Privacy Policy
Last Updated: February 9, 2026
1. Introduction & Scope
This Privacy Policy explains how Orcha ("we," "us," or "our") collects, uses, and protects information when you use our desktop application for multi-agent orchestration of LLM CLI instances (the "Service").
By using Orcha, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
2. Data Controller Information
Orcha
Website: orcha.nl
Contact: orcha_ai@proton.me
For the purposes of the EU General Data Protection Regulation (GDPR), Orcha acts as a data processor, processing your data on your behalf to facilitate AI-assisted software development.
3. Data We Transmit to Third Parties
IMPORTANT: Please read this section carefully.
When you use Orcha to interact with AI agents, the following data may be transmitted to Anthropic (the provider of Claude AI):
- Source code — snippets, functions, files, or entire repositories that you submit or that agents access
- Code diffs — changes made to files during agent operations
- File paths and filenames — directory structures and naming conventions
- Commit messages — Git commit history and messages
- Branch names — Git branch identifiers
- Project metadata — project names, descriptions, and configuration
- Prompts and messages — your instructions and conversations with agents
- Command output — results from commands executed by agents
Recipient: Anthropic, PBC (Claude API)
Purpose: To enable AI-powered code assistance and agent orchestration
Legal Basis: Contractual necessity and your explicit consent through use of the Service
We strongly recommend:
- Do not submit confidential, proprietary, or trade-secret code without appropriate authorization
- Do not include API keys, passwords, credentials, or secrets in code submitted to agents
- Use .gitignore and .env files to exclude sensitive data from agent access
- Review your employer's policies regarding AI code assistants before use
4. Data We Store Locally
Orcha stores all operational data locally on your device:
| Data Type | Storage Location | Purpose |
|---|---|---|
| Projects | SQLite database (orcha.db) | Track repositories and configurations |
| Agent Groups | SQLite database | Organize agents by branch/domain |
| Agent Instances | SQLite database | Manage running agents and status |
| Conversations | SQLite database | Store chat history with agents |
| Settings | SQLite database | User preferences and configurations |
| Worktrees | .worktrees/ directory | Isolated Git worktrees per group |
No cloud storage: Your code, conversations, and project data are never uploaded to our servers. All data remains on your local machine.
5. Authentication Data
Orcha uses Supabase for optional authentication services. When you create an account, Supabase collects and stores:
- Email address
- User ID
- Authentication tokens
- Provider settings (including API keys stored in encrypted user_metadata)
Supabase Privacy Policy: supabase.com/privacy
Your API keys for third-party services (such as Aider/OpenAI) are stored in your Supabase user metadata, encrypted at rest.
6. International Data Transfers
When you use Orcha with Claude AI:
- Your data may be processed by Anthropic in the United States or other countries outside the European Economic Area (EEA)
- Anthropic maintains appropriate safeguards for international data transfers
- By using the Service, you consent to this transfer
Anthropic Privacy Policy: anthropic.com/privacy
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Local database | Until you delete it or uninstall Orcha |
| Conversations | Until you delete them within the app |
| Supabase auth data | Until you delete your account |
| Data sent to Anthropic | Per Anthropic's retention policy |
You can delete your local data at any time by deleting projects within the app, removing the orcha.db database file, or uninstalling the application.
8. Your GDPR Rights
If you are located in the European Union, you have the following rights under GDPR:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate personal data |
| Erasure | Request deletion of your personal data ("right to be forgotten") |
| Portability | Request your data in a portable, machine-readable format |
| Objection | Object to processing of your personal data |
| Restriction | Request limitation of processing |
| Withdraw Consent | Withdraw consent at any time (without affecting prior processing) |
To exercise your rights: Email us at orcha_ai@proton.me with your request. We will respond within 30 days.
Supervisory Authority: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.
9. Security Measures
We implement the following security measures:
- Local storage: All data stored locally on your device, protected by your operating system's security
- HTTPS: All communications with third-party services use encrypted connections
- No telemetry: We do not collect usage analytics or tracking data
- Subprocess isolation: Agent processes run in isolated subprocesses
Your responsibility: Keep your operating system and Orcha updated, protect your device with appropriate security measures, and do not share API keys or credentials.
10. Children's Privacy
Orcha is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, please do not use this Service.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last Updated" date at the top of this document. Continued use of the Service after changes constitutes acceptance of the revised Privacy Policy.
12. Contact Information
For questions, concerns, or requests regarding this Privacy Policy:
Email: orcha_ai@proton.me
Website: orcha.nl
We aim to respond to all inquiries within 30 days.