Legal

Privacy

Last updated: September 24, 2026

What MacOrb holds

• Your GitHub user id and login, from signing in with GitHub.
• A signed sign-in cookie carrying your MacOrb user id and GitHub login. It is HttpOnly and expires after seven days. The MacOrb CLI can use the same token.
• Your encrypted Amp key, and your encrypted GitHub token if you store one. See Security for how they are protected.
• A record of each session: its state, instance and runner identifiers, the repository you named, timestamps, the lifetime you asked for, and why it ended.
• Measured Mac minutes, and operational logs carrying request and account identifiers and events such as “a credential was stored”. Logging is written to redact secret values.

How it is used and shared

MacOrb uses this to sign you in, start and stop Macs, run the Amp runner, clone the repository you named, show your usage, and troubleshoot the service. Cloudflare hosts the application and the database. Namespace runs the Mac. Amp authenticates and runs the agent. GitHub handles sign-in and repository access. Each receives what its part of the service needs, and no more.

MacOrb does not sell this information and does not use it for advertising.

Sign-in and repository access

GitHub sign-in asks only for public profile access (read:user). It identifies your MacOrb account. It does not authorize repository access and is never used to clone.

Cloning uses the separate GitHub token you choose to store. If you store no token, MacOrb clones nothing.

Variables you configure at Amp

A MacOrb Mac fetches the Secrets and Environment Variables configured on your Amp account and makes them available to what a thread runs on that machine. They travel from Amp to the Mac; MacOrb does not store them, and they are not part of anything described above. This is on for every session and there is no per-session opt-in — see Security for what that means for a GITHUB_TOKEN you configure there.

Cookies and page requests

The console sets two cookies: the sign-in cookie, and a short-lived cookie that protects the GitHub sign-in round trip. Neither is an advertising cookie. These public pages use clicks.page, a third-party analytics service, to count page views and clicks on the early-access button.

The console loads its interaction script from Cloudflare’s cdnjs service, so your browser makes a request there.

How long it is kept

• Your Amp key, GitHub token and plugin tokens: until you remove them or delete your account, then deleted at once.
• A paused Mac’s disk: 24 hours after it pauses, unless you resume it. Then the Mac and everything on it is deleted.
• Session details — the repository you named, the checkout path and a failed Mac’s boot log: one year after the session ends. The session’s times, minutes and how it ended are kept with the billing records.
• Billing records — credit bought and spent, payments, and measured minutes: seven years, the period Dutch tax law requires.
• A deleted account’s GitHub id and login: 30 days after deletion. After that the account is a random id that only the billing records point at.
• A waitlist entry: 12 months, or sooner if you ask.
• Operational logs: seven days, which is how long Cloudflare keeps them.

Deleting your account

The console’s Account page lets you sign out and delete your account. Deleting removes your stored Amp key and GitHub token and your plugin tokens at once, and your GitHub id and login 30 days later.

Session and usage rows stay, because they are what MacOrb bills and audits against, for the periods in How long it is kept. Deleting your MacOrb account does not revoke anything at Amp or GitHub, so revoke credentials there as well.

Signing out clears the cookie in that browser. The session token is stateless, so a copy already saved elsewhere, such as by the CLI, keeps working until it expires.

Your choices

You can sign out, stop a running Mac, replace or remove either stored credential, and delete your account. Stopping a Mac deletes nothing from MacOrb’s records. Read Security before rotating a credential a running session is using.

Who holds your data

MacOrb is operated from the Netherlands, whose law governs. It is a one-person operation with no postal enquiries desk, so write to support@macorb.dev, which is read by the person who runs the service.

That address is the contact point for the person responsible for this data. There is no separate data-protection officer; MacOrb is one person.

To ask a privacy question, or to ask for a copy of your data or its deletion, write to that address. Never include keys, tokens or cookies in the message.