Orbit uses your messages and the data sources you choose to connect to work for you. We do not sell personal information, run ads, or use your private content to train a general-purpose AI model. You can inspect memory, disconnect sources, export data, delete imported data, or delete your account.
This Privacy Policy explains how Kaustubh Bhal, a sole proprietor doing business as Orbit (“Orbit,” “we,” “us,” or “our”), collects, uses, discloses, and retains personal information when you use the Orbit assistant, website, account portal, messaging program, beta application form, and connected-service features (the “Service”). Kaustubh Bhal is the operator of Orbit and the controller of the personal information described in this Policy.
1. Information we collect
Information you provide
- Identity and profile. Your verified messaging handle or phone number, name, time zone, assistant name, communication style, invitation and consent records, and account-session information.
- Messages and attachments. Requests, replies, approval decisions, images or files you send, and the conversation context needed to respond and follow through.
- Orbit connections. Friend labels you provide, mutual connection state, and the purpose-scoped requests, candidate windows, public options, availability responses, exact plan proposals, decisions, and replies you direct Orbit to exchange with another Orbit user.
- Preferences and memory. Facts, relationships, instructions, notification preferences, quiet hours, feedback, and durable memories you ask Orbit to remember or that you confirm.
- Tasks and actions. Reminders, watches, background tasks, approval previews, action receipts, calendar and email drafts, and privacy-minimized activity history.
- Support and beta operations. Information you provide when requesting access, reporting a problem, sending feedback, or communicating with us.
Beta applications
Our request-access page embeds a form provided by Tally. If you submit it, Tally processes the information you enter and related technical information on our behalf so we can review your application, contact you, and administer beta access. Tally’s own privacy notice also describes its practices. Please do not include sensitive personal information in a beta application.
Information from services you connect
When you connect Google Workspace, Orbit receives OAuth credentials and the Google data needed for the capabilities you authorize, which may include Gmail messages and metadata, calendars and events, Drive file metadata, and Google Docs content returned by a targeted search. Google shows the requested scopes before you connect.
Orbit currently keeps a rolling 30-day Gmail index; imports calendar events from 180 days in the past through 365 days in the future during each calendar sync; and does not crawl Drive or Docs account-wide. A targeted Gmail or Docs search retrieves at most a small bounded set of matches and adds only those selected items to your private index.
Information collected automatically
We collect technical and usage information needed to run and secure the Service, such as request timestamps, IP address, browser and device information, session and message identifiers, delivery state, connector health, feature usage, error logs, rate-limit records, and security events. Orbit account surfaces use an essential, short-lived account-session cookie; Orbit does not use advertising cookies. The embedded Tally form is a third-party service and may process technical data under Tally’s own notice.
2. How we use information
We use personal information to:
- authenticate you and provide, personalize, and maintain Orbit;
- answer requests, retrieve relevant context, create reminders and watches, and perform actions you request or approve;
- decide whether an authorized proactive event deserves your attention under your settings;
- create mutual Orbit connections and deliver the requests or replies each connected owner directs their Orbit to send;
- show you memories, indexed-item metadata, activity, approvals, connections, exports, and deletion controls;
- protect accounts, prevent abuse, enforce limits, debug failures, and keep the Service reliable;
- understand aggregate beta usage and improve product features; and
- comply with law and protect the rights, safety, and integrity of users, Orbit, and others.
We do not sell personal information. We do not use it for targeted advertising or cross-context behavioral advertising. We do not use your messages, memories, or connected-service content to train a general-purpose AI model unless we first give you a separate, explicit choice.
Orbit-to-Orbit connections
An Orbit connection is a mutually approved, revocable communication path between two assistants. It is not account access. A connected person and their Orbit cannot browse your calendar, email, memories, files, credentials, tools, or full conversation history.
Each Orbit uses its own owner's private context locally. A connected Orbit may ask your Orbit to check a small set of task-specific candidate times. Your Orbit can use your calendar locally to prepare an answer, but the other person does not receive your event titles, attendees, conflict reasons, general schedule, or even the compatible times unless you approve the exact disclosure. The receiving Orbit can return only compatible subranges of the original candidates or say that none work without giving a reason.
After both assistants find compatible availability, one owner can approve an exact plan containing the selected time, public option, and limited logistics. The other owner sees that exact plan and can approve or decline it. Agreeing on a plan does not itself create a reservation, purchase, invitation, message to a third party, or calendar change. Those remain separate actions subject to the applicable owner's approval rules.
You can inspect coordination status and revoke a connection in the account portal. Revocation immediately blocks new Orbit-to-Orbit messages in both directions and cancels active coordination sessions on that connection. It does not undo information that an owner previously authorized their Orbit to share.
3. AI processing
To generate a response or decide how to handle an authorized event, Orbit sends the current request and a bounded set of relevant context to OpenAI’s API. This can include selected conversation context, memory, and connected-service excerpts relevant to your request. Orbit uses stateless API requests with storage disabled; OpenAI does not use API inputs and outputs to train its models by default, although it may retain abuse-monitoring logs for up to 30 days unless a different data-control arrangement applies.
Orbit’s bulk Google index is not sent to the AI provider. Only excerpts selected for the current request are decrypted and provided. Orbit’s default embeddings are produced locally; sending bulk indexed content to an external embeddings provider requires a separate configuration.
4. Google Workspace data
Orbit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Orbit uses Google data only to provide or improve the user-facing features you request. We do not sell Google user data, use it for advertising, use it to determine creditworthiness or lending eligibility, or use it to train or improve a generalized AI model. We do not transfer Google user data except to service providers that help provide the requested feature, for security, when required by law, or as otherwise permitted by Google’s policy with the consent it requires.
Humans do not read Google message or file content unless you give explicit consent for a specific support purpose, access is necessary to investigate a security or abuse issue, or disclosure is required by law. Aggregated and de-identified operational information may be used internally where permitted.
Disconnecting Google stops future access and revokes Orbit’s stored credential. You may separately erase previously imported Google data from the portal. You can also revoke Orbit from your Google Account security settings.
5. When we disclose information
We disclose personal information only as needed in these circumstances:
- Service providers. Infrastructure, security, AI, messaging, form, and connected-service providers process data for us under their terms and our instructions. Current core providers include Amazon Web Services for application hosting, Cloudflare for the website and network security, Photon for message transport, OpenAI for AI inference and optional web search, Google for connected Google services, and Tally for beta application forms.
- Actions and Orbit messages you request. When you ask Orbit to contact a connected Orbit user, send a message, invite attendees, update an event, or take another external action, the necessary information is disclosed to the recipient or service you selected. An Orbit connection alone does not disclose your memory or connected-service data.
- Legal and safety. We may disclose information when we reasonably believe it is necessary to comply with law, protect rights or safety, investigate fraud or abuse, or secure the Service.
- Business transfer. Information may transfer as part of a financing, reorganization, merger, acquisition, or sale of assets, subject to this Policy, applicable law, and any additional consent required for Google user data.
- At your direction. We may disclose information when you ask us to or give informed consent.
6. Retention
We keep information only for as long as reasonably needed for the purpose described below, to maintain security and auditability, or to meet legal obligations:
- Gmail index: a rolling 30-day corpus; expired messages are purged during sync.
- Calendar index: each sync imports events from the current 180-day past and 365-day future window. Previously imported calendar items remain in your private index until you erase imported Google data, disconnect and choose deletion, or delete your account.
- Targeted Drive and Docs results: kept in your private index while needed to provide reusable context, until you erase imported Google data, disconnect and choose deletion, or delete your account. Targeted Gmail results remain subject to the 30-day Gmail purge.
- Messages, memories, tasks, and action records: kept while your account is active unless you delete the relevant item or account. Some privacy-minimized security and idempotency records may be kept longer where needed to prevent duplicate actions or abuse.
- Orbit connections and coordination sessions: kept while your account is active so each owner can inspect, export, reply to, cancel, or revoke the relationship. Sessions also expire automatically at the end of their bounded planning window. Revocation blocks new messages and cancels active sessions; account deletion removes the connection and associated messages and sessions from active systems.
- OAuth credentials: kept while the connection is active, encrypted at rest, and deleted when you disconnect.
- Web sessions: expire automatically after no more than 12 hours and can be revoked earlier.
- Account deletion receipt: a limited opaque record may remain to prove deletion status and prevent deleted data from being recreated.
- Beta applications: kept while reasonably needed to evaluate and administer beta access, unless you ask us to delete your application or a longer period is required by law.
If a provider or law requires a different retention period, that requirement controls. Where backups exist, residual copies may remain temporarily until they are removed through normal backup rotation; they are not restored to active use except for disaster recovery.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; to withdraw consent; to object to or restrict certain processing; and to appeal a denied privacy request. Orbit provides many of these controls directly in the account portal:
- inspect, correct, or delete durable memories;
- change notification settings, quiet hours, and proactive preferences;
- cancel reminders, watches, or background tasks;
- disconnect Google and separately erase imported Google data;
- inspect or revoke mutual Orbit connections and inspect or export the messages and coordination sessions exchanged through them;
- download a portable account export, currently limited to one per hour for security; and
- permanently delete your account across Orbit services.
You can also contact privacy@heyorbit.dev. We may need to verify that the request comes from the account owner. We do not discriminate against anyone for exercising a privacy right. Because we do not sell personal information or use it for targeted advertising, there is no sale or targeted-advertising opt-out to exercise.
8. Security
Orbit uses measures designed to protect personal information, including short-lived single-use setup and login links, secure HttpOnly account cookies, encryption of provider credentials and imported content at rest, encrypted transport where supported, service-to-service authentication, subject-level data isolation, least-privilege access, explicit approval boundaries, and deletion workflows that verify completion across services.
No system is perfectly secure. Do not send passwords, payment-card numbers, Social Security numbers, authentication codes, or other highly sensitive secrets to Orbit. Contact security@heyorbit.dev if you discover a security issue.
9. Children
Orbit is not directed to children and the private beta is limited to people 18 or older. We do not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact privacy@heyorbit.dev so we can investigate and delete it.
10. U.S.-only private beta
Orbit is currently operated from the United States and the private beta is offered only to people located in the United States. Our providers may process information in the United States and other countries. Do not request or accept beta access if you are located outside the United States.
11. Public materials and ownership
This Policy describes how Orbit handles personal information; it does not grant commercial rights in the public website, Journal, documentation, engineering explanations, designs, or other Orbit materials. Except for user-owned content and third-party materials, those materials are proprietary to Kaustubh Bhal, a sole proprietor doing business as Orbit, and are made available for personal, non-commercial, informational use under the Terms of Service.
This ownership notice does not change your rights in your Input or Output, give Orbit ownership of your messages or connected-service data, or reduce any privacy right described in this Policy.
12. Changes to this Policy
We may update this Policy as Orbit changes. We will post the new effective date and provide additional notice for material changes. If we materially expand how we use Google user data or other private content, we will request renewed consent before using it for the new purpose where required.
13. Contact
Operator and data controller: Kaustubh Bhal, sole proprietor doing business as Orbit.
Privacy questions and requests can be sent to privacy@heyorbit.dev. Legal questions can be sent to legal@heyorbit.dev.