Privacy Policy

Account and profile information

When you create or use an account, we may collect your name, email address, authentication information, account identifiers, timezone, and profile settings. Password authentication is handled through our authentication infrastructure; we do not need to store a readable copy of your password.

Content you choose to store in Orbit

Orbit stores information you intentionally provide to use the Service, which may include tasks, lists, habits, habit completions, focus-session information, day-planning records, reflections, and related organizational content. Reflections and other free-text content may be personal or sensitive depending on what you choose to enter. Please avoid entering information you do not want stored in the Service.

Usage, device, and analytics information

We collect limited usage and technical information needed to operate, secure, understand, and improve Orbit. This may include event type, timestamps, local date, timezone, app path, device class, session and anonymous identifiers, installation/standalone-app status, referral and campaign information, and controlled feature metadata. Orbit's first-party analytics is designed not to send the text of your tasks, reflections, habit names, list names, or email address as analytics properties.

Notifications

If you enable push notifications, we process a push subscription identifier and technical delivery information so Orbit can deliver requested notifications, such as Focus-session completion alerts. You can disable notifications through Orbit and/or your device or browser settings.

Orbit also keeps a limited notification delivery log to diagnose delivery problems. Each entry records an internal entry identifier, your account identifier, the notification identifier where applicable, the attempt time, the result category, the push service response code where available, the push-service provider category, and whether the attempt was a user-requested test. The delivery log does not contain notification text, task or reflection text, habit or list names, email addresses, device push addresses, subscription encryption keys, or browser user-agent strings. A push service accepting a notification does not confirm that your device displayed it.

Authentication information from third parties

If you choose Google sign-in or another supported third-party sign-in method, we receive information necessary to authenticate you, such as an account identifier, name, and email address, subject to the provider's settings and policies.

Payment information

When paid features launch, payments may be processed by Apple, Google, or a web payment provider. BAM Meridian generally receives transaction, subscription, entitlement, and limited billing-status information needed to provide paid features, while the payment provider processes payment credentials under its own terms and privacy policy.

• provide, personalize, synchronize, and maintain Orbit;
• authenticate users and secure accounts;
• save and synchronize tasks, habits, focus sessions, reflections, and other requested content;
• deliver notifications and service communications, and diagnose notification delivery problems using limited technical delivery logs;
• understand product adoption, activation, reliability, and performance using privacy-conscious analytics;
• provide support and respond to requests;
• administer subscriptions and entitlements when paid features are offered;
• detect, investigate, and prevent abuse, fraud, and security incidents;
• comply with law and enforce our agreements;
• improve Orbit and develop new features in ways consistent with this Policy.

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you (for example, to provide Orbit), based on legitimate interests (for example, security and privacy-conscious product analytics), with your consent where required (for example, certain device permissions or marketing), and to comply with legal obligations. You may withdraw consent where processing is based on consent, without affecting earlier lawful processing.

We do not sell your personal information. We may disclose information to service providers that process data on our behalf; to app stores and payment providers for purchases and subscriptions; when you direct us to integrate or share data; in connection with a corporate transaction subject to appropriate safeguards; or where reasonably necessary to comply with law, protect rights and safety, or investigate abuse. Service providers are authorized to process personal data only for permitted purposes and subject to contractual or legal obligations appropriate to their role.

Orbit currently uses Supabase-backed infrastructure for database, authentication, and related backend functions, and Lovable-provided application, authentication, and email tooling as part of the application stack. Google is used when you choose Google authentication. Web Push infrastructure is used to deliver notifications you request. Depending on your browser or device, the push service may be Google Firebase Cloud Messaging (FCM), Apple Push Notification service, Mozilla’s push service, or another browser-selected push provider. Orbit sends the provider the technical subscription information needed to route an encrypted notification; subscription addresses and encryption keys are stored separately from the delivery log. The log records only a provider category (Google/FCM, Apple, Mozilla, other, or none when no subscription is available), not the device’s push address. Apple and Google will process information when Orbit is distributed through their stores. Additional payment infrastructure will be identified before paid functionality is launched. We will keep this Policy and our subprocessors documentation current as vendors change.

Orbit currently uses a first-party analytics architecture stored in its backend rather than embedding a general-purpose third-party product-analytics SDK such as Google Analytics, Mixpanel, Amplitude, or PostHog. Analytics events use a controlled schema designed to exclude user-entered free text. If we later introduce advertising, cross-app tracking, or additional analytics providers, we will update our disclosures and obtain permissions or consent where required.

We retain account information and User Content while your account is active and as reasonably necessary to provide the Service. We may retain limited records after deletion where required for legal, tax, fraud-prevention, security, dispute-resolution, or enforcement purposes. Backup copies may persist for a limited period before being overwritten or securely deleted. Analytics and security records may be retained in identifiable, pseudonymous, aggregated, or de-identified form for periods appropriate to their purpose. Notification delivery logs use a 30-day retention window: a daily cleanup removes entries older than 30 days, so removal occurs on the next scheduled cleanup rather than exactly at the 30-day boundary. Successful in-app account deletion removes that account’s delivery-log entries without waiting for this scheduled cleanup. Protected backups may temporarily retain copies until their ordinary expiry. Other operational retention schedules will be documented and this Policy updated if those schedules materially affect users.

Orbit users may initiate account deletion from within the app. We will also maintain an external web pathway for deletion requests as required for Google Play. Deletion removes the account and associated personal data that we are not legally required to retain. Notification delivery-log entries are removed during successful in-app account deletion. If you cannot complete deletion in the app, contact us so we can verify your request and complete associated delivery-log cleanup; removal of a login alone does not automatically remove these separate records. If you use Sign in with Apple in the future, deletion will also follow Apple's token-revocation requirements. Cancelling a subscription does not by itself delete your Orbit account or User Content.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; withdraw consent; or appeal certain decisions. You may exercise available controls in Orbit or contact us at [email protected]. We may verify your identity before fulfilling a request. You may also have the right to complain to a data-protection authority.

Residents of certain U.S. states may have additional rights under applicable privacy laws. Orbit does not currently sell personal information or share it for cross-context behavioral advertising. If our practices change, we will update this Policy and provide legally required choices.

Orbit and its service providers may process information in the United States and other countries. Where required, we use recognized transfer mechanisms and contractual safeguards for international transfers of personal data.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encrypted network transport, database security controls, row-level authorization policies, secret management, authentication controls, and monitoring. No system can guarantee absolute security. See our Security Policy for additional information.

Orbit is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If local law requires a higher age for a person to consent to digital services, users below that age should use Orbit only with any consent required by law. If we learn that we collected information from a child in violation of applicable law, we will take appropriate steps to delete it.

We may update this Policy as Orbit evolves. We will post the updated version and change the effective date. If a change is material, we will provide additional notice where appropriate or legally required.

Privacy questions and requests: [email protected]. Controller/business responsible for Orbit: BAM Meridian LLC, New York, United States.

Contact: [email protected] · BAM Meridian LLC (opens in a new tab) · orbitapp.day