Privacy Policy

Last updated: 4 June 2026

This Privacy Policy explains how Orchard (orchapp.dev) collects, uses, and protects your personal data. Orchard is a service operated by Ross Hidge, a sole trader based in the United Kingdom ("we", "us", "our").

We are the data controller for personal data we collect about you when you use Orchard. If you have any questions, please contact us at support@orchapp.dev.

1. What this policy covers

This Privacy Policy applies to your use of:

The Orchard website at orchapp.dev.
Any Orchard mobile or desktop applications.
The Orchard code generation, build, and deployment pipeline.

This policy does not cover apps that you create using Orchard ("Your Apps"). When you build and ship Your Apps, you become the data controller for any personal data those apps collect from their own users. You are responsible for providing your own privacy policy for Your Apps and for complying with applicable data protection laws as their developer.

2. What data we collect

We collect the following categories of personal data:

Account data

Your email address.
Your account password (stored as a salted hash; we never see it in plain text).
Authentication identifiers from your sign-in provider, if you use one.

Content you submit

The text prompts and descriptions you submit to generate apps.
Configuration, settings, and metadata you provide for your apps (including App Store listing copy, screenshots, and category choices).
Images and assets you upload (for example, app icons and screenshots).

Generated content

The source code and application files that Orchard generates on your behalf in response to your prompts.

Apple Developer credentials

The App Store Connect API key, Issuer ID, and .p8 private key you connect to enable deployments. These are stored encrypted and used only to deploy your apps to your Apple Developer account.

Payment data

We use Stripe to process payments. Stripe collects and processes your card details; we never see or store your full card number. We receive limited information from Stripe (such as the last four digits of your card, billing country, and subscription status) to manage your account.

Usage and technical data

IP address, browser type, operating system, device type, and approximate location (derived from IP, not from GPS).
Pages you visit on orchapp.dev, features you use, and actions you take in the Service.
Error reports and diagnostic logs collected via Sentry.
Cookies and similar technologies (see Section 8).

Communications

Emails you send us, including support requests.

3. How we use your data

We use your personal data for the following purposes:

Purpose	Lawful basis (UK-GDPR)
Providing the Service: creating your account, generating apps from your prompts, building and deploying them to Apple, and giving you access to your projects.	Performance of contract
Charging for paid plans and managing your subscription.	Performance of contract
Communicating with you about your account, the Service, and important changes (for example, security notices or material changes to these terms).	Performance of contract / legitimate interests
Providing customer support.	Performance of contract / legitimate interests
Improving the Service: understanding how features are used, fixing bugs, and developing new features.	Legitimate interests
Detecting and preventing fraud, abuse, and security incidents.	Legitimate interests / legal obligation
Complying with legal obligations, responding to lawful requests, and enforcing our Terms.	Legal obligation
Sending marketing emails about Orchard (only if you opt in).	Consent

Anthropic and AI model use

When you submit prompts to Orchard, we send those prompts to Anthropic's API to generate code and other content using Claude models. Anthropic does not train its models on data submitted through its API by default, and your prompts are not used to improve any AI model. Anthropic processes the prompts solely to return a generation response to us, which we then deliver to you. See Anthropic's privacy policy for more.

4. Who we share your data with

We share your personal data with the following categories of third parties, only as needed to provide the Service:

Third party	What we share	Purpose
Anthropic	Your prompts and relevant project context.	AI code generation.
Supabase	Account data, project metadata, uploaded assets.	Database, authentication, file storage.
Stripe	Email, billing country, subscription status.	Payment processing and subscription management.
Render	Application logs and runtime data.	Hosting the Orchard API and worker services.
Scaleway	Generated source code (during the build).	Compiling and signing iOS applications on Apple Silicon servers.
Apple	App metadata, build artefacts, and credentials you have provided.	Uploading and submitting Your Apps to TestFlight and the App Store via your own Apple Developer account.
Fly.io	Generated source code (during the agent loop).	Running ephemeral build agents.
Appetize.io	Compiled application builds.	Providing in-browser app previews.
Sentry	Error reports and limited diagnostic data.	Error monitoring and reliability.

We do not sell your personal data. We do not share your data with advertisers, and Orchard does not show ads.

Some of these third parties are based outside the UK or European Economic Area. Where we transfer your data internationally, we rely on appropriate safeguards under UK-GDPR (typically the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with provider-side safeguards).

We may also disclose your data:

To comply with a legal obligation, court order, or lawful government request.
To enforce our Terms or protect the rights, property, or safety of Orchard, our users, or others.
In connection with a sale, merger, or restructuring, where the recipient agrees to honour this Privacy Policy.

5. How long we keep your data

We keep your personal data for as long as your account is active. When you close your account, we delete or anonymise your personal data within 30 days, except where we need to retain certain information for:

Legal or regulatory obligations (for example, financial records for tax purposes, typically 6 years in the UK).
Resolving disputes or enforcing our agreements.
Backup and security purposes (older backups are rotated out within a reasonable period).

Generated source code, prompts, and project assets are retained for the lifetime of the project and deleted within 30 days of project deletion or account closure.

6. Your rights

Under UK-GDPR, you have the following rights:

Access: request a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate data.
Erasure: ask us to delete your data ("the right to be forgotten"), subject to legal exceptions.
Restriction: ask us to limit how we process your data.
Portability: ask us to provide a portable copy of data you've provided to us.
Objection: object to processing based on our legitimate interests.
Withdraw consent: where we rely on consent (for example, marketing), withdraw it at any time.
Complain: lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to address your concerns first, so please consider contacting us before making a complaint.

To exercise any of these rights, email us at support@orchapp.dev. We will respond within one month, or explain why we need longer (we may need to verify your identity first).

7. How we protect your data

We use technical and organisational measures to protect your data, including:

Encryption in transit (HTTPS/TLS for all traffic to and from orchapp.dev and our APIs).
Encryption at rest for sensitive credentials (including your Apple Developer .p8 key).
Access controls and least-privilege access within our infrastructure.
Error monitoring and alerting on suspicious activity.
Regular updates to underlying infrastructure and dependencies.

No system is 100% secure. If a security incident affects your data, we will notify you and the relevant regulator (the ICO) in line with our legal obligations.

8. Cookies and similar technologies

We use cookies and similar technologies on orchapp.dev for the following purposes:

Strictly necessary cookies: keep you signed in, remember your basic preferences, and keep the Service secure. These cannot be turned off.
Functional cookies: remember settings such as your last-used deploy destination and UI preferences.
Analytics cookies: help us understand how the Service is used so we can improve it. We will only set these with your consent.

You can change your cookie preferences at any time via the cookie banner on orchapp.dev or your browser settings. Disabling strictly necessary cookies may prevent parts of the Service from working.

9. Children

Orchard is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please email support@orchapp.dev and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 14 days before they take effect. The "Last updated" date at the top of this policy will always reflect the latest version.

11. Contact

Data controller: Ross Hidge, United Kingdom Email: support@orchapp.dev

If you wish to raise a concern about how we handle your personal data and we have not resolved it to your satisfaction, you can contact the UK Information Commissioner's Office at ico.org.uk or by post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.