Privacy Policy

Last updated: 1 May 2026

This policy explains what data orcs.to collects when you use chat.orcs.to, how we use it, and your rights under the General Data Protection Regulation (GDPR). orcs.to is currently in Alpha — this is pre-release software.

1. What we collect

We collect only what is necessary to provide the service:

• Account information — your email address and display name, provided via Clerk (our authentication provider) when you sign up or sign in.
• Conversation messages — the messages you send and the model responses you receive are stored in our database so you can access your chat history.
• Code execution outputs — when you run code, the input and output are processed by E2B sandboxes and may be logged for debugging.
• LLM usage traces — request metadata (model, token counts, latency) is sent to Langfuse for tracing and cost monitoring. Message content may be included in traces.
• Anonymous pageview analytics — we use Umami for privacy-friendly analytics. Umami does not use cookies, does not track individuals across sites, and does not collect personally identifiable information.

2. How we use your data

• To authenticate you and provide access to the service.
• To store and display your conversation history.
• To route requests to the appropriate language model.
• To debug errors and improve reliability.
• To monitor resource usage and prevent abuse.

We do not sell your data. We do not use your conversations to train language models.

3. Data storage

All data is stored on servers located in the EU (Hetzner Frankfurt, Germany). Data is encrypted at rest and in transit (TLS).

4. Retention

• Account data is deleted within 30 days of a verified account deletion request.
• Conversation data is deleted on request. Email ethankerdy@gmail.com to request deletion of specific conversations or all your data.
• Anonymous analytics data (Umami) is not linked to individuals and is retained indefinitely in aggregate form.

5. Your rights (GDPR)

If you are in the European Economic Area, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your personal data ("right to be forgotten").
• Portability — request your data in a machine-readable format.
• Objection — object to processing in certain circumstances.

To exercise any of these rights, email ethankerdy@gmail.com. We will respond within 30 days.

6. Third-party processors

We share data with the following sub-processors to operate the service:

• Clerk (clerk.com) — authentication and identity management. Processes your email and name.
• E2B (e2b.dev) — sandboxed code execution. Processes code you submit for execution.
• OpenRouter / LiteLLM — LLM routing layer. Your conversation messages are forwarded to the selected open-weight model via our self-hosted LiteLLM instance.
• Langfuse (self-hosted at langfuse.orcs.to) — LLM observability and tracing. Processes request metadata and may include message content in traces.
• Hetzner Online GmbH — infrastructure hosting (Frankfurt, EU).

7. Contact

For any privacy questions or to exercise your rights, contact: ethankerdy@gmail.com

We aim to respond to all privacy requests within 30 days. For unresolved complaints you have the right to lodge a complaint with your local data protection authority.