Privacy Policy

Effective Date: June 12, 2026 · Orcamatic Labs (`orcamatic.com`)

This Privacy Policy explains how Orcamatic Labs ("we", "us", or "our") protects and handles data for the ORCA Chrome Extension, ORCA Cloud AI service, and associated website (`orcamatic.com`). ORCA is engineered from the ground up so that your automation data stays local in your browser session.

1. Data Stored Locally in Your Browser

The vast majority of data created or used by ORCA is stored locally on your device via chrome.storage.local. This includes:

  • URL Profiles & Picked Elements: CSS selectors, XPath locators, bounding box coordinates, and custom friendly labels (elements[]).
  • Automation Rules: Conditional `if/else` workflows, multi-action chains, and schedule configurations (rules[]).
  • Runtime Variables: Extracted HTML table grids, JSON-LD schema objects, and user-defined variables (variables[]).
  • Run Logs: Local execution timestamps, task metrics, and step status logs (logs[]).
  • Settings & Themes: Your UI preferences, human-like delay toggles, and CAPTCHA auto-pause flags (settings[]).

This local data never leaves your device unless you explicitly export it as a JSON profile or share a workflow via our collaborative sharing link.

2. Cloud AI Queries & Vision Processing

When you trigger an AI-powered visual task (such as our Set-of-Marks visual planner or site capability compiler), the extension transmits necessary task context to our secure serverless endpoint (`POST /api/engine`):

  • Marked Viewport Screenshots (`Set-of-Marks`): A single `markedScreenshot` image containing numbered red/green coordinate bounding boxes over your active viewport.
  • Pruned Accessibility Trees: Depth-14 structural summaries of interactive controls (`role, name, sid`) on the active page.
  • Task Descriptions: The natural-language prompt or goal you submitted (`e.g., "apply to one Python job"`).

Strict Sandbox Protection: These payloads are processed in memory by our cloud LLM providers (our enterprise cloud LLM inference partners) strictly to compute the step action (`mark: N`) and return it to your browser. We never sell, rent, or trade your screenshots or page data to third-party data brokers or advertisers.

3. Authentication & Billing Data

When you sign in with Google OAuth (`chrome.identity`), we receive only your basic profile email (`user@example.com`) and unique user ID. This is stored in our Redis accounting ledger (`_db.js`) strictly to associate your account with your metered AI dollar balance (`credits`). Subscription checkouts are processed securely by Lemon Squeezy as our merchant of record; we never see or store your credit card or financial numbers.

4. Chrome Web Store Compliance

ORCA fully complies with the Google Chrome Web Store Developer Program Policies, including the Single Purpose and Limited Use requirements for `activeTab`, `scripting`, `storage`, and alarms. We do not track your general browsing history across unconfigured tabs.

5. Contact & Support

If you have any questions regarding data privacy or wish to request complete deletion of your cloud account record, reach our engineering team directly at orcamatic@gmail.com.