Privacy Policy

01Personal information collected and collection methods

orke’s AI account settings and terminal and web work information are stored on your computer. Google member sign-in and device and connection approval use the Company’s api.orke.bomtobe.com server. When you use website and agent sign-in, the NVIDIA API, optional web action decision models (Jev and Microsoft Decision-1), direct HTTPS access, or orke support, information needed for that feature is sent to the relevant service. If you use orke support, questions sent by your service, values identifying the person asking, and information the AI retrieves through MCP tools are also stored on your computer. Questions and information retrieved through tools are sent to the AI provider you choose; values identifying the person asking are sent to MCP servers you configure to receive them. We process the address and inquiry content you send to our contact email to respond to you.

This website consists of static pages. It does not use cookies or analytics tools to identify visitors. However, the hosting provider may retain access logs (IP address, access time, and requested address) for a period to operate its servers. That processing follows the provider’s policy. The hosting provider is Microsoft Corporation (Azure Static Web Apps), whose policy is the Microsoft Privacy Statement. This static website’s cookie information does not apply to the separate membership API. The membership API uses cookies to keep you signed in and protect approval requests.

Google membership and device approval server — Stores the unique identifier, email, and name of the account verified by Google, along with membership creation and most recent sign-in times, in MongoDB. It processes device names and identifiers, member associations, hashes of device credentials and API session secrets, session expiry and request protection values, device approval codes, one-time approval proofs, approving members, expiry times, and hashes and counters for rate limiting. It verifies Google credentials when sign-in is requested but does not receive your Google password. The API tells the PC the public IPv4 address observed on the connection so it can construct the connection address. Terminal bytes, web screens, PFX files, and private keys are not sent to this membership server.

02Information stored on your computer

The App stores the settings and work information it needs on your computer. When you enable remote access, terminal input and output and web page screens and input travel directly between the PC’s HTTPS endpoint and the connected device. The membership API does not relay this work content.

The default settings folder is ~/.orke. ORKE_HOME specifies the storage folder if set. The App does not import or copy settings or credentials from other products.

• Settings and state files — ~/.orke/settings.json (execution environment and notification settings), agents.json (agent catalog overlay), accounts.json (registered account list)
• Account homes — ~/.orke/accounts/<agent>/<id>. This is the CLI settings home for additional accounts managed by the App. Each CLI stores its own sign-in credentials here. In the isolated environment, account homes are in volume orke-home at /home/orke/.orke/accounts/… .
• Browser data — Desktop window and web profile cookies, sign-in state, caches, and similar data are stored in ~/.orke/desktop/shell; web browsing history and restore information are stored in ~/.orke/browser. If you access orke from a regular browser, that browser may also store the local access token cookie (orke_t_<port>) and history in its own profile.
• Web action decision model settings and keys — Whether the feature is enabled and the chosen model are stored in the settings file. The Jev API key is stored in ~/.orke/jev/credentials.json; the Microsoft Decision-1 Azure address, deployment name, and API key are stored in ~/.orke/microsoft-decision/credentials.json. Keys are encrypted. Saving these settings does not itself call the TypeSafe or Azure API.
• NVIDIA agent — The API key, settings, conversations, and tool execution records are stored in ~/.orke/nvidia. The API key is kept separate from the general settings file and is used to authenticate service requests.
• orke membership and direct access settings — Device credentials, the member profile, and the most recent verification time are stored in ~/.orke/account; the port, access enabled state, and IP server certificate are stored in ~/.orke/remote-access. Credentials and the certificate’s private key are protected separately from general settings snapshots, using user encryption on Windows and user file permissions on other operating systems. PFX import passwords are not retained in settings. A remote browser’s approval cookie remains in that browser, while approval sessions remain in PC memory.
• orke support — AI settings and instructions, access key hashes and last 4 characters (the original keys are not stored), and MCP connection information are stored in ~/.orke/support. Each room’s questions and answers, values identifying the person asking (encrypted), and processing records (including values sent to and results received from MCP tools called by the AI) are stored in its rooms folder; room working folders are stored in ~/.orke/support-work. MCP header and environment variable values are encrypted in storage (protected only by file permissions on Linux). Claude Code and Codex, which generate the answers, also keep their own conversation records for each room. Claude Code stores them in ~/.claude/projects; Codex stores them in ~/.codex/ sessions and history databases there. If you set CLAUDE_CONFIG_DIR·CODEX_HOME, records are stored in those folders.
• Files in sessions — Files created by shells and agents remain in the working folder you choose. In the isolated environment, they remain in volume orke-home .
• Session recording (off by default) — Environment variable ORKE_RECORD_DIR records terminal bytes in the specified folder only if you set it yourself.

03When the App communicates externally

The features below communicate with the relevant services. What is sent depends on the pages you open, the models and tools you select, and the tasks you run.

04Third-party disclosure and outsourced processing

The external features in Section 3 send information to the relevant services at your choice. Each service’s policy governs storage, use, and deletion of information it receives. You can use the standard web windows and direct web actions by agents without using a web action decision model.

Questions and values identifying the person asking handled by orke support, and information the AI retrieves through MCP tools, may contain information about other people, such as customers of services you connect. This information is stored on your computer and sent as needed to the AI provider you select and MCP servers you connect; the Company does not receive it. If you enable remote access and open the orke support window from another device, room records, access keys created in that window, and MCP secrets you enter also travel between that device and the PC over the PC’s HTTPS connection. As the operator of that service, you are responsible for informing those people of this processing and obtaining any necessary consent.

05Retention and destruction

Information stored on your computer can be removed through the App’s deletion features or by deleting it yourself. Retention and deletion of information already sent to external services follow those services’ policies. You can request access to or deletion of inquiry content at the contact address below.

Membership records do not expire automatically. You can request access to, correction of, or deletion of membership information at the email address in Section 9; the App has no delete membership button. Device credentials can be used for authentication for up to 30 days, API and remote browser sessions for up to 24 hours, and one-time device approval requests for up to 10 minutes. During a network failure, the PC may use its most recent verification for up to 24 hours, but a 401 rejection is not converted into permission to use offline access. These periods define authentication validity; they do not mean data is physically deleted at that exact second. MongoDB expiry indexes remove expired device, API session, pending sign-in, and rate-limit records after a delay. Pending connection approvals embedded in a device record disappear when expired entries are removed on a subsequent request or when the device record is deleted. When device sign-out reaches the server, that device record is deleted. If communication fails, the PC retains the revocation request and retries it. Google’s own sign-in history and content already sent to external AI services follow each provider’s policy.

orke support rooms are automatically deleted after the retention period has passed since the last question finished (30 days by default, configurable from 1–3650 days). Deleting a room also deletes its records, working folder, and that room’s conversations in this computer’s Claude Code and Codex history. Conversation histories are deleted one room at a time after the rooms are deleted, so this may take several minutes if there are many rooms. If you close orke during that time, deletion continues at the next startup (it gives up if deletion still has not succeeded after five startups, for example if codex has been uninstalled). Before uninstalling the App or deleting ~/.orke, delete the AI or rooms in orke support, and do not close orke immediately afterward. You can manually delete remaining history from the Claude Code and Codex history folders listed in Section 2.

The settings folder ~/.orke and the isolated volume orke-home are not automatically deleted when you uninstall the App. Exit orke, save any files you need, and then delete the settings folder yourself. To delete the isolated volume, make sure no container is using it and run docker volume rm orke-home. If you accessed orke from another browser, separately delete that browser’s browsing history and cookies as well.

06Your rights

You can access, correct, and delete your local settings and work information. For information sent to external services, follow those services’ procedures for exercising your rights. Send requests about inquiry content or this policy to the contact in Section 9.

07Security measures

• Default local access uses the loopback address (127.0.0.1). Access from other devices is possible only if you enable direct HTTPS access or expose the orke support question endpoint through a proxy.
• Local access checks access tokens and cookies. Remote access verifies that the Google member ID matches the PC owner and uses approval for each browser. Access checks also apply to terminal connections.
• Windows notification bodies do not include terminal output, commands, paths, or account information.
• The isolated environment’s container has no host folder mounts or published ports.
• Programs inside the isolated environment can connect to localhost services on this PC.
• Web pages are not given access to the App’s Node runtime or orke’s internal APIs. Web pages remain allowed to communicate externally.
• Jev and Microsoft Decision-1 API keys are encrypted and stored locally. They are not passed to agents’ environment variables or web pages. They authenticate TypeSafe and Azure requests, respectively.
• Credentials needed for usage checks and model APIs are used to authenticate requests to those services.
• The orke support question endpoint listens only over http on 127.0.0.1 on this computer and checks requests using a different access key for each AI. Only key hashes and last 4 characters are stored, and keys are masked in logs. To let a service on another computer send questions, you must expose this endpoint through a proxy such as nginx or Caddy (direct access to the workspace does not expose it). You configure https, certificates, and firewalls for that connection.

08Children’s personal information

The App and website are not intended for children under 14. We do not intentionally collect children’s personal information.

09Privacy officer

• Name — Hyun-ki Kim (김현기)
• Email — bomtobe.sw@gmail.com

10Changes to this policy

If this policy changes, the changes and their effective date will be posted on this page. This policy takes effect on 2026-10-16.