Privacy and Data
What stays on your machine, what leaves it and when, how credentials are handled, and how to clear your data.
What stays on your machine
By default, almost everything:
- Your queue, playback position, and history
- Replay statistics, computed locally from local events
- Audio Engine configuration, learned automatic-EQ profiles, and per-track gains
- Song Cache audio bytes
- Pins, preferences, and installed artist packs
- YouTube Music session cookies
All of it lives in Orchard’s per-user data directory:
| Platform | Path |
|---|---|
| Windows | %APPDATA%\Orchard |
| macOS | ~/Library/Application Support/Orchard |
| Linux | ~/.config/Orchard |
What leaves your machine, and when
Always, because it is how the app works
YouTube Music. Browsing and playback go to Google’s servers using your session, including which tracks you play. This is unavoidable for a YouTube Music client.
On by default, and switchable
Send listening history to YouTube. Plays update your YouTube account history. Turn it off in Settings → Integrations. Orchard’s local Recently Played and Replay keep working either way.
Discord Rich Presence. Sends the current track, artist, and artwork to your local Discord client, which then shows it to whoever can see your status. Turn it off in Settings → Integrations. Animated artwork additionally routes an artwork URL through Orchard’s artwork-proxy worker.
Off unless you enable them
Last.fm scrobbling. Requires you to authorize it. Once authorized, plays are sent to Last.fm through Orchard’s signing worker.
Spotify. Requires you to connect an account.
Orchard Connect. Runs a LAN-visible server only when you use it, and grants access only to devices you explicitly approve. See Orchard Connect.
Listening parties. Playback state is broadcast to the room. Audio never leaves your machine, since parties are peer-to-peer and the coordinating worker never proxies media.
Support reports. Sent only when you file one. Diagnostics and screenshots are attached only if you choose to attach them.
Metadata lookups
Orchard queries its own workers for tempo and key, artist genre, concerts near a location you specify, and share-link resolution. These carry the query (a track title, an artist name, a location) and not your identity or your history. See Cloudflare Workers.
Credentials
Orchard never asks for your Google password. Sign-in happens in an embedded browser session on Google’s own pages, and Orchard keeps the resulting cookies locally.
Your Last.fm session key is stored encrypted on your machine. Orchard’s own Last.fm API key and shared secret are not bundled with the app; they live in a worker that signs requests. GitHub sign-in for the Support System uses Device Flow, so you authorize by code on GitHub’s site.
Orchard Connect device tokens are stored only as SHA-256 hashes, so a stolen copy of the device file yields nothing usable.
The Support System
Filing a private report creates an anonymous identity and a conversation stored in D1. Screenshots go to a private R2 bucket. Each report opens a private Discord forum thread, and the report description is mirrored into a public-safe GitHub issue.
Public issues are public. Do not put anything in a report description you would not want in a public issue.
Backup and export
Settings → Backup exports your local state to a file and imports it back. The export is a plain file on your disk and is not uploaded anywhere.
Clearing your data
Quit Orchard and delete the per-user data directory above. That removes sessions, cache, Replay, preferences, and installed packs. Export first from Settings → Backup if you want any of it back.
Third-party services
Features that depend on external services carry those services’ own privacy practices: YouTube Music, Discord, Last.fm, Spotify, GitHub, Ticketmaster, GetSongBPM, Apple’s public lookup APIs, Deezer, and TIDAL.