OrcaThis Privacy Policy explains how Gamina Teknoloji ve Yazılım Hizmetleri A.Ş. ("Gamina", "we", "us") processes personal data when you use Orca: the orca.actor website, the web app at app.orca.actor, Orca Server for Mac, Orca for Mac, remote access, the server directory and in-app feedback (together, the "Service").
Gamina is the data controller. Contact details are in section 15. If you are in Türkiye, see also our KVKK Aydınlatma Metni.
1. The short version
- Your projects, code, conversations, agent histories and backups stay on your own computer. Orca's server runs on your Mac, and we cannot see that data. When you use remote access, it travels through Cloudflare's network to your devices and is not stored by us (section 3.3).
- We keep only what we need to run your account and remote access: your Google account ID and email address, the names of the servers you connect, which Terms you accepted, and the feedback you choose to send.
- Prompts and code go directly from your computer to the AI providers you connect (such as Anthropic or OpenAI), under your own agreements with them. They do not pass through us.
- Analytics are off unless you agree. If you opt in, we use Google Analytics for Firebase to see which pages and screens are used. It never receives your code, prompts or conversations.
- Optional features that contact other services (website icons, weather, currency rates, market quotes) are off until you turn them on.
- We do not sell your personal data or use it for advertising.
2. Where your data lives
| Where | What | Who can access it |
|---|---|---|
| Your computer (Orca Server and apps) | Projects, code, files, conversations, agent histories, organisation and settings, logs, backups; your AI provider sign-ins and API keys | You. Gamina has no access. |
| Our cloud services (Google Firebase, Cloudflare) | Account details, server directory entries, Terms acceptance records, feedback tickets, hosting logs; analytics data if you opt in | Gamina, and our service providers acting for us (section 7) |
| Services you connect or turn on yourself (Anthropic, OpenAI, ElevenLabs, GitHub, Open-Meteo and others) | Whatever you, your agents or the feature send them | You and that provider, under its own terms (section 8) |
3. Personal data we process
3.1 Account data
You sign in with Google through Firebase Authentication. Firebase keeps a user record with your Google account identifier (user ID), email address, name, profile photo URL and sign-in times. Orca itself uses only your user ID and verified email address; it does not use or store your name or photo.
The Orca server you own also keeps your user ID and email address on your Mac, so that it recognises you as its owner.
3.2 Server directory
To give each of your Macs an address such as yourname.orca.actor, our directory stores:
- your user ID and email address as the owner, and when you first signed in;
- the names you choose for your servers;
- the identifiers of the secure tunnels connecting them; and
- when entries were created and updated.
3.3 Remote-access traffic
When a client connects to your server from outside your network, the traffic travels through Cloudflare's network. It is encrypted in transit, and Cloudflare decrypts it at its edge to route it to your Mac. We do not store the contents of this traffic. Cloudflare may process connection metadata (such as IP addresses and timestamps) for security and operations.
3.4 Website and hosting logs
When you visit orca.actor or app.orca.actor, download an app, or your apps contact our directory, our hosting providers (Google Firebase Hosting and Cloudflare) process technical data: IP address, browser and device type, the pages and files requested, referrer and time of the request. Signing in also loads Google's Firebase software from Google's servers, which then see your IP address.
3.5 Analytics (only with your consent)
If you choose "Allow analytics", we use Google Analytics for Firebase ("Analytics") on orca.actor and in the Orca web app, wherever it runs: app.orca.actor, Orca for Mac, or your own server's address. The choice is asked and kept separately on each of these sites. Nothing from Google Analytics loads, and no analytics cookie is set, before you choose. Analytics then collects:
- a randomly generated identifier, kept in the
_gacookies and the browser's Firebase storage; - the pages and screens you view. In the apps these are fixed screen names such as "settings" or "thread", never the titles, IDs or paths of your threads or projects. On orca.actor they are the page address, without query details other than campaign tags;
- events Google Analytics records automatically, such as first visit, session start and time engaged;
- browser, operating system, device type, screen size and language;
- approximate location (country, region, city), which Google derives from your IP address; and
- how you arrived (the referring website and campaign tags).
Analytics never receives your code, file names or contents, repository details, prompts, conversations, agent output, API keys or provider credentials. We turn off Google signals and ad personalisation, deny all advertising storage, and block the copy of each hit that Google's tag sends to its advertising endpoint. We do not link Analytics to advertising products and do not collect advertising identifiers.
You can change your choice at any time: with "Cookie settings" at the bottom of every orca.actor page, or under Settings → Privacy in the apps. Withdrawing stops collection and deletes the analytics cookies and identifier from your browser.
3.6 Terms acceptance
When you accept our Terms and this Privacy Policy at sign-in, we record the versions you accepted, the time and your user ID.
3.7 Feedback
When you send a bug report or idea from the app, we receive the text you write, a screenshot if you attach one, the page you were on, the Orca version and which app you used, and your email address and name from your Google account. Your server also stores a feedback key for your account; we keep only its fingerprint. Gamina's team reads feedback, and we may use AI tools, including models from Anthropic or OpenAI, to sort it and act on it. Please do not include secrets or other people's personal data in feedback.
3.8 Communications
If you email us, we process your message, email address and anything you choose to include.
3.9 Optional outside services (off until you turn them on)
Under Settings → Privacy you can turn on features that contact other services directly from your browser or Mac, not through us:
- Website icons: sends the hostnames of links in chats and browser tabs to Google to fetch their icons;
- Weather: sends your weather location's coordinates, and place searches, to Open-Meteo;
- Currency rates: sends your currency pairs to Frankfurter;
- Market quotes: your Orca server sends your market symbols to Yahoo Finance.
Each of these services also sees your IP address, and processes data under its own terms and privacy policy.
3.10 What we do not collect
We do not collect payment data, since Orca is free during the beta. We do not collect the contents of your projects or conversations, your AI provider sign-ins, or your API keys.
4. Why we use personal data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account; sign you in; link your clients to your servers | Account data, directory data | Performance of a contract (Art. 6(1)(b)) |
| Provide remote access and the server directory | Directory data, remote-access metadata | Performance of a contract (Art. 6(1)(b)) |
| Keep the Service secure; prevent abuse and fraud; troubleshoot | Hosting logs, remote-access metadata, account data | Legitimate interests (Art. 6(1)(f)) |
| Understand and improve how Orca is used | Analytics data | Consent (Art. 6(1)(a)) |
| Handle the feedback you send and improve Orca with it | Feedback data | Legitimate interests (Art. 6(1)(f)) |
| Record acceptance of the Terms; establish, exercise or defend legal claims | Terms acceptance record, relevant account data | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) |
| Answer your messages; send essential service notices, such as Terms changes or security issues | Contact data, communications | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Comply with the law and lawful requests from authorities | As required | Legal obligation (Art. 6(1)(c)) |
The legal grounds under Turkish law are set out in our KVKK Aydınlatma Metni. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Cookies and similar technologies
| Name / type | Where | Purpose | Duration | Needs consent |
|---|---|---|---|---|
| Firebase Authentication storage (browser IndexedDB) | app.orca.actor | Keeps you signed in | Until you sign out or clear it | No: strictly necessary |
| Orca session cookie | Your own server's address (e.g. yourname.orca.actor) | Keeps your client connected to your server; set by your server, not by us | Until 30 days after you last use it, or until you sign out | No: strictly necessary |
| Preference storage (browser local storage) | orca.actor, and wherever the Orca web app runs | Remembers settings such as layout, theme and your analytics choice (with its time and text version) | Until you clear it | No: strictly necessary |
_ga, _ga_<ID> (Google Analytics) | orca.actor, and wherever the Orca web app runs | Distinguishes visitors and sessions for analytics | Up to 2 years, or until you withdraw consent | Yes |
| Firebase Installations storage (browser IndexedDB) | orca.actor, and wherever the Orca web app runs | An identifier the Analytics software keeps | Until you withdraw consent or clear it | Yes |
Analytics cookies and identifiers are set only after you agree, and only for the site you are on. You can withdraw your consent at any time with the same ease as giving it, through "Cookie settings" at the bottom of every orca.actor page or Settings → Privacy in the apps.
6. How long we keep data
| Data | How long we keep it |
|---|---|
| Account data | While your account exists; deleted when you delete your account |
| Server directory entries | Until you remove the server or delete your account |
| Terms acceptance records | While your account exists; deleted when you delete your account |
| Feedback | Until you delete your account, unless we delete it earlier |
| Record of a deletion | Your user ID and the time of deletion, for one day, so a repeated request can be answered |
| Analytics event data | 2 months at event level; aggregated reports that do not identify you may be kept longer |
| Hosting and network logs | For the standard retention periods of Google and Cloudflare; longer only if needed to investigate abuse or where the law requires it |
| Emails and support requests | As long as needed to handle your request, then up to 2 years |
Data stored on your own computer stays there until you delete it. We cannot delete it for you.
7. Who we share data with
We share personal data only with:
- Service providers we use to run the Service: Google LLC (Firebase Authentication, Firebase Hosting, Google Analytics for Firebase) and Cloudflare, Inc. (DNS, Tunnel, Workers and D1 storage for the server directory, Terms acceptance and feedback). We also use AI providers such as Anthropic and OpenAI to help us handle feedback (section 3.7).
- Authorities, where required by law or to protect rights, safety and the integrity of the Service.
- A successor, if Gamina or the Service is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.
- Others, with your consent.
We do not sell personal data and do not share it for cross-context behavioural advertising.
8. Services you connect or turn on yourself
When you connect an AI provider or another service to Orca, such as Anthropic, OpenAI, ElevenLabs or GitHub, or turn on an optional feature from section 3.9, your Mac or browser communicates with it directly, using your own account or API key where one is needed. That provider processes your data as an independent controller under its own terms and privacy policy. We do not receive that data. Please review those providers' policies.
Your Orca server also downloads software and public data it needs, for example updates of the AI tools you installed (from npm and GitHub), public model price lists (from Orca's directory service, or GitHub if it cannot be reached) and the Cloudflare tunnel software. Those services see your Mac's IP address.
9. International transfers
Gamina is based in Türkiye. Google and Cloudflare, which run our cloud services, and the AI providers we use for feedback store and process data in the United States and other countries where they operate. Using Orca's cloud features therefore means your account, directory, Terms acceptance and feedback data are transferred outside Türkiye and outside your own country. Analytics data is transferred to Google only if you consent (section 3.5).
10. Security
We use encryption in transit, access controls, and the security features of Google and Cloudflare to protect personal data. Your Orca server accepts remote connections only after you sign in with the owner account. No method of transmission or storage is completely secure. Please protect your Google account and the computer running your server. Report vulnerabilities to support@gamina.app.
11. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time (for example, for analytics), without affecting earlier processing; and
- complain to a supervisory authority. In Türkiye, that is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the EU/EEA, it is your local data protection authority.
Users in Türkiye have the rights listed in Article 11 of the KVKK, described in our KVKK Aydınlatma Metni.
To exercise your rights, email support@gamina.app from the email address linked to your account. We may need to verify your identity. We reply within 30 days, free of charge, unless the law allows otherwise.
12. Deleting your account
You can delete your account under Settings → Privacy → Delete account in the apps, or by emailing support@gamina.app. Deleting it in the app removes, at once, your Google sign-in record in Firebase and everything our directory keeps for your account: your servers' directory entries, addresses and tunnels if you own them, your Terms acceptance records and your feedback. If you ask by email, we do the same within 30 days. Analytics data already collected is not linked to your account and expires as described in section 6.
Deleting your account does not delete data stored on your own computer; you can remove that by deleting Orca's data folder and the apps.
13. Children
Orca is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy. We will post the new version at orca.actor/legal/privacy with a new effective date, keep earlier versions in the archive linked from that page, and for material changes ask you to accept the new version when you next sign in.
15. Contact
Data controller: Gamina Teknoloji ve Yazılım Hizmetleri A.Ş.
Esentepe Mah. Talat Paşa Cad. No: 5, İç Kapı No: 1, Şişli, İstanbul, Türkiye
Privacy, legal and security: support@gamina.app