Effective July 19, 2026 · Orstrum, Inc.
Orstrum ("we," "us," or "our") is operated by Orstrum, Inc. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use the Orstrum website and account service at orstrum.com and the Orstrum plugin for Claude Code (the "Plugin").
Account data. When you create an account — via GitHub OAuth or email/password — we collect your email address and, if provided through OAuth, your GitHub username and public profile information.
Plugin data stays on your machine. The Plugin writes its event
log, usage samples, checkpoints and handoffs to folders on your computer
(.orstrum/ in each project and ~/.orstrum/). None of
it is sent to us. The Plugin makes two kinds of network request: to Anthropic's usage endpoint,
using the credentials Claude Code already stores, to read your usage numbers; and, on paid
plans, to orstrum.com to verify your license key. The license request carries the key and
nothing else. We never receive your source code, your prompts, or your session contents.
Usage data. We collect server logs, API call counts, and aggregate request metrics (e.g., license checks per day) for billing, rate-limiting, and service improvement. Rate limiting is keyed on your IP address, which is held briefly in a Redis store and expires automatically.
License keys. When you create a license key for the Plugin, we store a SHA-256 hash of it, its label, and its creation, last-used, and revocation timestamps. The raw key is shown once and is never stored, so we cannot recover it for you.
Cookies. We set the Supabase session cookies
(sb-<project-ref>-auth-token and its refresh counterpart) required
for authentication. See our Cookie Policy
for details.
We do not sell your personal data to third parties. We collect no telemetry from the Plugin.
Your data is stored in a Supabase-managed PostgreSQL database. Row-level security (RLS) policies enforce workspace isolation — no user can access another workspace's data through our API. Infrastructure is hosted on Vercel (edge/serverless) and Supabase (database).
Each processor is bound by its own privacy policy and, where applicable, a Data Processing Agreement (DPA).
Anthropic. The Plugin reads your usage numbers from Anthropic's usage endpoint with the credentials Claude Code already holds. That request goes from your machine to Anthropic; we are not party to it and never see the credentials. We do not send any of your data to an LLM provider.
We retain your data for as long as your account is active. If you ask us to close your account, we delete your workspace, keys, and personal information within 30 days, except where we are required to retain records for legal or billing purposes (up to 7 years for financial records).
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, email us at tyler@aforah.com from the address on your account. We respond within 30 days. Everything the Plugin records lives on your own machine, in plain SQLite and text files, and is yours to read, export or delete at any time without involving us.
Orstrum is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have done so, contact us and we will delete the information promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the effective date. Continued use of the service after changes constitutes acceptance of the updated policy.
Questions about this policy? Email tyler@aforah.com.