Privacy policy
Orpheus is run by Mjonesone LLC ("we"). This page says what the service collects, why, who else handles it, how long it is kept and how to delete it. It covers the website, the web app and the Orpheus apps for iPhone, iPad, Mac and Android. Last updated November 13, 2026.
The short version
- We collect what is needed to sign you in, run your workspace and bill you: your email address, your name if you give one, sign-in records and what you and your agents put into the workspace.
- The live screens of your agent sessions stream through our server to your browser. We do not store them. Transcripts and uploaded files pass through the same way.
- No advertising, no third-party trackers or analytics, no selling or sharing of personal data for advertising.
- You can delete your account from inside the app at any time: Account and security, then Delete account.
What we collect
| Data | Details | Why |
|---|---|---|
| Account | Email address (required). Name, if you sign in with Google. If you use Google sign-in, Google's account id for you. | Sign-in, account recovery, showing who did what to your workspace members. |
| Passkeys | The public key, credential id, a label and use counter for each passkey you add. The private key never leaves your device. | Sign-in and confirming sends. |
| Sign-in sessions | A hash of the session token, the browser or app user agent, the IP address, and when the session started, was last used and expires. | Keeping you signed in, the "Where you're signed in" list, security. |
| Sign-in codes | Your email address, a keyed hash of the 6-digit code and link (never the code itself), the requesting IP address, attempt count and expiry. | Email sign-in and step-up checks, abuse prevention. |
| Workspace | Workspace name, members and their roles, invitations (the invited email address and role), plan. | Running the workspace you share with others. |
| Connected servers | The label you give a machine, its host name, operating system and connector version, when it was last online, and a hash of its connector credential. | Showing your servers and checking the connector is allowed to connect. |
| Agent sessions | tmux session names your connector's local policy exposes, the agent type (for example Claude Code or Codex), the name of the agent's config folder, activity times and the share settings. | Listing your sessions. |
| Asks, decisions and rooms | Questions your agents raise and their context, the answers and notes you give, Decision Matrix items and choices, and room messages. | These features keep this content so you and your team can act on it. |
| Usage readings | For each AI login on a connected machine (only if you turn usage on in the local policy): percentages used, reset times and credit figures. Never tokens, emails or credentials. | The Usage page and limit projections. |
| Audit log | Who did what and when in a workspace (for example sent text to a session, revoked a server, changed a role), with the IP address and details such as the session name and the number of bytes sent. It does not record the text you sent. | Security and accountability inside the workspace. |
| Preferences | Your layouts and view settings for each workspace. | Keeping the app the way you set it up. |
| Billing | Card payments: your Stripe customer id, plan, subscription status and renewal dates. Card details go to Stripe and never reach us. App Store and Google Play purchases: the store's transaction or purchase id, product, status and renewal dates. | Knowing which plan your workspace has. |
| Checkout reminders | If you start a card checkout and don't finish it, the attempt (plan, time, whether you unsubscribed) so we can send up to two reminder emails. Each has an unsubscribe link. | Finishing a purchase you started. |
| Push tokens | In the apps, if you allow notifications: the device's push token, platform and app version. | Sending notifications to that device. We do not send any yet. |
| Server logs | Errors with the request method and path. Rate limits count requests per IP address and email address in memory only. | Keeping the service running and stopping abuse. |
What passes through but is not stored
- Live screens. The visible output of the sessions you open is sent by your connector to our server and straight on to your open browser or app. It is held in memory only while it is relayed.
- Text and keys you send to an agent. They are relayed to your connector. The audit log records that a send happened and its size, not the text.
- Transcripts. When you open the Read view, your connector reads the conversation from your machine and our server relays it to you. It is not saved.
- Uploaded files. A file you attach is relayed to your machine and saved there by your connector, if its policy allows uploads. We do not keep a copy.
Your code, your agents' credentials and the rest of your machine stay on your machine. The connector cannot run commands we send it; see Security.
On your device
We set three cookies, all first-party: the session cookie (keeps you signed in, 30 days from last use), a security token against cross-site requests, and a short-lived cookie during Google sign-in. The web app also keeps layout settings and image thumbnails in your browser's local storage. There are no advertising or analytics cookies.
How we use it
Only to provide the service: sign you in, run your workspace, relay between you and your machines, bill you, keep the service secure, answer support requests, and send the emails the product needs (sign-in codes, invitations, checkout reminders). We do not use your data for advertising, sell it, or use your workspace content to train AI models.
Who else handles it
| Who | What they get |
|---|---|
| Our hosting provider | Runs the servers and database that hold the data above. |
| Resend | Your email address and the message, to deliver sign-in codes, invitations and checkout reminders. |
| Stripe | Your email address, name if set, workspace id and payment details, to take card payments on the web. |
| Apple and Google | In-app purchases are made with your Apple Account or Google account under their terms. We receive the transaction details listed above. Push notifications, when we send them, go through Apple's or Google's push service. |
| Google sign-in | Only if you choose it: Google tells us your email address, name and account id. |
| Members of your workspace | See your name and email, and what you do in that workspace. |
We may disclose data if the law requires it. If the business is sold, the data would move with it under this policy.
How long we keep it
- Account, passkeys, sign-in records and push tokens: until you delete your account.
- Workspace content (servers, sessions, asks, decisions, rooms, audit log, preferences, billing rows): until the workspace is deleted, which happens when its last owner deletes their account.
- Usage readings: 14 days.
- Sign-in codes: usable for 10 minutes. The hashed record is kept until the account is deleted; it cannot be turned back into the code.
- Sign-in sessions: expire 30 days after last use. The record stays until the account is deleted.
- Rate-limit counters: in memory, at most 15 minutes.
- Stripe, Apple and Google keep their own payment records under their own policies.
Deleting your account
In the app or on the web, open Account and security and choose Delete account. You confirm it's you, then we delete at once:
- your account, passkeys, sign-in sessions, push tokens and preferences;
- every workspace you own with no other owner, with everything in it, and the connection of every server in it;
- your membership of workspaces that have another owner. Those keep their history, with your name removed from past actions.
A card subscription for a deleted workspace is cancelled at the same time. App Store and Google Play subscriptions are not cancelled by deleting your account; cancel them in your device's subscription settings. If you can't sign in, email support@example.com from the account's address and we will delete it for you.
Your choices and rights
You can see and change most of your data in the app, remove passkeys and sign out devices, and delete your account. Depending on where you live (for example under the GDPR or California law) you may also have the right to a copy of your data, to correct it, to object to or restrict its use, and to complain to a data protection authority. Email us to use any of these rights. We handle personal data on the basis of providing the service you signed up for, and our legitimate interest in keeping it secure.
Security
Traffic is encrypted with TLS. Sign-in tokens, codes and connector credentials are stored only as hashes. Workspaces are isolated in the database. Details are on the Security page.
Children
Orpheus is a tool for software developers and is not directed at children under 16. We don't knowingly collect their data.
Changes
If we change what we collect or how we use it, we will update this page and its date, and tell account holders by email before a material change takes effect.
Contact
Mjonesone LLC. Privacy questions and requests: support@example.com. Security reports: security@example.com.