Privacy Notice
Who is responsible. Orlu is provided by Max Yung, trading as Orlu, located in Richmond, British Columbia, Canada. Privacy contact: maxyung520@gmail.com.
Local records and credentials. Orlu keeps project registrations, conversations, attachments, preferences and local backups on your PC. Local voice recognition uses a downloaded model; live voice and AI requests may send audio, transcripts or content to the selected AI provider. API keys entered in Orlu are encrypted using Electron safeStorage and the Windows user/profile context. Official CLI account sign-ins are managed by their official tools. Orlu's sync service is not given provider credentials or their native session state. Encryption of keys does not mean the entire local workspace or its backups are encrypted at rest by Orlu.
AI and cloud-agent providers. When you select a provider, Orlu supplies the request, relevant conversation context, attachments or file references, and approved tool information as supported by that integration. Those providers apply their own terms, account controls and privacy policies. API requests go from your PC to the relevant provider. Manus tasks run in Manus's cloud; Codex/Claude cloud environments and repositories are also separate third-party services. They are not covered by Orlu sync encryption. Switching to another provider may send it shared conversation context; only choose that provider if you want it to process that context.
Optional encrypted cloud sync (currently a private preview). Sync is initially unconfigured. Once a user connects a space and chooses projects, Orlu uploads selected conversation records, project names/instructions and registered attachments as encrypted snapshots, and downloads them to authorized computers. Whole project/source folders, Git repositories, API keys, official CLI sign-ins, local execution permissions, local absolute paths and native provider sessions are excluded. Content typed into a conversation or attached as a file may itself contain personal or confidential information and will be included if that project is selected.
Content is encrypted on the client with AES-256-GCM before upload. Each space uses a content key held by its authorized clients and included in its recovery authority. The service stores ciphertext in a private Cloudflare R2 bucket and coordination information in Cloudflare Durable Objects. Under the implemented protocol it is not given the content decryption key. This is a description of the implementation, not a claim of an external cryptographic audit. Protect your paired computers and recovery code: anyone with recovery authority can add a computer and decrypt the space.
The service can process space/device identifiers, computer display names, device-token hashes, pairing/approval material, revision numbers, timestamps and encrypted object sizes. Cloudflare also processes network information such as IP addresses and request metadata under its own service policies. We have disabled the application's Worker observability setting; that does not mean no hosting/network metadata is processed by Cloudflare. Do not put sensitive information in a computer's display name.
Sync is scheduled separately on each PC (default 30 minutes, or Manual only). Current cloud snapshots remain while the space is retained. Superseded snapshots are eligible for removal after 30 days through the service's cleanup process; cleanup is not a promise of deletion at an exact instant. Local workspace backups and recovered/conflict copies are separate and are not automatically pruned by this version. Local copies remain on computers that have downloaded them.
Deselecting a project or disconnecting a computer does not delete its cloud history. Revoking a device stops its later service access; it does not remotely erase its local copies or rotate the key protecting snapshots it already had access to. Losing every authorized device and the recovery code can make the encrypted content unrecoverable. Verified deletion requests for a private-preview sync space can be submitted through maxyung520@gmail.com.
Phone, tablet and browser access. A paired browser communicates with the user's PC over a configured HTTPS/WebSocket Cloudflare relay or a Tailscale-based connection. The relay forwards prompts, replies, approvals and supported attachment traffic needed for the browser session. Relay transport is protected in transit but is not the same as end-to-end encrypted sync: the Cloudflare relay processes readable request/response content while forwarding it. It is not designed as a persistent conversation store. Pairing/session-token hashes and device records are kept by the PC. Cloudflare/Tailscale may process connection metadata under their own terms.
Subscriptions and licence delivery.
| Data | Purpose | Where | Retention / Limitation |
|---|---|---|---|
| Buyer identity, contact, billing/payment and tax information | Payment, receipts, billing, refunds and fraud controls | Paddle, Merchant of Record; Orlu does not store card details | Paddle's applicable retention and legal requirements |
| Paddle subscription ID, status, paid-period dates and revocation flag | Determine paid access | Orlu licence service on Cloudflare Workers / Durable Objects | Retained while active and for 24 months after a subscription ends, then automatically purged during subsequent service pruning |
| Licence-key hash | Verify a licence key | Licence service | Purged automatically with the associated subscription record 24 months after the subscription ends |
| Temporary plaintext licence key and one-time claim association | Deliver the key to the app that started checkout | Licence service | Claim delivery expires after 7 days; expired records are pruned during later relevant processing |
| Processed webhook event IDs / timestamps | Detect duplicate notifications | Licence service | Old entries beyond 30 days are pruned when later webhook processing occurs |
| IP-derived hash for rate limiting | Reduce abusive licence checks | Licence-service memory | Per-minute rate window; no application database storage for this limiter; hosting-layer processing is separate |
The licence check transmits a licence key; validation replies contain status/expiry rather than buyer identity. Checkout uses Paddle's cookies and notices. For lost-key replacement, the requesting app generates a private claim token and shows only a reference hash, valid for 7 days. Support verifies the actual Paddle order and buyer control, including a challenge to the Paddle-recorded email; an authenticated operator can then invalidate the old key and queue a replacement for that private token. The licence service stores an operation ID, subscription/order ID, reference hash and timestamp for this audit, with entries older than 30 days pruned on later processing. The service does not receive the email challenge or buyer email in this workflow. Support emails sent to maxyung520@gmail.com are retained for up to 24 months after resolution unless required longer for legal or tax compliance. Do not send card numbers, provider API keys or cloud-sync recovery codes.
Recipients and international processing. Relevant recipients include the AI/cloud services you choose, Paddle for billing, Cloudflare for licence hosting, optional sync and relay hosting, and Tailscale if you use that access method. Service providers may process data in Canada, the United States, the United Kingdom, the European Economic Area, or other countries where they operate. We do not sell personal data.
Requests and deletion. Depending on applicable law (including British Columbia's Personal Information Protection Act and applicable consumer privacy laws), you may have rights to access, correct, export, restrict or delete personal data. Contact maxyung520@gmail.com. We may need to verify control of the relevant subscription or sync space. We cannot decrypt a sync snapshot without client-held keys or erase copies held on another computer remotely. Payment records are also subject to Paddle's procedures and legal retention duties. Local files and backups can be managed on your own computer.
Security and changes. We use HTTPS for service transport, client-side authenticated encryption for optional sync, hashed service authentication/entitlement values where described above, and local credential encryption. A compromised PC can expose its readable records and unlocked keys. We will update this notice when data flows or services change.