How Orbit keeps you safe

How we keep your data safe

Who can see your data

• Messages in a server are visible to the people in that server who can see the channel. Direct messages and group conversations are visible to the people in them.
• Your email address is never shown to other people on Orbit.
• Orbit staff cannot browse or monitor your conversations. They see message content only when something is reported to us or sent to us for review.
• Staff tools are limited by role, and every staff action is recorded in an audit log.
• Usage statistics, such as how many messages you sent, are visible to the site owner only.
• Text messages are not end-to-end encrypted. They are stored on our server, where the server can read them, as the Privacy Policy explains.

What we do not do

• We never sell your data.
• We never use your messages to target ads.
• We use no third-party analytics or trackers.

We collect only what Orbit needs

• An account needs a username, a display name, an email address and a password. We do not ask for a phone number or your real name.
• The full list, and why we collect each item, is in What we collect in the Privacy Policy.

You can delete your data

• You can delete your own messages at any time, and a deleted message and its images are removed straight away.
• You can delete your account yourself in Settings, My account. By default there is a 14-day grace period, or you can choose to delete it straight away. Your profile, email address, friends, sessions and devices are then removed.
• What happens to everything else, and how long each kind of data is kept, is in How long we keep it and Deleting your account. Step by step: Delete your account.

How we protect it on our side

• Our database is not reachable from the public internet.
• Only the few people who run Orbit can reach our systems.
• Backups are kept for a short, fixed time (see Data and backups).

Encryption

• All connections to Orbit use HTTPS, and your browser is told to use only HTTPS for Orbit.
• Voice and video calls, camera and screen sharing are end-to-end encrypted. Your device encrypts what it sends, and our voice server relays it without being able to decode it.
• If your browser cannot encrypt a call, Orbit does not let you join it unencrypted.

Accounts and sign-in

• Passwords are stored only as salted hashes, so we cannot see them. Session tokens, verification codes and email links are stored as hashes too.
• New passwords cannot be one of the most common breached passwords.
• Sign-up and sign-in include a bot check, and repeated failed attempts are slowed down with rate limits.
• You verify your email address, and it is used to sign in and recover your account.
• A sign-in from a browser and a place your account has not used before has to be approved from your email.
• We email you when your account signs in from a new device, and when your password or email address changes. An email change comes with a link to undo it.
• Sign-in attempts are recorded so that abuse can be spotted and investigated.
• Your sign-in cookie cannot be read by scripts on the page.
• In Settings, My account, you can see the devices you are signed in on and sign any of them out.

Uploads and media

• Orbit checks what an uploaded file really is, not just what its name says, and refuses files it does not accept.
• Hidden metadata is removed from pictures before they are stored, including location, camera details and timestamps.
• Uploaded files are served so that they cannot run code in your browser.

The app itself

• Orbit runs under a strict content security policy that blocks third-party scripts.
• Orbit has no third-party analytics or trackers.
• Anything people type is escaped before it is shown, so a message cannot run code on a page.

Data and backups

• The database is backed up every night, and every backup is kept for at most 14 days.
• A deleted account is therefore gone from every backup within 14 days of its deletion.
• Sign-in records are deleted after 90 days.
• Everything else, and the exceptions where the law requires us to keep something longer, is in How long we keep it.

Safety and moderation

• You can report a message to the Orbit team from inside the app.
• You can block people you do not want to hear from, and unblock them later.
• Reports are reviewed by staff, and server moderators can remove content from their own servers.
• More about how we protect younger people: Child safety.

Report a security problem

If you think you have found a weakness in Orbit, email [email protected]. This also applies to our website and our apps.

Please

• Describe what you found and how to reproduce it, so we can fix it quickly.
• Give us reasonable time to fix it before you tell anyone else.
• Stop as soon as you have shown the problem exists.

Please do not

• Read, change or delete other people's data.
• Disrupt the service, for example with floods of traffic.
• Trick or pressure people, or test anything physical.

Our promise

• If you act in good faith and follow the above, we will not take legal action against you for your research.
• We will read every report, and we will tell you when the problem is fixed.

Our machine-readable contact details are in security.txt.