Last updated: October 12, 2026
Local crash recovery
Compatible builds keep an encrypted recovery snapshot on this Windows computer for the same Orca account. It records open tab URLs and titles, window layout, profile references and temporary proxy settings, including proxy credentials when needed to restore a session. This includes the URLs of open Fresh and private tabs; their cookies, form values and other private website storage are not captured for crash recovery. Fresh and private tabs reopen in new isolated sessions. Recovery snapshots are separate from administrator crash reports and are never uploaded by the crash reporter. Clean exits remove that session's snapshot. Failed-session snapshots expire after seven days and are cleaned up when Orca next checks or saves recovery data; at most 32 recent snapshots per account are retained. Successful restoration removes the consumed snapshot.
Information handled by the licensing service
Orca's licensing website processes account details such as display name, email address, password verifier, role, subscription status, license status, device identifiers and labels, app version, activation timestamps, and administrative audit events. Compatible signed-in builds also store an account-scoped encrypted copy of profiles, saved website account credentials, proxies, tags, and contact/address autofill data. After accepting the expanded browser-state disclosure, newer builds also checkpoint browsing history, reading lists, tabs, supported cookies and website storage for transfer between computers.
Encrypted account library
Orca encrypts the synchronized library on your computer before upload. The service stores authenticated ciphertext and encrypted key envelopes, not plaintext profile content or a plaintext library key. Your Orca password is used on your computer to unlock or update the recovery envelope after sign-in; it is not stored in the sync record.
Managed Team profile sharing
Compatible Team builds require a separate sharing acknowledgment before automatically sharing all current and future supported saved Chromium profiles with authorized Team leaders, including their saved proxy passwords, cookies and login sessions, supported website storage, open tabs, browsing history and reading lists. This channel is separate from end-to-end encrypted Account Sync: its session keys are held by the service, so Orca's servers and operators can decrypt these shared copies. Device Lock, Team Access and legacy Lendable tag lists do not limit authorized managed Team leaders. Leaders can borrow the latest completed shared session while the member is offline; Fresh sessions are not shared, and session-conflict and authorization checks still apply. A leader who already downloaded a copy can retain it.
Information kept on your computer
Older builds keep browser state local. With expanded sync, supported session cookies, first-party local storage and per-tab session storage are encrypted and transferred. Websites control those values, which may include authentication tokens or payment information that Orca cannot reliably identify. Orca's own saved full payment-card numbers and security-code fields are excluded from structured Account Sync. New Team structured records reject full card numbers and security codes, but may retain validated account metadata (a four-digit suffix, expiration, and card-presence indicators) for older-client compatibility. Team order records may retain a validated four-digit suffix. Previously stored encrypted Team records may predate these controls. Mailbox integration credentials, device-bound keys, extensions, caches, IndexedDB and unsupported storage are not included. Order records and other application data may be transmitted through separate features.
How information is used
Licensing information is used to authenticate accounts, determine access, enforce device limits, display subscription details, support account security, and record administrative changes. Encrypted library and checkpoint data is used to synchronize and restore supported Orca data for the same authenticated account. Only one current device session can access the vault. A checkpoint is made available only after its encrypted parts verify; offline or unfinished changes cannot transfer. Websites may still require reauthentication on another computer.
Security
Orca sign-in passwords are stored as salted password verifiers rather than plaintext. License and administrator authenticator secrets are encrypted at rest, while recovery codes are stored only as one-way hashes. Administrator sessions require two-factor verification. Session cookies are HttpOnly and use secure transport in production. No system can guarantee absolute security, so customers should protect their credentials and devices.
Automatic crash reports
Compatible Orca builds automatically send limited reliability diagnostics to the administrator crash inbox after signing in. Reports contain the Orca and Windows versions, crash time, exception type, code stack identifiers, exit code when available, and a coarse operation such as startup or card autofill. When available, an unexpected-exit report also includes the last modifier or browser shortcut and a coarse input context, such as checkout autofill; ordinary typed text is not recorded. Reports are associated with the authenticated Orca account and device. This reporter does not upload screenshots, browsing URLs, page contents, form values, passwords, cookies, payment details, raw error logs, or memory dumps. Offline reports wait locally for reconnection; the local queue holds up to 128 reports for 30 days. Server reports are visible for 90 days and old records are removed during subsequent report ingestion. Some forced exits and power failures reveal only that a clean shutdown was missing, not why it happened.
Retention and control
Account, subscription, device, encrypted library, and audit records may be retained while access is active and afterward as needed for synchronization, security, support, and administrative records. The signed-in customer can delete the encrypted cloud copy and sign out while keeping local data. Administrators can inspect operational metadata, revoke devices, cancel licenses and disable accounts; this account-sync protocol does not give administrators the customer's decryption key.
Third-party websites and proxies
Orca can open third-party websites and use proxy services selected by the customer. Those services operate under their own privacy terms. Orca does not control how a destination website or proxy provider processes traffic.
Changes
This notice may be updated as Orca's distribution, payments, support, or product capabilities change. The date shown below identifies the current version.