ORBIT Privacy Notice — draft

1. Draft and controller

This is a staging draft, not public-launch approval. Controller details, provider agreements and retention periods need completion and approval before public availability.

Controller: [OWNER TO SUPPLY: full legal name and legal form]. Address: [OWNER TO SUPPLY]. Privacy and rights contact: [OWNER TO SUPPLY: working email]. Data Protection Officer, if appointed: [OWNER TO CONFIRM: contact or no appointment].

2. Account and required information

To verify account access, we process email, account identifier, verification and session information, and event times. Email and proof of access are necessary to sign in; without them we cannot provide a private account. A provisional authentication account may exist before registration is complete.

We separately record the accepted Terms version, privacy version presented, server time, language and event source. There is no required 'privacy policy consent'. Age 18+ confirmation is a product policy; we do not collect a birth date or identity document copy for that confirmation.

3. Your ORBIT data

We process what you save: goals, categories and areas, metric values and history, notes, dates, settings and progress calculations. Profit includes amounts, currencies, dates, notes and import provenance. Vault includes item titles, categories, priorities, prices, links, notes, images, Fund history and links to Profit.

Profiles may contain a name, handle, avatar, friendships, selected showcases and goals, and activity settings. These are optional for the relevant features. Your notes, photos and goals may reveal health or other sensitive information; do not enter other people's data or unnecessary details. Health integration requires separate consent; it is not consent for arbitrary other special-category data.

4. Purposes and lawful bases

Verification at your request, account operation and necessary Profit, Vault, Progress, requested imports and sharing use GDPR article 6(1)(b): steps before a contract or its performance. Processing must actually be necessary for the requested feature, not merely written into Terms.

Proportionate security, diagnostics and handling claims may use article 6(1)(f), the interest in secure operation and protection of rights, after a balancing assessment. Specific legal duties and handling data rights use article 6(1)(c) together with the applicable legal provision. This basis is not assigned to arbitrary purposes.

Optional Health processing uses consent under article 6(1)(a) and explicit consent under article 9(2)(a). Health consent, system HealthKit permission, Google spreadsheet sharing and acceptance of Terms are separate.

5. Apple Health

Following your separate decision, the native app reads steps and walking/running distance from Apple Health. ORBIT receives daily totals, dates, units, time zone, connection/device identifiers and sync times. Initial or full reconciliation covers up to 365 days; ordinary refresh covers the latest 8 days. This does not automatically delete older values already stored after 365 days.

Data supports your metrics, goals, history and summaries. We do not use it for advertising or marketing. It is stored in ORBIT infrastructure, not only on your device. Goals bound to imported Health streams cannot currently be shared through profile previews. Manually entered health-related goals or notes can reveal sensitive information if you choose to share them.

You may refuse without losing core ORBIT features and withdraw in Settings. Withdrawal stops sync, disables the source and erases imported Health data and values derived solely from it. Metric bindings may remain empty rather than being converted into manual entries. This does not delete originals in Apple Health. You can additionally change system permission in Apple Health settings. Withdrawal does not affect the lawfulness of earlier processing.

6. Google Sheets

The current import requires sharing a file with ORBIT's service account and adding a verification marker. The account has read-only access to the entire shared workbook, not only the selected tab or Profit cells. During inspection, the server fetches metadata and the entire used contents of up to 20 worksheets to locate the marker and Profit table. Routine sync fetches the entire used contents of the selected worksheet. Do not share a workbook containing unnecessary data.

From the fetched contents, we store canonical daily Profit totals, file identifier/title, tab name, import settings, sync status/times, error or conflict summaries and links to Profit entries. We do not retain a complete workbook copy or use this data for advertising. We do not store your Google password or a personal OAuth refresh token; this mechanism uses ORBIT service-account credentials.

Disconnecting in ORBIT stops further imports and removes connection configuration and source links. It keeps imported Profit entries, which you may delete separately. It does not revoke file sharing: also remove the service account from permissions in Google. Google handles its own accounts and services under its terms; it is not automatically a processor for all ORBIT data.

7. Sharing with other users

Your profile name, handle and avatar support search by signed-in users and friendships. You may restrict a wishlist to yourself, friends or other signed-in people through 'everyone'. Selected showcases, goal previews and activity follow their settings. This does not make all underlying private data available.

Recipients may see titles, images, links, prices and selected progress values. Someone may save a shared item into their Vault; their own copy may remain after you change visibility or delete your account. Do not share information whose further disclosure would put you at risk. Content notices may include the content, explanation and reporter's contact details, accessible to the authorised person handling the notice.

8. Providers and recipients

Supabase provides the database, authentication, file storage and related services. Vercel hosts the web app and server requests. An email provider delivers login codes and technical messages: [OWNER TO CONFIRM: provider, role and agreement]. Providers engage subprocessors for infrastructure, content delivery, security and support under their agreements.

Authorised provider staff may access data as necessary for support, security or rights requests. Authorities or advisers may receive data where there is an appropriate basis and need. Google and Apple operate their own services and permissions; their role depends on the actual operation.

BEFORE PUBLIC LAUNCH: processor contracts must be confirmed. Vercel's public DPA covers Pro and Enterprise, while the current Hobby plan has no independently established article 28 arrangement. Its standard DPA additionally prohibits special-category data. A plan change alone does not resolve server-side Health processing. This draft does not remove those blockers.

9. Locations and transfers

ORBIT Supabase projects use eu-west-1 in Ireland for primary storage. This does not guarantee EU-only processing: global support, subprocessors, CDN file delivery and operational data may involve other countries. Vercel also uses infrastructure and processing outside the EEA.

Transfers needing safeguards require an applicable mechanism, particularly standard contractual clauses in appropriate agreements, with transfer assessment and supplementary measures where necessary. [OWNER TO CONFIRM BEFORE LAUNCH: actual agreements, recipients and ORBIT transfer assessment]. Ask the controller for information and an available copy of safeguards.

10. Cookies, device storage and logs

Supabase session cookies support sign-in and account protection. ORBIT also stores selected language, accent, Aurora, time zone and onboarding preferences. Most such preferences last up to one year; the actual duration depends on the item and your settings. Clearing browser cookies may sign you out or reset preferences. The native app stores its session through the authentication library and sync settings on your device.

The audited code contains no analytics or marketing SDK; necessary/requested storage alone does not cause a general consent banner. This does not mean there are no logs: infrastructure processes IP addresses, request/device information and technical data for operation and security. ORBIT records error contexts/codes and sync events. [OWNER TO CONFIRM: exact provider log periods and production configuration].

11. Retention and deletion

Account, Profit, Vault, Progress data and files remain while you use the account until you delete the relevant item or account. Health data is also erased on consent withdrawal as described. Google disconnect removes configuration but keeps Profit entries. The 365-day import window is not automatic one-year retention.

Account deletion requires identity confirmation, stops integrations and removes owned data, files and user-linked legal/consent evidence in the current implementation. ORBIT does not retain raw Health values as consent evidence. Independent lawful copies saved by other users and originals at Apple or Google are outside that deletion.

Provider backups and operational logs may expire through rotation rather than simultaneously with active database deletion. [OWNER TO COMPLETE BEFORE LAUNCH: verified backup/log periods, restore handling and the need/lawful basis for a limited evidence archive]. No indefinite retention or invented statutory period is established. Any legally required exception needs a specified dataset, basis, duration and appropriate notice before implementation.

12. Your rights and contact

Subject to GDPR conditions, you may request access, a copy, rectification, erasure, restriction and portability of data processed automatically under contract or consent. You may object to processing based on legitimate interests and withdraw consent without affecting the lawfulness of earlier processing.

Settings provides account export and deletion. A structured export supplements the existing XLSX and excludes passwords and secret tokens. Send other requests to the controller. We respond without undue delay, normally within one month, and explain any lawful extension. We may ask for proportionate identity confirmation.

You may complain to the President of the Polish Personal Data Protection Office (UODO); information and channels are at https://uodo.gov.pl. You do not need our permission or have to give up other legal remedies.

13. Automated calculations and changes

ORBIT automatically totals entries, calculates progress and presents history using your settings. It does not make solely automated decisions with legal or similarly significant effects, such as lending or medical decisions. It does not use this data for advertising profiling.

New purposes, recipients or bases need assessment and updated information before processing changes. We present material privacy updates in the app. An update alone does not require 'privacy acceptance'; renewed consent is required only where the consent-based processing itself changes in a way that requires it. Archived versions remain available.