Your friends' words are not our content.

Orbit is built for small private circles. We minimize what leaves your device, protect what the shared service must hold, and never use answers for advertising or model training.

Effective August 4, 2026

What stays on your device

Your original birth date, time, place, precision choice, and unfinished answer drafts are stored only on your device. Orbit does not request Contacts or Location access and does not upload your address book.

What the shared service stores

To run a circle, Orbit stores your account state, a circle display name, invitation status, notification preferences, sealed answers, fixed reactions, reports, and deletion or export state. Answers and display names are server-encrypted at rest and encrypted in transit. Orbit's service can decrypt an answer only when authorized behavior requires it, so this is not end-to-end encryption.

Operational metadata

We use body-free operational metadata such as an event type, broad latency bucket, error code, build, and queue status to keep Orbit reliable and measure completed mutual reveals. We do not put questions, answers, birth information, invite codes, friend identities, or free text into analytics, queues, delivery receipts, or logs.

Service providers and tracking

Cloudflare provides the API, encrypted storage, queues, and recoverable workflows. Apple provides Sign in with Apple and notification delivery. Orbit has no advertising SDK, cross-app tracking, contact matching, remote font, social pixel, or runtime generative AI service.

Retention, export, and deletion

Unused invites expire after seven days or sooner when revoked.
An account export is encrypted, available once, and expires after 24 hours.
An export excludes another friend's answer unless that author explicitly allowed it.
Deleting an account immediately revokes Orbit sessions and removes live access.
Orbit also attempts to revoke the related Apple authorization before erasing the stored credential. If Apple is temporarily unavailable, deletion remains visibly pending and retries.
Encrypted disaster-recovery copies may remain inaccessible in Cloudflare recovery storage for up to 30 days and are guarded against restoration into production.

Your choices

You can delete your own answer, leave or block within a circle, report an answer, request an export, or delete your account from the app. Removing the app clears device-only data according to iOS storage behavior. For help or an accessibility request, visit Orbit Support.

Age and changes

Orbit is for adults age 18 and over. Material policy changes will be shown in the app before they take effect; we do not silently expand how private answers are used.