Orbit is a personal habit tracking app. We take your privacy seriously and are committed to protecting your personal data. This policy explains what data we store, how we use it, and your rights under the LGPD (Lei Geral de Proteção de Dados) and equivalent data-protection laws.

The data controller is TL SOFTWARE ENGINEERING LTDA (CNPJ 58.429.979/0001-06), the company that operates Orbit. For privacy requests or questions, contact our data protection lead at contact@useorbit.org.

Account information: name and email address (via email signup or Google OAuth) Habit data: habits you create, completion logs, schedules, tags, and goals AI chat messages: conversations with the Orbit AI assistant Preferences: language, timezone, color scheme, notification settings, and AI memory facts you provide

To provide and operate the Orbit service To personalize your experience with AI-powered insights and summaries To send push notifications and habit reminders you have configured

We use the following services to operate Orbit: Google OAuth - for authentication Stripe - for subscription payment processing Firebase Cloud Messaging - for push notifications OpenAI - for AI chat features and daily summaries Resend - for transactional emails

We retain your data only as long as needed to provide the service: Account data: kept for as long as your account is active. Authentication sessions and push tokens: kept while active and removed on logout, token expiry, or device unsubscribe. AI chat history and memory facts: kept while AI features are enabled; deleting your account or clearing AI memory removes them. After account deletion or the 7-day grace period, your personal data is permanently erased except where the law requires us to retain limited records.

If you connect Google, we request only the scopes needed for the features you use: Basic profile and email, to create and identify your account. Read access to your Google Calendar events, used solely to show events alongside your habits and to suggest imports. We never expose raw Google event payloads to the AI, and you can disconnect Google at any time, which deletes the stored access and refresh tokens.

Orbit's database and application servers are hosted with Supabase and Render. Some subprocessors (such as OpenAI, Stripe, and Google) may process data outside Brazil. International transfers rely on adequacy decisions or standard contractual clauses, consistent with LGPD Chapter V.

Orbit's AI assistant, Astra, processes your habit and chat data to generate summaries, retrospectives, and suggestions. This is assistive only and does not make legally significant decisions about you. You can disable AI memory and AI summaries at any time in AI Settings, and you may object to automated processing by contacting us.

Orbit is not directed to children. You must be at least 13 years old to create an account. If we learn that we have collected data from a child under 13 without appropriate consent, we will delete it.

You can download a copy of all your Orbit data (habits, logs, goals, tags, AI memory facts, and settings) as a JSON file from the Profile page, in line with your data-portability rights under LGPD Art. 18.

Your data is not sold to third parties and is not used to train AI models. Your habit data and conversations are used solely to provide you with the Orbit service.

All connections to Orbit use HTTPS encryption. Authentication uses rotating refresh sessions. Payment information is handled entirely by Stripe and never touches our servers.

You can delete your account and all associated data at any time from the Profile page in the app. The process requires email confirmation: 1. Go to Profile and tap "Delete account" 2. A confirmation code will be sent to your email 3. Enter the code to confirm deletion All data is permanently deleted immediately, including habits, completion history, AI conversations, user facts, and settings. This action is irreversible.

If you have questions about this privacy policy or your data, contact us at contact@useorbit.org.