Legal

Privacy Policy

Last updated:

Orbito is built on a simple promise: ask, don't stalk. We don't sell your location, we don't run ads, and every time someone checks on you, you see it in your Ledger.

1. What we collect

• Account: your name and email from Google or Apple Sign-In. On Apple, we accept private-relay email addresses.
• Location: latitude, longitude, accuracy, and timestamp — only while you have location sharing on. Background broadcasting is off unless you enable it.
• Profile: your status text, emoji, ghost-mode preference, and the toggles you've set.
• Circle data: the people you invited or accepted invites from, and the reasons attached to Pings you've sent.
• Payments: if you subscribe to Plus or Family, Stripe (web/Android) or Apple (iOS) processes the payment. We store your subscription tier, cycle, and expiry — never card numbers.
• Diagnostics: anonymized crash logs and app version data. No third-party analytics SDKs.

2. What we don't collect

• Your contact list, photos, microphone, calendar, or any device sensor beyond GPS.
• Advertising IDs. We don't run ads.
• Location history from before you signed up.
• Data from other apps you use.

3. How location is shared

Your live location is visible only to people in your Circles and Constellations that you invited or accepted. Every time one of them opens your marker or requests a Peek, it's logged in your Ledger — Orbito never hides who saw you.

Ghost Mode replaces your live location with the status “Going ghost” — your Circle sees you toggled it, but not where you are.

4. Where the data lives

We host on Emergent Cloud (Kubernetes on GCP, US-East). Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Only two senior engineers have production database access, and every query is audit-logged.

5. Who sees your data

• Your Circle members — only per the visibility rules above.
• Payment processors (Stripe, Apple, RevenueCat) — only what's needed for billing.
• Emergent Cloud — as our hosting provider under a standard data processing agreement.
• No one else. We do not sell, rent, or share your data with brokers, advertisers, or “partners”.

6. How long we keep it

• Live location: last known point only. Older breadcrumbs auto-delete after 7 days (Free), 30 days (Plus), or 10 years (Family).
• Ledger entries: 7 days (Free) or forever (Plus/Family).
• Account records: until you delete your account.

7. Delete anytime

Open the app → Profile → Delete my account. Everything scoped to you (Circles you own, Ledger, streaks, places, breadcrumbs, saved skins) is wiped from our production database within 24 hours. Financial records (payment_transactions) are retained per tax law but stripped of your name and email.

You can also email privacy@orbito.life — we'll do it manually within 3 business days.

8. Your rights (GDPR / CCPA)

You have the right to access, export, correct, or delete any personal data we hold. Email privacy@orbito.life and we'll respond within 30 days.

9. Children

Orbito is intended for people aged 13 and above. Parents can invite children under 13 into a Family Circle with an explicit parental consent flow (rolling out in the Family tier). We do not knowingly collect data from anyone under 13 outside of that flow.

10. Changes

If we materially change this policy, we'll email every active user at least 30 days before the change takes effect and post a diff at orbito.life/privacy.

11. Contact

Privacy questions: privacy@orbito.life
Data-protection officer: dpo@orbito.life
Everything else: hello@orbito.life