Privacy Policy

Orca Knows is a guide to AI tools and the companies behind them. You can browse it without an account. This policy says what we collect when you use it, why, who helps us, how long we keep it and how to get it back or delete it.

Orca Knows is run by KOBO KOBO, LLC (“we”, “us”). We decide how your personal information is used, so in privacy-law terms we’re the controller. Questions or requests: [email protected].

The short version

• We collect what we need to run your account and the features you use, and little else.
• We don’t sell your personal information, share it for advertising, or give it to the companies we list.
• There are no advertising cookies or scripts. We use PostHog, a product analytics service, to see how the site is used. In the EU, EEA, UK and Switzerland we ask before setting its cookie.
• Business profiles you add are private to you. Reviews you post are public.
• You can download your data or delete your account from Settings at any time.

What we collect

When you browse without an account

We don’t ask who you are. Our hosting and security providers handle your IP address and browser details to deliver pages and block abuse (see “Who helps us”). We don’t store your IP address in our own database.

Our analytics provider, PostHog, records how the site is used: the pages you view, what you click and search, where you came from, your browser and device, and an approximate location worked out from your IP address. For some visits it records a replay of the page so we can see where people get stuck, with everything you type hidden. If you sign in, these records are linked to your account ID, never your email address.

When you create an account

• Your email address, used to sign you in with a one-time code and to send the emails you ask for.
• About you, if you fill it in: your name, timezone, what best describes you (role, how you work, industry), where you work and how big it is, and an optional photo.
• Sign-in and security records: when you signed in, and failed or repeated attempts, so we can stop abuse.

When you use Orca Knows

• What you watch: the tools and categories you follow, your alert settings, and items you hide from your feed.
• Your chats with Orca, our assistant: your questions and Orca’s answers, saved to your account.
• How you use the site: searches, the tools you open, compare or click through to, and which suggestions you act on. We use this to improve your feed and Orca’s suggestions, and to see which parts of the site work.
• Tools you ask us to cover and reports you send us about wrong details or reviews.

Business profiles

You can add a business so Orca Knows can suggest tools for it. We store what you give us (name, website, location, description, goals, answers) and what we read from it: the text of your own public web pages, and the facts, offerings and tools we find there. Each week we re-read those pages to notice changes. If you upload a file (a PDF or image), we read it once to build your profile and don’t keep the file. We keep only its name and what we learned from it.

Profiles are private to you. We use a profile to build your own matches, insights and alerts. The “Use this with Orca” switch decides whether Orca also sees it when you chat. We never publish a profile or use it to rank tools for anyone else.

Reviews

Reviews are public. With your rating and review we show your choice of name (first name and last initial) or your role, plus your role, how you work, industry, organisation size and, if you choose, your organisation’s name and your photo. If your email address is at the same company as the tool you review, we mark the review as written by an employee. Before you post, the review form shows exactly what will appear. Before a review is published, it may be screened automatically and checked by our team. We keep earlier versions of an edited review for 90 days.

When an AI assistant uses Orca Knows

You can connect Orca Knows to an AI assistant such as Claude or ChatGPT. When the assistant asks us something, we receive the request (for example the words of a tool search), the name and version of the assistant, a scrambled session ID and, from ChatGPT, a country. We don’t receive your conversation, your name or your account with that assistant. We keep these records for 90 days. After that we keep only daily counts with no personal information. Searches that found nothing are counted together and shown to our team only once at least three different assistants have asked.

How we use it, and why we’re allowed to

• To provide the service you asked for: your account, sign-in, watches, alerts, Orca, profiles and reviews. This is necessary to perform our agreement with you.
• To keep Orca Knows safe and working: preventing abuse and spam, enforcing rate limits, moderating reviews, fixing errors. This is our legitimate interest in running a secure, trustworthy service.
• To improve Orca Knows: understanding which tools people look for, which features work, and testing changes. Sometimes we test a change by showing a small share of accounts a version without personalisation. This is our legitimate interest, and we use the least personal information that does the job.
• To email you: sign-in codes and security notices (always), and alerts and summaries you choose to receive. We don’t send marketing email.
• To meet legal obligations and respond to lawful requests.

Where the law requires consent, we ask for it and you can withdraw it at any time.

Who helps us run Orca Knows

These providers process personal information for us, under contracts that limit them to doing so on our instructions:

• Railway hosts the website, the database and file storage (including profile photos).
• Supabase runs sign-in and account authentication.
• Resend delivers our emails: sign-in codes, security notices, alerts and summaries.
• PostHog provides our product analytics and session replays, as described above. It receives your IP address only to estimate your location, and doesn’t keep it.
• Cloudflare delivers and protects the site, and its Turnstile check stops automated sign-up and sign-in abuse. It sees your IP address and browser details.
• AI model providers run the models behind Orca, profile reading and personal suggestions. We pick the best model for each job and may change providers as models improve. Today we use Anthropic (Claude). We send what each request needs: your question and chat, your business profile when it’s used, the text of your pages and files you upload. We never send your email address. We only use providers’ paid business services, under terms that forbid them from training their models on what we send and require them to keep it confidential.
• TypeSafe may screen reviews for spam and abuse before they’re published. We send the review text and the tool’s name and description, never your name, email or rating. Reviews that contain links, email addresses or phone numbers go only to a person.

We also share information when the law requires it, to protect people or the service from harm, or as part of a merger or sale of our business (in which case this policy keeps applying to your data). We don’t share personal information with the companies we list.

How long we keep it

• Your account and what’s in it (profile, watches, chats, business profiles, reviews): until you delete it, or delete the account. If you don’t sign in for three years, we’ll email you and delete the account 30 days later unless you sign in.
• Search words in your activity history: 90 days. The rest of that history: 180 days.
• Copies of emails we sent you: 30 days.
• Sign-in and security records: 2 days. Rate-limit counters: up to 2 days.
• AI assistant request records: 90 days.
• Earlier versions of edited reviews: 90 days.
• Reports you send us about listings or reviews: we keep the report so our records stay accurate, but it is no longer linked to you once you delete your account.
• Analytics records at PostHog: up to 1 year. Session replays: 30 days.
• Backups: up to 35 days, then overwritten or deleted.
• Hosting and security logs held by our providers: usually no more than 30 days.

When you delete a chat, we also delete any copy of its questions. When you delete your account, we remove your personal information from our live systems right away, and from backups as they expire. We keep only a one-way scrambled marker of your sign-in identity, so an old sign-in can’t bring a deleted account back. You can sign up again later with the same email and start fresh.

Your choices and rights

• See and download all the personal information we hold about you: Settings → Download my data.
• Correct it in Settings, or ask us.
• Delete a chat, a business profile, a review or your whole account at any time.
• Turn analytics cookies off in “Cookies and storage” below. We then count your visits only anonymously.
• Stop emails from the link in any email or in Settings. Sign-in codes and security notices can’t be turned off while you have an account.
• Object or restrict: ask us to stop a use based on our legitimate interests.

Depending on where you live (for example the EU, UK or California), the law gives you some or all of these rights. We give them to everyone. Email [email protected] from the address on your account, or tell us how to confirm it’s you. We reply within 30 days, and we won’t treat you differently for using your rights. If you’re in the EU or UK, you can also complain to your local data protection authority.

For California residents

In the last 12 months we collected identifiers (email address, account ID), information you provide about your work, internet activity on our site, and the content of your chats, profiles and reviews, for the purposes above. We don’t sell or share personal information for cross-context behavioural advertising, and we don’t use sensitive personal information to infer things about you. We honour Global Privacy Control signals.

Cookies and storage in your browser

We use what the site needs to work, plus one analytics cookie. No advertising cookies.

• Sign-in session (orca_auth_…): keeps you signed in, up to 30 days.
• Sign-in in progress (orca_signin): the email you’re signing in with and where to return, for 10 minutes.
• Account deletion check (orca_delete_proof): confirms a deletion request, for 2 minutes.
• Pending action (orca_intent): remembers what you were doing (like watching a tool) while you sign in, for 15 minutes.
• Chosen business (orca_place): which of your business profiles the site is showing, for up to a year.
• Hidden tips (orca_ai): remembers that you hid our AI-assistant tips, for up to a year.
• Analytics (ph_…, with a copy in local storage): a random ID that tells PostHog two visits came from the same browser, for up to a year. In the EU, EEA, UK and Switzerland we set it only if you accept. If you decline, or your browser sends Global Privacy Control, we set nothing and count your visits anonymously.
• Cloudflare may set cookies needed for security checks.
• Session storage: an unsent question to Orca and the state of the Orca panel, cleared when you close the tab.

Security

Connections to Orca Knows and to our providers are encrypted. Access to personal information is limited to the few people who need it to run Orca Knows, such as to moderate reviews or answer your requests. No system is perfectly secure. If a breach affects your personal information, we’ll tell you and the authorities as the law requires.

Where your data is processed

We’re based in the United States, and we and our providers process data in the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses for transfers from the EU and UK.

Children

Orca Knows is for adults and businesses. It isn’t meant for anyone under 16, and we don’t knowingly collect personal information from them. If you think a child has given us information, email us and we’ll delete it.

Information about companies and people in our listings

Our listings describe AI tools and the companies behind them, using public sources such as company websites, public announcements and public social media posts. We show where each detail came from. If a listing includes information about you and you want it corrected or removed, email [email protected].

Changes

If we change this policy, we’ll update the date at the top. If a change materially affects how we use your personal information, we’ll email account holders at least 14 days before it takes effect. Adding or swapping a provider for a job listed above, on the same terms, isn’t a material change. We keep the provider list on this page up to date.

Contact

KOBO KOBO, LLC, 8 The Green, STE B, Dover, DE 19901. Email [email protected].