Trust and privacy: where your work lives and what leaves your PC

Five different places, and they are not the same place

Most privacy pages collapse everything into one sentence. That sentence is always either false or useless. Orcheri's information sits in five distinct places, and the difference between them is the whole point.

Your PCYour Rooms, conversations, Room memory, decisions, shared files, your teammates' results and Orcheri's record of each teammate's session. Stored locally under your Windows profile. Relevant context goes to a teammate’s provider when it works; it is not automatically uploaded to Orcheri’s service.
Your AI providersWhat each AI tool sends directly to its own maker, under your own account, when it works: the prompt Orcheri composed for that turn, carrying the Room context and handoffs that teammate needs, plus whatever the runtime itself gathers. Anthropic, OpenAI, Cursor, Google and GitHub each apply their own terms to it, and so do the model providers you configure in OpenCode.
Your Orcheri accountA small online service for the Private Alpha: your request, your account, your access, your download. It does not automatically receive Room or work content. It receives account, access and update requests, support content you choose to send, and limited product insights only if you turn them on.
What you send usA message from Help & feedback, and a diagnostic report if you choose to attach one. Room information is not automatically attached. Account, access and update checks also contact Orcheri’s service. Help improve Orcheri is a separate, optional choice.
Where you put itA local backup you asked for, or a handoff document you exported. Those are files on your disk, and after that they go wherever you take them.

Your Rooms are stored on your PC

This is the half that is genuinely local. The other half — what your AI tools send to their own providers while they work — is the next section, and it is the part no product should claim away.

Orcheri is a Windows desktop application, not a website with a desktop client. Rooms, conversations, Room memory, decisions, the trace of who did what, and Orcheri's record of each teammate's session live in a local database in your Windows profile. There is no Orcheri server holding a copy, and there is no sync.

The agent session itself — what it holds and how long it lasts — belongs to the AI tool's own runtime, not to Orcheri. If the runtime positively reports that a session is gone, Orcheri starts a fresh one and gives the teammate its work back from the Room’s record. When the evidence is ambiguous and there is work to preserve, it keeps the session binding, tells you and offers the choice to start fresh. A replacement is never presented as a resume. How work continues.

A local backup, when you ask for one, is a folder on your own disk and nothing is sent anywhere. Two facts about it we would rather you hear from us: it is not encrypted, so keep it somewhere private and do not send it to anyone including us; and it covers Orcheri's own record and the files Orcheri keeps — a linked project folder or repository is listed as not included, not silently missed. Restoring is checked and staged before anything in your live profile changes, nothing is deleted, and work that was under way comes back waiting for you rather than resuming behind your back.

Unless you turn on Help improve Orcheri, the desktop shares no product-usage information. It writes content-free operational messages to standard output. The hosted service and its infrastructure also keep operational and security records; the privacy notice describes those separately from your Room work.

What your AI tools send, and to whom

This is the part no local-first product can honestly claim away. When a teammate works, its own runtime sends its own traffic to its own provider — the prompt Orcheri composed for it, with the context that teammate needs, plus whatever the runtime itself gathers as it works. Orcheri adds no relay of its own in between and holds no key of its own.

So: your work does leave your PC when an agent works on it, and it goes to the same provider it reaches when you use Claude Code, Codex, Cursor, Antigravity, OpenCode or GitHub Copilot CLI directly. What changes with Orcheri is not the destination but the composition: Orcheri decides what each teammate is told, from the Room's own record, so a provider also receives the Room context that turn needs — the assignment, relevant memory and decisions, handoff results and the material selected for the work — that you would otherwise have pasted in yourself. What a teammate is given.

Each provider's own terms, retention and training policies apply to that traffic, under the account you signed in with. Orcheri cannot alter them and does not claim to.

What comes back is structurally reduced before Orcheri saves it and again when it is read, so known credential-shaped fields are kept out of what Orcheri stores and shows.

What your Orcheri account holds

The Private Alpha needs somewhere to keep requests, accounts and approved downloads. That small online service holds your email address, the answers you gave on your request, your account and when its email was verified, the sign-in provider's identifier for you, your optional choices, the PCs you set up, the purpose and delivery state of messages we send you, and an audited record of what an Orcheri operator did. If you turned on Help improve Orcheri, it also holds the limited insights that choice covers.

It does not automatically receive your Room or work content. Account, PC activation, access renewal and update checks contact the service. Support is separate: we receive whatever you choose to type or send, including a diagnostic report if you attach one.

Your password, if you use one, is held by the sign-in provider, never by Orcheri. Validation of invitation codes and emailed links uses one-way fingerprints. Usable codes may be held encrypted briefly for delivery, and expired delivery secrets are removed.

The detailed information-handling notice is the notice published with the application form, with its own revision, the operator and the privacy contact. That revision is recorded with your application. This page is a summary; read the notice for the current categories, choices and retention rules.

What you send us, only when you send it

Orcheri has a Help & feedback surface, and it is a one-way door you open.

A support message is a message between you and the Orcheri team, tied to your account. It is not a Room, not a conversation and not a teammate. Conversation text, files, folders, prompts, Room names, paths, repository addresses, environments, logs and session identifiers are not automatically attached. What you type is what we get, so leave out secrets and work you do not want to share. Your own copy of those conversations is kept encrypted by Windows, outside every Room profile and every backup.
A diagnostic report is a fixed set of typed facts: the versions of Orcheri, Windows and your AI tools, where this PC's access stands, whether Orcheri could reach us, and which kind of activity you were doing. It has no free-text field by design, so there is no field a path, prompt, title, address or session identifier could travel in, and you see the exact text before you decide to send it.
An exported handoff never leaves your PC on its own. It is a document rendered from one piece of work, carrying no prompt, no compiled context, no session and no captured provider history, and you are shown the exact text before it is saved.

Nothing about what you did in a Room is sent to us. The one thing the app can share about how it is used is the optional, account-linked product insight described next, and only if you choose it.

Necessary service data, and one optional choice

Two kinds of information reach Orcheri's online service, and only one of them is optional.

Necessary service dataYour Alpha request and its approval, your account and sign-in, setting up each PC, access renewal, update-offer checks and the downloads you ask for, and Support messages or diagnostic reports you choose to send. These provide the Alpha service. Where enabled for delivery, a small installation receipt can also report that the app reached a usable launch, a fixed launch problem, or that Windows accepted an update-page open request.
Optional product insightsOff unless you choose Help improve Orcheri: one unchecked choice in Setup, which you can change at any time in Settings → Privacy & data. Declining changes nothing about installing, activation, updates or ordinary use.

When you turn it on, Orcheri shares a limited picture of how the app works, linked to your Alpha account — it is not anonymous: app version and channel; recent app connectivity and whether a window is visible or minimized; coarse daily launch and usage totals; interaction and execution time ranges; the days you started meaningful work; broad feature use and single-agent or team use; which runtime families were discovered, ready or used, with bucketed attempt and outcome counts and fixed connection or reliability problem categories; and update presentations, dismissals or handoff failures. Connectivity means the app reached the service; it does not prove a person is present, and Orcheri does not inspect activity in other applications.

Never included: conversation or prompt text, answers, project names, file names or paths, files, screenshots, clipboard contents, exact team rosters, commands, raw errors, model names, native session contents, provider credentials, or token and cost records. It does not copy your Rooms to the cloud or start provider work to measure anything.

Orcheri uses these observations to improve onboarding, runtime connections, reliability, updates and broad adoption. Account-linked views are limited to the authorized Owner role in Orcheri's operations; there is no analytics export, duration views describe a group of at least five participating accounts, and there is no individual hours-worked view or productivity score.

Turning it off stops this PC's optional recording immediately, clears its pending optional data and requests withdrawal and deletion of the linked history; if you are offline, the request waits and is retried. Local optional queues expire after seven days and daily summaries after 90 days; hosted backups are scheduled to expire after 30 days, which is not a promise of immediate erasure from backups. The Product Learning notice in Setup and in Settings → Privacy & data holds the exact wording.

Official interfaces only

Claude Code through Anthropic's Agent SDK, running the Claude Code you installed yourself; Codex through its app server; Cursor through Cursor Agent's ACP mode; Google Antigravity through Google's own Antigravity ACP helper; OpenCode through its ACP mode, opencode acp; GitHub Copilot CLI through its own ACP server. Orcheri never automates a consumer chat window, never calls a private endpoint, and never copies or parses another application's credential store — by any route, for any reason.

When you ask Orcheri to install Antigravity's helper, OpenCode or Copilot CLI, it downloads only the provider's reviewed release from the provider's own host, refuses it unless its SHA-256 and publisher signature match, and unpacks it unchanged into its own folder. Signing in stays in each provider's own flow; for Copilot CLI that may be the GitHub CLI sign-in Copilot finds by itself, which Orcheri never reads.

Orcheri runs the Claude Code you installed and signed in to yourself. It never bundles, installs or modifies it, never offers a Claude sign-in of its own, and never reads Claude's credentials. The supported configuration is your own Anthropic API key or a supported cloud provider, each billing you directly; Orcheri makes no claim that a Claude subscription is a supported way to use it.

Your accounts, your bills

Each teammate runs under the login you already have with its maker. There is no Orcheri key in between or token bundle, and the Private Alpha is free. Orcheri adds no provider-usage markup during this Alpha. Your provider’s rates and limits apply; delegation and review can use more of your provider allowance. Signing in to Orcheri is a separate thing from signing in to any of your AI tools, and never replaces it.

A project Room points at a folder you chose. Teammates work there the way they normally do, with their own tools — which can include Git — inside their own sandboxes and within the autonomy you set.

In a folder you bring, Orcheri's own use of Git is read-only: it reads the status, the current commit and the diff, to check what a teammate actually changed. There is one exception, and it only happens when you ask for it. If you choose Create new project, Orcheri makes a new empty folder and starts an ordinary Git repository in it with a single empty first commit, so later work has something to be compared against. No remote, no hosting account, and no change to your global Git settings.

Who decides what an agent may do

You do, in two ways, and no teammate can widen either.

The autonomy you chose — Ask me first, Work, ask when it matters or Keep going — decides whether a permission an agent asks for reaches you, and your answer continues the same turn. A denial is a real answer, not an error. No teammate and no lead answers a permission that reaches Orcheri.
The work's own ceiling. Where work is meant to be read-only, a request to write is refused outright rather than put to you — because no answer inside that work could allow it, and an ordinary Allow can never widen it.
Who holds that ceiling differs by tool, and Orcheri says which. On Claude Code the write tools are simply not in the model's hands, and Codex keeps its own read-only sandbox: the runtime itself holds the limit. Cursor, Antigravity, OpenCode and GitHub Copilot CLI give Orcheri no way to have the runtime itself hold it, so Orcheri does not run work that must change nothing on them as though the limit were enforced: it refuses that work, and refuses any write request above the limit that reaches it. Asking a teammate only to review is an instruction it follows, not a sandbox.
Some tools keep their own permission settings. OpenCode and GitHub Copilot CLI keep their native permission behaviour under every autonomy setting: they ask when their own settings say to ask, Orcheri shows you that request to allow or decline, and what their settings already allow or deny stays as they set it. OpenCode 2 asks before nothing by its own default.

Orcheri coordinates work within limits. Every round asks each teammate at most once, work has step and delegation bounds and pauses when it starts repeating itself, and Until done runs only within the allowance you set and only while Orcheri is open. Stop ends processes held inside Orcheri’s execution boundary, including its running project check.

Tools can also hand work to other applications or services beyond that boundary. Before your team can make changes, Orcheri asks you to acknowledge this limit. In a Room without a project, the disclosure reads: Orcheri can end processes inside its containment. Tools can hand work to other apps or services that Orcheri does not own and cannot reliably stop or prove finished. That work may continue after Stop or Quit and may overlap later work in this Room.

There is a choice behind that. Orcheri could narrow what your AI tools are allowed to do until everything stayed inside its own boundary — and it does not. Your teammates keep their shell, their MCP servers, their browser and everything else their runtime gives them, because a teammate cut down to fit a containment guarantee is a worse teammate. The acknowledgement is the honest price of leaving them whole.

The acknowledgement covers the project folder, or the Room when there is no project, in your profile on that PC. Accepting starts nothing and is not repeated at every handoff. You can revoke it from the Room’s details. A changed disclosure, a restored profile or a move to another PC can require a fresh acknowledgement. If Orcheri cannot confirm that work it owns has ended, it blocks further work and tells you what needs attention; the acknowledgement does not bypass that check.

Stopped, interrupted, failed and “waiting for you” are said plainly in the conversation and on Home. A crash leaves resumable work and a sentence naming what the team was doing. In a project Room, “done” is checked against the repository and your own check script before it is published. Delegated work never appears as conversation, but every step is kept and readable under Behind this answer — kept out of your way, never hidden from you.

Secrets: what we catch, and what we cannot

Orcheri's redaction is structural. It removes fields that are shaped like credentials from what it stores, shows and exports, and it runs again when a stored payload is read back. An outward handoff is reduced further: private parts of URLs and absolute paths come out.

No structural rule can find a secret pasted into ordinary prose, and we will not pretend otherwise. If you paste an API key into a message, it is text in your conversation like any other text. That is exactly why an exported handoff is shown to you in full before it is saved — so the last check is a human one. Keep secrets in the places your tools already read them from.

Telling us about a security problem

If you find something that exposes data, credentials or a machine — yours or anyone's — we want to hear it early, and an Alpha is the cheapest moment to fix it. A security report is read by the Owner of the Orcheri team.

Security reports: use the contact form and choose the security option

Please describe what you did and what you saw, and leave live credentials out of the message — say what kind of thing appeared and where, not the secret itself. Orcheri runs no bug bounty and pays nothing for reports, which is worth saying plainly so nobody is misled. What to include.

What we do not claim

Orcheri does not verify that a change is semantically correct. It verifies that the repository moved and that your own checks passed.
It does not measure what a run cost. Your providers' own dashboards stay the source of truth.
It cannot find every secret, as above.
It cannot always tell whether a provider still holds a session. When it is unsure it keeps the teammate's session and asks you, rather than silently replacing it.
It does not yet carry months of project memory.
It is not a security boundary around your AI tools. Each one keeps its own sandbox and its own safety behaviour, and Orcheri works with those rather than over them.
Nothing here is legal advice, and the Private Alpha's policies are an Alpha's policies, not a claim of compliance in any particular jurisdiction.

Your choices, and asking us about your data

Your request carries two optional choices, off unless you turn them on: launch news by email, and taking part in optional Alpha product-learning activity. Neither affects your request or your access, and you can change either at any time from your request or account page. The desktop's Help improve Orcheri is a separate, newer choice, made in Setup and changed in Settings → Privacy & data; an earlier choice is never converted into it. Messages about your own request, invitation, account and support are sent because you asked for them; they are not marketing and carry no tracking.

Retention depends on the record. A request whose email is never confirmed is deleted after 30 days. Account, identity, consent and PC records do not all have a fixed automatic expiry; the notice published with the application form explains the rules and the removal process. To see, correct or delete what we hold about you, write to the privacy contact named in that notice.