Privacy Policy

1. Who is responsible
2. What this policy covers
3. Website and mailing list
4. The hosted environment
5. Cookies and local storage
6. Who receives your data
7. Transfers outside the EU
8. How we protect your data
9. How long we keep it
10. Your rights
11. Children
12. What you must give us, and automated decisions
13. Changes to this policy

1. Who is responsible

The controller of your personal data, as defined in the EU General Data Protection Regulation (GDPR), is:

Worca Development Community
Email: hello@worca.dev

Use that address for every privacy question or request.

2. What this policy covers

This policy covers:

• the website worca.dev and the documentation at docs.worca.dev;
• the mailing list: release emails and project news;
• invite requests for the hosted environment;
• the hosted environment: the control plane at app.worca.dev and the instances under worca.run, which the project runs so people can evaluate Worca. It is not a commercial service.

Self-hosted Worca. The Worca software you install and run yourself (from npm, GitHub or a container image) sends nothing to us. It has no telemetry. Its metrics are written to your own git repository, and the AI models it uses are called with your own provider keys, directly from your machine. We receive no personal data from it, so this policy does not apply to it.

What's inside a hosted instance. When an org uses the hosted environment, the code, prompts, task data and agent output on its instances belong to that org. For that data we are a processor: we process it only on the org's instructions, to run the instance. The org is the controller, and its own privacy notice applies. If your data is in an org's instance and you want to use your rights, contact that org; we will help them.

3. Website and mailing list

3.1 Visiting worca.dev

What

Your IP address and the technical details every browser sends: the page you asked for, the time, your browser and operating system (user agent) and the page you came from.

Why

To deliver the pages to you and to protect the site against attacks. The site is static: we run no code of our own when you visit, and we have no analytics.

Lawful basis

Our legitimate interest in running a working, secure website (GDPR art. 6(1)(f)).

How long

We keep no visitor logs of our own. Our hosting provider, Cloudflare, processes this data to serve the request.

The fonts and scripts on worca.dev come from worca.dev itself. Because every page carries the mailing list form in its footer, every page also loads the Cloudflare Turnstile script from challenges.cloudflare.com (see section 3.4). The film on the home page is served from media.worca.dev, which is also hosted by Cloudflare. Apart from that, your browser contacts another site only when you follow a link to it, or when you send one of our forms, which go to app.worca.dev.

3.2 Release emails and project news (the mailing list)

You can subscribe in the footer of any page, or from your account page on the hosted environment. You choose which release emails you get (none, major releases only, major and minor, every stable release, or everything including release candidates) and whether you want project news.

What

Your email address; your choices (release level, project news on or off); where you subscribed (the website or your account); when you subscribed, confirmed, changed your choices or unsubscribed; and the delivery status of each mail we send you (delivered, bounced, marked as spam). The delivery records hold an id from our mail provider, not your address.

Why

To send you the emails you asked for; to prove that you agreed (double opt-in: we only start after you click the link in the confirmation mail); to stop mailing addresses that bounce or complain.

Lawful basis

Your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every mail, without giving a reason. Keeping a record that an address unsubscribed or bounced, so we never mail it again, is our legitimate interest in respecting your choice (art. 6(1)(f)).

How long

• Not confirmed: the confirmation link works for 7 days; the address is deleted 30 days after you subscribed.
• Subscribed: as long as you stay subscribed.
• After you unsubscribe, or after a bounce or spam complaint: your address is erased 30 days later. Until then you can undo the unsubscribe from your manage link. After that we keep only a keyed one-way hash of the address and its status, so we recognise it and don't mail it again. The hash cannot be turned back into the address.
• If you delete your account on the hosted environment, the subscription for its address is deleted with it.

Every mail has a signed link to a page where you can change your choices or unsubscribe, and a one-click unsubscribe that works from your mail program. Unsubscribing from everything also invalidates all earlier links. Mails are sent through Resend. We do not track opens or clicks.

3.3 Asking for an invite to the hosted environment

While the hosted environment is invite-only, you ask for an invite code by email to hello@worca.dev or in an issue on GitHub. What you write in a GitHub issue is public, under GitHub's own terms.

What

Your email address and what you tell us about what you would like to try; our reply; and, if we grant access, an invite code that only works for your address (we store only a hash of the code).

Why

To decide who joins while capacity is small, to reply, and to let you sign up. Requests are read and decided by a person.

Lawful basis

Steps you asked us to take before we provide the hosted environment to you (GDPR art. 6(1)(b)), and our legitimate interest in deciding who joins a limited evaluation and keeping out abuse (art. 6(1)(f)).

How long

Your email is kept as described in section 4.6. The record of an invite code is deleted once the code is used or has expired.

3.4 Protecting the forms

What

Your IP address, used as a counter key to limit how many times a form can be sent from one address. Cloudflare Turnstile also checks your browser to tell people from bots. Its script loads on every page of worca.dev, because the mailing list form is in the footer, and on the sign-in pages of app.worca.dev; the check itself runs invisibly unless Cloudflare needs to ask you to confirm. For that, Cloudflare processes your IP address and technical details of your browser, and may keep a short-lived token in your browser for the check.

Why

To stop spam and abuse of the forms and of the mails they send.

Lawful basis

Our legitimate interest in keeping the service safe (GDPR art. 6(1)(f)).

How long

The counters expire on their own, after two hours at most. They are never logged.

4. The hosted environment

The hosted environment at app.worca.dev is run by the project so that interested people can evaluate Worca without a server. It is free and not a commercial service. People use it as members of an organization (org). For the data below we are the controller. For the content on instances we are a processor (see section 2).

4.1 Your account and how you sign in

What

• Your email address and name, your account status, when you signed up, and the sign-up code you used (as a hash).
• How you sign in. Email code: the code, stored only as a hash, valid for 5 minutes. Passkey: its id and public key, when you added it and last used it (we never get your private key or biometrics). Google, Microsoft or your org's single sign-on: the account id that provider gives us, and the tokens it issues, encrypted.

Why

To create your account, sign you in and keep it yours.

Lawful basis

Providing the hosted environment you or your org asked for (GDPR art. 6(1)(b)), and our legitimate interest in providing it to the org's members (art. 6(1)(f)).

How long

Until you delete your account. You can delete it yourself at any time, unless you are the last admin of an org; then you hand over the org or delete it first. Deleting your account removes your memberships, sessions, sign-in methods and passkeys and destroys your personal data key, which makes any copy left in a backup unreadable.

When you sign in with Google, Microsoft or your org's single sign-on, we ask only for your name, email address and an account id. That provider handles your sign-in under its own privacy terms.

4.2 Orgs, teams and invitations

What

The orgs you belong to and your role in each (admin or user), your teams, when you joined and who invited you; invitations (the invited address, role and teams, valid for 7 days); the org's sign-in rules, verified domains and single sign-on settings.

Why

To let the org's admins decide who may use which instance, and to let members see who else is in their org.

Lawful basis

Providing the hosted environment the org asked for (GDPR art. 6(1)(b)) and our legitimate interest in providing it to the org's members (art. 6(1)(f)).

How long

As long as you are a member. An invitation is deleted 30 days after it expired, whether it was accepted, declined, withdrawn or never answered (it expires 7 days after it was sent). Deleting an org deletes its instances, teams, members and invitations and destroys the org's data key.

Who sees what. Every member of an org sees the other members' names, email addresses, roles and teams. The org's admins also see when people joined, how each signs in, who invited them and pending invitations. The maintainers who run the platform see org names, instance names and the email addresses of org admins, so they can help with support. They never see what is inside an instance.

4.3 Sessions, security and the audit log

What

• Sessions: the sign-in method, whether a passkey was used, the expiry, and your IP address and browser user agent, encrypted with your own key. The list of your sessions shows only "browser on operating system", never your location.
• Audit log: who did what and when (for example: signed in, invited someone, changed a policy, created or deleted an instance). Details about an org are encrypted with the org's key. Our own log of platform actions holds ids and numbers only, never an address.
• Sign-in resets: if you lose every passkey, the request and its reason (encrypted with your key) and the two maintainers who handled it.

Why

To keep accounts secure, spot misuse, let org admins see what happened in their org, and keep us accountable for our own actions.

Lawful basis

Our legitimate interest, and the org's, in the security of the service (GDPR art. 6(1)(f)); and our duty to keep personal data secure (art. 32 together with art. 6(1)(c)).

How long

• A session ends 7 days after it was last renewed (use renews it at most once a day), or when you sign out. Signing out deletes it at once; an expired session, with its IP address and user agent, is deleted 7 days after it expired.
• Audit log entries: 30 days. When an org is deleted, its log is deleted at once; we keep a record that the deletion happened (org id, who, when) for 30 days.
• Sign-in reset requests: deleted 30 days after they were carried out, or 30 days after they expired unapproved.

Sign-in forms are also protected by the counters and the Turnstile check described in section 3.4.

4.4 Emails we send you

What

Your email address and the content of the mail: sign-in codes, invitations, confirmations of important actions, notices about your org and its instances (for example a new Worca version, or a new passkey on your account). For each mail we keep the mail provider's id, the kind of mail and its delivery status, without your address.

Why

These mails are part of the service: they let you sign in, confirm risky actions and know what happens in your org.

Lawful basis

Providing the hosted environment you asked for (GDPR art. 6(1)(b)) and our legitimate interest in a secure service (art. 6(1)(f)).

How long

Mails are not stored by us. Delivery records are deleted 30 days after the final delivery status (delivered, bounced, marked as spam, failed); a record that never gets one is deleted 180 days after the mail was sent. The record of an invitation mail is kept as long as the invitation, so admins can see whether it arrived. Resend keeps the mails and delivery logs it handles for us for a limited time under its own retention rules.

4.5 Instances: what we see

Each instance runs on its own host under worca.run. To keep it running we receive, every minute, a heartbeat: whether it is healthy, its Worca version, how many pipelines are running, queued, waiting or failed, and when the next scheduled run is. It never contains pipeline titles, prompts, branch names or code. We also record the instance's status and the operations on it (create, upgrade, suspend, delete), which we keep 30 days after they finish.

When you open an instance, our gate checks your sign-in and teams first, then passes the instance a short-lived token with your user id, email address, name and the ids of the teams that gave you access. This lets Worca show who did what. Everything the instance stores after that is the org's content, for which we are a processor.

The maintainers cannot open instances. No platform role gives access to an instance. They see an instance's status, version and the heartbeat numbers above, not your work.

4.6 When you contact us

What

Your email address, your message and our reply.

Why

To answer you and to handle your request, including privacy requests, abuse reports and security reports.

Lawful basis

Our legitimate interest in answering you (GDPR art. 6(1)(f)); for privacy requests, our legal obligation to handle them (art. 6(1)(c)).

How long

As long as we need it to handle your request, and up to two years after the last message, so we can refer back to it if you write again.

5. Cookies and local storage

worca.dev sets no cookies. We use only what is strictly necessary for something you ask for, so no consent banner is needed (ePrivacy Directive art. 5(3)).

The Worca app running inside an instance may store its own settings in your browser. That is part of the org's instance.

6. Who receives your data

6.1 Service providers (processors)

These companies are third-party processors: they process personal data only on our behalf, each bound by its data processing agreement (GDPR art. 28), which obliges it to protect the data and use it only to provide its service to us. All three are US companies; where they keep the data and which safeguards apply is in section 7.

6.2 Independent controllers

These services receive data because you, or your org, chose to use them. They decide for themselves how to handle it, under their own privacy policies:

• Google and Microsoft, when you sign in with them.
• Your org's single sign-on provider (for example Microsoft Entra ID or Okta), set up by your org's admins.
• AI model providers (for example Anthropic or OpenAI) that your org's agents call with the org's or your own keys. Prompts, code and other content go to them directly from your instance.
• Git hosts and other tools your org connects (for example GitHub), which the agents read from and write to.

6.3 Others

• Your org: other members and the admins see what is described in section 4.2.
• The maintainers who run the platform, a small group bound to confidentiality, see only what they need to run it, as described above.
• Authorities, when the law requires us to hand over data and the request is valid. We disclose the minimum, and tell the people concerned unless the law forbids it.

We do not sell personal data, use it for advertising, or use the content of instances to train AI models.

7. Transfers outside the EU

We keep data in the EU where we can: the control plane's database and the instances' state run in EU locations, and instances run in Railway's EU West region (the Netherlands). Our mail provider sends from its EU region.

Cloudflare, Railway and Resend are US companies, and Cloudflare serves each request from the data centre nearest to the visitor, which may be outside the EU. Where personal data reaches a country without an EU adequacy decision, we rely on:

• the EU-US Data Privacy Framework, for providers certified under it (Cloudflare and Resend); and
• the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), included in each provider's data processing agreement (for Railway, the only safeguard).

You can ask us for a copy of the safeguards at hello@worca.dev.

8. How we protect your data

• Personal fields in our database (email addresses, names, IP addresses and user agents, org, team and instance names, invite codes and mailing list data) are encrypted in the application with AES-256-GCM. Each person, org and mailing list subscriber has its own data key; those keys are themselves encrypted with a master key kept as a platform secret.
• Lookups by email use a keyed hash with a separate key, so the address itself stays encrypted. Sign-in codes, session tokens and confirmation links are stored only as hashes.
• Deleting an account, an org or a mailing list address destroys its key, so even copies in database backups can no longer be read.
• Each instance has its own isolated project, network and tunnel, on a separate domain from the sign-in. No platform role can open an instance.
• Maintainers with platform access need a passkey or second factor. Their actions are logged.

9. How long we keep it

10. Your rights

Under the GDPR you have the right to:

• access your data and get a copy (art. 15). Signed-in users can download their profile and memberships from their account page;
• have it corrected (art. 16);
• have it erased (art. 17). You can delete your account yourself;
• restrict how we use it (art. 18);
• get it in a portable format, to give to someone else (portability, art. 20);
• object to processing based on our legitimate interest (art. 21);
• withdraw your consent at any time, for example by unsubscribing. This doesn't affect what we did before;
• complain to a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg). You can also complain to the authority where you live or work, or where you think the problem happened.

To use a right, email hello@worca.dev from the address concerned. We answer within one month. If we can't tell that the request is yours, we may ask you to confirm it, for example by replying from that address. If your data is inside an org's instance, we pass your request to that org, which decides on it.

11. Children

You must be 16 or older to subscribe to the newsletter, and 18 or older to use the hosted environment. We do not knowingly collect data from children. If you think a child has given us personal data, tell us and we will delete it.

12. What you must give us, and automated decisions

You need to give an email address to subscribe, to ask for an invite and to have an account; without it we can't provide those services. Everything else is optional.

We make no decisions about you by automated means alone, and we do no profiling. Invite requests are decided by a person.

13. Changes to this policy

We will update this policy when what we do changes. The version and date are at the top, and the history is below. If a change matters to you, we will tell users of the hosted environment by email and in the app, and mailing list subscribers in a mail, before it takes effect.

Version history