๐Ÿ‹OrcaLayer
Sign In

Privacy Policy

Last updated: October 6, 2026

1. Introduction

OrcaLayer ("we", "our", "us") operates the website orcalayer.com (the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information: When you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Wallet Addresses: Wallet addresses you search for are publicly available on the blockchain. We do not link wallet addresses to your identity unless you explicitly save them to your account.

Usage Data & Analytics: We use analytics tools to understand how the Service is used (pages visited, features used). These set cookies and collect anonymised usage data: Google Analytics and Google Ads conversion measurement on all pages, the Whop Pixel on all pages (page views, attribution of purchases made through Whop, and device information), and Yandex Metrica on our Russian-language (/ru) pages. We do not sell this data. You can manage or decline analytics cookies via the banner shown on your first visit or through your browser settings.

We never ask for or store private keys, seed phrases, or wallet passwords.

3. How We Use Your Information

  • To provide and maintain the Service
  • To manage your account and subscription
  • To send alerts and notifications you have opted into
  • To improve the Service based on anonymous usage patterns

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data only:

  • With service providers necessary to operate the Service (hosting, authentication)
  • If required by law or to protect our rights

5. Data Security

We use industry-standard security measures including SSL/TLS encryption, secure authentication via OAuth 2.0, and access controls. However, no method of transmission over the Internet is 100% secure.

6. Third-Party Services

We use Google OAuth for authentication. When you sign in with Google, Google's Privacy Policy applies to the information they collect. We only receive the information described in Section 2. We also use third-party analytics (Google Analytics, Google Ads and the Whop Pixel on all pages, Yandex Metrica on Russian-language pages; the Whop Pixel also collects device information) โ€” the full list of sub-processors is in Section 10.

7. Your Rights

You can:

  • Request deletion of your account and associated data
  • Opt out of notifications at any time
  • Access and export your data

To exercise these rights, contact us at support@orcalayer.com.

8. Children's Privacy

Our Service is not directed to anyone under the age of 18. We do not knowingly collect personal information from children.

9. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal basis: We process your data based on legitimate interest (providing the Service) and your consent (account creation)
  • Right of access: You can request a copy of all data we hold about you
  • Right to rectification: You can request correction of inaccurate data
  • Right to erasure: You can request deletion of your account and all associated data
  • Right to data portability: You can request your data in a machine-readable format
  • Right to object: You can object to processing of your data
  • Right to withdraw consent: You can withdraw consent at any time by deleting your account

To exercise any of these rights, contact us at support@orcalayer.com. We will respond within 30 days.

10. Sub-Processors & Data Retention

We use the following third-party services to operate OrcaLayer:

  • Hetzner Online GmbH (Germany) โ€” server hosting and data storage
  • Cloudflare, Inc. (USA) โ€” CDN, DDoS protection, SSL
  • Google (USA) โ€” OAuth sign-in, plus Google Analytics and Google Ads conversion measurement (analytics cookies)
  • Yandex Metrica (Yandex, EU/Russia) โ€” usage analytics on Russian-language (/ru) pages only (analytics cookies)
  • Whop and NOWPayments โ€” subscription billing (cards and crypto); card and wallet credentials go directly to them, never to us
  • Whop (USA) โ€” the Whop Pixel on all pages: page views and attribution of purchases made through Whop (cookies, browser storage and device information)

Data retention: Account data is retained for the duration of your account. Upon deletion, all personal data is removed within 30 days. Anonymous blockchain analytics data (publicly available) is retained indefinitely.

11. API and MCP Access

This section covers requests to the OrcaLayer API and to our MCP server at https://orcalayer.com/mcp, whether you send them yourself or an AI client sends them for you (for example Claude, Cursor or another Model Context Protocol client).

What we receive:

  • The request: the endpoint or tool called and its parameters, for example a wallet address, a market id or a search term
  • Request metadata: time, client IP address, client software (User-Agent), response status and duration
  • If an API key is sent: the key's internal identifier and the plan of the account it belongs to. The key itself is never written to our logs

What we do not receive: your conversation with the AI client, your prompts, the model's answers, your files, or anything else the AI client does not include in the tool call it sends. The AI client processes your conversation under its own privacy policy.

How we use it: to answer the request, to apply rate limits and plan access, to protect the Service against abuse, and to see which endpoints and tools are used in aggregate. We do not sell it and do not use it for advertising.

Retention: the API request log is kept for 45 days and web server access logs for 15 days; both are then deleted. Daily aggregate usage counts, which contain no IP addresses, may be kept longer.

Sharing: requests are processed on our servers at Hetzner (Germany) and pass through Cloudflare (Section 10). They are not shared with any other third party, except as required by law.

The API and the MCP server return analytics derived from public blockchain records. MCP tools are read-only: they cannot place orders, move funds or change your account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

support@orcalayer.com