Privacy

What Orbit knows about you

Orbit shares your family’s location, so it handles sensitive data. Here is exactly what we hold, what we do not, and how long we keep it.

What we collect

• Your account: an email address, a display name, and your password scrambled in a way that cannot be turned back. We never store the password itself, and nobody here can read it.
• Your loops: which ones you are in, your role in each, and whether you are sharing right now.
• Your loop's places: a name, a centre, a radius, and the street address of that centre, which your phone looks up when the place is saved. The address says nothing the centre does not; it is kept so the app can show a street instead of coordinates, and it goes only to the loop's members. An Android watch that reports by itself also keeps the centre and radius of each place it can arrive at, and nothing else about them, so it can notice crossing an edge with its app closed.
• Your position: latitude, longitude, accuracy, altitude, speed, heading, battery level, whether you are charging, and the time your device recorded them. Your phone measures speed, heading and altitude itself, at the same moment it works out where it is, and sends them along with the position.
• Your drives, if your loop turns them on: off unless somebody switches it on. While it is off we never work out that you drove anywhere, so there is nothing kept and nothing hidden. With it on, we keep where each drive started and ended, how far it went, how long it took, and the top speed. Never the route, so not the roads you took and not where you stopped along the way. Whoever the drives are about can see them, and can see who switched it on.
• Your devices: a name, the platform, and a token so notifications can reach you.

What we do not

• No driving score, no ranking, and nothing sent to an insurer. Speed is in the list above, so we are not going to pretend we cannot tell how fast you went. We just never turn it into a rating, and none of it leaves your loop.
• Someone who supervises a member of their loop can set a speed limit for them and be told if a drive goes over it. A person chooses that, not us. The member sees the limit and who set it, and it stays inside the loop.
• No contacts, photos, microphone, or browsing history.
• No advertising, analytics, or tracking SDKs in the apps.
• No fingerprinting or tracking on this website.

How long we keep it

Locations are kept for 2 days and then deleted automatically. Your latest position is cached for up to 24 hours so the map loads fast, and it goes the moment you pause sharing.

Two things outlast that window, because neither one is a position: the timeline of what happened, and any drives a loop records. Both say something took place and where it started or ended. Neither holds the trail in between, which is the whole reason they are allowed to stay, and why the 2-day promise can be as short as it is.

They do not outlast it indefinitely. The timeline is kept for 14 days and then deleted automatically, the same way locations are. A single arrival says little; a permanent list of them is a record of somebody’s week, and that is not a thing worth keeping after the point where anybody would look at it.

Your account also keeps a list of the changes that matter to its security: devices added or removed, password changes, signing out everywhere, joining or leaving a loop, supervision, and pausing sharing, each with who made it. Only you can see it, in Settings, and it is kept for 90 days. It never holds a location.

A temporary loop ends 24 hours after it is made, for everyone in it. At that moment it stops sharing anybody’s location, and shortly afterwards it is deleted with its places, its timeline and everyone’s membership. A temporary place in an ordinary loop is deleted the same way when it ends.

We also keep a count of how much Orbit is used each day: how many people and loops there are, and how many arrivals, departures, check-ins and positions the whole service handled. It is one set of totals for everybody, with no account, loop, place or time of day in it, so it says nothing about you, and we keep it to see whether Orbit is working for the people who rely on it.

You can delete your account here in a browser, or from Settings in the app. It is immediate and permanent. Your history, your devices and any loop you own go with it, and the people in those loops are told.

Who can see it

Only the people in the loops you have joined, and only while you are sharing with them. Pausing hides your position and your history from that loop immediately, and everyone in it can see you have paused rather than being shown a stale dot.

What we send by email

Every email we send, and almost nothing about your location in any of them.

• Confirming your email address, when you sign up.
• Resetting your password, when you ask us to.
• Telling you a new device signed in to your account.
• Telling everyone who shares a loop with you that you signed out everywhere, because whoever was in your account could see them too.
• Telling you a loop you were in has been deleted.
• Inviting you to a loop, if you do not have an account yet.
• Letting you know your trial is ending.
• Letting you know your trial has ended.

That is the whole list, and it is meant to stay short. Every one of them is something you asked for or something you need to act on. Orbit sends no newsletter, no summary, and nothing to tell you it still exists.

One unsubscribe switch, and it stops billing notices: a trial ending, and a trial ended. You can turn it back on.

Neither covers security mail. A new device signing in, a password reset, an account being taken back: those always send, whatever else you have switched off.

Why there are no photos on the map

Everyone appears as an animal, a character or a shape they choose, on a color of their own, or as their initials. You cannot upload a photo of your child or use one as their marker, and that is a decision rather than a missing feature.

A name is all your family needs to know who is where. A photo would show anyone who picks up the phone exactly what your child looks like.

If something breaks

Orbit fails quietly: an app that has stopped sharing looks exactly like somebody who has not moved. So Settings has a button that sends us a snapshot of your phone. The app version, which permissions you granted, your Android battery settings for Orbit, whether sharing is running, and any warnings the app recorded about itself.

It only happens when you press the button, it contains no location at all, and we delete it after 14 days whether anybody has read it or not.

If a snapshot is not enough, you can let us look a little further. Report a problem, in Orbit’s settings, has a switch that lets Orbit support see when your devices last reported, the gaps in their reporting, battery and app versions. It lasts 7 days and then turns itself off, only you can turn it on for your account, and a supervised member decides for themself, never the person supervising them.

It never shows us where you are or where you were. It only reads what we already keep, and every time we use it is recorded and shown to you under the switch.

Who else sees any of it

These companies do a job for us, and each gets only what that job needs.

• Apple or Google, if you subscribe, take the payment through the App Store or Google Play. Your card details stay with them and never reach us. They tell us which plan you are on, when it renews or ends, and a reference for the purchase, which we keep with your account to know whether you are subscribed.
• Resend gets your name and email, to deliver account mail like a reset link.
• Apple or Google, if you sign in with them, tell us your email address and, the first time, your name. We keep a reference to that account so it can sign you in again, and for Apple a token we use only to disconnect Orbit from your Apple ID when you delete your account. They learn that you use Orbit, and nothing you do in it.
• Apple and Google get the notification itself, to carry it to your device: Apple to an iPhone or Apple Watch, Google to an Android phone or Wear OS watch. A notification can name a person and a place, because that is what makes it worth sending. Google also carries those centres and radii to an Android watch.
• OpenFreeMap draws the map, in the app and on this website. Your device asks it for the part of the map on screen, so it sees your IP address and the area you are looking at, as any online map does. It is never sent anybody's position, a place, or who is in your loop.
• Apple or Google, through the geocoder built into your phone, turn a place's centre into its street address when the place is saved or you refresh its address. They are sent that one point. Searching for a place sends what you typed, and the point to search around, to Stadia Maps, or to the public OpenStreetMap services Photon and Overpass when Stadia is not configured.
• Grafana Cloud gets our server logs, which record an account id and which part of the app was called. Never an email address, and never a coordinate.

None of them gets your location history, none of them may use anything for their own purposes, and none of it is sold.

The commitments

• No data selling: Orbit has no advertising business and no data partners. There is no arrangement under which your location could become something we sell.
• No third-party tracking SDKs: The apps ship no analytics, attribution, or advertising SDKs. Nothing in Orbit reports your behavior to a company you have never heard of.
• Minimal data collection: An email address, a display name, your loops, and recent positions. Positions are kept for 2 days and then deleted. What happened is kept: arrivals, check-ins, and drives if a loop turns those on. None of that is a trail.