Privacy Policy

Contents

• Who we are
• What we collect
• Voice and video calls
• Images and link previews
• GIFs
• Orby, our support assistant
• Server apps
• Your email address
• Cookies and browser storage
• The desktop app
• The Windows app and the Microsoft Store
• How we use it
• Ads, analytics and partners
• Who can see what
• Who we share it with
• Where it is stored
• How long we keep it
• Your choices and rights
• Deleting your account
• Security
• Children
• Changes to this policy
• Contact

Who we are

Orbit is a chat app for friend groups, available at app.orbithq.chat and as a desktop app. Orbit is an independent development project run by an individual developer based in Queensland, Australia. In this policy, "we" and "us" means the people who run Orbit.

We aim to handle personal information in line with the Australian Privacy Principles. The rules for using Orbit are in our Terms of Service.

What we collect

Your account

• Your username and display name.
• Your email address, and whether you have verified it. New accounts give one at sign-up. Older accounts are asked to add one, but do not have to. See Your email address.
• Your password, stored only as a salted scrypt hash. We never store or see the password itself.
• When the account was created.
• Your age group (13 to 15, 16 to 17, or 18 or older), when you told us, and, if you are under 18, that a parent or guardian agreed to the Terms for you. See Your age. We keep the group, not your date of birth, unless you tick "Also use this for my birthday".
• The country your connection was in when you answered the age question (two letters, such as "AU"), as Cloudflare reports it. It is used only to apply a minimum age that the law sets for that country, and it is kept with your account so that it does not change when you travel.
• Whether your account has an age verification flag, when it was set and why (for example, that someone tried again after giving an age we could not accept), and when your age group was last changed by our team. See Your age.
• Which version of the Terms of Service you agreed to, and when.
• Whether you confirmed you are 18 or older (to open age-restricted channels), and when. We don't ask for ID for this. Where the law requires it, we may ask you for information to confirm your age, or use a trusted third-party age verification provider. If that happens, we'll tell you first and collect only what's needed.

We do not ask for your phone number, real name or payment details. We ask for your date of birth once, to work out your age group, and we do not keep it unless you tick "Also use this for my birthday" (see below). The law may also require us to confirm your age (see above).

Birthday (optional). You can add your birthday to your profile if you want servers to celebrate it. We only store it if you add it: the day and month, and the year only if you choose to give it. Your birthday is shared only with the servers you choose, and you can stop sharing at any time. Your birth year is never shown to anyone. Your age is shown only in servers that turn ages on, and only if you also turn on "Show my age". A birthday you add in Edit profile is never used for age checks. If instead you ticked "Also use this for my birthday" when we asked your date of birth (see Your age), that date is your birthday, kept under the same rules (nothing is shared until you choose a server), and your age group is worked out from it; if you remove it, we keep the age group it gave. The only other use is the Dust Orbit pays you on your birthday. After you first save your birthday you can change it for an hour; after that a change is a request that Orbit staff review, and they see the date you asked for. You can remove your birthday at any time in Edit profile, and it is deleted with your account.

Your age

Orbit is for people 13 and older, as the Terms explain. When you sign up, or the first time you use Orbit after we added the question, we ask when you were born (day, month and year). We use it for one thing: to work out your age group. We then keep only the group and when you told us, and we do not keep your date of birth, in our database or in our logs, unless you tick "Also use this for my birthday" under the question (it is off unless you tick it). If you do, your date of birth becomes your birthday (see Birthday below), and your age group is worked out from it from then on. If you are 13 to 17, we also ask you to confirm that a parent or guardian has agreed to the Terms for you, and we keep that you did.

If you tell us you are under 13 when you sign up, we do not make an account for you. If we decide that someone under 13 has an account, for example because a parent tells us, we delete it straight away, without a waiting period or an email. Their messages stay, shown as "Deleted user". We keep only a note of who deleted the account and why, not the account's name or email address.

In some places the law may set a higher minimum age, for example 16 in Australia. Where we apply one, we read the country that Cloudflare, which carries our traffic, reports for your connection when you sign up or answer the age question, and we keep that country with your account (our team can correct it). We do not look at your country again when you travel or use a VPN. If you are under the minimum age for your country, we do not make an account for you. An account that is already open is locked: you can still sign in to download a copy of your data, and the account is deleted after 14 days, when any servers it owned pass to their longest-standing member or are deleted if nobody else is in them. Our team can unlock an account if the country was wrong. We never lock staff accounts or the site owner's for this reason.

If someone gives an age we cannot accept and then tries again with a different one, we let them in but flag the account for age verification. We record when it was flagged and why (that they tried again), never the dates they entered. A flagged account cannot open age-restricted channels, confirm it is 18 or older, or change its own age group until our team clears the flag after checking the person's age with them by email. We do not ask for or keep ID documents in Orbit.

You can move yourself up an age group in Settings, My account. If your age group is wrong the other way, or a minimum age is stopping you, contact us.

Your devices

For each device you are signed in on, we keep the browser and system name (worked out from what your browser reports, for example "Firefox on Linux") and when it was last used. This lets you see your devices and sign them out in Settings, My account. It is kept for as long as that sign-in lasts. We also keep a record of each sign-in attempt to your account, successful or not: when it happened, the IP address it came from, the approximate location worked out from that address (country, and city when our network provider reports one), the device and browser, and whether it was the Orbit website, the installed app or the desktop app. We use it to keep your account safe: when someone signs in with your password from a device we don't know and a country or network your account hasn't used in the last 90 days, we pause the sign-in and email you to check it was you. We also use it to look into abuse. Password reset and email change requests are recorded the same way. You can see your recent sign-ins, with their approximate location and device but not the IP address, in Settings, My account.

To send new sign-in alerts, we also remember which browsers your account has signed in from before, using the device cookie described below. A browser your account has not used for 180 days is forgotten.

Your profile

Anything you add to your profile: a profile picture, a background, pronouns, a status line, an About me, the colours you pick, and the badges you choose to show.

What you post

• Messages in server channels, direct messages and group conversations, including replies, reactions and pins. Editing a message replaces the old text; we do not keep an edit history.
• Images you attach, along with the file name you gave them.
• GIFs you send. With a GIF message we keep only the GIF's KLIPY id, its size and its title. See GIFs.
• Notes on channel boards.
• Servers, channels, roles, icons and backgrounds you create or change.

How you use Orbit

• Your friends and friend requests, the servers and conversations you are in, your server order and folders.
• Which messages you have read in each channel, so we can show what is unread.
• Invite links you create, and who joined a server through which invite.
• Your Dust balance.
• Your status (online, away, busy or appear offline), which voice channel or call you are in, and when you were last seen. "Last seen" is not updated while you appear offline.

Usage statistics

We count, per person and per year and month: messages sent, time in voice, time in a server's AFK channel, time online, away, busy and appearing offline, Dust earned, and how many people joined through your invites. We also keep day-by-day message and voice counts for about 70 days, then delete them. These are counts and times, not the content of anything you say. Time spent appearing offline is still counted, although nobody else is shown that you are online.

We may also measure how well Orbit performs and which features are used, for example errors and failed actions, connection drops, load times, and the device, browser and app types people use. This is described in Ads, analytics and partners. It would be first-party only, and not the content of anything you say.

Only the site owner can see these statistics; other Orbit staff cannot. We use them to understand how Orbit is used and for features such as a yearly recap of your time on Orbit.

Technical information

Like any website, our servers receive your IP address and browser details with each request. We use IP addresses to stop abuse, for example by limiting sign-in and sign-up attempts. Sign-in attempts, including ones that were stopped for being too frequent and attempts at an address or username that has no account, are kept in the sign-in record described above. For an attempt at an address or username with no account, we keep only a scrambled (hashed) form of what was typed, so staff can look up attempts at an address they are given but cannot read it from the record. IP addresses may also appear in server logs, which are kept for a limited time. When an Orbit staff member takes a staff action, their own IP address is recorded with it.

Voice and video calls

Voice, camera and screen sharing in Orbit are end-to-end encrypted. Your browser or the desktop app encrypts what you send before it leaves your device, and the keys are exchanged between the people in the call, each one locked so that only its recipient can open it. Our voice server relays the encrypted media and the locked keys but cannot decode either. If your browser cannot encrypt a call, Orbit will not let you join it unencrypted. We do not record calls.

Our voice server does see who is in a call: your user ID, display name and IP address, when you join and leave, and whether you are sending audio or video. Your IP address is visible to the voice server because media is sent to it directly.

Text messages and images are not end-to-end encrypted. They are protected by HTTPS on the way to us and stored on our server, where the server can read them. We do not read your messages except when we need to deal with abuse, keep the service working, or comply with the law.

Images and link previews

When you upload an image (an attachment, profile picture, background or icon), Orbit removes its hidden metadata before storing it, including location, camera details and timestamps. The only piece kept is the rotation flag, so photos display the right way up. Images you upload but never send are deleted after about 6 hours.

When a message contains a link to an image, Orbit can show a preview. Our server fetches the image for you, so your browser never contacts the linked site and that site does not learn your IP address. Fetched images are kept in our server's memory for up to an hour. You can turn link previews off in your settings.

GIFs

GIFs come from KLIPY, using KLIPY's standard setup. When you open the GIF picker or view a GIF, your browser connects to KLIPY directly. KLIPY receives your IP address, any words you type into the GIF search, and the standard details your browser sends with any request (such as its type and language). KLIPY handles this under its own privacy policy (klipy.com/support/privacy-policy). Orbit's servers are not in between, and Orbit sends KLIPY no user ID, username or other account details. Your browser contacts KLIPY at api.klipy.com and loads GIFs from static.klipy.com, static1.klipy.com and static2.klipy.com.

With a GIF message, Orbit keeps only the GIF's KLIPY id, its size and its title, not its address. Orbit does not store your GIF searches. KLIPY's ads are switched off for Orbit, so the GIF picker shows no ads.

GIFs you favourite are saved to your account as a reference (KLIPY's name for the GIF, its size and its title), not a copy. They are deleted if you remove them from your favourites or delete your account.

To stop your browser contacting KLIPY at all, turn off Show GIFs in Settings. It is on by default. With it off, the GIF picker is hidden and GIFs in chat show their title instead of loading, unless you choose to open one. A server owner can also turn GIFs off for their server.

Orby, our support assistant

Orby is a robot that answers questions about how to use Orbit. She lives only in Orbit's official server. She is never in direct messages or in anyone else's server.

When something is sent. Only when someone mentions Orby in a channel of the official server, or when a moderator or support member asks Orby to answer a message there. In the second case the author of that message did not mention her, and other members are not shown which staff member asked. Messages in channels where neither happens, in other servers and in direct messages are never sent anywhere.

What is sent. The question (or the message a staff member asked her to answer), the up to 16 most recent messages in that channel before it (including messages from other people), with the display name of whoever wrote each one, and the sections of Orbit's own help text that match the question. Orbit does not add your email address, account details or anything from other channels. Anything typed in the messages themselves, including an email address someone writes out, is sent as written. If the person who asked cannot read the channel's message history, only their question is sent.

Who receives it. Cloudflare Workers AI, which writes the answer for us. Cloudflare acts as our processor: it handles this data to provide the service to us. Cloudflare's documentation says that Cloudflare "does not retain inputs or outputs after they are no longer needed to process the request and deliver the response" and that "Cloudflare does not use Customer Content processed by Workers AI to train AI models". It may keep operational metadata to run, secure and bill for the service, and that metadata does not include the content. See Cloudflare's Workers AI data usage page.

What Orbit keeps. Orby's reply is an ordinary message in the channel, so it is stored and can be seen like any other message there. Orbit's own logs record errors only, never message content.

How to avoid it. Anything posted in the official server's channels may be sent if someone mentions Orby or a moderator asks her to answer, so do not post anything there you would not want processed this way. Messages in other servers and in direct messages are never sent.

Orby, our support assistant. In the official Orbit server, Orby answers questions when someone mentions her, or when a moderator or support member asks her to answer a message. To write an answer, we send the question and, when everyone in that channel can read its history, up to the 16 most recent earlier messages of that channel (each shortened to 500 characters), together with the display names of the people who wrote them, to Cloudflare Workers AI, which processes them for us as a service provider. This includes messages from people who did not ask Orby anything. We never send direct messages or messages from other servers. We do not keep the text we send or Orby's prompts. We keep a record of who asked Orby, when, which message they asked about and what the answer cost, so we can limit use and prevent abuse; we delete these records after 90 days, and when you delete your account your identifier is removed from them straight away. Orby is an AI and can be wrong. For a person, email support@orbithq.chat.

Server apps

A server's owner can turn on built-in apps: Polls and events, Counting, Starboard, Birthdays and Giveaways. They run inside Orbit, so nothing they hold is sent to anyone outside Orbit. When you take part, Orbit keeps:

• Polls and events: your votes, your answers to events (going, maybe or can't go), and the events and polls you create. If a poll hides who voted, other people see only the totals, but Orbit still stores your vote so you can change it. For an event in a voice channel, Orbit records how long you spent in that channel while the event was on, and the host can tick who attended. This attendance is kept with the event.
• Counting: how many numbers you have counted in the server's counting channel and how many times you broke the count.
• Starboard: when a message gets enough stars, the app reposts it, with its author's name, in the server's starboard channel. The repost is removed when the original message is deleted.
• Birthdays: the app uses the birthday on your profile only in the servers you chose to share it with, and keeps which servers those are. See What we collect.
• Giveaways: your entries. When a giveaway starts, Orbit checks who meets its entry rules, using what Orbit already knows about you in that server (such as your roles, when you joined, how many messages you have sent there, time in voice, whether your email is verified and how old your account is), and keeps only the list of people who qualified, not those facts. Each draw keeps a record of who was drawn from and who won. The server sees a plain record (how many entered, when, and who won). The random seed and the list behind a draw can be seen only by Orbit administrators, to settle disputes.

Prize codes. Prize codes that a server stores for its giveaways are encrypted, and no Orbit screen, tool or staff member can see them: only the winner sees their code, when they redeem it, and it is deleted for good when they mark it claimed, when the server deletes the prize, or when the winner's account is deleted. This is not end-to-end encryption: whoever operates Orbit and holds both the encryption key and the database could, in principle, decrypt codes that have not yet been claimed. Our database backups hold only the encrypted codes, and are deleted after 14 days. A prize's record keeps its name, who won it and when, never the code.

Exclusions. The people who manage an app in a server can exclude someone from it, with an optional end date and a note. You are told you have been excluded when you try to use the app, but never the note or who added it.

The server's owner and the people they allow can see and manage the app's settings and what it posts. Everything an app keeps about you in a server is deleted when the server is deleted, and your votes, answers, attendance, counts, entries and exclusions are deleted when your account is. Giveaway results and draw records stay, so a giveaway can still be checked afterwards, with your name shown as "Deleted user".

Your email address

We use your email address for three things only: signing in (with your username or your email), recovering your account if you forget your password, and sending you security emails. We never use it for marketing, newsletters or ads, and other people on Orbit never see it.

Verifying your email

To verify an address, we send it a 6-digit code that works for 15 minutes, or a link that works for 24 hours.

Until your email is verified, you can use Orbit normally in private servers and direct messages, but you cannot send messages, react, upload images into chat or join voice in public servers (the ones listed on Discover). This helps keep spam and abuse out of public spaces. It applies to new accounts, and to older accounts once they add an email. We may later apply it to every account without a verified email.

Security emails we send

• Your verification code or link.
• Password reset links, which work for 1 hour.
• A notice that your password was changed.
• A notice that your email was changed. This goes to your old address, with a link to undo the change that works for 7 days.
• A new sign-in alert when your account signs in from a device it has not seen before. It names the device and browser only (for example "Chrome on Windows") and the time. It does not include a location.
• Account deletion notices: one when a deletion is scheduled, and a final receipt when it is done.

Codes and links are stored only as one-way hashes, so they cannot be read back from our database. They are deleted about a day after they expire or are used.

Who delivers our email

Emails are sent through Resend, an email delivery service based in the United States, which uses Amazon SES to deliver them. Resend receives your email address and the content of each email we send you. This means your email address is sent outside Australia.

If an email we send you bounces or is reported as spam, Resend tells us. We keep that report, with a scrambled (hashed) form of the address and a link to your account, for 90 days, so we can work out why our emails aren't reaching you.

Cookies and browser storage

• The sign-in cookie. It keeps you signed in, cannot be read by scripts on the page, lasts 30 days from when you sign in, and is removed when you sign out. The session token it holds is stored on our side only as a hash.
• The age cookie (orbit_age_block). Set only when you tried to sign up and we could not accept the age you gave. It holds one word and no personal information, cannot be read by scripts on the page, and lasts 24 hours. If that browser then signs up again, we let it, but we ask the person to confirm their age with us before they can open age-restricted channels.
• The device cookie (orbit_device). A random value that cannot be read by scripts on the page and lasts up to 400 days. It is used only to recognise a browser your account has signed in from before, so we know when to send a new sign-in alert.
• Settings on your device. Your browser's local storage keeps preferences such as your theme, audio devices and volumes, noise suppression, per-person volumes, screen share settings and whether link previews are on. These stay on your device and are not sent to us.
• Call recovery. While you are in a call, a small note of which call it is is kept in that browser tab so you can rejoin after a reload.
• Offline page. If you install Orbit as an app, it saves a simple "you're offline" page and nothing else.

We use no advertising or tracking cookies, except any set by an ad partner when you choose to watch one of its ads (see Ads, analytics and partners). Cloudflare, which carries our traffic, may set its own cookies to protect the site from attacks.

The desktop app

• The desktop app shows the same Orbit web app, so everything above applies to it too. It keeps your cookies and site data on your computer, just as a browser would.
• It stores its own settings on your computer: whether closing the window keeps Orbit in the tray, whether it starts with Windows, your push-to-talk shortcut, and the window's size and position.
• Push-to-talk registers only the one shortcut you choose with your operating system. It does not record any other keys.
• Updates come from the Microsoft Store, not from Orbit. The app asks the Store whether an update is available and the Store installs it. See The Windows app and the Microsoft Store.
• The desktop app itself does not send crash reports, analytics or telemetry. Orbit's measurements, if any, are described in Ads, analytics and partners. Windows or Microsoft may report crashes for the app under Microsoft's privacy statement.

The Windows app and the Microsoft Store

• Microsoft handles the download. The Windows app ("Orbit Chat") is distributed only through the Microsoft Store. Microsoft runs the download, installation and updates, and may collect information about them, such as device and diagnostic data and records of your download, under Microsoft's privacy statement and your Windows diagnostic settings. Orbit does not control that.
• What Orbit receives from Microsoft. Only aggregated reports that do not identify you, such as install counts, which link or campaign an install came from, ratings, and crash and error data for the app. Crash data can include technical details such as stack traces, but it is not tied to your identity. Orbit does not receive your Microsoft account details.
• Store links. Our website's Store links carry a campaign tag (for example cid=hero-web) so Microsoft's reports can show which link installs came from. This is aggregate only.
• Inside the app, Orbit handles your data exactly as described in the rest of this policy. The app keeps its own settings on your computer and asks the Microsoft Store whether an update is available. If you share your screen, only what you pick is captured, and Orbit sends nothing from it to Microsoft.
• Store reviews you leave are public on Microsoft's site.

How we use it

• To run Orbit: deliver messages, show profiles and presence, connect calls, and remember your settings.
• To let you sign in with your email, recover your account, and send you security emails.
• To keep Orbit safe: limit abuse, enforce bans, and investigate problems.
• To understand how Orbit is used and build features such as a yearly recap.
• To fix bugs and keep the service running.

We do not sell your data, build advertising profiles from your messages, or use third-party analytics or tracking tools. See Ads, analytics and partners for how ads and analytics work.

Ads, analytics and partners

Ads

Orbit may display ads. Where ads appear, they will not hinder or degrade your overall experience. Most ads are Orbit's own, for example promoting Orbit features. We never use the content of your messages, direct messages or uploads to target ads, and we never sell your data.

Optional third-party ads

Orbit may offer ads from a third-party ad partner (for example Google AdSense or a similar network) that you can choose to watch, for example in exchange for Dust, Orbit's earned currency. These are entirely user-initiated. Nothing from the partner loads unless you choose to watch one.

When you do, the partner may receive device and browser information and your IP address, and may set cookies or similar identifiers under its own privacy policy. Where the law requires consent (for example under the GDPR and ePrivacy rules in Europe), we will ask for it first. Declining has no effect on anything else in Orbit.

Analytics

We may measure how Orbit is used and how well it performs, for example errors and failed actions, connection drops, load times, device, browser and app types, and which features are used. This is first-party only: we do not use third-party analytics or trackers. The usage statistics we keep now are described in What we collect.

Partners

You can see our current ad and analytics partners on our partners page.

Who can see what

• Everyone on Orbit can find you by username or display name and see your public profile: username, display name, profile picture, background, pronouns, status line, About me, colours and badges. Your email address is never shown to other people.
• People you share a server, conversation or friendship with can see your status (online, away, busy) and which voice channel you are in.
• People who can view a channel or conversation can see the messages and images posted there.
• Server owners and moderators can manage their server: delete messages, time out, kick or ban members, and record a reason for a ban. The people who manage a server's apps can also exclude someone from an app (see Server apps).
• Orbit staff can look up accounts and servers (for example, which servers someone is in and how many messages they have sent), end someone's sessions, disable accounts, hide servers from the public directory and disconnect people from voice. Orbit administrators can also open a giveaway's draw record to settle a dispute. Every staff action is recorded in an audit log. Staff can see your sign-in record and email delivery reports, but not the IP addresses in it. Only Orbit administrators can see the IP address of a sign-in, one at a time, and each time they must give a reason, which is recorded in the audit log. Staff tools never show prize codes, and do not show message content except for moderation and safety: when a message, file or profile is reported to us or sent to us for review (for example by email with a link), staff can see it, remove it and keep a copy in our records. Any message can be reported, including in direct messages and group conversations. A reported message may be saved together with the messages sent in the same conversation in the 30 minutes before it, so we can understand what happened. Apart from that, staff cannot read or monitor your conversations.
• The site owner can also see the usage statistics described above.

Who we share it with

• Cloudflare, our infrastructure provider. All traffic to the Orbit website and app passes through Cloudflare, and uploaded images are stored and served by Cloudflare.
• Cloudflare Workers AI, our processor for Orby, our support assistant. When someone mentions Orby in the official server, or a moderator or support member asks her to answer a message there, that message and the recent messages in that channel are sent to it to generate an answer. See Orby, our support assistant.
• Resend, our email delivery service in the United States (using Amazon SES). It receives your email address and the emails we send you. See Your email address.
• KLIPY, the GIF service. When you open the GIF picker or view a GIF, your browser contacts KLIPY directly and KLIPY receives your IP address, search words and standard browser details. You can turn this off with Show GIFs in Settings. See GIFs.
• Google Fonts. The Orbit app and this website load their font from Google Fonts, so your browser contacts Google and Google receives your IP address. No Orbit account data is sent to Google.

If the law ever requires us to verify your age, we may share only the information needed for that with an age verification provider, and only for that purpose. We would tell you first. We do not use one today.

We share data with nobody else, except where the law requires us to and except an ad partner when you choose to watch one of its ads (see Ads, analytics and partners). We never share your messages or uploads with anyone for advertising.

Where it is stored

Orbit and its database run on a server in Sydney, Australia. Nightly database backups and copies of uploaded images are also copied to a separate, secure backup server operated by Orbit in Brisbane, Australia. All backups are kept for at most 14 days. The voice server runs on the Sydney server.

Uploaded images are stored with Cloudflare in its Oceania region and delivered through Cloudflare's worldwide network, so copies may be cached temporarily in Cloudflare data centres outside Australia. Because Cloudflare operates globally, your data may also pass through other countries on the way to us.

Your email address and the contents of the account emails we send you are processed by Resend, which may process them outside Australia, for example in the United States. Your browser may also load our font from Google Fonts. If you use GIFs, your browser contacts KLIPY directly. KLIPY runs its own servers and handles that information under its own privacy policy (see GIFs).

Where we disclose personal information to an overseas provider such as these, we take reasonable steps in line with Australian Privacy Principle 8 to make sure it handles that information appropriately.

How long we keep it

• Your account, profile and email address: until your account is deleted. After the final deletion receipt is sent, your email address is forgotten, or longer where the law requires us to keep it (see Deleting your account).
• Messages and images: until they are deleted, by you, by a server moderator, or because the server or channel was deleted. A deleted message and its images are removed from our database and storage straight away, unless they were reported to us or removed by Orbit staff. Then a copy is kept in our moderation records for up to 24 months, so the report can still be checked and appealed, and longer only where the law requires it. If you delete your account, your messages stay, shown as "Deleted user", unless you choose to delete them all.
• Sign-in sessions and device names: 30 days from when you sign in, or until you sign out.
• Known devices for sign-in alerts: forgotten after 180 days without use.
• Sign-in record (sign-in attempts, password reset and email change requests, with IP address and approximate location): 90 days, and deleted with your account.
• Email bounce and spam reports: 90 days, and deleted with your account.
• Verification codes and email links: about a day after they expire or are used.
• Usage statistics: yearly and monthly totals are kept while your account exists; day-by-day counts are deleted after about 70 days.
• Your 18+ confirmation: kept with your account until it is deleted.
• Server apps: until the server deletes it (an event, a poll, a prize) or the server is deleted, and your own votes, answers, attendance, counts, entries and exclusions until your account is deleted. Prize codes are deleted as described in Server apps.
• Your birthday: until you remove it or your account is deleted, and then it is deleted straight away along with which servers it was shared with. If you removed a birthday you had saved for more than an hour, we keep only the time you first saved it (no date) so that adding one again is reviewed.
• Records of who asked Orby: 90 days. When you delete your account, your identifier is removed from them straight away.
• Staff audit log: kept as a record of staff actions.
• Backups: the database is backed up every night. All backups, including the offsite copy, are kept for at most 14 days, so a deleted account is gone from every backup within 14 days of deletion.

Your choices and rights

• Change your profile at any time in your settings, and delete your own messages whenever you like.
• Appear offline to hide your status from other people.
• Add, share or remove your birthday in Edit profile. Nothing is shared until you choose a server, and you can stop sharing, or hide your age, at any time.
• Turn off link previews in your settings.
• Turn off GIFs with Show GIFs in your settings, so your browser does not contact KLIPY.
• See and sign out your devices in Settings, My account.
• Change your email address in your settings. We let your old address know, with a link to undo the change.
• Download a copy of your data in Settings, My account, under Your data. It is one file with your account details (username, display name, pronouns, status text, About me and when you joined), the servers you are in and when you joined each, your favourite GIFs (the GIF's name at KLIPY, its title and when you starred it, never the picture), what server apps keep about you (see Server apps: your birthday and where you shared it, your votes and event answers, attendance, counts, giveaway entries and wins and the status of prizes you won, never a code, and exclusions that name you, without their note), and the text of the messages you wrote, with when and where you wrote them. You can download it three times a day. You can also email us for a copy.
• Ask for a copy of anything else we hold about you, or ask us to correct it.
• Delete your account yourself in Settings, My account. See Deleting your account.

Send requests to privacy@orbithq.chat, for example under the Australian Privacy Act or the GDPR. We may ask you to confirm the request from your account's email address or from inside your Orbit account. We aim to reply within 30 days. If you are not happy with how we handle a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Deleting your account

• You can delete your account yourself in Settings, My account. Step-by-step instructions, and how to ask by email if you cannot sign in, are on the Delete your account page.
• By default there is a 14-day grace period. Your account is signed out everywhere and scheduled for deletion. If you sign in during those 14 days, the deletion is cancelled. You can also choose to delete it straight away.
• Before you delete your account, any servers you own must be handed to another member or deleted.
• Your messages are kept and shown as "Deleted user", with no name or picture, unless you choose to delete them all.
• Your profile, pictures, badges, email address, friends, sessions and devices are removed. Your username stays reserved for 30 days after the account is deleted, so nobody can take it straight away and pretend to be you; after that, someone else can use it. To enforce this, we keep a scrambled (hashed) form of the username for those 30 days, then delete it.
• When the deletion is done, we send a receipt to your email address, and then forget the address.

You can also ask us to delete your account by emailing privacy@orbithq.chat, for example under the Australian Privacy Act or the GDPR. Orbit staff can then erase it straight away through the same process, and send a notice to the account's email address if it has one.

All backups, including the offsite copy, are kept for at most 14 days, so a deleted account is gone from every backup within 14 days of deletion.

When we can't delete straight away. If we're legally required to keep information, for example because police or a court have asked us to preserve it, or because we've reported a serious matter such as child sexual abuse material to the authorities, we may pause deletion of the account, or keep the specific information involved, until that obligation ends. We keep only what's needed, restrict access to it, and delete it once we're allowed to. You can still ask us about your account at support@orbithq.chat.

Security

• All connections to Orbit use HTTPS.
• Passwords are stored only as salted scrypt hashes. Session tokens, verification codes and email links are stored only as hashes too.
• Voice and video calls are end-to-end encrypted.
• Location and camera metadata is removed from uploaded images.
• The sign-in and device cookies cannot be read by scripts, and sign-in attempts are rate limited, and a sign-in from a new device and place has to be approved from your email.
• We email you when your account signs in from a new device, or when your password or email address changes.
• The app runs under a strict content security policy that blocks third-party scripts.

No service can promise perfect security, but we work to keep your information safe.

Children

You must be at least 13 to use Orbit. If you're under 18, or under the age of majority where you live, a parent or guardian must agree to our Terms of Service for you. Where the law requires it, we may set a higher minimum age in some places. For example, in Australia we may be required to keep people under 16 off Orbit. We may ask you to confirm your age, and we may close accounts that don't meet the minimum age for where the account holder lives. If we learn that someone under 13 has an account, we will delete it.

Age-restricted channels are for people 18 or older. We ask you to confirm that you are, and we don't ask for ID for this. Where the law requires it, we may ask for information to confirm your age, as described in What we collect.

Changes to this policy

If we change how Orbit handles your information, we will update this page and its effective date. We will announce significant changes in Orbit.

Contact

Questions or requests about privacy: privacy@orbithq.chat.