Orthanc Privacy Policy

Effective date: August 9, 2026

Orthanc is a macOS app and set of browser extensions (Chrome, Firefox, Safari) that give you one-click AWS SSO login and AWS Console access. It is built and operated by an independent developer, and this policy describes everything Orthanc does with data, which is very little. The short version: your AWS credentials never leave your Mac, the only telemetry is anonymous counters you can turn off, and we store no identifier for you at all: no device ID, no account, no email.

1. Who we are

Orthanc is developed and published by Sebastien Stormacq, an independent (indie) developer.

Contact for anything in this policy, including data-deletion requests: orthanc@stormacq.net

2. Your AWS data stays on your device

Orthanc's core functionality is entirely local:

• AWS configuration. The app reads your ~/.aws/config file to list your SSO profiles. This file is read locally and is never uploaded anywhere.
• SSO tokens. When you sign in, Orthanc performs the standard AWS SSO authorization flow and caches the resulting tokens locally in ~/.aws/sso/cache/, in the same format the AWS CLI uses. Access tokens and credentials never leave your machine; they are used only by the native app on your Mac.
• Network calls for core features go only to AWS. To log you in and generate console links, Orthanc talks directly to AWS's own endpoints (IAM Identity Center / SSO OIDC and the AWS federation endpoint), on your behalf, from your Mac. We do not proxy, intercept, or ever see this traffic.
• What the browser extension receives. The extension is handed only the final, one-time-use federated sign-in URL so it can open the AWS Console in a tab. It never receives tokens, credentials, or your AWS configuration.
• Your favourite profiles (which profiles you star in the extension popup) are stored locally on your Mac, in a file only Orthanc uses. They are never uploaded, and the list of your profile names never leaves your machine.

We (the developer) have no server involved in any of the above and no visibility into your AWS accounts, profiles, sessions, or activity.

3. Anonymous usage statistics (optional)

To know roughly how many people use Orthanc, the app can send a small, truly anonymous ping to our backend when it launches. The complete contents of that ping are:

• firstPingEver, firstToday, firstThisMonth, firstThisVersion, firstPaidLaunch: booleans, computed on your Mac, used to count installs, daily/monthly active users, version adoption, and purchases
• appVersion, e.g. "1.0.0"
• osVersion, e.g. "26.1"
• licenseState: "free" or "full"
• profileBucket: a coarse range describing how many SSO profiles are in your config, one of "1-2", "3-5", "6-10", "11+". This is a count only: your profile names, account IDs, and regions are never sent. The field is omitted entirely if your config has no profiles.

That is the entire payload. It contains no device identifier, no user identifier, no IP-derived data, and no hash of anything. Deduplication happens on your Mac (the app remembers locally whether it already pinged today), so the server only increments aggregate counters. No per-device record of any kind is created, and there is nothing in our database that could be traced back to you, your Mac, or your purchase.

Because the data is aggregate-only, an individual ping cannot be located, exported, or deleted after the fact: there is no record of it as such, only counters that went up by one. This is a deliberate design choice. We would rather be unable to identify you than hold data we would then have to protect.

You can turn this off in the app: Settings → Privacy → the "Share anonymous usage statistics" toggle. When disabled, no ping is sent.

4. Purchases

Orthanc is free to use with two profiles. Unlocking unlimited profiles is a one-time purchase, and how it is processed depends on where you got the app.

If you installed from the Mac App Store, the purchase is an in-app purchase handled entirely by Apple. Payment processing, receipts, refunds, and your payment details are all handled by Apple under Apple's Privacy Policy. We never receive your name, email, Apple ID, payment information, or receipts. Your entitlement is verified on your device by StoreKit; our server never sees it, and we store nothing about your purchase.

If you downloaded Orthanc directly from our website, the purchase is processed by Stripe, using Stripe Managed Payments, which means Stripe (through its Link service) is the merchant of record, not us. The transaction will appear on your statement as LINK.COM*, and your receipt and invoice come from Link. Stripe collects and processes your payment details and email under Stripe's Privacy Policy; we never see or receive your card details, and we do not receive your email address.

What we store for a direct purchase is one or more rows containing only:

• an opaque license ID we generate,
• the Stripe Checkout session ID for the transaction,
• the license token issued for that purchase, and
• the date the license was issued.

There is no name, no email, no address, no payment data, and no device identifier in that row, and it is not linked to any other data we hold. Its only purpose is to let you retrieve your license key again from our website (via the success page or the "Recover my license" page) if you lose it. We keep it for as long as the license is valid, that is, indefinitely, because deleting it would leave you unable to recover a key you paid for.

Your license key itself is validated on your Mac, against a public key bundled in the app. Orthanc does not phone home to check your license, at launch or ever, so we have no record of you using it.

If you want that license row deleted, email us with your Stripe/Link receipt number and we will remove it, with the consequence, which we will restate before doing it, that you will no longer be able to recover your key from our site.

5. Browser extensions

The Chrome, Firefox, and Safari extensions:

• Request only the nativeMessaging permission. Its sole purpose is to talk to the Orthanc app on your Mac
• Cannot and do not read web page content, form data, or anything you type
• Do not access or collect your browsing history
• Do not inject scripts into pages, set cookies, or run on any website
• Receive from the app only profile names, session status, your favourites list, and one-time federated sign-in URLs (to open the AWS Console tab you asked for)
• Send nothing to any server themselves. All network activity happens in the native app, as described in §2–§3

The data-use declarations we file with the Chrome Web Store (Developer Program Policies disclosure) and Firefox Add-ons (AMO) match this policy: the extensions themselves collect no user data.

6. What we do NOT do

• No advertising of any kind
• No tracking. Orthanc does not track you across apps or websites owned by other companies (the App Tracking Transparency sense of "tracking") and requests no tracking permission
• No sale or sharing of data. We do not sell, rent, trade, or share any data with third parties, and never have
• No third-party analytics or advertising SDKs. There is no Google Analytics, Firebase, Sentry, Facebook SDK, or similar in the app or extensions
• No accounts, no profiles. Orthanc has no sign-up, and we cannot associate any data we hold with a person
• No device identifier ever leaves your Mac. Orthanc sends us no device ID, hardware hash, or other per-machine identifier — not in the ping, not anywhere — and does not use Apple's DeviceCheck service. Your licence file is tied locally to your Mac's hardware ID so a licence cannot be copied to another machine; that value stays on your device and is never transmitted to us or to anyone else

7. Data processors (where the small amount of server data lives)

Three companies process data on our behalf or in connection with Orthanc, strictly as described above:

• Amazon Web Services (AWS). Our backend is a serverless function (AWS Lambda) and a database (Amazon DynamoDB) hosted in the eu-west-1 (Ireland, EU) AWS region. It holds only the aggregate telemetry counters (§3) and, for direct purchases, the license rows (§4). Standard AWS infrastructure logging (e.g. request logs) is retained briefly for operational purposes.
• Apple. Apple processes in-app purchases for App Store installs (§4). We receive no purchase or payment data from Apple.
• Stripe. For direct-download purchases only, Stripe is the merchant of record and processes the payment, tax, receipts, refunds, and any payment dispute (§4). In that role Stripe is not merely our processor, it is the seller, and it is the controller of your payment and contact data, under Stripe's Privacy Policy.

Separately, and not on our behalf, the app connects directly to your AWS endpoints for SSO login and console access (§2). In that relationship AWS is your provider, not our processor.

8. Your rights (GDPR, CCPA, and similar laws)

Legal bases (GDPR):

• Anonymous usage statistics (§3): the data is anonymous by design; the feature is nonetheless optional and disclosed in-app, and you can withdraw at any time via the Settings toggle (consent/opt-out).
• License records for direct purchases (§4): performance of a contract. We hold the minimum needed to let you recover the license you bought.

Your rights: you may request access to, correction of, or deletion of any data we hold. In practice:

• Telemetry (§3) cannot be accessed or deleted per-user because it is not per-user: it exists only as aggregate counters, with no identifier of any kind. There is no record of you to produce or erase.
• License rows (§4) can be located only via your Stripe/Link receipt number, which you hold and we do not. Email us with it and we will show you or delete the row. We cannot find it from your name or email, because neither is stored (this inability to identify you is deliberate; see GDPR Art. 11).
• Payment data is held by Stripe as merchant of record, so access and deletion requests for it go to Stripe. Note that a data-deletion request made to Stripe may also remove the transaction record in our Stripe account.
• App Store purchases leave no data with us at all, so there is nothing to request.

CCPA/CPRA: we do not sell or share personal information as those terms are defined in California law. Beyond the license row described in §4, which contains no personal identifiers, we collect no personal information categories. There is no cross-border sale of data, or any sale of data, of any kind.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

9. Children

Orthanc is a professional developer tool and is not directed at children under 16. We do not knowingly collect data from children.

10. Changes to this policy

If we change what data Orthanc collects or how it is used, we will update this policy, change the effective date at the top, and for material changes note it in the app's release notes. The current version is always available at this URL.

Questions? Email orthanc@stormacq.net.