Privacy Policy

1. Who we are and what this policy covers

Orca (“we,” “us,” or “our”) operates the marketing website at aiorca.dev and www.aiorca.dev, and Orca Cloud at cloud.aiorca.dev. This policy describes information handled when you browse those sites, create or use a Cloud account, make managed AI requests, or contact us.

The open-source Orca plugin runs in your Godot editor. Its local storage and direct connections to providers are described below and in our Safety & privacy overview. Other websites and providers you choose have their own privacy policies. Our Terms of Service cover use of the website and Cloud, including accounts, subscriptions and your project content.

2. Information we process

• Website and connection information. Hosting and network services receive information such as your IP address, browser/request headers, requested pages and access times to deliver and secure the sites. Cloud uses security and rate-limit metadata, including hashed IP-address and email identifiers.
• Account and authentication information. Your display name, email address, account identifier, verification status, and records needed for login, recovery and sessions. For password-based accounts, your password is processed for authentication; we store a password hash rather than the plain password. Connected-editor records include device labels and session status.
• Usage and billing information. Model and request identifiers, timestamps, token-usage metadata, request outcomes, allowance grants, reservations and charges, subscription status, and payment/transaction references and amounts.
• AI request content. Prompts, attached images, conversation context, project instructions and relevant project content included in your model requests, as described in AI requests and project data.
• Support and enterprise communications. Your email address, message and any attachments or other information you choose to send us. The enterprise inquiry form also collects your name, company, selected discussion topic, and optional role and team size. Project content sent in an inquiry or support email can remain in that correspondence, separately from the handling of an inference request.

If you choose an external sign-in option where offered, such as Google or GitHub, we process the provider’s account identifier and the account information it supplies for that sign-in, such as an email address, display name and verification information where available. We use this information to authenticate you and associate the sign-in with your Orca account. The information available depends on the provider and the permissions requested in the sign-in flow. Your password with that provider is not supplied to Orca.

3. How we use information

We use information to deliver the website, create and authenticate accounts, verify email ownership, recover accounts, pair editors, provide model responses, enforce model access and usage limits, account for usage and payments, deliver transactional emails, answer support requests and enterprise inquiries, and protect the service against abuse.

Enterprise inquiries are processed by the marketing website’s server-side endpoint and sent to our support mailbox through the configured email service. They are not submitted to Orca Cloud or an AI model, and the marketing application does not keep an inquiry database. The endpoint keeps short-lived, hashed client-address counters in server memory to limit repeated submissions. Inquiry contents and email credentials are not included in its application error logs.

Where applicable law requires a legal basis, these purposes include performing the service you request, our legitimate interests in operating and securing the service and resolving support issues, and compliance with legal obligations. Where a use requires consent, we obtain it for that use. You can request withdrawal of consent where processing relies on it, without affecting processing already carried out.

4. AI requests and project data

When you use Orca Cloud, the plugin sends the content needed for an individual request to Cloud. Cloud forwards that request to its configured Microsoft Azure-hosted model service and streams the response back. Relevant project instructions, source content returned by tools, images and retained conversation context can be part of that request.

Cloud does not routinely persist prompts, source snapshots, images, full model outputs, tool arguments/results or private reasoning in its application database or routine logs. It retains usage, accounting and request-status metadata. The current integration does not use request content to train models or provide a Cloud chat-history archive.

Microsoft’s inference service has its own processing, retention and safety/abuse-monitoring practices. These can include content review or retention under the applicable Azure terms. See Microsoft’s Foundry model data-privacy documentation; our application-level storage behavior does not mean a model provider never processes or retains content.

When you use your own provider credentials or a local model endpoint, requests go to the endpoint you select rather than Orca Cloud. That provider’s policies and your server configuration govern its handling of content. A local endpoint can forward requests elsewhere. The plugin can store conversation history, including submitted images, locally on your device. Local archives are not automatically synced to a Cloud history service, but context included in an inference request is still transmitted.

Automatic-script recovery stores bounded exact previous/proposed script source as plaintext local conversation data. These recovery checkpoints are excluded from provider continuation and support reports and are deleted with the conversation. An optional remembered Auto apply preference is stored in local Godot EditorSettings for the exact project, outside project files and conversation history. Recovery records do not grant editing permission. See script recovery for its limits.

5. Cookies and analytics

Orca Cloud uses essential cookies for sign-in and security: orca_browser identifies a browser session and orca_csrf protects browser forms. If an external identity sign-in flow is enabled, the temporary orca_oidc cookie binds that login flow to your browser. These cookies are HttpOnly, use SameSite protections, and are Secure on HTTPS. Their lifetimes depend on the session or login flow.

The marketing header makes a request to Cloud using its existing session cookie and receives only your display name or a signed-out result. This allows it to show account and Console links. The header does not read the cookie value or copy your account information into browser local/session storage. The public pricing request omits cookies and authentication.

When you select a website language, we save that preference in your browser’s local storage as orca-site-language. It contains only the language code and lets us restore your choice when you return to the homepage. Translations are bundled with the website; selecting a language does not send page content to a translation service. You can remove the preference by clearing this site’s browser storage.

We have not enabled Vercel Analytics, Speed Insights, advertising trackers or session-replay tools on the marketing site. Hosting providers still process connection and operational data to deliver and protect the service. You can clear or block cookies in your browser; blocking essential cookies can prevent Cloud sign-in and related account features from working.

6. Service providers and disclosures

We use services that process information needed for their part of the service:

• Vercel: hosting and delivery of the marketing website, including technical request/connection data and server-side processing of enterprise inquiry forms. Vercel privacy notice.
• Microsoft Azure: hosting for Cloud and its database, and processing of managed model requests through Azure-hosted inference. Microsoft privacy statement and Foundry model data-privacy documentation.
• Zoho: email delivery, including recipient addresses, account or payment-email content, and enterprise inquiries when the website’s SMTP sender is configured with Zoho. Zoho privacy policy.
• PayPal: subscription and payment processing. PayPal handles payment details you provide in its checkout. Orca records transaction references, amounts and subscription status; its billing integration does not store full card numbers or card security codes. PayPal privacy statement.
• External sign-in providers, where offered: Google or GitHub process authentication with their service and supply the account information described in Information we process. Their own account and connection-data practices are covered by the Google Privacy Policy and GitHub General Privacy Statement.

Our current service does not sell personal information or share it for targeted advertising. Access by service operators is for administration, support, security and accounting. We may disclose information when required by applicable law or valid legal process, or when necessary to protect rights and service security. Providers’ own notices describe additional processing when you interact directly with their services.

Following links to GitHub, YouTube, the Godot Asset Store or another external site takes you to a service governed by its own policies. Information you post publicly or send to those services is handled there.

7. Data retention

We retain account, usage, financial and support records according to their purpose and operational or legal requirements. There is no single deletion period for all data.

Cloud periodically removes expired login, verification/recovery and pairing records, expired session/refresh records, old rate-limit records and completed job metadata. Transactional-email payloads are discarded when the queued work completes or reaches a terminal failure. Detailed settled usage telemetry and processed billing-event data are subject to configured retention rules.

Financial ledger entries, payments, allowance records and related account/request references are retained for accounting, reconciliation, audit and dispute handling. A receipt no longer appearing in the Console does not mean its underlying financial record has been deleted. Unresolved usage or payment records may need longer handling.

Support correspondence and information held by hosting, email, payment or model providers have separate retention considerations. To ask about a particular record or request deletion, contact us. The current Console does not offer automatic self-service account deletion.

8. Security

Cloud uses password hashing, HTTPS for deployed connections, authenticated account access, session revocation and browser-form security checks. Sensitive queued transactional-email content is encrypted in the application database. Routine application logs use limited operational fields instead of request bodies or credentials.

These protections do not make every record anonymous or every data store encrypted in the same way. In particular, local plugin history and direct-provider settings have their own storage behavior. See our Safety & privacy overview for local-data details. No internet service can guarantee absolute security.

9. Your choices and privacy requests

You can update your display name and password in Cloud settings, review usage and connected editors, revoke sessions, and sign out. You can also choose which content to submit, remove pending image attachments, and use your own provider or local endpoint instead of managed Cloud inference.

Depending on applicable law, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, withdraw consent where relevant, and raise a complaint with a data-protection authority.

Send requests to support@aiorca.dev, identifying the account email and what you are requesting. We may need to verify ownership before acting on account data. Requests are handled according to applicable law and the records involved; financial or security obligations can limit deletion. Please do not send passwords, access tokens or payment-card details with a privacy request.

10. International processing

Hosting, email, payment and model services can process information in countries other than where you live. Processing locations depend on the service and deployment configuration; this policy does not promise that all information remains in a single country. The provider notices linked above describe their international processing and safeguards. Contact us for questions about the processing relevant to your use of Orca.

11. Children’s privacy

If you are a parent or guardian with a concern about a child’s personal information being provided to Orca, contact us at support@aiorca.dev so we can review the information and the request under applicable law.

12. Changes to this policy

We may update this policy as our service or data practices change. We will publish the updated policy here with its effective date and provide additional notice where applicable law requires it.

13. Contact us

For privacy questions, concerns or requests, contact Orca at support@aiorca.dev.

Back to top ↑