Orthanc Privacy Policy

Effective date: August 3, 2026

Orthanc is a macOS app and set of browser extensions (Chrome, Firefox, Safari) that give you one-click AWS SSO login and AWS Console access. It is built and operated by an independent developer, and this policy describes everything Orthanc does with data, which is very little. The short version: your AWS credentials never leave your Mac, the only telemetry is anonymous counters you can turn off, and the only identifier we ever store exists to prevent free-trial abuse and can be deleted by you at any time.

1. Who we are

Orthanc is developed and published by Sebastien Stormacq, an independent (indie) developer.

Contact for anything in this policy, including data-deletion requests: orthanc@stormacq.net

2. Your AWS data stays on your device

Orthanc's core functionality is entirely local:

• AWS configuration. The app reads your ~/.aws/config file to list your SSO profiles. This file is read locally and is never uploaded anywhere.
• SSO tokens. When you sign in, Orthanc performs the standard AWS SSO device-authorization flow and caches the resulting tokens locally in ~/.aws/sso/cache/, in the same format the AWS CLI uses. Access tokens and credentials never leave your machine; they are used only by the native app on your Mac.
• Network calls for core features go only to AWS. To log you in and generate console links, Orthanc talks directly to AWS's own endpoints (IAM Identity Center / SSO OIDC and the AWS federation endpoint), on your behalf, from your Mac. We do not proxy, intercept, or ever see this traffic.
• What the browser extension receives. The extension is handed only the final, one-time-use federated sign-in URL so it can open the AWS Console in a tab. It never receives tokens, credentials, or your AWS configuration.

We (the developer) have no server involved in any of the above and no visibility into your AWS accounts, profiles, sessions, or activity.

3. Anonymous usage statistics (optional)

To know roughly how many people use Orthanc, the app can send a small, truly anonymous ping to our backend when it launches. The complete contents of that ping are:

• firstPingEver, firstToday, firstThisMonth: three booleans, computed on your Mac, used to count installs and daily/monthly active users
• appVersion, e.g. "1.0.0"
• osVersion, e.g. "26.1"
• licenseState: "trial", "metered", or "full"

That is the entire payload. It contains no device identifier, no user identifier, no IP-derived data, and no hash of anything. Deduplication happens on your Mac (the app remembers locally whether it already pinged today), so the server only increments aggregate counters. No per-device record of any kind is created by telemetry.

You can turn this off in the app: Settings → the "Orthanc sends anonymous launch statistics" toggle. When disabled, no ping is sent.

4. Free-trial verification (the one identifier we use)

Orthanc offers a 30-day free trial. To prevent the trial from being reset indefinitely (for example by wiping the app's local storage), the app makes one kind of identifier-bearing call, to our /v1/trial endpoint. It sends:

• A salted, one-way SHA-256 hash of your Mac's hardware identifier (the raw hardware ID never leaves your machine; only the hash does)
• An Apple DeviceCheck token, which our server exchanges with Apple to read/set two per-device bits that Apple stores (used as a tamper-proof "trial already used" flag)
• Your app version

What we store: a single database row keyed by the device hash, containing the trial start date and first-seen date. That's it.

What this data is not used for:

• Not used for analytics or usage tracking of any kind (telemetry, described above, is a separate, identifier-free path)
• Not linked to your name, email, Apple ID, purchases, or any other data. We have none of those
• Not used for advertising or shared with anyone

Retention. Trial records are deleted automatically 90 days after the trial starts (the 30-day trial plus a safety margin for devices that were offline during the trial and for support disputes about trial dates). After that, the only remaining trace is Apple's DeviceCheck flag (two bits, stored by Apple, see §7), which prevents repeat trials but contains no date or usage data on our side. Anonymous aggregate counters (which contain no identifier at all) expire after at most 400 days. You can delete your trial record earlier at any time (below).

Deletion. The app includes a "Delete my data" control in Settings. It recomputes your device's hash locally and calls our DELETE /v1/device endpoint, removing the trial record. The app is the only thing that can derive the hash, so deletion must be triggered from the device itself.

If you no longer have the app installed, we cannot locate your record on request: the identifier is a one-way salted hash stored with no name, email, or other linkable attribute, so we have no way to tell which record, if any, is yours (this inability to identify you is deliberate; see GDPR Art. 11). Your options in that case are to reinstall the app briefly and use the delete control, or simply wait: every trial record expires and is deleted automatically 90 days after the trial started (see Retention above). Note: deleting the record does not reset Apple's DeviceCheck bits (Apple stores those, scoped to this developer account, and they contain no data beyond the two bits, see §7).

Trial verification is fraud prevention, not analytics, so it is not covered by the telemetry opt-out toggle. If you never start a trial (e.g. you purchase immediately), no trial record is created for you.

5. Purchases

Orthanc Pro is a one-time in-app purchase handled entirely by Apple through the App Store's In-App Purchase system. Payment processing, receipts, refunds, and your payment details are all handled by Apple under Apple's Privacy Policy. We never receive your name, email, Apple ID, payment information, or receipts. Purchase entitlement is verified on your device by StoreKit; our server never sees it.

6. Browser extensions

The Chrome, Firefox, and Safari extensions:

• Request only the nativeMessaging permission. Its sole purpose is to talk to the Orthanc app on your Mac
• Cannot and do not read web page content, form data, or anything you type
• Do not access or collect your browsing history
• Do not inject scripts into pages, set cookies, or run on any website
• Receive from the app only profile names, session status, and one-time federated sign-in URLs (to open the AWS Console tab you asked for)
• Send nothing to any server themselves. All network activity happens in the native app, as described in §2–§4

The data-use declarations we file with the Chrome Web Store (Developer Program Policies disclosure) and Firefox Add-ons (AMO) match this policy: the extensions themselves collect no user data.

7. What we do NOT do

• No advertising of any kind
• No tracking. Orthanc does not track you across apps or websites owned by other companies (the App Tracking Transparency sense of "tracking") and requests no tracking permission
• No sale or sharing of data. We do not sell, rent, trade, or share any data with third parties, and never have
• No third-party analytics or advertising SDKs. There is no Google Analytics, Firebase, Sentry, Facebook SDK, or similar in the app or extensions
• No accounts, no profiles. Orthanc has no sign-up, and we cannot associate any data we hold with a person

8. Data processors (where the small amount of server data lives)

Two companies process data on our behalf, strictly as described above:

• Amazon Web Services (AWS). Our backend is a serverless function (AWS Lambda) and a database (Amazon DynamoDB) hosted in the eu-west-1 (Ireland, EU) AWS region. It holds only the aggregate telemetry counters (§3) and trial records (§4). Standard AWS infrastructure logging (e.g. request logs) is retained briefly for operational purposes.
• Apple. Apple processes in-app purchases (§5) and operates the DeviceCheck service (§4). The DeviceCheck bits are stored by Apple, scoped to your device and our developer account; Apple does not reveal your device identity to us.

Separately, and not on our behalf, the app connects directly to your AWS endpoints for SSO login and console access (§2). In that relationship AWS is your provider, not our processor.

9. Your rights (GDPR, CCPA, and similar laws)

Legal bases (GDPR):

• Trial verification (§4): legitimate interest: preventing free-trial fraud for a paid product. The data is minimal (a one-way hash), pseudonymous, and used for nothing else.
• Anonymous usage statistics (§3): the data is anonymous by design; the feature is nonetheless optional and disclosed in-app, and you can withdraw at any time via the Settings toggle (consent/opt-out).

Your rights: you may request access to, correction of, or deletion of any data we hold about your device. In practice:

• Access: use the in-app "Show my data" button (Settings). It fetches and displays everything the server stores for your device: a trial start date and a first-seen date. Like deletion, access is self-service from the device because only the device can derive its hash; we cannot look up your record from an email request (see the deletion note in §4)
• Deletion: use the in-app "Delete my data" button (Settings)
• Telemetry cannot be accessed or deleted per-user because it is not per-user: it exists only as aggregate counters

CCPA/CPRA: we do not sell or share personal information as those terms are defined in California law, and we collect no personal information categories beyond the pseudonymous device hash described in §4. There is no cross-border sale of data, or any sale of data, of any kind.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

10. Children

Orthanc is a professional developer tool and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to this policy

If we change what data Orthanc collects or how it is used, we will update this policy, change the effective date at the top, and for material changes note it in the app's release notes. The current version is always available at this URL.

Questions? Email orthanc@stormacq.net.