1. Static site and security request data
Sources include the browser, network operator and Cloudflare edge. Data may include IP address, time, path, User-Agent, TLS or network diagnostics and security events. Purposes are limited to serving the site, preventing abuse, diagnosing faults and meeting legal obligations; the project does not use this data for advertising profiles, sale or cross-site targeting.
Application code does not create a user log database. Cloudflare may retain account-level security, access and platform records under its published policies and the service configuration; Orylin does not represent infrastructure records as zero.
2. Invitation, rendezvous and connection data
The browser creates the invitation secret, places it in a URL fragment, removes it from the visible address bar after reading, and excludes it from ordinary HTTP requests. A derived room binding, encrypted signaling envelopes, role and resource counters are processed only for one short-lived rendezvous.
During a connection, state remains in volatile browser memory and active Worker or Durable Object memory. Application code does not persist messages, files, voice, keys or session history in KV, R2, D1 or Durable Object storage. A three-word code only locates a short-lived matching session. After the creator accepts a request, the creator browser randomly generates a four-digit human-verification code that is not sent directly through the three-word connection. The joiner obtains it over another trusted channel. Both browsers use the normalized words and digits as password material for a mutually confirmed SPAKE2 exchange. Each round accepts at most four distinct online attempts counted by the creator; the full invitation secret is released in transcript-bound AES-GCM ciphertext only after both sides complete key confirmation. The four digits alone are not an encryption key. Abnormal termination remains subject to normal browser, operating-system and Cloudflare platform behavior.
3. Direct and voluntary relay metadata
Direct WebRTC setup may reveal required candidate addresses and connection type to the peer. Cloudflare STUN, network operators and other transport infrastructure may also observe connection metadata. Orylin does not claim to conceal that communication occurred.
Volunteer relay is off by default and starts only after an explicit user action. It handles bounded single-hop end-to-end ciphertext, short-lived capabilities and circuit counters. It is not a general proxy and receives no session keys or application plaintext.
4. Legal basis, sale and automated decisions
Depending on applicable law, delivering a user-requested temporary connection may rely on performance of that request; security and resource protection may rely on legitimate interests or legal obligations; optional relay starts only after an explicit action and stops when the user disables it.
Orylin does not sell personal information, share it for cross-context behavioral advertising, infer traits from sensitive data, make decisions with legal or similarly significant effects, or create cross-session user profiles. Any future change requires updated notice and controls before collection.
5. Recipients, transfers and rights
Cloudflare is the infrastructure provider; the communications peer is an independent recipient required for the connection. Cloudflare's global network may process data outside a user's region under its published terms and transfer mechanisms.
Rights to access, correct, delete, restrict, object, port, withdraw consent, know about sale or sharing, and avoid discrimination apply where local law provides them. Because Orylin has no account or persistent user database, it may be unable to identify a temporary session record without sufficient non-secret context.