Privacy Policy

Last Updated: November 10, 2026

This Privacy Policy explains how Lovecast Inc. d/b/a Stably AI ("we", "our", or "us") handles information when you use Orca’s website, desktop and mobile apps, remote runtime, and company-operated online services (the "Service").

1. Information We Handle

Local use. Much of Orca runs on computers you control. Your local projects are not uploaded as product-usage telemetry. Online features process information needed for the features you use and the services you connect.

Accounts and sign-ins. We process identity and organization information, memberships, profiles, machine identifiers, authentication and session records, and related security information. Sign-in records can include a machine label, IP address, and sign-in or refresh times.

Mobile and remote connections. We process connection and routing information, including pairing, host, session and device identifiers, to connect supported Orca clients and hosts. Depending on the connection and feature, data passes through relay infrastructure operated for Orca. This includes Cloudflare Workers and Durable Objects, which can store relay credentials, assignments and connection state.

Connected services. When you enable an integration, we process the permissions, credentials or tokens, identifiers, messages, events, webhook requests and delivery records needed to operate it. An enabled chat or issue-tracker integration can exchange relevant messages, issue details and agent responses between that provider and your connected Orca host. The information depends on the integration and permissions you authorize.

Notifications. If you enable mobile push notifications, we process device push tokens, registration details, and host and delivery information. Notification payloads can include a title, body and identifiers used to open the relevant Orca view. Delivery involves Apple Push Notification service or Firebase Cloud Messaging, as applicable. Your device’s notification-preview settings affect what others can see.

Sharing and directory features. Hosted sharing processes the content, package files and metadata needed to store, deliver and manage your shares. Public artifacts can be accessible to anyone with their public link. Private sharing uses the feature’s access controls; revoking a share cannot recall copies already downloaded or installed. Directory features can process account-linked plugin likes and pseudonymous installation events to display popularity information.

Cloud Sandboxes. When you choose a hosted sandbox, the sandbox infrastructure processes the workspace, files, credentials and agent activity you enable there. These are hosted workloads, distinct from local-only use and optional product telemetry. The provider, location and retention arrangements depend on the deployment.

Support and diagnostics. We process submitted feedback, crash reports, screenshots, diagnostic bundles, device and app details, and contact information you provide to respond and investigate. These materials may be handled through our support and communications providers, including Slack. Review material before sharing it, particularly if it contains credentials, customer information or project content.

Product-usage telemetry. Where enabled, Orca sends usage events with a random installation identifier, build and platform details, and bounded feature-usage information. Some events use pseudonymous conversation identifiers to associate repeated usage summaries. This telemetry is designed to exclude project contents, prompts, agent responses, terminal output and free-form local paths. It is separate from information needed for accounts, integrations, remote connections, sharing and support. Product telemetry uses PostHog Cloud’s US service. See the telemetry documentation for current fields and controls.

Website analytics and service requests. We use Plausible and PostHog to measure visits, downloads and interactions. These website analytics integrations do not store analytics cookies or persistent visitor identifiers in your browser. PostHog processes request information, including IP address and browser details, to calculate an identifier that changes daily. We do not identify website analytics visitors by name or email or enable session recordings. PostHog requests use its US service. Hosting, delivery and security providers also process request information to operate and protect the Service.

2. How We Use Information

We use information to provide requested features; authenticate users and authorize access; route and deliver connections, messages, notifications and shared content; respond to support requests; understand and improve product use; investigate abuse and security incidents; and meet applicable legal obligations.

3. Disclosure and Service Providers

We do not sell your personal information. We use providers for infrastructure, storage, authentication, website delivery, analytics, communications and notification delivery. These include Google Cloud and Cloudflare for infrastructure, PropelAuth for authentication, Vercel for website hosting, and the analytics and communications providers described above. Providers process information relevant to their services.

When you connect an external service, relevant information passes to or from that service according to your configuration and its terms. Publicly shared content is disclosed to the audience of the sharing feature you select. We may also disclose information when required by law or in response to valid requests by public authorities.

4. Retention and Deletion

Retention depends on the information, feature, account relationship, security and operational needs, and applicable legal obligations. Expiring access to content or revoking a link is different from erasing stored objects or copies already received by others. Backup, object-version and soft-delete recovery periods can delay final erasure.

Contact [email protected] to request access, correction or deletion of personal information we handle. We may need to verify your identity and authority and consider shared ownership, legal requirements and information held by connected providers. We review requests across the relevant online services and recovery systems. Applicable legal rights and deadlines apply.

5. Processing Locations

Our infrastructure and providers may process information in the United States and other locations. Orca relay infrastructure includes US and Hong Kong regions and Cloudflare’s distributed network. Any customer-specific processing restrictions must be agreed and supported by the relevant service configuration.

6. Your Choices and Third-Party Services

You can disable product telemetry in Settings → Privacy, or use DO_NOT_TRACK=1 or ORCA_TELEMETRY_DISABLED=1 for supported launches. Turning off optional telemetry does not disable account and security records or processing needed for features you choose to use. Our website PostHog integration respects Do Not Track and does not initialize when your browser sends Global Privacy Control.

You choose which model providers, agents, integrations, hosts and sharing features to use. Independently selected services have their own privacy practices and terms. Customer-operated hosts and third-party agents can handle information separately from Orca’s company-operated services.

We do not use customer code or prompts to train our own models. Coding agents send the context needed for your requested inference to the providers and accounts you configure, under those providers’ terms. Disabling Orca’s optional telemetry does not disable that inference or change a connected provider’s training or retention settings.

7. Privacy Rights and Requests

Depending on your location and applicable law, you may have rights to know about or access your personal information, obtain a portable copy, correct inaccurate information, request deletion, restrict or object to certain processing, or withdraw consent where processing relies on it. California residents may have rights under the CCPA, as amended, including rights to know, access, correct and delete personal information and applicable rights concerning sale, sharing or sensitive personal information. The availability of a right depends on the law and our role in the processing.

Send privacy requests to [email protected], or contact our accountable privacy and security lead, Neil Parker, at [email protected]. You do not need to create an account to make a request. Describe the request and your relationship to Orca; do not send passwords, API keys or unnecessary identity documents. We may request proportionate information to verify identity and authority, including an authorized agent’s permission. Where we process information for an organization, we may refer the request to that organization or act on its verified instructions.

We provide privacy-request responses without charge except where applicable law permits otherwise, and follow applicable legal deadlines. If an exception or extension applies, we explain the basis and next steps as required. Deletion can be subject to legal retention obligations and the recovery-copy limits described above. Where applicable, you may complain to your data-protection regulator.

We do not discriminate against people for exercising applicable privacy rights, including by denying service, charging a different price or providing a different service quality for that reason. A feature may require information needed to provide it; if you ask us to stop processing that information, we explain any resulting functional limitation. This does not condition optional telemetry choices on a lower level of service.

8. Changes and Contact

We may update this policy by publishing the revised policy and its Last Updated date. Contact [email protected] with questions or privacy requests.

Business address: Lovecast Inc. d/b/a Stably AI, 2261 Market Street, STE 31863, San Francisco, CA 94114, United States.