Privacy Policy

Orca Dashboard ("Orca", "we", "us") is an invite-only tool for tracking purchase orders, buying-group payouts, and resale profit. This policy explains what information Orca collects, how it is used, and the choices you have. It applies to the website at orcadashbord.com.

Information we collect

Account information

When you create an account, we receive your email address and, if you sign in with Google, your name, email address, and profile picture from your Google account. Sign-in is handled by our authentication provider, Clerk.

Information from Gmail (with your permission)

If you connect a Gmail account, Orca requests read-only access to Gmail (gmail.readonly). Orca uses this access only to search for order confirmation emails from supported retailers and receipt emails from Buying Group, within the lookback period you choose. From those emails we extract and store:

• Order details: retailer, order number, order date, product name, quantity, prices, and totals.
• Buying Group receipt details: receipt ID, commitment ID, quantity, price, commission, and totals.
• The sender address, subject line, and Gmail message ID, so each order can be traced to its source email.

Orca does not store full email bodies and does not read, store, or process emails from any other senders. Orca never sends, deletes, labels, or modifies anything in your mailbox.

To keep syncing, Orca stores the OAuth access and refresh tokens Google provides. Tokens for additional inboxes are encrypted at rest (AES-256-GCM). The token for the Google account you sign in with is held by Clerk.

Information you enter

Orders you add or edit, names you give your payment cards (we never ask for or store card numbers), retailer account labels (retailer, nickname, and account email), and settings such as your sync lookback period.

Technical information

Our hosting provider records standard request logs (such as IP address, browser type, and pages requested) for security and troubleshooting. Orca uses cookies required for sign-in and for securing the Gmail connection flow, and your browser's local storage to remember your light or dark theme. We do not use advertising or cross-site tracking cookies.

How we use information

• To provide the service: importing orders, matching Buying Group receipts to orders, and calculating payouts and profit.
• To authenticate you and keep your account secure.
• To diagnose problems and keep the service running.

We do not sell your information, use it for advertising, or use it to train artificial intelligence or machine learning models.

How Orca Dashboard accesses, uses, stores, and shares Google user data

This section describes specifically how Orca Dashboard handles data it receives from Google when you sign in with Google or connect a Gmail account.

Data accessed

• Google sign-in: your name, email address, and profile picture (the basic openid, email, and profile scopes).
• Gmail (read-only): with the https://www.googleapis.com/auth/gmail.readonly scope, Orca Dashboard reads messages matching a search for emails from supported retailers (such as Best Buy, Walmart, Apple, and Target) and from Buying Group (buyinggroup.com), sent within your chosen lookback period (1–365 days). It does not access any other messages, contacts, calendar, or Drive data.

Data usage

• Your Google name and email are used only to identify your account and show who is signed in.
• Matching Gmail messages are parsed to create order records (retailer, order number, date, product, quantity, prices, totals) and to match Buying Group receipts (receipt ID, items, quantities, commission, payout totals) to those orders and mark them paid.
• Imported orders are shown to you in a review queue, and nothing counts toward your totals until you confirm it.
• Google user data is not used for advertising, is not sold, and is not used to develop, improve, or train generalized artificial intelligence or machine learning models.

Data sharing

Orca Dashboard does not sell, rent, or share Google user data with third parties, except with the service providers that host the app on our behalf (Clerk for sign-in, Neon for the database, and Vercel for hosting), who may process it only to run Orca Dashboard; when required by law; or as part of a merger or acquisition, with notice to you. Your data is never visible to other users.

Data storage and protection

• Only the extracted order and receipt details listed above are stored. Full email bodies and attachments are not stored.
• All data is sent over HTTPS and stored in an access-controlled database hosted by Neon.
• Gmail OAuth refresh and access tokens for additional inboxes are encrypted at rest with AES-256-GCM. The token for your sign-in Google account is stored by Clerk.
• Each user's data is scoped to their own account and is not accessible to other users.
• No person reads your Gmail data unless you give specific permission (for example, to troubleshoot a problem you report), it is necessary for security purposes such as investigating abuse, or it is required by law.

Data retention and deletion

• Imported order and receipt details are kept while your account is active, so your history and profit figures stay accurate.
• Disconnecting an additional Gmail inbox in Settings immediately deletes its stored tokens and revokes Orca Dashboard's access with Google. You can also revoke access at any time from your Google account permissions.
• To delete your account and all associated data, including every imported order and stored token, email privacy@orcadashbord.com. Deletion is completed within 30 days.

Limited Use

Orca Dashboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We share information only with providers that operate Orca on our behalf:

• Clerk: user authentication and account management.
• Neon: database hosting, where your orders and settings are stored.
• Vercel: application hosting.
• Google: Gmail API access, when you connect Gmail.

We may also disclose information if required by law, or to protect the rights, safety, or security of Orca, our users, or others.

Retention and deletion

We keep your information for as long as your account is active. You can disconnect an additional Gmail inbox at any time from Settings, which deletes its stored tokens and revokes Orca's access with Google; orders already imported from it remain until you delete them. You can also revoke Orca's access from your Google account permissions.

To delete your account and all associated data, email privacy@orcadashbord.com. We will complete deletion within 30 days, except where we must keep information to comply with law.

Security

Data is encrypted in transit (HTTPS), Gmail tokens for additional inboxes are encrypted at rest, and access to each account's data is restricted to that account. No method of storage or transmission is completely secure, but we work to protect your information.

Children

Orca is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

If we change this policy, we will update the effective date above. For material changes, we will notify you by email or in the app before they take effect.

Contact

Questions or requests about your data: privacy@orcadashbord.com.