Privacy Policy

Contents

The short version: your code, terminals and agents stay on your machine. We hold what an account, a plan and the hosted features you choose need, we never sell it, and we do not train models on your content.

• 1. Who we are and what this covers
• 2. The desktop app is local-first
• 3. Information we collect
• 4. How we use information
• 5. Legal bases for processing
• 6. AI, microphone and desktop disclosures
• 7. Who we share it with
• 8. Cookies and local storage
• 9. How long we keep it
• 10. Security
• 11. International transfers
• 12. Your rights and choices
• 13. Children
• 14. Changes to this policy
• 15. Contact

1. Who we are and what this covers

Orcyx is built and operated by Orcyx Labs (“Orcyx”, “we”, “us”). This policy explains what personal information we process when you use the Orcyx website at orcyx.dev, the account portal at app.orcyx.dev, the Orcyx desktop app, the hosted features the app can call, the Orcyx API, and the Orcyx community integrations - together, the “Services”.

For the account, billing, hosted-feature and website data described here, Orcyx is the controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). Where an organization administers your account, that organization decides some of how your data is used inside it, and its own policies apply too.

This policy does not cover the AI command-line tools you run inside Orcyx - Claude Code, Codex, Gemini and the others - or the provider accounts you sign them into. Those talk to their own vendors under their own privacy policies. Orcyx launches them on your machine; it is not in the path between them and their provider.

2. The desktop app is local-first

Most of what you do in Orcyx never reaches us. Your code, your terminals and what agents type into them, your Vault notes and their search index, your checkpoints, your Ledger, your swarm state and your pane layout are files on your own machine. Provider keys and tokens you give the app are kept in your operating system’s keychain; the app stores only a reference to them.

The app itself contacts our services for a short, fixed list of reasons: signing you in and checking your plan, and checking downloads.orcyx.dev for updates at launch and every 24 hours. Credits and hosted features are not introduced yet; once they are, the app will also show your credit balance and run a hosted feature when you choose one. Release telemetry is off by default and sends nothing unless you switch it on and an endpoint is configured; crash reports are kept on your disk and are not transmitted by current builds.

Privacy and telemetry in the docs lists every network call the app makes, where it goes, when, and what it carries. It is maintained from the code, and it changes before the app does.

3. Information we collect

Your account

• Email address, and the display name and profile picture URL you set or your sign-in provider returns.
• Your password as a scrypt hash - never the password itself. If you sign in with Google or Apple, the provider’s stable account identifier for you; we do not receive your provider password.
• When you verified your email, when you accepted these terms, whether you opted in to product email, and whether you finished onboarding.
• Session records: hashed session tokens, a device label, and when each session was created, used and revoked. Tokens themselves are never stored.

Organizations

• If you create or join an organization: its name, your role, invitations (including the invited email address), and an audit log of administrative actions such as invitations, role changes and removals.
• Organization settings an admin configures: API keys (stored hashed), single sign-on settings (the client secret is stored encrypted), and the allowed-tool and allowed-model policy the desktop app enforces.
• Once credits are introduced: per-member credit spend and any spend caps the organization sets.

Billing and credits

• Your billing account: email, plan, subscription status and renewal dates, the payment processor’s customer and subscription identifiers, invoices and refunds, coupons redeemed, trials and plan grants.
• Your credit ledger: every grant, purchase, hold, charge and refund of credits, with the hosted feature and quantity each charge was for. Credits are not introduced yet, so nothing is metered or sold today; the ledger holds only plan grants our billing system records in advance of a future launch.
• Country, and city where our network provider reports it, taken from Cloudflare’s edge on signed-in requests, plus when you were last active. We do not store your IP address on your account.
• We never receive or store card numbers or bank details. Payments are handled entirely by the payment processor named at checkout.

Hosted features

Hosted features are not introduced yet: the app does not offer them today and sends no audio, text or voice session to our hosted service. We may introduce them in future; this is how they will work. When you choose a hosted feature - cloud transcription, hosted prompt enhancement or Sage realtime voice - the audio, text or voice session that feature works on is sent through our hosted service to the AI provider that performs it, and the result comes back to you. We record the metering: which feature, how many units, how many credits. We do not keep the audio, the prompt or the transcript after the request completes. Voice transcripts are redacted for personal information on your machine before a hosted send.

The Orcyx API

If you create an Orcyx API token, the data you send through it is stored so the API can return it to you: tasks, prompts, agent configurations, workspace and swarm records, and memory you choose to sync. The token itself is stored hashed.

The website and email

• Page views, counted first-party: the page path, the referring site’s domain, your country, and a salted hash that rotates daily. No IP address, no browser fingerprint and no cookie is stored, so a visit can be counted within a day but not linked across days.
• Page-load performance, measured by Cloudflare Web Analytics: the page address and the page you came from, your browser and operating-system versions, how long the page took to load, draw and respond, and its rounded memory use, tagged with a random identifier that lasts a single page load. It sets no cookie and stores nothing in your browser, it is sent to Cloudflare through orcyx.dev itself, and we see only totals by page, referrer, country, browser and device. Cloudflare states that it does not use this data to track visitors across sites.
• If you join the waitlist: your email, the page you joined from, your country at the time, and your queue position.
• For email we send: delivery, open, click, bounce and unsubscribe events reported by our email provider, and a suppression list so we never email an address that unsubscribed or bounced.

Security, support and community

• Short-lived rate-limit and lockout counters keyed by email address, account or network address, used to stop password guessing and abuse.
• Sign-up, sign-in and password-reset forms are protected by Cloudflare Turnstile, which evaluates signals from your browser to tell people from bots.
• Messages you send us for support, and what we need to answer them.
• If you link Discord: your Discord user ID, obtained with Discord’s identify scope only, which we use to grant or remove your community role. We never request the list of servers you are in or your Discord email.

4. How we use information

• To create and secure your account, sign you in on the web and in the desktop app, and keep sessions you did not start out of it.
• To run your plan: check which features you are entitled to, bill you, grant and meter credits, and issue invoices and refunds.
• To perform the hosted features you ask for.
• To run organizations: membership, roles, policy and spend caps.
• To send service email - verification codes, password resets, receipts, security and account notices - and, only if you opted in, product news you can unsubscribe from in one click.
• To understand which pages people read, in which countries, and how fast those pages load, from the counts and measurements described above.
• To detect and prevent fraud, abuse, and security incidents, and to meet legal, tax and accounting obligations.

We do not sell your personal information or use your content, prompts, audio or code to train AI models. If you allow advertising measurement, we share the limited Google and X measurements described below to understand which ads lead to verified signups and purchases. Google advertising personalization is disabled.

5. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract - to provide the account, plan, credits, hosted features and API you signed up for.
• Legitimate interests - to secure the Services, prevent abuse, count page views and measure page speed without identifying visitors, and improve the product. We have weighed these against your rights, and none involves tracking you across sites.
• Consent - for product email, release telemetry in the desktop app, and optional Google and X advertising measurement on the website and account portal. You can withdraw consent at any time without affecting what came before.
• Legal obligation - to keep financial records and respond to lawful requests.

For people in India, we process personal data for the purposes you consent to when you create an account, and for the legitimate uses the Digital Personal Data Protection Act, 2023 permits, such as meeting legal obligations.

6. AI, microphone and desktop disclosures

• Sage, the voice companion, is an AI system. When you talk to it, you are talking to software, not a person.
• The microphone is used only while you are dictating or in a voice session, and only after your operating system grants permission. The local transcription engines process audio on your hardware and send nothing. A hosted cloud engine is not introduced yet; if we add one, it will send audio to our hosted service, be labelled as such, and be metered in credits.
• AI output can be wrong. Treat code, commands and text an agent or a hosted feature produces as a draft to review.
• Agents you run in Orcyx act with your user account’s permissions on your machine. What they read, change or send is between you, the agent, and that agent’s provider.
• Hosted features are performed by AI providers acting on our instructions (listed below). Their API terms govern how long they hold a request; we choose providers that do not train on API traffic.

7. Who we share it with

We share information with the providers below for the stated purposes. Optional advertising measurement starts only after you allow it:

Inside an organization, its owners and admins can see members’ email addresses, roles, the audit log, and credit spend. We also disclose information when the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition - in which case this policy continues to apply to what was collected under it.

Google Ads measurement is optional. The Google tag loads only after you allow it. We disable advertising personalization and automatic enhanced conversions; our purchase integration sends no email, name, phone number, account identifier or checkout credential. Purchase reporting requires verified payment data and is unavailable for gateway flows that cannot return it. See how Google uses information from partner sites.

X measurement is optional and requires the same advertising opt-in. A signup event requires confirmed email verification or first onboarding completion; a login or page visit is not a signup. Purchase events require verified payment data, exclude test payments, and carry opaque references for deduplication. We do not create website-activity audiences for these events. See X's privacy policy.

Meta measurement is also optional and requires a new advertising choice that expressly includes Meta. We report verified signups and confirmed live purchases, with opaque event references, the product name and, for purchases, the amount and currency. Meta also receives the page address, referrer and browser/device information. We disable automatic event discovery and do not supply email addresses, account IDs, form contents or enhanced matching data. Advertising tags are not loaded on sign-in, password or verification pages, or when the address or referrer contains unsupported parameters. See Meta's privacy policy.

8. Cookies and local storage

• The account portal uses strictly necessary HttpOnly cookies for your session and to bind a sign-in to the browser that started it. If you allow advertising measurement, it also keeps an opaque signup-conversion reference in a separate host-only HttpOnly cookie for up to one hour; that reference grants no account access.
• The website and account portal share your advertising choice in the orcyx_ads_consent_v3 cookie on orcyx.dev for 180 days. Earlier Google/X permission is not reused for Meta. If you allow measurement, Google, X and Meta may set first-party measurement cookies, including Google _gcl_ cookies, X _twclid, _twpid and _twsid cookies, and Meta _fbp and _fbc cookies. Our Google tag requests a 90-day lifetime; X cookies may last up to 13 months and Meta cookies up to 90 days. Browser privacy controls may shorten these. You can decline without affecting signup or checkout.
• The website keeps your theme choice in local storage and, during checkout, briefly holds your email and a receipt lookup reference in session storage. A receipt lookup expires after one hour. Opaque purchase references are held for the tab session to avoid reporting a purchase twice. Cloudflare may set a strictly necessary security cookie; Cloudflare Web Analytics sets no cookie.
• The desktop app keeps its settings, layout and history in files on your machine.

Use Privacy choices at the bottom of a website or account page to allow or decline advertising measurement. Declining withdraws consent across those domains, clears accessible Google, X and Meta first-party measurement cookies and reloads the page without the advertising tags. Other open tabs recheck the shared choice when focused and before reporting a conversion. Reload them to immediately unload previously loaded tags. Global Privacy Control and Do Not Track keep measurement off. Account and payment functions remain available.

9. How long we keep it

• Account and organization data: for as long as the account exists, then deleted when you ask us to delete it.
• Sessions, sign-in codes and lockout counters: until they expire; expired records are purged automatically.
• Billing records, invoices and the credit ledger: for as long as tax and accounting law requires, even after an account is closed.
• Waitlist entries: until you are invited or ask to be removed.
• The email suppression list: indefinitely, because it is what keeps us from emailing you again.
• Page-view counts: kept, but they identify no one and cannot be linked across days.
• Web Analytics measurements: kept by Cloudflare under its own retention terms; we see only the totals.
• Hosted-feature content: not retained by us after the request completes.
• Orcyx API data: until you delete it or your token’s owner is deleted.

10. Security

Traffic to every Orcyx service is encrypted in transit. Passwords are hashed with scrypt; session tokens, API keys and one-time codes are stored only as hashes; single sign-on secrets and sensitive service settings are encrypted at rest. The desktop app signs in through your browser with a one-time code handed back over your own machine’s loopback address, and keeps secrets in your operating system’s keychain. Payment details never reach our systems.

No system is perfectly secure. If you find a vulnerability, please report it to [email protected] rather than disclosing it publicly. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

11. International transfers

Our service providers process data in the countries where they run infrastructure, including the United States and the European Union, so your data may be processed outside the country where you live. When personal data from the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the standard contractual clauses or an equivalent safeguard offered by the provider.

12. Your rights and choices

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy of it;
• correct data that is wrong or incomplete;
• delete your account and personal data, subject to the records we must keep by law;
• export the data you gave us in a portable format;
• restrict or object to processing based on our legitimate interests;
• withdraw consent you gave, such as for product email or telemetry;
• nominate someone to exercise these rights for you if you die or become incapacitated, as India’s DPDP Act allows.

Email [email protected] from the address on your account. We will respond within 30 days, and may need to confirm the request came from you. Account deletion is currently handled on request rather than by a button in the portal.

You can also act directly: unsubscribe from product email with the link in any message, turn telemetry off in the desktop app under Settings → Privacy, discard queued crash reports there, sign out of every device by asking support, and unlink Discord from your account settings.

If you are not satisfied with our answer, you can complain to your local data protection authority or, if you are in India, to the Data Protection Board of India.

13. Children

The Services are for people aged 18 and over, and we do not knowingly collect personal data from anyone younger. If you believe a child has given us personal data, contact [email protected] and we will delete it.

14. Changes to this policy

When this policy changes, the date at the top of this page changes with it. If a change materially affects how we use personal data you have already given us, we will tell you by email or in the portal before it takes effect.

15. Contact

Privacy questions, requests and complaints: [email protected]. This address also reaches the person responsible for grievances under India’s DPDP Act.