Privacy policy

Last updated: 24 September 2026

Orbily is responsible for the personal information described here. This policy covers our website, beta signup and mobile app. You can contact us about privacy or exercise your rights at info@joinorbily.app.

1. Information we collect

• Beta signup: your email, signup dates, source and invitation status. Joining the list does not create an app account.
• Account and groups: sign-in and profile details, orbit membership and sharing preferences.
• What you add: calendar events, appointments, to-dos, messages, photos, saved places, meeting points and check-ins. Only include sensitive information, such as appointment details, if you are comfortable sharing it with the relevant orbit.
• Location and journeys: where enabled, precise coordinates, timestamps, movement and speed information, journey routes, distance, duration and estimates such as acceleration, braking and cornering.
• Technical information: device and app information, notification tokens and service/security logs such as request times and network addresses. These help deliver the service, prevent abuse and diagnose problems.

2. Location sharing and background tracking

The website does not request your location. In the app, location features require device permission and your sharing choices. Background permission can allow updates while the app is not on screen. Your device may use GPS and other positioning signals; accuracy and update frequency vary.

Use the app’s sharing controls to choose your audience, set a sharing end time or stop live sharing. You can also revoke location permissions in your device settings. Stopping live sharing removes your current shared position; it does not erase recorded journeys, saved places, check-ins or previously shared content.

Recorded journey visibility follows the orbits and activity permissions selected when the journey was shared. The current beta also stores a private server-side archive of location updates received from the device. Updates already in progress may reach that archive after live sharing is stopped. The archive is not available to other members through the app. To prevent further device location access, revoke its location permission.

3. How we use information

We use your information to provide your account, shared plans, photos, maps and safety features; honour sharing choices; deliver notifications; maintain security; respond to support requests; and manage beta invitations. We do not sell your location or use it for advertising.

Where UK or EU data-protection law applies, we rely on consent for optional location collection and beta emails; performance of our agreement with you for the core service; and legitimate interests for proportionate security, abuse prevention and support. We may also process information when necessary to meet legal obligations. You can withdraw consent without affecting the lawfulness of earlier processing. Some features cannot work without the data they need.

4. Who can see your information

Members of the orbits you share with can see the information made available to those groups. They may save or copy it, so choose your audience carefully. Support access is limited to what is necessary to operate and support the service. We may disclose information if legally required or necessary to protect someone’s rights or safety.

We use service providers to run Orbily: Vercel for website hosting, Railway for the API, Supabase for database and file storage, Clerk for sign-in, and Apple and Google/Firebase for device services and notifications. Maps use Apple Maps on iOS and Google Maps on Android. Mapbox provides place searches and location naming, which may involve a search phrase, approximate search area or coordinates. Naming a location you drop on a map may also use your device’s geocoding provider, typically Apple or Google.

Providers may process information in countries outside your own. Where data-protection law requires safeguards for international transfers, those safeguards must apply, such as recognised adequacy arrangements or approved contractual protections. Contact us for information about the arrangements relevant to your data.

5. How long we keep it

Retention depends on the information and your choices. The beta does not yet automatically expire every type of historical data:

• Your current shared location is replaced by updates and removed when live sharing stops.
• Recorded locations, location-request records, journeys and activity statistics currently have no automatic expiry. Journeys can be deleted using the available activity controls; location records and journeys are removed with account deletion. Contact us for help with other records or a specific deletion request.
• Events, messages, photos and saved pins are retained as shared content until removed through the relevant controls, account or orbit lifecycle. Removing your account may anonymise shared records that other members still need instead of removing those records entirely.
• Beta-list addresses remain until removed on request or no longer needed to manage invitations. Removal is currently handled manually through our contact email; we may retain a minimal suppression record to respect an opt-out.
• Security records and backups may remain for operational or legal reasons after a deletion request. We restrict their use and remove them when no longer needed.

We will not describe a sharing timeout as deletion of all your data. Contact us if you want an explanation of what remains or help deleting it.

6. Your choices and rights

You can change sharing permissions, stop sharing, manage device permissions, delete available content and request account deletion. To leave the beta list or request access, correction, deletion, a copy of your data or restriction of processing, email us. We may need to verify that the request is yours.

You can object to processing based on legitimate interests and withdraw consent for optional processing at any time. Rights depend on the applicable law and may be subject to limited exceptions. You may complain to your local data-protection authority; in the UK, this is the Information Commissioner’s Office.

7. Children and family use

Parents and guardians should explain location sharing and group visibility in language children understand and supervise their use. Do not use Orbily to secretly track anyone. Provide any parental authorisation required by local law. Contact us if you believe a child’s information has been collected without the necessary permission.

8. Website storage and security

The marketing site does not add advertising trackers or analytics cookies. It uses Vercel Web Analytics and Speed Insights, which count page views and measure how quickly pages load without cookies or identifying you across sites; invite codes are removed from the page addresses they record. Hosting providers may process technical request information for delivery and security. The app uses local storage and sign-in/session technology to function. We use access controls and encrypted network connections to help protect information, but no system can guarantee absolute security.

9. Changes to this policy

We will update this page as the beta and our practices change. For material changes affecting your choices, we will provide appropriate notice and obtain new consent where required.