, your browser keeps a small counter of how many times you finished Smart Extract, in its local storage on your own device. The counter is never sent. ORDO sends only one of four ranges (first time, 2-3, 4-10, or 11 or more), with no identifier, so it cannot tell you apart from anyone else. If your browser blocks storage or sends Global Privacy Control, nothing is counted, asked or sent.

There is no user ID, no tracking cookie, no stored IP address, and no third-party script or tracker. Statistics are sent to ORDO itself and stored in the analytics service of Cloudflare, ORDO's hosting provider, where they are deleted automatically after about three months.

The only cookie ORDO sets is ordo-locale, which remembers the language you chose. If your browser sends a Global Privacy Control signal, ORDO sends no statistics at all.

File names, document content, text read from files, values read by Smart Extract, tax IDs, invoice numbers, company names, amounts, spreadsheet cell values, and file hashes.

This is enforced, not just promised: the statistics endpoint accepts only predefined event names and labels. Every other value is discarded both in your browser and on the server, so there is no field document data could leak through.

The “helped / didn't help” buttons after a result record only which one you pressed. There is no text box.

No account is required, so no personal information is collected to use the tools.

Some planned features, such as reading scanned documents with OCR, need more computing power than a browser has. They will be labeled “Secure processing on ORDO” before you use them, files will be deleted automatically after processing, and on-device tools will keep working exactly as they do now.