Legal
Privacy Policy
The short version
- We collect only what Orbit needs to work: your username, display name, a hashed password, your profile, and what you post. No email address, phone number, real name or payment details.
- Voice and video calls are end-to-end encrypted in your browser. Text messages and images are encrypted in transit but stored on our server, where they can be read by the server.
- We never sell your data, show ads, or use third-party analytics or trackers.
- Cloudflare carries our traffic and stores uploaded images, and your browser loads our font from Google Fonts. Nobody else gets your data unless the law requires it.
- Data is stored on a server in Sydney, Australia, and with Cloudflare.
- Email privacy@orbithq.chat to get a copy of your data, correct it, or have your account deleted.
Contents
Who we are
Orbit is a chat app for friend groups, available at app.orbithq.chat and as a desktop app. Orbit is run by an individual developer in Australia. In this policy, "we" and "us" means the people who run Orbit.
We aim to handle personal information in line with the Australian Privacy Principles.
What we collect
Your account
- Your username and display name.
- Your password, stored only as a salted scrypt hash. We never store or see the password itself.
- When the account was created.
We do not ask for your email address, phone number, real name, date of birth or payment details.
Your profile
Anything you add to your profile: a profile picture, a banner, pronouns, a status line, the colours you pick, and the badges you choose to show.
What you post
- Messages in server channels, direct messages and group conversations, including replies, reactions and pins. Editing a message replaces the old text; we do not keep an edit history.
- Images you attach, along with the file name you gave them.
- Notes on channel boards.
- Servers, channels, roles, icons and banners you create or change.
How you use Orbit
- Your friends and friend requests, the servers and conversations you are in, your server order and folders.
- Which messages you have read in each channel, so we can show what is unread.
- Invite links you create, and who joined a server through which invite.
- Your Dust balance.
- Your status (online, away, busy or appear offline), which voice channel or call you are in, and when you were last seen. "Last seen" is not updated while you appear offline.
Usage statistics
We count, per person and per year and month: messages sent, time in voice, time in a server's AFK channel, time online, away, busy and appearing offline, Dust earned, and how many people joined through your invites. We also keep day-by-day message and voice counts for about 70 days, then delete them. These are counts and times, not the content of anything you say. Time spent appearing offline is still counted, although nobody else is shown that you are online.
Only the site owner can see these statistics; other Orbit staff cannot. We use them to understand how Orbit is used and for features such as a yearly recap of your time on Orbit.
Technical information
Like any website, our servers receive your IP address and browser details with each request. We use IP addresses to stop abuse, for example by limiting sign-in and sign-up attempts (these counters are kept in memory for a few minutes and are not stored). IP addresses may also appear in server logs, which are kept for a limited time. When an Orbit staff member takes a staff action, their own IP address is recorded with it.
Voice and video calls
Voice, camera and screen sharing in Orbit are end-to-end encrypted. Your browser or the desktop app encrypts what you send before it leaves your device, and the keys are exchanged between the people in the call, each one locked so that only its recipient can open it. Our voice server relays the encrypted media and the locked keys but cannot decode either. If your browser cannot encrypt a call, Orbit will not let you join it unencrypted. We do not record calls.
Our voice server does see who is in a call: your user ID, display name and IP address, when you join and leave, and whether you are sending audio or video. Your IP address is visible to the voice server because media is sent to it directly.
Text messages and images are not end-to-end encrypted. They are protected by HTTPS on the way to us and stored on our server, where the server can read them. We do not read your messages except when we need to deal with abuse, keep the service working, or comply with the law.
Images and link previews
When you upload an image (an attachment, profile picture, banner or icon), Orbit removes its hidden metadata before storing it, including location, camera details and timestamps. The only piece kept is the rotation flag, so photos display the right way up. Images you upload but never send are deleted after about 6 hours.
When a message contains a link to an image, Orbit can show a preview. Our server fetches the image for you, so your browser never contacts the linked site and that site does not learn your IP address. Fetched images are kept in our server's memory for up to an hour. You can turn link previews off in your settings.
Cookies and browser storage
- One sign-in cookie. It keeps you signed in, cannot be read by scripts on the page, lasts 30 days from when you sign in, and is removed when you sign out.
- Settings on your device. Your browser's local storage keeps preferences such as your theme, audio devices and volumes, noise suppression, per-person volumes, screen share settings and whether link previews are on. These stay on your device and are not sent to us.
- Call recovery. While you are in a call, a small note of which call it is is kept in that browser tab so you can rejoin after a reload.
- Offline page. If you install Orbit as an app, it saves a simple "you're offline" page and nothing else.
We use no advertising or tracking cookies. Cloudflare, which carries our traffic, may set its own cookies to protect the site from attacks.
The desktop app
- The desktop app shows the same Orbit web app, so everything above applies to it too. It keeps your sign-in cookie and site data on your computer, just as a browser would.
- It stores its own settings on your computer: whether closing the window keeps Orbit in the tray, whether it starts with Windows, your push-to-talk shortcut, and the window's size and position.
- Push-to-talk registers only the one shortcut you choose with your operating system. It does not record any other keys.
- It checks Orbit's server for updates and downloads them from Orbit's download server, which is served by Cloudflare.
- It does not send crash reports, analytics or telemetry.
How we use it
- To run Orbit: deliver messages, show profiles and presence, connect calls, and remember your settings.
- To keep Orbit safe: limit abuse, enforce bans, and investigate problems.
- To understand how Orbit is used and build features such as a yearly recap.
- To fix bugs and keep the service running.
We do not sell your data, show ads, build advertising profiles, or use third-party analytics or tracking tools.
Who can see what
- Everyone on Orbit can find you by username or display name and see your public profile: username, display name, profile picture, banner, pronouns, status line, colours and badges.
- People you share a server, conversation or friendship with can see your status (online, away, busy) and which voice channel you are in.
- People who can view a channel or conversation can see the messages and images posted there.
- Server owners and moderators can manage their server: delete messages, time out, kick or ban members, and record a reason for a ban.
- Orbit staff can look up accounts and servers (for example, which servers someone is in and how many messages they have sent), end someone's sessions, disable accounts, hide servers from the public directory and disconnect people from voice. Every staff action is recorded in an audit log. Staff tools do not show message content.
- The site owner can also see the usage statistics described above.
Who we share it with
- Cloudflare, our infrastructure provider. All traffic to the Orbit website and app passes through Cloudflare, and uploaded images and desktop app downloads are stored and served by Cloudflare.
- Google Fonts. The Orbit app and this website load their font from Google Fonts, so your browser contacts Google and Google receives your IP address. No Orbit account data is sent to Google.
We share data with nobody else, except where the law requires us to.
Where it is stored
Orbit runs on a server in Sydney, Australia. The database, the voice server and our backups are on that server. Uploaded images and desktop downloads are stored with Cloudflare, and Cloudflare may cache copies in its data centres around the world to serve them quickly. Because Cloudflare operates globally, your data may pass through other countries on the way to us.
How long we keep it
- Your account and profile: until your account is deleted.
- Messages and images: until they are deleted, by you, by a server moderator, or because the server or channel was deleted. A deleted message and its images are removed from our database and storage straight away.
- Sign-in sessions: 30 days from when you sign in, or until you sign out.
- Usage statistics: yearly and monthly totals are kept while your account exists; day-by-day counts are deleted after about 70 days.
- Staff audit log: kept as a record of staff actions.
- Backups: the database is backed up every night, and those backups are deleted after 14 days. The operator also keeps a separate offsite copy of the backups for disaster recovery. Deleted data can remain in backups until they are removed.
Your choices and rights
- Change your profile at any time in your settings, and delete your own messages whenever you like.
- Appear offline to hide your status from other people.
- Turn off link previews in your settings.
- Ask for a copy of the personal information we hold about you, or ask us to correct it.
- Delete your account. Orbit does not have a delete button yet. Email us and we will delete your account and the personal information tied to it, including your messages and images.
Send requests to privacy@orbithq.chat. Because Orbit accounts have no email address, we may ask you to confirm the request from inside your Orbit account. We aim to reply within 30 days. If you are not happy with how we handle a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Security
- All connections to Orbit use HTTPS.
- Passwords are stored only as salted scrypt hashes.
- Voice and video calls are end-to-end encrypted.
- Location and camera metadata is removed from uploaded images.
- The sign-in cookie cannot be read by scripts, and sign-in attempts are rate limited.
- The app runs under a strict content security policy that blocks third-party scripts.
No service can promise perfect security, but we work to keep your information safe.
Children
Orbit is not for children under 13. If we learn that someone under 13 has an account, we will delete it.
Changes to this policy
If we change how Orbit handles your information, we will update this page and its effective date. We will announce significant changes in Orbit.
Contact
Questions or requests about privacy: privacy@orbithq.chat.