Where your data goes

What never reaches us

• Provider API keys. The extension stores them in vscode.SecretStorage on your machine. The web app keeps a guest’s keys in the open tab only; once you sign in, it saves them in this browser’s local storage for your account until you sign out. Browser storage is a convenience, not a vault: it is not encrypted. Keys are never logged, and never sent to us in readable form except through Server Proxy (below).
• Key Vault (optional, signed-in accounts). Keys in your Key Vault are stored only as ciphertext that we cannot read. When you use Server Proxy, your key passes through our server for that request and is not stored. Each key is encrypted in your browser (AES-256-GCM) before upload, under a key unlocked by a recovery key that only you hold. We cannot decrypt your keys or recover them if you lose your recovery key. This depends on the code we serve: a compromised site could capture keys while your vault is unlocked. Signing out removes the unlock and keys from that device; the encrypted copy stays in your account until you delete it in Settings. If you let a device remember your vault, that device keeps your vault key only in encrypted form, and we keep a separate per-device secret that opens it. We release that secret only while the device has been used in the last 30 minutes, and we forget it when you lock or remove the device, sign out, or lock every device. On its own, neither copy can decrypt your keys. A known limit of this version: someone who controls our database cannot read your keys, but could replace one saved key with an older encrypted copy of it, or remove a key.
• Saved team (optional, signed-in accounts). “Save team to account” stores your seats’ providers, models, roles, directives and rates in your account in readable form, not encrypted, until you replace them. It never includes a provider key.
• Extension prompts. The extension sends requests from your editor directly to the provider you seated. It has no inference proxy, so an extension request is not stored here. A web Server Proxy request is forwarded in memory and not stored; an explicit cloud save is listed under what we hold.
• Local plans and audit trails. PLAN.md, EXECUTION.md and everything under memory/ are ordinary files in your repository.

One exception, in the web app, and only if you choose it. By default your browser calls the provider directly. If you are signed in on a paid plan and switch Transport Mode to Server Proxy, or you are signed in on any plan and seat a provider that blocks direct browser calls (the seat says so), that request, including your provider key, passes through our server on its way to the provider. It is forwarded in memory only: we do not store or log the key, the prompt or the reply, and we never substitute a key of our own.

What we do hold

• Account data. Supabase Auth manages your sign-in identity and credentials. Supabase also holds your account entitlement and billing status. Google sign-in does not require an AI Orchestra password.
• Billing records. Handled by our payment processor; we retain invoices and the last four digits of a card, never the full number.
• Cloud chat save (explicit). When you save a web chat to the cloud, Supabase stores that transcript, including prompts and completions. The extension has no equivalent cloud transcript save.
• Cloud workspace files. Saving a file in a cloud workspace stores that file’s text. Local plans and files stay on your machine until you save them there.
• Support correspondence. What you send us, kept while the issue is open and for a reasonable period after.

Who else is involved

The model providers you seat process your direct requests under their terms. Supabase supplies authentication and the account database; Stripe processes payments; Vercel hosts this website and its performance measurements. We do not sell data, we run no advertising, and we do not use your data to train anything.

HubSpot runs on our public pages only: the home page, pricing, the blog, the changelog, the docs, download, help, proof, the site map, and this page and the terms. There its scripts measure visits, show its cookie notice, and include a form collector that can record details submitted through a form on those pages, such as the email address on an invite request. HubSpot is not loaded on the web chat, the sign-in and sign-up pages, your account, dashboard or workspace. If you arrive at one of those from a public page, the page loads afresh so that HubSpot is no longer running. In a browser where you have saved provider keys, used Key Vault, or signed in, HubSpot is not loaded on any page.

Your controls

Export or delete your account data from Billing or by asking us. Deletion removes the account and its billing history subject to statutory retention. The extension has no telemetry toggle. Files on your machine are yours; deleting your account does not touch them.