Privacy Policy

Orchestra never proxies your model calls. Your code and your model calls stay on machines you control.

Last updated: 2026-10-13

This Privacy Policy explains how Orchestra Technologies, Inc. ("Orchestra", "we", "us", "our") collects, uses, shares and protects personal information when you:

• visit our website at orchestrahq.ai (the "Site"), including when you request early access; and
• use the Orchestra service, including the web app, the desktop app, the command-line tool (the "CLI"), the session capture tools, and the MCP server that AI agents connect to (together, the "Service").

Orchestra is in private beta. Some features described here may not be available to every account yet.

This policy does not cover third-party services you choose to use with Orchestra, such as your coding agents, your AI model providers or Linear. Their own privacy policies apply to them.

1. Summary

• The Site uses no analytics, no advertising trackers, no cookies and no third-party scripts.
• If you request early access, we collect your work email address so we can contact you about early access, and we use it for nothing else.
• If you use the Service, we store the content you and your team bring into it: captured AI agent sessions, commit details, notes and memory, work items, and data from integrations you connect. This content can include personal information, such as the names and email addresses of people who appear in it.
• The Service automatically removes the secrets it detects, such as API keys and tokens, from captured content before storing it. It does not remove other personal information by default.
• We do not use your content to train or fine-tune AI models.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.

2. Information we collect

2.1 When you visit the Site

The Site does not set cookies, does not use analytics or advertising tools, and does not load scripts or fonts from third parties. Our fonts are served from the Site itself.

The Site is hosted by a website hosting provider. Like any website, its servers receive standard request information when your browser loads a page, such as your IP address, browser type (user agent), the page requested, the referring page, and the date and time. Our host keeps this information in its request logs for up to 90 days.

2.2 When you request early access

The early-access form asks for one thing: your work email address. With it, we store where the request came from (the Site), the version of the notice shown under the form, the times of your first and most recent requests, and how many times you have submitted the form. We do not store your IP address, browser details or any tracking identifier with your request.

To protect the form from abuse, our servers use your IP address to limit how often requests can be sent. They hold it in memory for no longer than 10 minutes and do not store it with your request. Our hosting infrastructure may also record it in network logs (see Section 2.9).

We use your email address only to respond to your request and to contact you about early access to Orchestra. Requests are stored in our database, hosted with Amazon Web Services in the United States, and only the Orchestra staff who manage early access can see them. When a new request arrives, our team receives an internal notification that does not include your email address. We do not send a confirmation email.

2.3 When you contact us

If you email us, we receive your email address, your name if you include it, and whatever you write. We use this to reply and to keep a record of the conversation.

2.4 Account information

You sign in to the Service through Clerk, our authentication provider, which holds your account details, such as your name and email address. When you sign in, the Service receives from Clerk:

• a unique user identifier;
• your organization's identifier and short name; and
• where your sign-in includes them, your name (or your first and last name) and your email address.

We store the user identifier, your organization's identifier and short name, and a display name. The display name is your name or, if no name is available, a form of your email address. Your workspace is named after your organization's short name.

If a store is set up with the CLI's orchestra init command, it also records a display name taken from your git configuration or your computer account name, and your git email address, as your identity.

When you sign in from the CLI, the sign-in tokens are stored on your own computer, in a file readable only by your user account, and are used to authenticate your requests to the Service.

2.5 Captured agent sessions

The core of the Service is capturing the work your AI coding agents do, so that your team can find it, cite it and hand it off. Orchestra's capture tools read the session files that supported agents already write on your computer, including Claude Code, Codex, Gemini CLI, Cursor and OpenCode. Capture happens only where it has been set up or run, repository by repository: the orchestra enable command installs capture hooks in a repository and orchestra disable removes them; the orchestra watch command, and the desktop app for each repository added in its Preferences, capture sessions while they run; and you can capture or import sessions yourself with the CLI.

From each captured session we store:

• the messages exchanged between you and the agent;
• excerpts of the agent's tool calls (for example, a command it ran or a file it edited) and of their results, limited in length;
• excerpts of the model's reasoning text, where the agent records it, limited in length;
• token usage figures; and
• a complete archived copy of the session transcript, after secret redaction (see Section 2.10).

Because agents work on your code, captured content can include excerpts of source code, file paths, command output and anything else that appeared in the session.

You can also import exports of your conversations from claude.ai and ChatGPT with the orchestra import-chat command. Imported conversations are handled in the same way.

2.6 Code and repository details

For commits connected to captured sessions, we store the commit identifier, the repository (its remote URL or a local path), the commit message, the branch, the commit author's email address and the commit time. We use these to link commits to the sessions that produced them. We do not copy whole repositories. Code reaches the Service only as it appears in captured session content.

2.7 Memory and work content

We store the content you and your agents create in the Service, such as notes saved to memory, decisions, session summaries, work items and issues, comments, and activity in shared sessions. From this content we derive search indexes (including text embeddings) and a graph of the people, work items, repositories and sessions it mentions, so that answers can cite the events they came from.

When you are active in a shared session, other participants can see your messages and when you are typing. The typing indicator is held in memory for a few seconds and is not stored.

2.8 Integrations you connect

If your workspace connects Linear, we read and store, and write changes back at your direction, Linear data including issue identifiers, titles, descriptions, status, priority, labels and teams, the name and email address of issue assignees, your own Linear name and email address, and your Linear organization's name. The Linear API key you provide is stored encrypted, is never written to the event log, and is deleted when you disconnect the integration.

2.9 Technical and log data

Our servers and hosting infrastructure record technical information when the Site's early-access form or the Service is used, such as request details (which can include IP addresses), errors and database performance records. We use it to operate, secure and debug the Service. These logs can contain identifiers and, occasionally, fragments of content. Section 8 explains how long they are kept.

2.10 Personal information inside your content

Before captured content, notes, commit messages and archived transcripts are stored, the Service runs them through a redaction step that replaces secrets such as cloud credentials, API tokens, private keys, passwords in credential settings and credentials embedded in URLs. Redacted secrets cannot be recovered from the stored content. Redaction is automated and may not catch every secret.

The redaction step can also detect some other personal information, such as email addresses, phone numbers and postal addresses, but that detection is off by default. Unless it is turned on, personal information that appears in your content, such as a colleague's name or email address in a transcript, commit or issue, is stored as it appeared.

Please do not bring into the Service special categories of personal data (such as health, genetic or biometric data, or information about racial or ethnic origin, political opinions, religious beliefs or sexual orientation), protected health information, payment card data or government identification numbers.

2.11 Data kept only on your computer

The CLI and capture tools also keep some data only on your own computer, such as records of capture progress, local backups you create with orchestra backup, and custom redaction rules. We do not receive this data unless it is also sent to the Service.

3. How we use information

We use personal information to:

• provide the Service: store, index, search and display your workspace's content to the people and agents permitted to see it, link sessions to commits and work items, and keep connected integrations in sync;
• create and manage accounts and authenticate sign-ins;
• respond to early-access requests and other messages, and send messages about the Service;
• keep the Service and its users safe, including detecting and preventing abuse, fraud and security incidents;
• operate, maintain, debug and improve the Service; and
• comply with the law and enforce our terms.

To improve the Service, we may use information about how it is used, such as which features are used and the errors that occur. We do not use Customer Content, meaning the content you and your team bring into the Service, for anything other than providing, securing and supporting the Service for your organization, and we do not use it to train or fine-tune AI models, unless your organization agrees in writing.

We do not send marketing email. We email early-access requesters only about early access, and account holders only about the Service, for example about security or changes to our terms.

4. AI models and where processing happens

Orchestra is built so that the AI agents you use run under your own accounts:

• The coding agents whose sessions you capture, such as Claude Code or Codex, run on your computer under your own accounts with their providers. Orchestra does not operate those agents and is not a party to your relationship with their providers.
• Sessions you start through Orchestra, such as with orchestra chat, run on your computer using your own Anthropic API key or Claude Code sign-in.
• Some optional features, such as creating search embeddings or session summaries, can call OpenAI or another OpenAI-compatible model provider using an API key that you configure. Those calls are made under your account with that provider, and that provider's terms and privacy policy apply to them.
• Where no model provider key is configured, search embeddings are created with an open-source model that runs where the data is being processed. Content is not sent to a third party for this.

Orchestra does not currently send Customer Content to any AI model provider on its own account, and does not run AI agents for you in the cloud. If that changes, for example to create summaries in the background, we will update this policy and the list of service providers in Section 6 before it does.

Whichever of these applies, the content of the sessions you capture, and of sessions you start through Orchestra, is stored in the Service as this policy describes.

5. How we share information

We share personal information only in these cases:

• Within your workspace. Content in a workspace is visible to the members of that workspace and to agents acting for them. Your name and display name are visible to other members.
• Service providers. We use service providers that process personal information on our behalf and under our instructions (see Section 6).
• Integrations and providers you direct us to use. When you connect an integration such as Linear, or configure a model provider key, data is sent to that service at your direction.
• Legal and safety reasons. We may disclose information if we believe in good faith that the law or legal process requires it, or that it is needed to protect the rights, property or safety of Orchestra, our users or others.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your consent, or at your direction, in other cases.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. Service providers (subprocessors)

We will update this list before a new service provider starts to process personal information for us.

Services you connect yourself, such as Linear, your coding agents and your AI model providers, are not our subprocessors. You use them under your own agreements with them.

7. Where information is stored, and international transfers

Data in the hosted Service is stored with Amazon Web Services in the United States (the us-east-1 region). If your organization configures the CLI or capture tools to write to a database that it operates, the data those tools write is stored in that database, under your organization's control, instead.

We are based in the United States, and we and our service providers process personal information there. If you are outside the United States, your information will be processed in the United States, where data protection laws may differ from those where you live. Where we process personal information for a customer under a data processing agreement, transfers are covered by the safeguards that agreement describes, such as the European Commission's Standard Contractual Clauses.

8. How long we keep information

• Early-access requests: until we give you access or decide not to, and in any case no longer than 24 months after your most recent request, unless you ask us to remove your request sooner.
• Account information: for as long as your account is active, and then deleted within 90 days after it is closed, unless the law requires us to keep it longer.
• Workspace content: for as long as your organization's workspace is active. The Service records activity in an append-only event log. Events in the log are not edited in place: correcting or superseding a note records a new statement and does not erase the earlier one. Removing content therefore needs a dedicated deletion process, which we are building. Until it is available, when an organization closes its workspace or asks us to delete its content, we delete that workspace's data from our production systems within 90 days. Deleting individual items from a workspace that stays active is not yet supported; contact us and we will help.
• Backups: automated database backups are kept for 14 days, so deleted data may remain in backups until they expire. When we retire a production database, we may keep a final snapshot of it for up to 30 days.
• Server logs: kept for 90 days.
• Integration credentials: until you disconnect the integration, when they are deleted.

We may keep information for longer where the law requires it, or to resolve disputes and enforce our agreements.

9. Security

We use technical and organizational measures designed to protect personal information, including encryption of the hosted database at rest, encrypted connections to the database, a database that is not reachable from the public internet, envelope encryption of integration credentials with keys held in a cloud key management service, and redaction of secrets before content is stored.

No system is completely secure, and the Service is in beta. If you believe you have found a security vulnerability, please report it to contact@orchestrahq.ai.

10. Your choices

• Capture: capture runs only where it has been set up or run. The orchestra disable command removes the capture hooks from a repository. To stop continuous capture, stop orchestra watch, or remove the repository from the desktop app's Preferences.
• Integrations: the orchestra disconnect command disconnects an integration and deletes its stored credential.
• Export: you can ask for a copy of your workspace's content by writing to contact@orchestrahq.ai. We will provide it in a machine-readable format within 30 days.
• Early access: you can ask us to remove your email address at any time by writing to contact@orchestrahq.ai.
• Email: we do not send marketing email, and you can ask us to stop contacting you at any time.

11. Your privacy rights

Depending on where you live, you may have rights over your personal information. To use any of them, email contact@orchestrahq.ai. We will verify your request by confirming that you control the email address linked to your request or account. We will respond within 30 days, or within the longer period the law allows, and tell you if we need more time. We will not discriminate against you for exercising your rights.

For content in an organization's workspace, we act on the organization's behalf, as its service provider or processor, and the organization decides how that content is used. If your personal information is in such a workspace, for example because you are named in a colleague's captured session or are assigned a Linear issue, we may refer your request to the organization and will help it respond. For account information, Site information and early-access requests, we decide how the information is used and act as its controller. We offer a data processing agreement to customers on request.

11.1 European Economic Area, United Kingdom and Switzerland

Where the GDPR, the UK GDPR or Swiss data protection law applies and we act as controller, you have the right to access, correct or delete your personal information, to restrict or object to our processing of it, to data portability, and to withdraw consent where processing is based on consent. You can also complain to your local data protection authority.

Our legal bases are:

11.2 United States state privacy laws

Some US state privacy laws, such as the California Consumer Privacy Act, give residents rights over their personal information. Where these laws apply, residents may have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; and to opt out of its sale, of its sharing for cross-context behavioral advertising, and of certain profiling. We do not sell personal information or share it for that kind of advertising, and we do not use it for profiling that produces legal or similarly significant effects. You may use an authorized agent to make a request, subject to verification.

We collect the following categories of personal information, from you, from your organization and its members, from integrations you connect, and from our service providers:

We use sensitive personal information only for purposes the law permits, such as providing the Service, and not to infer characteristics about you.

11.3 Do Not Track and Global Privacy Control

The Site and the Service do not track you across other websites, and we do not sell or share personal information for advertising, so there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of. If that changes, we will treat a Global Privacy Control signal as a valid request to opt out.

12. Cookies and similar technologies

• The Site sets no cookies and uses no browser storage, analytics, pixels or third-party scripts. If that changes, we will update this section first.
• The web app uses cookies set by our authentication provider, Clerk, to keep you signed in and to secure your session. They are strictly necessary for the Service to work.
• The CLI stores sign-in tokens in a file on your computer rather than in cookies (see Section 2.4). The desktop app signs in through the CLI in the same way, and the web app it displays uses the same sign-in cookies as the web app in a browser.

13. Children

The Site and the Service are intended for business use and are not directed to children. You must be at least 18 to use the Service. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page and change the "Last updated" date. If we make material changes, we will tell account holders by email or through the Service before the changes take effect.

15. Contact us

• Company: Orchestra Technologies, Inc.
• Privacy questions and requests, and security reports: contact@orchestrahq.ai

Questions about any of this go to contact@orchestrahq.ai.

Back to the homepage