VOX ORDO · LEGAL — READABLE FIRST, BINDING ALWAYS

Legal & privacy

Two documents, each in two registers: the plain-language summary that IS accurate, and the full text underneath it. Where the architecture already answers a legal question, we say so instead of writing a clause.

01 / THE TWO-REGISTER PAGE — SUMMARY THAT BINDS

PLAIN · §3 YOUR CONTENT

Your files, dictations, recordings, and memory are yours. We can't see them, so we claim no license to them. Full stop.

§3.1 Member Content is stored exclusively on Member-controlled hardware… EXPAND FULL TEXT

the plain box is contractually part of the document — if plain and full ever conflict, the reading FAVORING THE MEMBER wins, and that rule is itself a clause

plain-language boxes that legally bind — not marketing paraphrase
the member-favoring conflict rule makes the summary safe to trust
every section pairs one green plain box with expandable full text

02 / PRIVACY — THE FOUR-ROW TABLE, AGAIN, BINDING

we collectemail · per-key usage counts · 7-day relay metadata

we sell / sharenothing · no one · including "partners" and "affiliates"

we train onnothing of yours — architecture makes this non-optional

you canexport everything · delete everything · verify both, yourself

this is the security page's inventory restated as promises — the two pages cite each other and can't drift apart silently

GDPR/CCPA RIGHTS ARE ONE COMMAND EACH: `aria export --all` AND `aria forget --all` — THE POLICY JUST POINTS AT THEM

03 / CHANGES — DIFFED, DATED, NEVER SILENT

06-14§7 added: affiliate attribution disclosureDIFF ↗

05-26v1.0 — signed with the release keyGENESIS

terms changes render as diffs like code · material changes email you 30 days out with the diff inline · continued use never silently accepts anything gated

the policy has a changelog with reasons, like every other artifact
red/green diff view — lawyers and members read the same thing
each version is signed and archived; old versions never vanish

04 / REFUSALS — CLAUSES THIS CONTRACT WILL NEVER GROW

✗ no license grab over member content — we can't see it, we don't claim it

✗ no forced arbitration for privacy violations

✗ no unilateral "we may change this at any time" — 30 days, diffed, always

✗ no survival clauses on data we shouldn't have held anyway

SAME CONTRACT AS EVERY REFUSALS CARD: REMOVING ONE REQUIRES A CHANGELOG ENTRY EXPLAINING WHY

05 / THE DPA — ONE PAGE, BECAUSE THERE'S ALMOST NOTHING TO PROCESS

DATA PROCESSING AGREEMENT · FOR ORGS

we processemails, per-key counts, relay timestamps — the four rows

subprocessorstwo, named, with links — changes notified 30 days out

everything elseprocessed on YOUR hardware — you are your own processor

sign it in the admin console with your org key — countersigned copy lands in the org ledger, no email chain with legal

procurement's favorite page: the DPA fits on a screen
"you are your own processor" reframes the entire review
signing is a ceremony in the console, not a docusign scavenger hunt

06 / LICENSING — WHAT'S OPEN, WHAT'S OURS, WHAT'S YOURS

open · MITthe ledger format · the verify tooling · the CLI client

ours · source-availablethe runner and workspace — read it, audit it, don't resell it

yours · unconditionaleverything Aria makes with you — code, docs, videos · no carve-outs

the ledger format is MIT so your receipts outlive us — lock-in on the trust layer would rot the whole thesis · SBOM licenses listed per release

07 / THE ACCEPTANCE — WHAT SAYING YES LOOKS LIKE

BEFORE YOU SIGN · 20 SECONDS

✓ your content stays yours, on your machine

✓ we hold four rows of data, listed here ↗

✓ changes come as diffs, 30 days ahead

! BYOK means YOUR provider bills you directly

I read the four lines — sign

four lines and one honest warning replace the 40-page scroll-box
the amber line is the one thing people actually get surprised by — so it's loudest
acceptance is a signed ledger entry; "I never agreed to that" has an answer

08 / LAW ENFORCEMENT — THE GUIDE, PUBLISHED

serve uslegal@voxordo.sh · we require valid process, always

we can producethe four rows — email, counts, 7-day relay timestamps

we cannotcontent, keys, memory, recordings — not held, not producible

the memberis notified unless a court gags us · gags are counted publicly

published so agencies read it BEFORE serving — most requests end at "not held" · counted in the transparency report either way

the guide is public so the answer is predictable in both directions
"we cannot" is architecture, restated one final time — the pages all agree
every request lands in the transparency count, gagged or not

LEGAL RULES: THE PLAIN BOX BINDS · MEMBER-FAVORING CONFLICTS · CHANGES ARE DIFFS · RIGHTS ARE COMMANDS · "NOT HELD" IS THE BEST PRIVACY POLICY — 8 SURFACES