Privacy Policy

1. Who we are

OrcaStrate operates an event-planning and wishlist service from California, United States. This policy describes the consumer OrcaStrate service and applies when you visit our website, create an account, join an event or interact with a shared page. For privacy questions or requests, contact support@orcastrateapp.com.

2. Information we collect

Account information: identifiers and profile details supplied through our authentication provider, Clerk, and your chosen sign-in method. This may include your name, email address, profile image and provider account identifier, depending on the method and permissions used. We also store your chosen display name and account-linked service records.

Planning and wishlist content: event names, dates, locations, descriptions, tasks, votes, guest and invitation details, RSVP replies, product links, notes, wishlist ordering, uploaded images and vision-board layouts. If you provide information about someone else, you are responsible for having an appropriate basis to share it.

Social and shopping activity: discoverability preferences, follows and connection requests, your private Friends or Family labels, blocks, sharing links, and gift reservations or purchase confirmations submitted by gift-givers. If you add a birthday, we store only its month and day, your birthday-sharing preference and whether you wish to receive birthday emails. We do not collect a birth year for this feature.

Technical information: hosting, authentication and application systems may process IP addresses, browser and device information, request timestamps, security events and error logs to deliver and protect the service. We do not receive your Google password.

3. Google sign-in

When you choose Google sign-in, Google and Clerk handle authentication. OrcaStrate uses the identity information made available for sign-in to create or recognize your account, display account information and secure access to your content.

Choosing Google sign-in does not by itself give the event-planning service access to your Gmail messages, Google Drive files, Calendar events or Google contacts. We do not use Google sign-in information for advertising profiles or sell it. Any future feature requiring additional Google access would need its own explanation and authorization.

You can manage the connection in your Google Account’s third-party access settings. Revoking Google access does not itself erase content previously stored in OrcaStrate; use our deletion controls or contact us as described below.

4. How we use information

We use information to authenticate users, save and display content, coordinate events, process invitations and RSVPs, provide requested sharing, support people connections, preserve gift surprises, retrieve product previews and respond to support requests.

We also use information to prevent abuse, troubleshoot problems, maintain service reliability, enforce our terms and comply with applicable legal obligations. Where a law requires a legal basis, these purposes may involve performing the service you request, legitimate interests in operating a secure service, legal obligations or consent where required.

5. Who can see your information

Event hosts and authorized co-planners can see planning information appropriate to their roles. Guest and shared vision-board pages expose the information selected for those pages to people who have access to the link. Invitation recipients may see the inviter’s name and event information.

Display-name search is opt-in rather than automatic. Other signed-in members who know your complete account email can also find and follow you by an exact-email lookup, even if name search is off. We do not support partial-email browsing or show email addresses in search results. Following is one-way, needs no approval, and does not grant access to private wishlists or events. When you follow someone, they can see your display name in their in-app notifications and choose to follow you back, even if you are hidden from name search. Friends or Family labels are private to the person who assigns them.

Birthday sharing is optional and separate from name-search discoverability. If enabled, active followers who have not disabled birthday emails may receive your display name and birthday month and day 14 calendar days beforehand. We use the Pacific calendar, with February 29 observed on February 28 in non-leap years. Emails go individually to verified primary account email addresses and do not reveal other followers. You can remove your birthday, stop sharing it or stop receiving reminders in Settings. Delivery records prevent duplicates and record provider acceptance; this is not a guarantee of inbox delivery. Turning a preference off cannot recall an email already sent.

Personal wishlists start private. If you explicitly choose Public to signed-in members, any signed-in member may view and shop that list, whether or not they follow you. Anonymous visitors cannot view those wishes. Lists set to Friends & family are automatically available to people you follow who also follow you, as well as previously accepted connections. One-way follows alone do not unlock those lists, and mutual follows never unlock lists marked Private. Separately enabled private wishlist links have a limited public heading; signed-in link holders can view their wishes and gift-giver availability. Copying items to an event creates a separate event copy. The wishlist owner’s account is not shown reservation or purchase statuses, claimant identities or claim metadata. Gift-giver identities are not displayed to other gift-givers. The service still stores account-linked markers so each gift-giver can manage their own commitments.

People with a link can forward it, and authorized viewers can save or copy what they see. Revoking a supported sharing link prevents future access through that link, but cannot recall screenshots or downloaded copies. Event copies of wishlist items are separate records, not a live synchronized list.

6. Service providers and external websites

Replit supplies application hosting, database and file-storage infrastructure used to store content and deliver the service. Clerk provides authentication and session management. Google processes sign-in when you choose it. These providers process information needed for those functions under their applicable terms and privacy practices.

Where invitation email delivery is configured and requested, Resend processes recipient email addresses, sender information, event names and invitation links to deliver the message. Copying a link yourself does not send an email through OrcaStrate.

Retailers and image hosts may receive technical request information when their images load or when you open their links. To retrieve a product preview, our server may request the product URL you submit from that website. Do not place private information or access tokens into product URLs.

Amazon, Target, Walmart, Etsy and other linked websites operate independently. Affiliate links may send a retailer an affiliate identifier, and retailer cookies or similar technologies may attribute qualifying purchases. Retailers control their checkout, tracking and order data. A retailer click is not proof of purchase, and a gift status changes only when a user explicitly confirms it in OrcaStrate.

We may disclose information where legally required, to protect people and the service, to professional advisers under appropriate confidentiality, or as part of a business transfer subject to applicable safeguards and notice requirements. We do not sell personal information or share it for cross-context behavioral advertising.

7. Cookies and browser storage

Optional OrcaStrate analytics is off until you allow it. With permission, we store a random browser identifier for up to 90 days and a per-tab visit identifier. We measure broad page categories, coarse source categories (direct, search, social or other), successful feature interactions and estimated active time. We do not record private share URLs, query strings, event titles, wishlist contents, keystrokes or session recordings in these analytics records. Signed-in activity is associated with a pseudonymous account identifier so the owner can see aggregate active-user counts. Basic account totals come from our authentication provider, independently of optional browser tracking.

The owner-only dashboard displays aggregated analytics, not a list of individual visitors. Active time stops for hidden or unfocused pages and after inactivity; visitors are browser estimates, not exact people. We honor Global Privacy Control and Do Not Track for optional OrcaStrate tracking. Analytics records are eligible for cleanup after 93 days without activity, with cleanup performed when activity is processed. In Privacy Policy or Settings, you can withdraw permission and request removal of this browser’s earlier analytics. Planning-data deletion also removes account-linked analytics. Browser deletion does not remove other browsers’ records.

Authentication providers use cookies or similar technologies to sign you in and protect sessions. OrcaStrate uses browser storage for preferences such as motion settings and to remember a guest RSVP reference on that browser. These technologies support service functionality; clearing them may reset preferences or require you to sign in again.

External services, fonts, embedded or remote images and retailer pages may process connection information under their own policies. Browser controls can limit cookies and storage, though some features may stop working. This policy does not claim that external retailers honor your OrcaStrate privacy choices.

8. Retention and security

We retain information as reasonably needed to provide your account and requested collaboration, maintain security, resolve disputes and meet legal obligations. Retention depends on the type of record and its purpose; we do not promise a single fixed deletion period for all systems.

We use access controls and other technical safeguards designed to protect information. Shared links are access credentials and should be protected. No online service, storage system or transmission method is completely secure.

Deletion from active service records may not immediately remove information from backups, security logs, third-party authentication systems or copies independently retained by other users. Providers may process data in the United States or other countries, which may have different privacy laws.

9. Your choices and privacy rights

You can edit available profile details, keep people-search discoverability off, manage connections, revoke supported sharing links and remove content using the service controls. Settings provides export and deletion controls for your OrcaStrate planning data, including personal wishlists. Deleting that data is separate from deleting your Clerk sign-in account; email support@orcastrateapp.com to request authentication-account deletion or help with information not covered by the controls.

Deleting your hosted events removes their shared planning records; leaving another person’s event does not necessarily delete all content or copies they are entitled to retain. Deleting your personal shopping data clears your gift reservations and purchase markers so those wishes become available again. Consider this effect before deleting.

Depending on your location and applicable law, you may have rights to know or access the information we hold, obtain a copy, correct it, request deletion, object to or restrict certain processing, withdraw consent, or complain to a data-protection authority. California residents may have additional rights under California law, including rights concerning sale or sharing where applicable. We will not unlawfully discriminate against you for exercising a privacy right.

Send requests to support@orcastrateapp.com, describing what you need. We may verify your identity and, where relevant, an authorized agent’s authority before acting. We respond within applicable legal deadlines and explain any lawful limitations or exceptions. Do not email passwords or sensitive identity documents unless we arrange a secure method.

10. Adults-only accounts and children’s privacy

OrcaStrate accounts are intended for adults age 18 and older, and the service is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided information or created an account, contact support@orcastrateapp.com so we can investigate and take appropriate action.

Adults may plan family events involving children. Minimize identifying details, use sharing controls carefully and provide information about children only where you are authorized to do so. Do not publish children’s sensitive information through shared pages.

11. Policy updates and contact

We may update this policy to reflect service changes or legal requirements. The date at the top identifies the latest version. We will provide reasonable notice of material changes through the service or available contact details and obtain consent where required.

For privacy questions, account-deletion requests or concerns about this policy, contact OrcaStrate at support@orcastrateapp.com.