How Orbit protects you

Every photo taken on a phone carries hidden data: the exact GPS coordinates of where you were standing, which phone you used, the lens and camera settings, and the precise timestamp down to the second. This data is called EXIF metadata, and it is embedded in the image file itself, invisible to you, but readable by anyone who has the file.

Before normal app uploads reach Orbit's servers, photos are re-rendered and videos are exported with metadata containers cleared. We verify camera, camera-roll, edit, and share paths before treating this as a release guarantee.

Being in the same Orbit does not automatically give someone access to your inbox. You can choose whether people in an Orbit may send you a message request, and a conversation begins only after you approve it.

You can also share a personal message invitation with someone directly. They do not need to join one of your Orbits first.

Share a personal message QR code or invitation link with someone you trust. It opens a private conversation without adding them to one of your Orbits.

Orbit uses account authentication, controlled access, secure connections, protected storage, short-lived media links, blocking, and reporting tools to help keep your spaces private.

Most apps include third-party software libraries that report your behavior back to advertising and analytics companies, even if the app itself has no ads. These libraries run silently in the background and can track which screens you visit, how long you spend on each one, what you tap, and sometimes link that behavior to profiles used for advertising across other apps.

Orbit does not include ad networks, tracking domains, or third-party analytics SDKs. We do collect first-party operational data such as crash diagnostics, security logs, push tokens, and aggregate product metrics needed to run the app.

Private posts are protected by access rules on our side, not just by what the app chooses to show. Membership decides what you can see, and that rule is enforced before any content is returned to a device.

Private media is served through short-lived access URLs. The app requests a fresh URL when needed, and copied links should expire rather than becoming permanent public media URLs.

Account and post deletion are designed to remove user content, media, message records, pending exports, and related app data without a marketing-style grace period. Some records may be retained where required for safety review, legal preservation, fraud prevention, diagnostics, or payment records.

Stories and expiring Feed posts disappear when their time is up. Your conversations stay available until you delete them, so you never lose the thread when you switch devices.