Privacy and your data

The linked privacy notice, cookies and storage notice and website terms cover this public website and initial enquiries. This page describes application data paths; it does not extend those notices to workspace use. Before sharing project material in a pilot, agree access, purpose, provider use and retention under the arrangements applicable to that pilot.

What is stored

On the server: your company, teams, memberships, issues, projects, labels, Vault pages, comments, Intents and their revisions. Where evidence capture is enabled, also the captured run records your setup and company sharing policy allow: observations, configured check results and, where the policy and setup include them, agent replies. Orneos does not upload the session transcript; its reference stays on your computer.

Your Home conversation history (only where saved history is enabled for your workspace): your Home questions, the team you asked in, the identifiers of the issues shown as sources, and when you asked. See Home conversation history.

Usage events: a record of which product actions happen and when, described under Usage measurement.

In your browser: a replica of your teams’ data, your queue of unsent changes, and small preferences. See Local data and storage.

On a computer set up for capture: a local queue of records not yet sent (kept up to 14 days) and the capture-only token, which is used only with the one server it was set up for.

With the identity provider: your account identity — email, name, authentication. Orneos never receives your password.

What we do not do

• Orneos does not use your workspace content to train models. Provider handling depends on the AI path and provider terms; this is not a promise about every third party you choose to send data to.
• We do not sell or share your data with third parties for their own purposes.
• We do not run third-party analytics or advertising trackers on our websites. about.orneos.com counts its own page views without cookies or identifiers (page path, referring site and campaign tags only; browser storage only for an opt-out you choose); docs pages are not counted. The privacy notice and cookies notice describe it.
• AI data paths are disclosed per feature. Personal BYO drafting and server-provider AI use different credentials and funding controls.

Usage measurement

The application records first-party usage events so we can see whether Orneos is useful: who comes back, which features help, and where people get stuck. It is on by default for everyone, and you can switch it off for yourself at any time (see Turning it off).

• What an event holds: the event name, time, your account identifier, company and team, whether a person or a personal token acted, and a few fixed values such as the screen name or a count. Some events include internal identifiers of the issue, comment, Intent, agent run or operation they concern; these are opaque codes, never names or text.
• What it never holds: titles, descriptions, Intent text, comments, search, Home or Insights questions, page addresses, file paths or email addresses.
• Where it goes: into the Orneos application database only. No third-party analytics, advertising or session-recording service receives it. Your browser holds events briefly in memory until they are sent, and never saves them to browser storage.
• Retention: events become eligible for automatic cleanup after 400 days (about 13 months). Cleanup runs in batches as new events are recorded, so this is not a guaranteed deletion deadline: inactive periods, a backlog or a cleanup failure can leave older records stored longer. An account or company deletion request also deletes these records, including those made through your personal tokens.

What we record

This is the complete list. Nothing else is recorded, and adding an event requires a reviewed change to this list.

Event	What it records
session.started	You opened Orneos (once per page load).
screen.viewed	Which kind of screen you opened, such as the board or an issue — never which issue.
context_bundle.copied	You copied a context bundle.
insights.asked	You asked an Insights question, and whether it was a query or an analysis — never the question.
issue.created	An issue was created (its internal id, never its title).
comment.created	A comment was added (the issue’s internal id, never the text).
intent.created	An Intent draft was created (the issue’s internal id), and whether a person or an agent drafted it.
intent.approved	An Intent was approved (the issue’s internal id), and whether it was edited as part of approving.
company.created	A company workspace was created.
team.created	A team was created.
invite.sent	Someone was invited: how many teams, and whether an email went out — never the address.
invite.accepted	An invitation was accepted, and for how many teams.
agent_run.attached	An agent run was attached to a task.
agent_run.reply_shared	A held agent reply was shared.
agent_run.evidence_viewed	An agent run’s evidence was opened.
capture.run_created	The capture tool reported a new agent run.
mcp.tool_called	An agent called an Orneos tool through MCP: which tool (reading task context, reading an Intent, or another tool) and whether it succeeded.

Who can see it

Only the Orneos founder, through an internal usage dashboard and read-only database access. The database is hosted by our infrastructure provider as part of running the service.

The dashboard shows activity per day, per feature, per screen and per team, and a list of people with, for each person: name and email (looked up from the identity provider at viewing time, never stored with usage events), teams, when they were first and last active, on how many days they were active, and how many sessions they started. In the dashboard or the database, the founder can also filter by company or team, find a person by name, email or account identifier (names and emails are looked up at viewing time), and open a person’s or a team’s event timeline: which of the events listed above happened, when, in which team, whether a person or a personal token acted, and the values each event holds. Search terms are not stored or logged.

Usage events are not shown to your teammates or company administrators, and are not sold or shared.

Turning it off

Open Settings → Profile → Usage data and switch Record my usage off. This takes effect immediately for you, in every company and team, and:

• deletes the usage events already recorded for you;
• stops new usage events being stored for you, from your browser, agent tools and personal tokens alike;
• does not affect your work, your data or any feature.

You can switch it back on at any time; earlier deleted events are not restored. If you would rather we turn it off for a whole pilot team, tell us before you start.

The cookies notice is about the public website, which counts anonymous page views but sets no cookies for it. Usage measurement in the application uses no cookies and no browser storage.

Home conversation history

Home is work in progress and not yet released. Where it is enabled, and where saved conversation history is enabled separately for your workspace, Orneos stores on its server:

• the questions you ask in Home, as you typed them, and the conversation titles (your first question, or a name you give it);
• the team each conversation belongs to, the issue a question was scoped to, and which starting question you chose;
• the identifiers of the issues shown as sources. Orneos works these out itself from the answer it gave you; no issue titles, text, statuses or explanations are stored with them, and they are read fresh, through your current access, when you reopen a conversation;
• when each conversation was created and last used.

AI answers are never stored. Where an AI answer is requested, only its usage receipt (identifiers, categories, the processing profile version and the cost) is kept, as for any AI request; see AI features.

• Who can see it: only you. There is no view of another person’s history for teammates or company administrators. Conversations of a team you no longer belong to are deleted when you are removed from it, or from the company.
• Retention: a conversation is eligible for deletion 90 days after its last activity and is deleted within about a day after that. Orneos keeps at most 100 conversations per person per organization and 50 questions per conversation.
• Deleting it yourself: in Home’s conversation history, delete one conversation or Delete all for the organization. Deletion takes effect immediately in the Orneos database. It does not reach backups that already contain it (see Backups and recovery).
• Account or company deletion: an account or company deletion request through support (see Deletion) also deletes these conversations.
• Where saved history is not enabled, Home keeps your conversations only in the open browser tab’s memory, and nothing about them is stored.

Usage events never include your Home questions.

Search queries

Spotlight uses local lookups and sends the query to Orneos for server-side Vault title/body search. Results are limited by team and space access. The Search page also sends your query and filters to Orneos when Company scope is selected, returning results within your authorized company access. Company is its default scope and needs a connection; Team scope queries local issue data. These searches use Orneos data, not a model provider; search is not an entirely on-device operation.

AI features

Orneos AI features use Anthropic’s Claude models through Anthropic’s commercial API. BYO Intent drafting sends request data directly from your browser to Anthropic under your own Anthropic account and its terms. Insights and enabled funded drafting send it from the Orneos server to Anthropic under Orneos’s account, with the applicable consent and allowance controls. Having no browser key does not mean no AI request can be made.

For requests under Orneos’s account, Anthropic’s commercial terms as published today say it does not use the inputs or outputs to train its models by default, and deletes them within 30 days; it can keep them longer where it has to enforce its Usage Policy or comply with the law. BYO requests follow the terms of your own Anthropic account. Orneos does not use Anthropic’s feedback features. Today, no Orneos feature sends your repository’s source code to a model; text you write, such as a description or comment, is sent as written, including any code pasted into it. The review assistant in development will send only the diff excerpts a reviewer selects, and this page will list it before it is enabled.

Which content that is:

Feature	Sent
Intent drafting	The assembled, export-filtered task context: task fields, confirmed Intent when available, project details, parent/sub-issues and relations, available discussion, and eligible Vault titles and links. Vault page bodies are not included.
Insights	Your question and the issue data needed to answer it

Drafting excludes restricted/private Vault enrichment and references whose visibility cannot be established. This does not remove URLs already present in user-authored text. Review the task context before sending it to a provider.

A context bundle makes no model call. It can load missing discussion and exports available material to your clipboard; where you paste it is your decision. Restricted/private Vault enrichment is excluded.

Deletion

Deleting an issue, project or Vault page removes it for everyone in the team. It is not a soft delete and there is no trash.

For deleting an account or a company’s data, email support@orneos.com. Server-side deletion does not reach a copy already delivered to someone’s browser — see the revocation note in Security and isolation.

Export

Context bundles export task context and confirmed Intent. Vault Export downloads one page as Markdown. There is no self-service “download everything” button.

If you need your data out, ask and we will get it to you.

Backups and recovery

Where it runs

Application and database are hosted with a cloud provider. AI requests are processed by Anthropic: BYO calls under your Anthropic account, server features under Orneos’s. If data residency is a requirement for you, raise it early — we have no residency commitments today.

Related

• Security and isolation
• Local data and storage
• Privacy policy · Cookies and storage · Terms