Privacy Policy

Your privacy matters. ora is designed to keep your data local and under your control. This policy explains what we collect, what we don't, and how we handle your information.

The ora CLI Tool

ora runs entirely on your machine. Your prompts, AI responses, and file contents never leave your computer through ora's own servers. When you use ora, your prompts and answers are sent directly to the AI provider you have configured (Anthropic, OpenAI, Google, etc.) under that provider's own privacy policy. oracommand.com never sees, stores, or processes your prompts or AI outputs.

API Keys

Your API keys are stored locally on your machine in ~/.ora/config.toml with 0600 file permissions (readable only by your user account). ora never transmits your API keys to oracommand.com or any server other than the respective AI provider's API endpoint.

What We Collect

If you opt in to telemetry, ora sends anonymous usage analytics. This data includes:

  • ora version number
  • Operating system (e.g. macOS, Linux, Windows)
  • Model family used (e.g. "claude", "gpt" -- not the full model name)
  • Strategy selected (e.g. "plan", "code")
  • Iteration count per session
  • Stop reason (e.g. "confidence reached", "budget exhausted")
  • Error type, if an error occurs (e.g. "rate_limit", "auth_failure")

If you opt in to error reporting, we receive anonymous error data that includes the error type and ora version. No stack traces containing file paths or personal information are included.

What We Do NOT Collect

We never collect any of the following, regardless of your telemetry settings:

  • Your prompts or questions
  • AI model responses or answers
  • API keys or authentication tokens
  • File contents, directory structures, or source code
  • IP addresses for analytics purposes
  • Personal identifiers of any kind

Telemetry

Telemetry is disabled by default. You must explicitly opt in for any usage data to be sent. When enabled, telemetry only transmits the anonymous data points listed above. It never sends prompts, answers, file contents, or any personally identifiable information. You can disable telemetry at any time in your ora configuration.

Website

The oracommand.com website maintains standard web server logs for security and operational purposes. These logs may include IP addresses, user agent strings, and timestamps. We do not use tracking cookies. We do not use third-party analytics services. We do not serve ads or share any data with advertisers.

Data Retention

Anonymous analytics data is retained for 90 days, after which it is permanently deleted. Web server logs are retained for a reasonable period necessary for security monitoring. You can delete all local ora data from your machine at any time by running:

ora --clean --all

Third Parties

We do not sell, rent, or share your data with third parties. The only external services that receive data from ora are the AI providers you explicitly configure (Anthropic, OpenAI, Google, etc.), and that communication happens directly between your machine and the provider.

Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will update the "Last updated" date below and, where appropriate, notify users through the ora CLI or website.

Contact

If you have questions about this privacy policy or your data, contact us at hello@oracommand.com.

Last updated: March 2026