Privacy Policy

Last updated: 4 November 2026

Orbit (orbitdiscuss.com) is a community discussion site. This policy explains what we collect and why.

What we collect

• Account data you give us: username, display name, email address (required to sign up, or from Apple or Google if you sign in with them; Apple may give us a private relay address instead of your real one), country and languages, password (stored only as a salted hash).
• Content you post: posts, comments, reactions, votes, direct messages, uploaded images and videos, and your avatar.
• Basic usage data needed to run the service, such as session tokens, rate limiting and notification state, and the country you signed up and most recently signed in from (a 2-letter country code that our content delivery network derives from your connection; we never store your IP address).
• If you enable push notifications in the iOS app, a device token, used only to deliver your notifications through Apple Push Notification service.

Sign in with Apple or Google

If you choose Sign in with Apple or Continue with Google, Apple or Google confirms who you are and shares a unique account identifier and your email address with us (and, the first time with Apple, your name if you choose to share it). We never receive your Apple or Google password. When you delete your Orbit account we delete this link and the identifiers we received. You can also stop using Sign in with Apple for Orbit at any time in your Apple Account settings.

How we use it

To run Orbit: show your content, personalise your feed, send notifications you ask for and keep the community safe. We do not sell your data and we do not show third-party ads.

Your email address

When you create an account or sign in with Apple or Google, we use your email address to:

• run your account: sign-in, password resets and security alerts;
• send service messages about your account, your content or important changes to Orbit;
• send occasional Orbit updates and newsletters. Every one of these emails has an unsubscribe link, and you can also turn them off in Settings at any time.

We never sell your email address or share it for other companies’ marketing. Emails are sent through our email provider on our behalf.

Cookies and local storage

On the website, a banner asks for your choice on your first visit. “Accept all” and “Only necessary” are equally easy, nothing is pre-selected, and you can change or withdraw your choice at any time with Cookie settings (in the footer, the account menu and Settings). We store your choice in your browser together with its version and the date you made it. If you withdraw consent, we stop using that category and delete the analytics cookies.

• Necessary (always on, no consent needed — § 25(2) TDDDG): your sign-in session, preferences (theme, language, feed languages, muted videos, hidden posts, recent searches), your cookie choice and similar small technical entries in your browser’s local storage. They are needed to provide the service you asked for and are never used for tracking.
• Statistics (only with consent — Art. 6(1)(a) GDPR, § 25(1) TDDDG): Google Analytics (Google Ireland Ltd.) sets cookies (_ga, _ga_*) and receives your IP address, which Google may process outside the EU (USA, under the EU–US Data Privacy Framework), so we can see in aggregate how Orbit is used. We never use it for advertising. Without consent the analytics script is not loaded at all.
• External media (only with consent, or when you tap “Load content” for a single item): YouTube video previews and players (privacy-enhanced mode), Spotify and SoundCloud players, GIFs from GIPHY and images that members link from other websites. Loading them sends your IP address to that provider, who may also set cookies; their privacy policies apply. Until then we show a placeholder instead.

Signing in with Google loads Google’s sign-in script only on the sign-in and sign-up screens. The mobile apps don’t use browser cookies.

Direct messages

Direct messages are private between you and the person you write to. They are not shown to anyone else and are not used for ads or to personalise your feed.

• Security: messages are encrypted in transit (HTTPS) and stored on our servers in the EU (Frankfurt, Germany). They are not end-to-end encrypted, so please don’t share passwords, payment details or other highly sensitive information.
• Who can read them: only you and the other participant. Orbit staff do not read message content. We only look at specific messages when a participant reports them to us, or when we are legally required to. For operations we use aggregated, content-free counts (for example, how many messages are sent per day).
• How long we keep them: until one of you deletes the conversation (this removes it for both participants) or until either account is deleted.
• Your controls: you can block a user to stop their messages, report spam or abuse, and delete conversations at any time.
• Legal basis: delivering messages is part of the service you signed up for (Art. 6(1)(b) GDPR); handling reports protects you and others (Art. 6(1)(f) GDPR).

Sharing

Your posts, comments and public profile are visible to everyone. We use AWS (Frankfurt, EU) to host the service. We share data with authorities only if legally required.

Translations: when you tap “Translate”, the translation is generated by AWS in the EU (Amazon Bedrock) from public content only, never from direct messages. We keep it for a few weeks so others can read it too, and delete it together with the original.

Third-party content and services

• GIFs: GIF search goes through our server to GIPHY, so GIPHY does not see who is searching. GIF images are loaded from GIPHY’s servers, which receive your IP address; on the website this happens only after you allow external media or tap to show a GIF (see Cookies and local storage).
• YouTube: when a post links to a YouTube video, we show a preview (on the website, the thumbnail only after you allow external media). The video player is only loaded when you tap play, and uses YouTube’s privacy-enhanced mode (youtube-nocookie.com). YouTube’s own privacy policy applies to the player.
• Push notifications: delivered through Apple Push Notification service.

The iOS and Android apps contain no analytics, advertising or tracking SDKs. Apart from Google Analytics on the website (only with your consent, see Cookies and local storage), we do not use analytics or advertising services, and we do not track you across other companies’ apps or websites.

Your choices

You can edit your profile, delete posts and comments, and delete your account permanently from Settings (in the web, iOS and Android apps). Deleting removes your profile, email, memberships and notifications, and all of your posts and comments.

Children

Orbit is only for people aged 16 and over. If you are under 16, please don’t use Orbit. If we learn that an account belongs to someone under 16, we delete it.

Contact

The provider responsible for Orbit is named in our legal notice (Impressum). Questions about privacy: support@orbitdiscuss.com