As little as possible is the whole design.

This site is a set of static pages. It uses one analytics tool, Umami, which we self-host. It is cookieless: it sets nothing on your device, does not track you across other sites, and gives us only aggregate counts such as page views and referrers, never an identified profile of who you are. Beyond that we embed no tracking pixels, run no advertising, and ask you to create no account. There is no form on this site that submits data anywhere; nothing you type here is sent to us unless you separately choose to email us.

The one honest exception: our host's request logs

This site is served through Cloudflare's hosting and content-delivery network. Delivering any web page necessarily involves the host seeing standard request data, such as your IP address, browser user agent, the URL requested, and a timestamp, as part of ordinary web serving and abuse protection. Cloudflare processes that on our behalf, acting as our processor; the only analytics we add on top is the cookieless, aggregate Umami described above, and we do not receive an identified profile of who visited. If you want the detail of how Cloudflare itself handles that, its policy is at cloudflare.com/privacypolicy.

Orrery's core is identity-free and runs entirely on the operator's own machines. By default it makes no outbound network call of its own: the only traffic it initiates is the ssh read that a profile you write explicitly declares, to a box you named. It ships with usage telemetry that is off by default; if you turn it on with ess-orrery telemetry on, it sends only anonymous, aggregate data (the ess-orrery and Python versions, your OS family, and counts of which commands you ran), never your data, your fleet's shape, your secrets, or anything that identifies you. ess-orrery telemetry status prints exactly what it would send, and turning it off deletes the anonymous id. If you opt in, that anonymous data is received and stored by a small collector we run, keyed only by the random id, and we store neither your IP address nor your user agent.

It does not send us your data, your fleet's shape, or your secrets. The secret graph it builds, secret-edges, maps which secret feeds what, by a non-secret identity such as a vault path or an environment-variable name, and never reads a secret's actual value into anything it reports, stores, or would have anywhere to send.

orrery@eveningstar.app is the only contact channel for this project. There is no separate ticket system or mailing list. If you write to us, we see whatever you send, your email address, the message, and any attachment, and we use it only to respond to you. Emailing us does not add you to any list.

No accounts exist today, either on this site or in the self-hosted software. If Evening Star Productions launches a hosted, account-based version of Orrery, that service will collect what running it actually requires, at minimum account and billing details, and it will have its own privacy policy describing that in full, presented to you before you sign up. This page will be updated to link to it once it exists; nothing here should be read as already covering a service that does not exist yet.

This policy may be updated from time to time, most likely as the hosted service takes shape. When it is, the effective date at the top of this page will change. There is no notification list to sign up for; check back if it matters to you.