Orca is an iOS podcast app that reads the episodes of the shows you follow and tells you which are worth your time. To do that, our servers process podcast content and the information about you listed below. This page names all of it, what each part is for, who else handles it, and what “Erase my data” removes.
The app makes a random device identifier the first time it runs and keeps it in the iPhone’s Keychain. Every request to our servers carries it, with the app’s build number. Apple’s App Attest gives us a key that proves requests come from a genuine copy of Orca; we keep that key and the record of each check. We do not collect your name, contacts, location, or Apple’s advertising identifier. Our servers see your IP address with each request, as any server does. We use it to limit repeated sign-in attempts; salted and hashed, to count clicks on the website and, for three days, the requests our server refused or failed from each network. Website clicks use a coarse network block and browser signature, which may still distinguish a network or browser; they do not establish a unique person. Rate-limit counters for performance reports use a fixed-size pool of hashed source slots, with no raw address in the performance reports. Accepted reports prune old counters using an hourly 24-hour window; cleanup can be delayed when reporting stops. When a new install first registers with App Attest, we keep its address and its network block with a count for that day, so that one network cannot register installs without limit; the count is removed after that day. On the website, the pages look up the country of the address when you open the front page, in a database we hold, to choose which edition to show. We do not store it with your data.
The listening-interest description you type into the app (your profile), and the calibration lines Orca writes from your corrections, are stored together and used to personalize your verdicts. Your watchwords (words that pull matching episodes of a show into your queue) are stored with the show they belong to, with a note of the ones you removed, so another phone on your account does not bring them back. Clippings: the people, books, companies and phrases you ask Orca to watch for across every show it reads, with what you typed, whether you want every mention or only the episodes a person appears on, and whether matches go to your queue, and a log of which episodes it has already handed you so you never get one twice, delivery receipts and whether your phone confirmed saving them, and the newest one it woke your phone for, so it never wakes you twice for the same one. The stories you follow (two names a show put in the same remark, such as a team and its manager), and when you followed each, so they come first on your Front Page and in your weekly report.
When you agree to send your profile for AI personalization, we record that consent with your device and profile. It lets us honor your choice and require recorded consent when that requirement applies; erasing your server data removes the profile and its consent record.
Your follows: every show in your lists, Subscribed and Library alike, each with which list it is in and its title. Since 3 October 2026 this includes Library-only shows, which Orca does not fetch or score; they are stored so your lists come back on a new phone. We also keep when you followed each show and, after an ordinary unfollow, when you dropped it and how many times you have dropped and re-added it. A show reached through a member (paid) link is never sent in this list.
Approved show-name corrections keep the spelling your phone uses, the public feed link, the publisher's title, the review reason and when the correction was approved. They help match that phone's shows without changing the publisher's information.
Account-wide sync: if you sign in, a phone reads the follows and watchwords of every device on your account, so your lists follow you to a new phone, and it learns whether each episode it holds has been played, or can still be played, on any of them. Anyone signed in to your account on another phone can therefore see your shows and watchwords, and which of your episodes you have played. A phone that is not signed in is only ever told about its own.
Account web choices: follows and stories saved on the website, episodes you mark done, and requests to send a public episode to your linked phones belong to your signed-in account. Linked phones can read them. We keep the current choices and pending delivery records until superseded or the account is deleted; completed older requests are removed after 30 days when you next make a web change. Unlinking a phone removes its delivery records and keeps your account choices. Erasing phone data removes its delivery records; deleting the account removes these choices and requests.
Sync ordering records keep a random sync-client identifier, ordering generations and sequence numbers, the public feed link or member show identifier, a fingerprint of the operation, and a bounded copy of its acknowledgment. They prevent an old delayed request from restoring a show you removed. These records contain no private member link or transcript.
Phone save acknowledgments keep a fingerprint of the episode, whether it was a verdict or brief, a random receipt marker, the editorial and corpus versions, a fingerprint of the exact response, and when we issued it and when the app acknowledged saving it. They help us find stale app data. They are associated with your device; a fingerprint is not anonymous data, and the app's report does not independently prove what is physically stored on the phone. We keep these sync and acknowledgment records until you erase your server data.
Your verdicts: what Orca said about each episode for you and why, and the takeaways it picked for you. We also keep an exact-input fingerprint to bind a paid verdict to the episode source, profile and model versions that produced it. The verdict retains hashed source and result identities and original provider charge receipts, including the provider, reservation, cost and request fingerprint, to prove that the saved result was paid for once. These saved-verdict records are erased with your verdicts. The working verdict cache is kept for up to 45 days, less if your phone stops checking in for 30 days. For your historical reports, we retain the first known verdict on each public episode, its explanation and scoring inputs, and its title, show, feed, publication date and duration until you erase your server data. This report history survives changes to your profile and the working cache. It contains no member-only episode.
Your corrections: when you change a verdict, play an episode Orca did not recommend, or remove an episode you never played, we record the episode, what Orca had said, what you did, your reason if you gave one, how far you had listened, and when. A removal of an unheard episode is recorded as a guess about your taste, not as something you said. When you rate a takeaway or a moment (too high, too low, just right), we record your rating, the opening words of the item, and the percentages Orca showed beside it. Older builds also let you vote on individual takeaways and moments; those votes are kept the same way.
On your phone, a compact report-count history keeps episode identifiers and first verdict counts after an episode leaves the library. A local library review also keeps the last time you opened Orca and the last observed play of each show. These local histories are removed when you erase your data. A missing older history is described as unknown, not as zero listening.
For each episode on your phone, the app reports its state (played, partly played, unplayed, removed, unavailable), your position and the episode’s length, whether it is downloaded and whether it can be played, and when that last changed on the phone. For public shows it includes the show and episode title, so we can match it to our copy; for member shows it never does. For a removed episode it says whether you removed it or the app cleared it to save space. With each full report the app sends how many episodes it holds. When you ask Orca to read an episode it has no transcript for, the episode’s title, show and audio link wait in a transcription queue until it is done.
If you add a private member link from a podcast you pay for, the link is your credential, so we store it sealed (encrypted with a key only our server holds), with the show’s name and whether the feed is still answering, and use it only to fetch that feed for you. We record which member episodes you asked Orca about. The transcripts and briefs of member episodes are kept per episode and shared only with other members of the same show; they are the publisher’s content, not yours.
Per day, as totals with no time of day and no episode named: how many times you opened the app and how long it was open; plays started and seconds playing; visits to each tab (Front Page, queue, clippings, shows, settings) and time spent there; briefs opened and time spent reading; taps from the Front Page into an episode; share cards made; and plays and removals of episodes, counted by the verdict they carried. With them, a snapshot of your settings as short values, never anything you typed: continue mode, playback speed, episode view, show notes in the list, auto-skip ads, downloads on cellular, notifications, refresh interval, the tab the app opens to, the shows view, the steering-wheel mode in CarPlay, Live Activity, the crash-report switch, text size, volume, and whether you have written a profile (yes or no, never its text). These counts are always sent.
On by default; turn them off in Settings → Advanced → “Send crash and exit reports”. Each time the app stops running (a crash, iOS closing it, or a swipe from the app switcher), its next launch tells Orca when and how it closed, which app and iOS version, how long it had been open and in the background, whether audio was playing and whether it was streamed or downloaded, when audio was last paused in the background, how many low-memory warnings iOS gave it, and its error message if it crashed. With that comes what the app was doing: any transcription and how long it had run, downloads, server requests, its background work and whether iOS stopped it, slow moments, memory use, how many errors it recovered from and of what kind (the first one’s message, with links, file paths and quoted text removed), and whether CarPlay connected. Never what you were listening to. Error text is cleaned of links, file paths, quoted text and email addresses on the phone and again on our server.
From build 142, the app also sends the crash, hang and performance reports iOS writes about Orca (Apple’s MetricKit diagnostics): the error and where in Orca’s code it happened, the iPhone model, iOS version and region setting, and daily memory, CPU, disk, network and launch figures. We keep each report as iOS wrote it, with its text cleaned the same way, and a summary of it. And with each exit: how much memory Orca had left, whether the iPhone was hot or in Low Power Mode, audio interruptions, headphone or Bluetooth changes and restarts of iOS’s audio service, and whether iOS said it was closing the app. Free disk space never leaves your phone. This includes request timings by budget class and their percentiles. And a daily count of the failures the app handled without telling you (a sync that did not go through, a file that would not delete, a background refresh that stopped early), by a code naming which check it was, with the app’s build number; never what the failure was about. When the switch is off, none of this is sent and the reports waiting to be sent are discarded.
When you make a share card, we record which episode and which item it shows, the item’s text, which app you shared it to, whether the share went through, and a random card identifier. Website link counting is described below.
Your report email, if you type one in for the email edition. Your push address: the token Apple gives the app so we can send notifications and wake it to fetch new episodes.
When our server declines a request from your phone (a daily limit, or an episode it cannot reach), we keep the episode, the reason and how often it happened, so we can tell you why and fix what is ours.
A record of your phone: when we first and last heard from it, whether its free trial has been used, whether it has a subscription, and how many show feeds we read at its request today. While we confirm a purchase with RevenueCat, we keep that check open. A log of purchase events RevenueCat reports to us (the store’s transaction id, the product, the kind of event). And a ledger of the processing we did for your phone, such as transcription minutes and model calls, with what each cost us. The ledger can retain the device and account that incurred a cost. Durable provider request records retain hashed work and exact-input identities, the provider and its request identifier when available, the original cost reservation and its status, and reconciliation decisions. An uncertain provider outcome remains held so we do not buy the same work twice. Private member and personalized calls retain no raw prompts, transcripts or response bodies in this request journal. Public episode replies may be held for recovery until their result is published, then the reply body is removed. These provider and cost records have no automatic expiry.
Signing in is optional and uses your email address only: we send a one-time link or code (we store only a hash of it), and there is no password. We store the address, which devices are signed in to it, and, on the website, a sign-in session with your browser’s name.
If you follow a person, show, company or book from a page on the website, we store your email address, what you follow, and the page you signed up from, and send you a confirmation and updates. An unsubscribe is kept to suppress further updates unless you explicitly sign up again. Website mail receipts keep whether delivery was accepted, rejected or uncertain. A daily digest receipt also keeps the original edition: your address, unsubscribe token, and the selected public-news titles, links and short excerpts. This lets us retry an explicitly rejected delivery without changing its contents, and hold an uncertain delivery instead of sending it twice. There is no automatic expiry for these delivery receipts. Deleting an account redacts matching daily digest addresses and edition contents, retaining a keyed fingerprint and delivery outcome to veto a duplicate; this is separate from ordinary unsubscribing or erasing a phone's data.
Website button clicks keep a salted fingerprint of a coarse network block and browser signature, the page or episode, button, source channel, and bot or prefetch flags. We keep raw click rows for up to 90 days and daily aggregate counts longer. Signed campaign links prove an issued source link; unsigned or invalid links still work and are counted without campaign attribution. We report raw and qualified clicks separately, excluding known bots, prefetches, repeats and excess traffic from qualified counts. Fingerprints and qualified clicks are not counts of unique people, and a click does not prove a subscription purchase. Page views are counted by Umami, which we run ourselves; it sets no cookies.
Page correction and removal requests retain the Orca page address, your note, an optional reply email, submission time and the review outcome. We keep a salted fingerprint of your network only to cap abuse, with no raw address. Open requests remain until reviewed; resolved requests are removed after 90 days when another request is submitted.
The app reports bounded timing buckets for startup, refresh, tapping into a result and API requests. The website reports standard loading and interaction measurements. Our servers also time admitted, successful requests and their database, upstream and request-body phases. We store hourly aggregate buckets by metric, app or site release and measurement source using a 30-day retention window, with no device identifier, session, URL, episode or typed text in the metric payload or aggregate rows. Sender authentication does not prove a client's measurements are accurate or that samples come from different people. Operator release thresholds and exceptions remain in an audit history. These aggregate reports and security rate-limit counters are separate from the optional crash reports.
If you import shows from a screenshot, the image is sent to a language model to read the show names, then dropped; we do not keep it.
We do not sell personal information or share it for advertising. The app carries no advertising or third-party analytics, and we do not track people across other apps or websites. The providers listed below receive the data needed to operate Orca.
OpenAI runs the language models. It receives episode transcripts and, to write your verdicts, your profile and calibration, the episode’s title and show, and the takeaways shown to every reader. It receives your corrections without episode names when Orca updates your calibration, and an imported screenshot. Anthropic is our alternative model provider and receives the same if we move a task to it; the provider depends on the selected model and task.
DeepInfra, fal.ai and RunPod (where we rent machines to run our own transcription) receive episode audio, including member episodes you ask Orca to read, and return transcripts. They receive no Orca profile or listening history. Audio and member-source access can nevertheless contain information about a publisher or listener.
RevenueCat records subscription state, keyed by your device identifier or, once you sign in, your account. Purchases go through Apple in the app and Stripe on the website; we never see your card. Postmark sends sign-in mail and the website’s follow mail, so it receives those addresses. Apple also delivers notifications and checks App Attest. When the hardware bootstrap check is enabled, Apple DeviceCheck keeps two anti-abuse bits for your device on our developer team; we do not store its device token. These Apple-held bits persist across reinstalls and are not cleared by erasing your Orca server data. When the website sign-in security check is enabled, Cloudflare Turnstile verifies the browser challenge. The challenge runs in your browser, so Cloudflare can receive browser and network information. Our server sends it the challenge token, never your email or account state.
Fly.io hosts our servers and the database that holds everything on this page. Encrypted backups of that database are kept with Tigris and Backblaze B2. Expo delivers app updates. Umami, our website analytics, runs on our own servers, not a third party’s.
Settings → Advanced → “Erase my data on Orca’s servers” removes, for your phone:
Kept by design: purchase and billing records (the purchase log and the ledger of what processing your phone cost us), the device record your trial is counted on, the App Attest key and its check history, and today’s count of requests the model vendor refused, until midnight UTC, so erasing cannot restart a free trial or a daily limit. These records retain device or account associations and facts about purchases or processing, but not your profile, corrections or personal verdict text. Provider request and reconciliation records, including uncertain original reservations and hashed work identities, remain as described above. Erasure also leaves one-way, purpose-separated sync replay barriers and keyed member-device or member-show generations: they contain no direct device identifier, member credential or content, have no automatic expiry, and only stop delayed old work from recreating erased data. Shared-credential risk observations retain keyed feed fingerprints and aggregate counts of devices and accounts, without the member link or a list of those devices. Performance and click aggregates are retained under their stated periods. Your account itself stays; delete it separately (Settings → Sign-in → Delete account), which removes your email address, its sessions and every device link. For 31 days after, we keep a one-way, keyed fingerprint of the address (never the address itself) and the times devices were linked, so that signing up again with the same email inside that window continues the same subscription allowance instead of starting a new one; after 31 days both are gone. Shared episode analysis, which is not tied to you, stays.
Your shows and downloads stay on your phone. If you keep using Orca, the app registers the shows it still holds and starts new records from that day.
Copies: our page builder works from a copy of the database that it removes after every build, so an erased row is gone from it by the next build, within a day. Backups age out on their own: the continuous backup within 30 days, nightly copies within 14 days, disk snapshots within 5 days. Erased data is gone from every copy within 30 days.
Orca Pod LLC · admin@orcapod.fm