Privacy Policy

Information We Collect

When you create an Orbit AI account, the service stores your email address, optional name, a one-way password hash and salt, account status, policy acceptance, verification state, and security records. Depending on how you use Orbit, it also stores profile and locality details, posts and media, comments, reactions, follows, reposts, collections, events and attendance, reviews, collaborations, organizations, offers and loyalty activity, reports and appeals, notification preferences, generated workspace content, and native product analytics.

Orbit is a first-party social ecosystem. It does not connect to, publish to, or continuously import data from outside social networks. Historical marketing-workflow and connector records from earlier versions are quarantined, are not used by the active product, are excluded from production readiness, and are removed with the associated account except where law requires limited retention.

Social, Safety, and Analytics Data

Public profiles and content are visible according to the audience and status controls shown in the product. Blocks, mutes, hidden-post choices, reports, moderation actions, notification delivery state, and abuse-prevention signals are processed to keep the community usable and safe. Reports are not disclosed to the reported person merely because they request an export.

Orbit records first-party events such as views, follows, reactions, comments, reposts, saves, RSVPs, offer saves, and offer redemptions to operate the service and provide native analytics. Orbit does not use third-party advertising pixels or sell this activity to data brokers.

Pulse begins only when a customer activates it. Orbit processes the selected category, time window, audience-suitability preference, radius, coarse market, matching results, and limited result interactions to find first-party Orbit events and improve the feature. A one-time location may be used for the requested match, but exact coordinates and free-form searches are not stored. A customer may separately opt a saved-locality Pulse into fixed, completed-week community planning reports; that choice does not change matching results and can be withdrawn while the Pulse is active. One-time-location Pulses do not contribute to business reports. Businesses receive threshold-protected sample bands and grouped trends, never customer identities, raw searches, exact locations, exact activation times, or permission to contact individual customers.

Cookies and Security Data

The service uses Secure, HttpOnly cookies to keep users signed in and protect account actions from request forgery. Raw passwords are not stored. Session, verification, reset, and challenge tokens are stored server-side only as one-way hashes. Device labels, user-agent information, and hashed network identifiers may be processed for session management, rate limiting, suspicious-login detection, abuse prevention, and incident response.

If enabled, authenticator-app secrets are encrypted at rest and passkey public keys are stored for authentication. Orbit never receives the private key held by your authenticator.

Storage and Service Providers

Cloudflare hosts the website, database, and first-party media storage. When transactional email is configured, Resend processes verification, password-reset, deletion-request, and security-alert messages. An AI service provider may process the prompt and context needed for an AI feature you intentionally invoke. Providers process information only to deliver, secure, or support Orbit under their applicable terms.

Payment Information

Customer signup and available customer social features are free, and businesses begin with a free profile. Payment processing is launch-locked, and the public beta does not collect payment-card details. Staged business plan information is restricted to authenticated owners with a completed business profile. If an optional paid business service launches later, Orbit will identify the payment provider and update the applicable purchase terms and privacy notice before accepting payment.

How Information Is Used

Information is used to authenticate users, operate the native social graph, deliver content and notifications, personalize discovery, provide analytics, enforce limits, investigate safety reports, prevent abuse, support users, and maintain service reliability. NovaOrbital LLC does not sell account information.

Retention, Export, and Deletion

Active account content is retained while the account remains open and as reasonably needed to operate Orbit. Expired authentication challenges and delivery records are retained only for bounded security and operational purposes. Backups may preserve encrypted snapshots for a limited disaster-recovery period and are not restored selectively for ordinary product use.

Normalized account-linked Pulse sessions are retained for no more than 90 days. Privacy-thresholded weekly Pulse snapshots may be retained for no more than 365 days. Account deletion removes account-linked Pulse sessions; a previously generated aggregate may remain only when it no longer identifies or links back to an account and continues to satisfy the published privacy threshold.

The Account & Security page lets a signed-in user download an account-linked JSON export, manage sessions, change a password, and permanently delete the account. The JSON export includes first-party records and media metadata, but it does not embed the binary media files or authentication secrets. Download any media you want to keep before deletion.

Authenticated deletion removes the account and dependent user content from the database and deletes associated objects from first-party media storage. Orbit retains only a minimal, non-linkable deletion audit when needed to prove the request was completed. A public deletion-request form is available when you cannot sign in; support may need to verify account ownership before completing it.

Your Choices

You can edit profile information, control notifications, block or mute accounts, hide content, submit or withdraw eligible reports and appeals, revoke sessions, and request access, correction, or deletion. Some records may be retained where required by law, to protect other users, or to establish or defend legal claims.

Children

Orbit is not directed to children under 13, or a higher minimum age where local law requires one. Do not create an account if you are not legally eligible to use the service.

Contact

Use the Account & Security page first. For privacy questions or a deletion request when you cannot sign in, contact [email protected]. Never send a password, authenticator code, recovery token, or passkey credential.