Privacy policy

1. Who we are

Orbit is made by Orange Finch, based in Australia ("we", "us"). We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where they apply, other laws such as the GDPR. You can reach us through our contact page.

2. What you keep in Orbit

This means the people you add and what you record about them: names, relationships, birthdays and other dates, notes, gift ideas, places, family, tags, photos and assistant memory.

• On your device: stored in an encrypted database (AES-256) whose key stays in your device's Keychain. Photos have location and other metadata removed and are encrypted.
• iCloud sync (optional, off until you turn it on): stored in your private iCloud database and end-to-end encrypted, with keys in your iCloud Keychain. Only your devices can read it: not Apple, and not us. Apple can see how much you store and when it changes, but not what it says.
• Our servers: never store it. It is only sent off your device if you use the assistant (section 5).
• Contacts: Orbit doesn't ask for access to your contacts. When you pick someone in the system picker, Orbit copies only their name, nickname and birthday, plus their photo if you choose.
• Reminders and widgets: scheduled and built on your device. Notifications hide names unless you choose to show them.

The people in your orbit haven't signed up to Orbit themselves, so please record only what you'd be comfortable with them knowing you wrote down.

3. Your account

You need an Orbit account to use the app. You can sign in with Apple, continue with Google, or use an email and password. If you use Google, Google tells us your email address, name and profile picture link; we keep them with your sign-in details and use only the email. We hold:

• your email address (or the relay address Sign in with Apple provides) and a random account ID
• how you sign in (passwords are stored hashed, never in plain text)
• whether you have Orbit Pro
• device-check keys that help prevent abuse of the assistant, and counts of how often you've used it

We use this to sign you in, give you the features you've paid for and keep Orbit secure. Account data is stored with Supabase in Sydney, Australia.

4. Subscriptions and payments

• In the app: Apple processes your payment. We receive the subscription status, not your card details.
• On this website: RevenueCat runs checkout and Stripe processes the payment. You enter your card on Stripe's form, so we never see your card number. Both receive your email address (for receipts), your billing country and the payment details you enter, and RevenueCat also receives your Orbit account ID.
• RevenueCat keeps the status of subscriptions bought on this website, under your Orbit account ID. The app doesn't use RevenueCat: App Store purchases go from Apple to us directly.

5. The assistant, Opal (Orbit Pro, optional)

Nothing is sent until you turn the assistant on and agree to how it works. When you ask a question:

• Orbit chooses the details relevant to the people in your question and replaces real names with labels like "Person A" on your device.
• May be sent: notes that aren't private, gift history (titles and price ranges), dates (day and month only), trips and ages. Where people live is only sent if you allow it.
• Never sent: private notes, photos, links, addresses, map pins, phone numbers and email addresses.
• The request passes through our server in Sydney, which keeps usage counts but never what you asked, to OpenAI in the United States.
• OpenAI keeps each request and answer for up to 30 days to check for misuse, then deletes them. It doesn't use them to train its models. We also send a code that changes every month so OpenAI can detect abuse. Because we could link it back to your account, we treat assistant content as linked to you.

You can keep any person out of the assistant, choose to review each question before it's sent, see what was shared afterwards, and turn the assistant off at any time.

6. Usage analytics

To understand what works and what doesn't, the app shares a fixed list of events, such as which screens and features are used and whether a purchase or sign-in succeeded, along with the app version, the iOS version and the type of device. It uses PostHog, hosted in the United States.

• It never includes anything you've written, who is in your orbit, how many people you have, or whether you have Pro.
• It uses a random ID for each account on each device. Your IP address isn't kept and no location is derived from it.
• It's on by default. Turn it off any time in Settings with "Share how Orbit is used". When you do, nothing more is sent and the ID is discarded.

Orbit doesn't track you across other apps or websites, and contains no advertising.

7. This website

• Hosting: the site is hosted by Vercel, which runs it in Sydney and serves pages from its global network. Vercel keeps standard server logs, including IP addresses, for security and reliability, for [N] days. [CONFIRM]
• Sign-up and onboarding: creating an account here works as described in section 3. Your onboarding answers only shape the screens you see. They stay in your browser tab and are gone when you close it: they're never stored or sent anywhere.
• Android waitlist: we keep your email address in our own database in Sydney, only to tell you when Orbit is on Android. It's added once you confirm it from the email we send. Unconfirmed addresses are deleted after 7 days, and the whole list is deleted once Android launches. Every email has a link to leave the list.
• Contact form: your name, email and message are sent to our support inbox through Amazon SES in Sydney, only so we can reply. The website doesn't store them. To limit abuse of both forms, we keep a scrambled form of your IP address for up to a day.
• Emails we send: they load our logo from this website. The image is the same for everyone, but loading it tells Vercel an IP address and a time. There are no tracking pixels and links aren't tracked.
• Cookies: the only cookies keep you signed in on the account, sign-up and onboarding pages, plus Stripe's own during checkout. This website runs no analytics and no advertising.

8. Who we share with

We share personal information only with service providers that help us run Orbit, under agreements that limit how they can use it. We never sell it.

Some providers are outside Australia, so your information may be processed overseas. We may also disclose information if the law requires it.

9. Security

Orbit encrypts your data on your device and, when synced, end to end. Connections to our servers use TLS 1.3 with certificate pinning, and the assistant checks that requests come from a genuine copy of the app. You can also lock Orbit with Face ID or your passcode and hide it in the app switcher. No system is perfectly secure, but we design Orbit so that even if our servers were breached, your people wouldn't be exposed, because they're not there.

10. Keeping and deleting data

• We keep your account data for as long as you have an account.
• Delete Account in the app deletes your account from our servers, your iCloud copy and everything on that device.
• Deleting your account on the website removes it from our servers, cancels a subscription bought here and deletes your record at RevenueCat, but can't reach your devices or iCloud. See every step.
• Assistant requests held by OpenAI are deleted within 30 days. Backups of our account database are deleted within [N] days. [CONFIRM]
• Because only you hold the keys, we can't recover your people if you lose all your devices and your iCloud Keychain. Export a copy from Settings if you want a backup.

11. Your rights

You can ask to see or correct the personal information we hold about you, or ask us to delete it. Depending on where you live, you may also be able to object to or restrict how we use it, or ask for a copy in a portable format. Your people are already yours: export them any time in the app. Contact us and we'll respond within 30 days. If you're unhappy with how we've handled your information, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

12. Children

Orbit isn't directed at children under [16]. We don't knowingly collect personal information from them. If you think a child has created an account, contact us and we'll delete it.

13. Changes and contact

If we change this policy, we'll update the date at the top, and for significant changes we'll tell you in the app or by email. Questions? Contact us.