Orbit1 privacy policy

Last updated 29 October 2026.

For a plain-English overview of what we collect, where it goes and who else receives anything, see Where your data goes. This policy is the full legal text.

1. Who is responsible for your data

Orbit1 is published by Tom Fleming, an individual developer. That person decides how and why your data is used, and is responsible for it (the "controller"). In this policy "we" and "us" mean that person.

• Privacy questions and requests: support@orbit1.uk
• Postal address: Wych Elm House, Ashwood Road, Woking, GU22 7JW, United Kingdom

Orbit1 is for people aged 18 and over.

2. What we collect, how, and why

"Collect" here means the data leaves your phone and reaches our servers or the service providers in section 3. We use each kind of data only for the purposes listed beside it.

Your account

• What: your email address; your password, if you sign in with one; which way you sign in (email, Google or Apple); an account number we create; and when the account was made and last signed in.
• How: you type them, or Google or Apple give them to us when you sign in with them. With Google, the sign-in service also keeps the name (and the profile picture link, if any) on your Google account; Orbit1 never shows that name to anyone. With Apple, we ask only for your email address, which may be a private address Apple makes for you. Your password is handled by Google's sign-in service, and Orbit1 never stores it in readable form.
• Why: to sign you in, to keep your data together under one account, to show you which account you are using, and to reply if you write to us.

Your date of birth

• What and how: you type it when you create an account, or when you finish setting up after signing in with Google or Apple.
• Why: only to check that you are 18 or over, and to choose the settings that apply to your account. If the date shows you are under 18, no account is set up, and a sign-in already made through Google or Apple is deleted.
• It is never shown in the app. No app, Orbit1 included, can read it from our database; only our server uses it. It is in your Export, because it is yours.

Your name and picture

• What: the name you choose for yourself (until you choose one you are shown as "New member"); the face you make for yourself (its hair, face, skin tone and colour); and, if you choose one, a photo.
• Your photo: you take it with Take a selfie or pick it with Choose a photo. Your phone crops it to a small square, about 10 KB, and sends it to our server, which removes everything stored inside the photo besides the picture itself — such as where and when it was taken and on which phone — before keeping it. Google's Cloud Vision service checks it once for nudity and violence, and a photo it flags, or cannot check, is not kept. We count how many photos you set each day, to limit it. Use my face instead removes it. Orbit1 reads only the one photo you choose, and uses the camera only after you tap Take a selfie (or, for a cost, after you tap to take its photo).
• Why: so the people in your circles can tell who is who. Everyone in your circles sees them.

Your location

What. While sharing is on, each position your phone sends contains:

• where you are (latitude and longitude) and how accurate that is;
• your speed and direction of travel, when your phone reports them;
• the time your phone took the position;
• your phone's battery level, and whether it is charging;
• whether your phone judged itself still, and whether it is waiting to move before it reports again;
• whether you are walking or in a vehicle, judged from your speed, and since when you have been still, walking or moving;
• which of your phones sent it, as its make and model and a short code (for example "samsung SM-X716B · xg5m"), kept with your timeline;
• how the position came to be taken (for example a regular update, arriving at or leaving one of your places, or someone asking);
• if a setting on your phone may stop it sharing (battery optimisation, pausing unused apps, or a permission), which setting.

How. From your phone's own location service, which may use GPS, Wi-Fi and mobile networks. Sharing starts when you tap Not sharing at the foot of the map (before your first start it reads Not sharing yet · Start), then Start sharing, and allow location. Orbit1 keeps your choice with your account, so if you sign in on a phone that already allows Orbit1 to use location all the time, sharing starts again by itself unless you last chose Stop sharing.

Once on, sharing carries on when the app is closed or not in use, after your phone restarts and after the app is updated, until you tap Stop sharing or Pause for 6 hours (or another length under Other times), sign out, or take location permission away in your phone's settings. A pause stops sharing for the time you choose, up to a day; the people who see you are told until when. When it ends, our server sends your phone a message with no position in it: an Android phone starts sharing again by itself, and an iPhone shows a notice and starts again when you open Orbit1. On Android, Orbit1 posts a notification, "Orbit1 is on", while it runs; opened, it says "Your circle can see where you are." Android shows it unless notifications for Orbit1 are turned off. Its Pause for 1 hour pauses sharing for an hour; if someone asked to be told when you stop sharing, it opens Orbit1 first, which names them. A tap anywhere else on it only opens Orbit1. Positions are sent more often while you move and rarely while you are still; a still iPhone sends nothing until it moves. An extra position is taken when you join or create a circle, when you arrive at or leave one of your places, when someone who sees you exactly taps Where now?, and a last one when your battery is nearly empty.

Why. Your location is used for these things and nothing else:

1. Your live position, for the people in your circles. Each person sees you as you choose for them: Exactly; Roughly (an area about half a kilometre across, updated less often); Town (an area a few kilometres across, updated less often still); or Nothing. Until you choose, a person who shares a circle with you sees you exactly. You can also choose When they see you: always, or only on the days and between the times you choose. People who see you roughly or by town are not given your speed, your direction, whether you are walking or driving, or since when. Everyone you share with sees your battery level and whether it is charging, a setting that may stop your phone sharing, and whether your phone is waiting to move — which is only ever so while it is still, so anyone you share with can tell when you are still. Your latest position stays in each circle until a newer one replaces it; when you stop sharing it is replaced by the time you stopped, and when you leave a circle it is removed.
2. Your timeline. Your positions are stored in five-minute batches and kept for 90 days. Only people who see you exactly can look back over any of it, and only as far as you allow each of them: the last 90 days unless you choose less: 24 hours, a week or 30 days. Someone you show on a schedule cannot look back over it at all. Each batch says which of your phones sent it.
3. Note when I'm over the speed limit. Off unless you turn it on, on that phone, for your account. Turning it on downloads, once, one file of the speed limits OpenStreetMap has for roads in Great Britain, from our own storage; the same file goes to everyone, so the download says nothing about where you are, and your phone looks for a newer one at most once a month while the app is open. While you drive, your phone compares the speed of each position it records with the limit for the road it is on. When it is over the limit by more than 10% plus 2 mph twice in a row, your phone notes when, your fastest speed and the limit — never where. This stays on your phone and nobody else can see it — unless you send your driving week (below), when the times you were over the limit during each drive you send go with that drive.
4. Alerts. Someone who sees you can ask to be told when you arrive at or leave one of your shared places, are not at one by a set time, your battery runs low, you stop sharing, or your phone has been in one place too long (2 to 8 hours, as they choose, counted between 08:00 and 21:00 their time, so we keep their time zone with the alert). They can also ask to be told when you arrive at or leave a place of theirs: your phone is given that place's name, centre and size to watch, and before you answer it says how far and which way that place is from you, and it tells them your comings and goings there whatever else they see of you; if they move or resize the place, the alert is deleted. You are told who asked. If they see you exactly, the alert starts at once and you can end it with Stop; otherwise it works only once you tap Allow. Alerts at your places and "in one place too long" need them to see you exactly. Your phone notices most events; "in one place too long" is judged by our server from the position your phone last sent and how long it has been still, because a still iPhone sends nothing until it moves. Our server records each event for them in the app; it also sends them a notification for "not there by a time" and "in one place too long" at once. Arriving, leaving, battery low and stopped sharing are gathered into one evening summary notification, at the time the person who set them chooses under Evening summary (19:00 unless they change it, or off), unless they turned on Tell me at once for that alert; so we keep their chosen time and time zone, and when their last summary went. A summary names people, never a place.
5. Where now? Someone who sees you exactly can ask your phone for a fresh position: up to 30 times a day each, and 100 times a day in all. Our server sends your phone a message that contains no position, and your phone answers like any other update. On an iPhone you see a notification each time; on Android nothing shows. Every ask that wakes your phone is listed in your Who looked at you, and so is each time someone opens your card.
6. Your places. Places you keep (a name, a centre and a size) are watched by your phone so that it knows when you arrive or leave. You choose who sees each place: circles, people, or both. A circle you choose includes anyone who joins it later, unless you untick them. Only people who see you exactly can see a place — its name and where it is, while you are sharing — and see that you are there; each of them can also tell who else it is shared with. Who you ticked, and who you left out, only you can see. A place can be as small as 50 metres across the middle; arriving at and leaving one smaller than 100 metres is still judged at 100 metres, because phones do not watch smaller areas reliably.
7. Occupied places. You can turn on Show when occupied for a place of yours, and choose who counts (anyone you see exactly, or people you choose), how many, and for how long they must be there first. Then each person who sees that place sees it change colour on their own map, and in their list of places, while enough of those people are there. This is worked out on each person's phone, only from the people that phone already sees exactly, and nothing about it is sent anywhere: a place is never coloured on a phone because of somebody that phone does not see exactly. The colour is each person's own choice, kept on their phone. If you also turn on Keep the colour until someone resets it, each phone keeps the place coloured after they leave until somebody taps Reset colour. A reset is the one part that is stored: who reset it and when, on the place itself, where everyone who sees the place can read it. The app says "name reset place" (in the list of places and in the circle's activity) only on phones that had kept the place coloured, and on the resetter's own; Reset colour is offered whenever the place stays occupied, whatever the resetter's own phone shows, so a reset does not prove that anybody was there. It is not sent as a notification, and one account can make at most 30 a day. It is kept until the next reset, or until the place or your account is deleted. Who you chose to count is stored with the place, so everyone who sees the place can tell who counts.
8. Directions. Someone who sees you exactly can tap Directions. After a line telling them so, their phone hands your position, as coordinates with no name, to their own maps app, which may keep it. This happens only when they tap it.
9. How far away someone is is worked out on the viewer's phone from positions it already has. Nothing extra is sent.
10. Crash check. Off unless you turn it on, on that phone, for your account. While it is on and your phone is moving at driving speed, Orbit1 reads your phone's motion sensor (not the microphone, not the camera) and works out on the phone whether it felt a hard impact and then stopped. If it did, your phone asks Are you OK? for 30 seconds and tells our server that it is asking: the time it happened, your battery level, your speed just before, and how hard the impact was — never a position. If you tap I'm OK in time, nobody is told. If you don't answer, or tap Tell them now, our server tells everyone who can see you — except anyone who has paused sharing with you or blocked you — by a notification and in the app: your name and that you may need them, the time and your battery — and your speed only to those who see you exactly. Our server keeps the deadline itself, so they are told even if your phone is switched off or breaks. Anyone told can tap I'm on it, which the others told can see, and so can you: your card names who is on it, and our server keeps that list, for you alone, until you tap I'm OK or the incident itself is deleted. If you tap I'm OK later, they are told you are OK. Orbit1 does not call emergency services. It tells nobody outside your circles, except the emergency contacts you tick to be told after a crash, and only once someone in your circles has been told (see SOS). Hard braking, hard acceleration and sharp turns your phone notices while it is on stay on your phone, and are never sent — except hard braking and hard acceleration inside a driving week you choose to send (below).
11. Safety alert. Off unless you start one, from Safety alert on the map or under Your sharing, while you are sharing: you choose how long (15 minutes to 2 hours) and tap Start alert. Your phone tells our server when you started it and when it ends — never a position. If you tap I'm OK in time, nobody is told. If you don't, our server tells the same people, in the same way, as for Crash check (the emergency contacts you tick for it included, once someone in your circles has been told, see SOS) that you missed your safety alert, even if your phone is switched off. It is kept, and deleted, as a possible incident is. You can instead choose When I’m at a place: one of your places and a time, up to 12 hours ahead. Before you tap Start alert, the app shows who will see what, for example “Home by 23:30”. Only the people who see you exactly are told about it: they see that place’s name and the time at once, even if you have not shared the place with them, and are told when you get there (“Arrived” and the time, without the place’s name) or, if you have not arrived by then, as for a missed safety alert. Your phone judges that you have arrived from the positions it already takes, and keeps the place’s centre only until the safety alert ends or you sign out. Our server keeps your time zone with it, so the time is shown where you are.
12. SOS. Only when you start one: your circle is told, and the contacts you chose are sent a link that shows where you are exactly, for up to 24 hours (see SOS).
13. Emergency contacts after a crash or a missed Safety alert. Only the contacts you tick for it, only once your circles are told: they are sent a link that shows where you are exactly, until you tap I'm OK or for up to 24 hours (see SOS).
14. Your driving week. Off unless you choose someone. Your phone works out your drives from the positions it already keeps, and keeps them on the phone for 8 days. If you turn on Send my driving week for someone — only someone who sees you exactly — each drive that ends while anyone is chosen is sent to our server once, as your phone measured it, and you cannot change or remove it: when it started and ended, how far, your top speed, and the hard braking and hard acceleration felt during it while Crash check was on (the time, your speed before and after, and how hard). If Note when I'm over the speed limit is on, each drive also carries the times you were over the limit during it: when, your fastest speed and the limit. Never a position, a route or a road name. Everyone you chose who still sees you exactly can read your drives of the last 7 days — only those since you chose them, and only as far back as the timeline window you give them; someone who may also read that day of your timeline can see where a hard stop was on it. Anyone you chose can tap Stop receiving to take themselves off your list. A train at speed counts as a drive. It is not offered under 18.
15. Phone in hand while I drive. Off unless you turn it on, on that phone, for your account. It is not offered under 18. While it is on and you are driving, your phone notes when its screen was on or it was unlocked and it was being held — when, for how long and how fast you were going. On an iPhone it notes only when the phone was unlocked. It never reads which app was open, what was on the screen, what you typed or your notifications, and asks for no new permission. It is kept with your drives, for as long as your drives are kept, and is sent only inside the driving week you choose to send (above). A phone cannot tell a driver from a passenger, so this is a note about your phone, not proof of who was driving: you can mark any drive I was a passenger, and anyone you send your driving week to then sees that drive's day, time and length marked Passenger and nothing else about it. That mark is kept beside the drive, for as long as the drive. Turning the switch off deletes what it noted on your phone; drives already sent keep theirs.

Your location is not used for advertising or for anything not listed here.

Names you type that others see

• Circle names are seen by everyone in the circle. Place names are seen only by you, unless you share the place — and a shared place's name can be kept in a report someone in your circle makes (see Reports).
• Names you give other people (with Rename on their card) are seen only by you. Our server uses them in notifications sent to you.
• Favourites (the star beside a person's name) are kept with your account and seen only by you; the person is never told.
• On a trip and in a cost tally, what you type is seen as Trips, Trip fun and The cost tally say.

Your circles and invitations

• What: the circles you are in, who else is in them, who owns each, when people joined, when a temporary circle ends, and each circle's activity (who joined, left, was removed and by whom, or renamed it, and when). A rename keeps the circle's name before and after, which only people in the circle at the time can read: anyone who joins later sees only that it was renamed, and by whom. Someone removed from a circle can still read the record of their own removal. For invitations: the code, its circle, who made it and when, and who used it. A code works once, for 6 hours.
• Why: so a circle works, so everyone in it can see who joined and left, and so a code cannot be guessed or reused.
• Links. A circle’s owner can also send one link that lets a set number of people in, for the days they choose, and works as a trip’s link does (see Trips): we count each use and note who used it, so someone who takes their ask back and asks again is counted once and the owner is told once; we keep how it was sent (a group chat or email, never any address), and with Ask me before each person joins the person waits for the owner, who sees their name and picture and gets a notification naming them, never the circle’s name. We note whose link they came by, so the right person’s Founder count goes up. Turn away keeps a record, which no app can read, that the person may not join that circle. Someone removed from a circle cannot come back by a link. If you send a link by email, your own mail app sends it: Orbit1 sends no email and keeps no address.
• Founder badge. An account made in the Founder period after launch gets a Founder badge, and someone whose invitations or links bring in new accounts during it can earn bronze, silver or gold. The badge shows to the people in your circles. The badge itself stores only a count of the new accounts you brought in, and it is not reduced if one is later deleted; the invitation and link records described above already note who made and who used each one, and someone waiting at a circle’s door carries whose link or code brought them until the owner answers.

Trips

A trip is a circle that ends by itself, at the time its owner sets. It can start up to a year after it is made and last up to a year. Everything said above about circles applies to it, and so does this:

• Trip links. The owner can tap Share link to send a link that lets a set number of people in, for up to 30 days at a time; the owner can renew it, and it never works after the trip ends. The code is in the part of the link a browser never sends to a website. We count each use of it. If the owner chose Ask me before each person joins, someone who uses the link — or any other invitation code into the trip — waits until the owner taps Let in or Turn away: while they wait, the owner (and nobody else in the trip) sees their name and picture, and gets a notification naming them, never the trip’s name. When they are let in, they get a notification saying so: that everyone on the trip can now see where they are, or, if they are not sharing, that they can tap Start so the trip can see them. Turn away, and removing someone from a trip, keeps a record, which no app can read, that the person may not join that trip. Only adults can join a trip.
• Meeting points. The owner, or whoever took the Sat Nav job (see Trip fun), can set a meeting point: a name, a spot on the map and, if they like, a time, and a note of up to 280 characters, which everyone on the trip sees. Everyone on the trip sees it, including people who see the setter only roughly or by town. A meeting point may be dropped where the setter is standing, and then it shows everyone on the trip where the setter was at that moment, whatever else they see of them; the app says so before it is set.
• Your own stops. Anyone on a trip can add a stop to the plan for themselves. It is seen by you and by the trip's owner and anyone with the Sat Nav job, so they can share it with the trip — but not by anyone you have blocked, or who has blocked you — and by nobody else. Only the owner or the Sat Nav can add a stop where they are standing. If you tap Send for approval, the owner and the Sat Nav get a notification with your name, never the stop's name or place, and if one of them approves it, everyone on the trip sees it from then on, as a meeting point. Changing the stop takes the request back. Your own stops are deleted at the same times as meeting points, when you leave the trip, or when you or the owner remove them, and they are in your data export.
• Placing a stop. When you place a stop or a meeting point you can type coordinates, paste a map link, type a UK postcode or search a UK place name. Coordinates and most map links are read on your phone and nothing is sent. A UK place name is searched on your phone, in a list of UK places from OpenStreetMap that your phone downloads whole from our own storage the first time you search, so what you type is sent to nobody. A short map link (one with no place in it, from Google, Apple or OpenStreetMap) is sent to our server, which follows it to find the place; Google, Apple or OpenStreetMap then sees our server ask for that link, never your phone or your account. A UK postcode is sent to our server, which looks it up in Ordnance Survey’s list of postcodes. Neither the link nor the postcode is kept or logged by our server; only the place you choose is kept, as the stop. Postcodes contain OS data © Crown copyright and database right 2026, Royal Mail data © Royal Mail copyright and database right 2026, and National Statistics data © Crown copyright and database right 2026.
• A trip's look and contacts. Whoever runs a trip can give it its own colours and a logo, and a company's name, phone number, 24/7 number, email address, website, WhatsApp number and the link to a WhatsApp group. Everyone on the trip sees them; they never say where anybody is. A logo is checked automatically for images that are not allowed, as a photo of you is, and is kept as a new picture, so nothing the camera recorded with it, such as where it was taken, is kept. Orbit1 never opens the WhatsApp link itself: it opens only when you tap Join the WhatsApp group, and then WhatsApp shows your phone number to the group, as it does for anyone who joins. If you have blocked the person who runs the trip, the app does not show you their logo or the link. Any of it can be reported. It is deleted with the trip.
• Things to bring. On a trip’s plan, under Bring, anyone on the trip can add something to bring: a line of text, and who it is for. The owner can add it for everyone on the trip. Anyone can add it for people they choose: then only those people and the person who added it see it, unless they turn on Everyone can see it’s for that person, when everyone on the trip at that moment sees it (someone who joins later does not). If you have blocked someone, the app does not show you what they added. Only me is kept on your phone and never sent to us. Your ticks stay on your phone too: nobody, the owner included, sees what you have ticked. What someone else typed can be reported. A thing to bring never says where anybody is. When you leave a trip, what you added goes, and you are taken off what others added for you. Your phone notes when the list last changed, from the trip itself, so it can mark what is new for you; it does not say what changed or for whom.
• Tour companies. An adult can make a company to plan tours: its name and contact details, tours (a name, how many days, stops with a place and a time, things to bring) and the dates each tour runs, with the email address of the guide for each date. A guide can turn down a date that names them. You can ask other people to help run it by email; they join only by signing in with that address. Only the company's owner and the people helping run it see any of this, and the people on the team see each other's display names; the email addresses of asks still waiting are shown to the owner alone, and an ask you cancel or that is not answered in 30 days is deleted. When a date is made into a trip, the company keeps only that it was made, and when: never who joined the trip or where anybody is. A file you import is read in your browser and only the tours and dates it makes are sent to us; a postcode or a short map link in it is sent to our server to find the place and is not kept. A company can also have colours and a logo. The logo is checked automatically for images that are not allowed, and it is kept as a new picture, so nothing the camera recorded with it, such as where it was taken, is kept. They are shown to everyone on any trip made from the company's tours, and kept until the company is deleted. If you delete your account, a company you own passes to the person who has helped run it longest, or is deleted with its tours and dates if nobody has.
• Your flight. On a trip you can add your own flight to the trip's plan: the flight number, the airports and the times you type. Our server then finds the plane and asks you to confirm it, and keeps the plane's call sign, its radio address, its type and the two airports, and any call sign you said was not yours. While the flight is in the air we keep where the plane was last seen, its height, direction and speed, how far it is from where it lands, the time it was seen, the country or sea it was over, which flight-position service answered and when we asked. Only the people who see you exactly, at all times, see your flight, and only while you are sharing: not people who see you roughly or by town, or only at the times you chose under When, not people you have paused, and not anyone you have blocked. When you stop sharing, the plane's position is hidden from everyone else at once, and cleared at the next update or when it expires. Nobody else can add a flight for you, and Remove flight takes it off at any time. The plane's position comes from a public service (see section 3), which our server asks — never your phone — so that service is never told who you are. Your flight is in your Export.
• Transport. On a trip’s plan anyone on the trip can add a journey for themselves: how they travel (car, train, coach, flight, boat, bike, on foot or other), from and to as they type them, when it leaves and arrives, and a note. Only the owner, or whoever took the Sat Nav job, can add one for everyone on the trip. A journey for everyone is seen by everyone on the trip. A journey you add for yourself only is seen as your flight is: by the people who see you exactly, at all times, while you are sharing, never by anyone you have blocked, and only once the trip has started. It is a plan, never a position: it is not where you are. It is deleted a day after it arrives (or leaves, if no arrival time is given), at the latest when the trip ends, and when you leave the trip. What someone else typed can be reported.
• When a trip starts. A trip can start up to a year after it is made and last up to a year from its start. Until it starts, people can join it and plan: its plan, its things to bring, its costs and Trip fun's lists work, but nobody sees where anyone is through it: nobody on the trip sees anyone's position, history or flight through it, nobody is told about anyone's battery by its Minder or buddies, and the app does not offer a meeting point where you are standing. Anyone you also share another circle with still sees you there, as before. You can pause, narrow or block someone on the trip before it starts, and that holds when it starts. The owner can change the dates before the start, and everyone else on the trip is told. When it starts — at the time its owner set, or earlier if the owner taps Start now — everyone on it gets a notification saying it has started, and from then on it is like any other trip; nobody reads anyone's history from before the start through it.
• When a trip ends, everyone leaves it and it is deleted with its meeting points, its things to bring, its transport, its waiting list, its Trip fun and its activity. Its cost tally is kept for a while longer (see The cost tally).

Trip fun

Trip fun is a game the owner of a trip can turn on, only in a trip and only between adults. It never uses where anybody is.

• What: a label for one person (such as “Stag”, which the owner can rename), jobs (each a name and a line, such as Sat Nav or The Minder), secret missions (a line of text), and buddy pairs; and each person’s answers (yes or no to the label, taking, swapping or handing back a job, accepting, swapping or bottling a mission, saying Deal to a buddy). The owner types or edits the jobs and missions, and our server checks every word.
• Who sees what. A label is shown on the board only after the person it is about says yes. A job, once taken, is seen by everyone on the trip. A mission is seen only by the person dealt it — not by the owner, and not by anyone else — until the owner taps Reveal, when everyone on the trip sees who had which mission, and who bottled theirs. Who you were paired with as buddies reaches you only when you say Deal; once everyone in a pair says it, everyone on the trip sees the pair. For running the game, the owner sees the lists they wrote, who they asked to take the label and their answer, who was offered which job and whether they took it, and how many missions were dealt and answered — never who holds a mission or what it says.
• The Minder and buddies. If the person with the label agrees to let the Minder be told, the Minder is told when that person’s battery runs low, until the trip ends. Buddies who both say Deal are told when the other’s battery runs low, until 9am the next morning where the trip’s owner is, never past the trip’s end. Each of these is an alert about you (see Alerts): it needs you to be sharing with them, never says where you are, is sent to them as a notification, and you can end it with Stop.
• Kept for next time. When the owner saves the game’s lists, the trip’s label, jobs and missions (the words only, no people) are kept in the owner’s own account, for “Use last trip’s jobs”, until they delete them or their account.

The cost tally

Each circle can keep a tally of shared costs: who paid for what, how it is split, and who owes whom. No money moves through Orbit1: it holds no payment details, makes no payments and takes no fee; I’ve paid (or … paid me) only records that a payment was made another way.

• What: for each cost, its words (for example “Dinner at the harbour”), the amount and currency, who paid, who shares it and how much each, any tip or service on top, the time, who added or last changed it, and, if it is itemised, each item’s name and price, how many there were and whether it was shared (a bottle of wine, say), and who said they had which items and how many (Tap what you had). For each payment you mark: who paid whom, how much and when, and whether the person paid has tapped Got it. A cost that is removed stays in the tally, marked removed and by whom, until it expires. The tally also remembers the last payer and split chosen, so the next cost starts from them.
• Who sees it. Everyone in the circle sees every cost in its tally — its words, amounts, names and time — whatever they see of you on the map, including people who see you only roughly or by town, or whom you have paused. A cost’s words and time can say where you were, so write them as you would want the whole circle to read them. Someone who leaves while they owe or are owed money keeps seeing the costs from before they left and any cost that names them, until they are square.
• Photos of a cost. You can add a photo to a cost: a picture of the receipt or the meal, or a screenshot of a payment. Your phone shrinks it and saves it again before sending it, which removes what a camera stores inside a photo, such as where it was taken; our server removes it again before keeping it. From a screenshot, only the strips you swiped to reveal are sent; everything else never leaves your phone. A photo of a receipt or a meal keeps the time it was taken, nothing else of what was stored inside it. Before keeping it, our server sends the photo — already without what was stored inside it — to Google's Cloud Vision service, which checks it once for nudity and violence, as it checks a photo you choose as your picture; a photo it flags, or cannot check, is not kept. Everyone who can see the cost can see its photo, and anyone who sees one can report it.
• Export and deletion. Export includes every tally you can read, and on a trip your own Trip fun card, what its board says about you, and any circle or trip you are waiting to join or were turned away from. When you delete your account, your name, your remembered split and the photos you added are taken off every tally you were ever in, but the costs and payments stay, naming you only by your account number (a random code), because they record other people’s money.
• Reading a receipt. Receipt on a new cost reads a receipt you photograph into its lines, so you can check them and say who had what. You drag a frame round the items; the top and the bottom of the receipt, where it names the shop, its address and your card, are always left out, and a frame that does not leave them out is not sent. Nothing is sent until you have seen exactly what will be sent and tapped Looks right · send. Then only that frame, cut from the photo on your phone and without what a camera stores inside a photo, goes through our server to Google’s Cloud Vision service to be read. The lines in it may still show a shop’s or a dish’s name; no position is ever sent. Google reads it for us as our service provider, under our own Google Cloud account: it processes the picture in memory to read it and does not keep it or use it to train its systems (Google’s statement). We keep only the lines you then add to the cost, not the picture you framed. You can always type the lines instead with Lines.
• Other currencies. Each tally settles up in one currency, pounds unless whoever runs the circle chooses another. You can record a cost paid in another currency: the tally keeps the amount you typed, its currency, the exchange rate used, whether that was the European Central Bank’s rate for the day or one you typed (for example what your card charged), and the amount it comes to; everyone in the circle sees them, as they see the cost. The day’s rates are fetched by our server from a public service that republishes the European Central Bank’s rates; our server asks only for the day’s table and sends nothing about you, and your phone never contacts that service. If the tally’s currency is changed, every cost is converted again and everyone sees who changed it.

SOS

SOS is for when you need the people close to you. It is off until you start one, it is only for adults, and starting one does not start sharing your location.

• Your contacts. You can add up to 3 people to text when you start an SOS: a name and, for each, a UK mobile number (only UK numbers for now), an email address, or both, which you type (Orbit1 does not read your phone's contacts). They are kept with your account, and only you can see them: nobody in your circles learns who they are. They are in your Export, and deleted when you remove them or delete your account. Add only people who would want to hear from you this way.
• Starting one. You hold the SOS button, then a 10-second countdown runs, and Cancel stops it with nobody told. When it ends, our server tells your circles and texts or emails your contacts — even if your phone is switched off or breaks in the meantime.
• Your circles are told as for a possible incident (see Crash check): everyone who can see you, except anyone who has paused sharing with you or blocked you, gets a notification saying you started an SOS — never a place — and sees it in the app until it ends. What they see of your position is what they already see. You can choose, under Emergency contacts, whether an SOS tells everyone you share with (the default), only the circles you tick, or only your emergency contacts. This changes only who is told of an SOS, never who can see where you are. Your choice is kept with your contacts, and with each SOS it was told under.
• Your contacts are sent a message by our server in every way you gave for them: a text message through Twilio, our SMS provider, and an email from sos@orbit1.uk through Resend, our email provider. Each says your first name, that you started an SOS in Orbit1, and a link of its own (a contact you gave both a number and an address gets one link in the text and another in the email); the email also says why they are getting it and how to stop these emails. The first contact is told at once and the rest 2 minutes later, even if someone says they are on it. Your circles are told again, up to 3 times in all, until someone in your circles or among your contacts says they are on it; if everyone in your circles who said so stops sharing with you, or you with them, and no contact has said so, your circles are told again. To stop Orbit1 being used to send many messages, each day's messages are limited: for your account, for Orbit1 as a whole, and for each number or address, which on one day can be reached by only a few accounts (3) not yet trusted (below); an account that is trusted is never held by that. Two contacts with the same number or address get one message between them. Part of Orbit1's daily allowance is kept for an account made more than a week ago, whose contacts were saved more than 6 hours ago, and whose SOS told someone in a circle; so on a very busy day a contact may not be sent anything. Your SOS bar then says so and asks you to call them. Twilio receives each contact's phone number, and Resend each contact's email address, with your first name and a link that shows your live position while your SOS is on, to deliver the message, under their privacy notices (Twilio, Resend); the message itself carries no coordinates and no place name, and neither provider receives your own phone number or email address. A reply to an email comes to us, at support@orbit1.uk.
• The link opens a web page with no app and no sign-in. While your SOS is on, it shows where you are exactly, the time that position was taken, and your battery — whatever the people in your circles see of you — how you are moving (for example "Moving, 30 mph"), and who has said they are on it, without naming anyone in your circles (it says "Someone in your circle") or your other contacts. It shows no history and no place names. Anyone who has the text can open the link, so it works only while your SOS is on: it ends when you tap I'm safe, when you end that contact's link, when you tap Stop sharing link (which ends every contact's link but leaves your SOS on for your circles), or 24 hours after it was sent, whichever comes first, and then it shows only "This link has ended." If the position it would show is more than a minute old, a contact who has opened the page (touched it or pressed a key) makes it ask your phone for a fresh one, as Where now? does. You see when each contact opens their link — when they touch the page or press a key on it, so a link that something only previews is not counted — and when they tap I'm on it. Your circles see that "a contact" is on it, never the name you gave them.
• I'm safe ends the SOS: every link stops at once, your circles are told you are OK, and each contact who was told is sent one more message, in the same ways, saying you are safe.
• After a crash or a missed Safety alert (only the contacts you tick). For each contact you can tick Also tell them after a crash or a missed Safety alert; it is off until you tick it. Then, if Crash check asks "Are you OK?" and nobody answers, or a Safety alert you set runs out, or you tap I need help on either — and only once someone in your circles has actually been told, never before and never if nobody could be — our server sends the contacts you had ticked at that moment, and still have ticked when it is sent, the same kind of message and link as an SOS, in every way you gave for them, once. A contact you tick afterwards is not sent it, and no link is sent more than 24 hours after your circles were told. It says your first name and that you may have been in a crash while driving, or missed a Safety alert, or that you asked for help after a hard impact or during a Safety alert — never a place — and the link shows where you are exactly, your battery and how you are moving, as an SOS link does. This is the one time someone outside your circles is shown where you are without you acting at that moment, which is why it is only for the contacts you tick, beforehand, on your own phone; your card says which of them are sent it. I'm OK ends every link at once and sends each of them one more message saying you are OK; Stop sharing link on your card ends every link and leaves your circles told, and you can end one contact's link alone; otherwise a link ends 24 hours after your circles were told. Your card, your lock screen, Safety alert and Crash check say the contacts you ticked before anything is sent, and afterwards your lock screen counts only those our server sent it to, and your card says who was sent the link and who could not be. The same limits, opt-outs, providers and records apply as for an SOS. Only for adults.
• Stop SOS messages like this one. A contact can tap it on the page, and confirm, and then no Orbit1 account will send the number or the email address that link was sent to another SOS — a contact reached both ways has a link for each, and each stops only its own way. We keep a scrambled form of it (a one-way hash), not the number or address itself, so that we can check it before each message. Straight after a stop the page offers Undo, which takes back only the way that link was sent; a link sent before one link per way, which stopped both, cannot be undone (SR2b-2); otherwise write to us at the address in section 1 to remove it. Phone numbers and many email addresses can be guessed, so someone with access to our database could work one out from its scrambled form, and we treat it as the number or address itself.
• Call 999 (or 112 outside the United Kingdom) opens your phone's dialler with the number filled in; you choose whether to call. Orbit1 never places a call, does not contact emergency services and cannot promise that anyone will respond. In an emergency, call the emergency services (see the terms of use).
• What we keep. The SOS is kept, and deleted, as a possible incident is, with the number and email address each contact was sent to, so that the message saying you are safe goes to the same ones. For each link we keep whose SOS it is, which contact and the name you gave them, the scrambled form of the number or address it was sent to (so that Stop SOS messages like this one works), when it was sent, when it ends or ended, and when it was opened and claimed — never a position, and never the link itself, which exists only in the message. To limit abuse we count how many texts and emails your SOSes sent today, and how many Orbit1 sent today in all. To stop one person getting many SOS messages, we also note, for each day, which accounts not yet trusted sent a message that reached each number or address: its scrambled form with those account numbers (usually no more than 3). A trusted account is not noted. The note is deleted automatically the day after (so kept 2 to 3 days). It is not deleted with your account and is not in your Export, because it is kept by the scrambled number or address, not by your account.

Who sees you, and how

For each person you share with, we keep how precisely they see you, how much of your timeline they may read, whether you have paused them, and, if you chose When, the days and times they may see you with your time zone, so that the times are counted where you are. We keep the same about what each of them lets you see. Both people a record is about can read it.

Stop sharing with this trip (or group), on Your sharing or the circle's page, keeps you in it and pauses what you share with everyone you share only that circle, or only circles you stopped, with: we keep which circles you stopped with your account. Someone you also share another circle with goes on seeing you through it, and the card says so. They see that you paused, as after any pause, never which circle. Share with this trip again gives them back what they had, but not your timeline from before you started again. An SOS still tells the people in the circles it would tell.

Block on a person's card keeps a record, read only by you, that you blocked them and when. While it stands, your sharing to them stays paused, even if you share another circle later; alerts you set about them, and theirs about you that relied on what you shared, are removed; your driving week stops going to them; and you are not told of their possible incidents or missed safety alerts. They see only that you paused sharing with them, never the word blocked. Unblock deletes the record and gives nothing back by itself.

Who looked at you

When someone opens your card while it shows your position, opens your timeline, or asks where you are now, we record who and when. Only you can read the list, under Who looked at you, and the person who looked cannot erase it. Your own looks at other people are recorded in their list the same way. Seeing you on the map or in the list is not recorded, and a changed copy of the app could look without being recorded.

Notifications

So that your phone can be asked for a fresh position and receive alerts, Google's Firebase Cloud Messaging gives your phone an address (on an iPhone it works through Apple's push service). We store that address with a random code and an identifier for this installation of the app. No app can read them from our database; only our server uses them. Our notifications contain a name and what happened, for example "Sam asked where you are", and never a place name or a position.

Reports and the terms of use

• When you tap Report on a person's card, our server keeps a copy of their name and photo as your circle sees them and the names of the places they share with you (names only, never where they are), with the circle, your account number and the time. For a circle's name it keeps a copy of that name and of the circle's earlier names its activity shows you. The developer reads reports to act on them; nobody else can, and the person reported is never told who reported them. Reports are kept for 90 days, then deleted automatically. If you make a report, your own Export lists it, without the place names or photo in it.
• On a trip you can also report the words of the game (the label, the jobs, and the missions once revealed), a meeting point’s name and note, a thing to bring, a journey’s words, a trip’s company contacts or logo, a tour company’s or a tour’s name, and a cost’s words or its photo; a pet’s name or photo; the words typed in medical info shared with you (never anything picked from a list, a blood type or a number); and the words of a car or breakdown cover shared with you (its name, another provider’s name, the name on the cover and the note — never its registration, membership number or number to call). Our server keeps a copy of what you reported as it was — the words, or the photo — with the circle, your account number, the account number of the person it is about (whoever wrote or added it; for the game’s words, the trip’s owner), and the time, in the same way and for as long as any other report.
• When you create an account, we record which version of the terms of use you accepted, and when.

Protecting the service

• To stop abuse we keep counts: failed invitation codes (five an hour, then a pause; and, with no account named, how many wrong codes everyone together tried in each hour), when you last exported your data, how many reports you sent today, how many photos you set today, how many possible incidents and safety alerts your phone reported today and when the last one was, whether your phones have been told that a pause ended, how many times today your phone was asked for a fresh position and by whom, how many alerts your phone reported in the last ten minutes and today, how many costs, payments and changes you recorded in a tally today, how many cost photos you added today, and when you last did something in Trip fun.
• App Check. The app asks Google Play Integrity (Android) or Apple DeviceCheck (iPhone) to confirm that requests come from the real app on a real phone. This sends information about your phone and the app to Google or Apple, and we receive only a token saying whether the check passed. It includes no location.

App updates

When you open Orbit1 (at most once a minute), it asks Expo's update server whether a newer version of the app's code exists. The request carries your IP address, a random identifier the update system makes for this installation, your phone's platform, and the app's version and update channel. It carries nothing about your account or your location.

The map

The map is drawn from map files we keep in our own Google Cloud Storage space, in the United States. To draw the area on your screen, your phone fetches pieces of those files, so Google sees your IP address and which pieces were fetched, and so roughly which area you were looking at. We have not switched on access logs for it, so we keep no record of who fetched what. Map data © OpenStreetMap contributors.

Our map files cover the United Kingdom, and the coasts just beyond it. When the map shows somewhere outside that area — because you moved it there, or because the people it opens on are there — Orbit1 shows Apple Maps on an iPhone and Google Maps on an Android phone instead, and switches back when you look inside it again. Apple or Google then draws the whole map area, including the part behind Orbit1's panels and not only the part you can see, so it receives your IP address and that whole area; Google's map on Android also sends Google technical details of your phone and the app, crash reports from the map software, an identifier for it, and how you move and zoom the map. The area someone looks at may be where you are: when a person who sees you opens your card while you are outside that area, Apple or Google learns the area around you from their phone, though not that it is you. They receive no position, name, place or route from Orbit1: the people, places and routes are drawn by Orbit1 on top of their map, on your phone, so they do not learn who is in your circle or who shares with whom. We switch off every extra of their map that we can: its own location dot, places of interest, traffic, buildings and indoor maps. Each handles this under its own terms: Apple Maps & Privacy and the Google Privacy Policy (with the data the Maps SDK for Android collects).

Diagnostics

Your phone sends no technical record of its own, but for a crash report you choose to send (below). Only test accounts the developer has marked as their own send the app's technical record to our database every few minutes: how and when it took positions, distances, accuracy, speed, battery, timings, phone settings and errors, with every coordinate removed, kept for 7 days. For every other account the app does not read that record for sending, and nothing of it leaves the phone.

Crash reports

If Orbit1 stops working, the next time you open it, it asks Send this crash report?. Only if you tap Send — or turn on Send crash reports under You › Privacy, which is off until you do — does your phone send us that one report. It says which part of Orbit1's code broke (the names of the functions and files and the line numbers), the app's version and build, which version of its code was running, your phone's model and its system version, and the minute it happened. It never holds where you are or were, your name, your email, your account, your circles, an ID for your phone, the error's own words, or anything you typed. See exactly what is sent shows you the report before you choose. Don't send deletes it from your phone at once; a report you have not answered is deleted from your phone after 7 days, and at most 5 wait. It goes only to Orbit1's own database, not to any other company, and only the developer reads it. Because it names nobody, it is not linked to your account: it is not in your export and cannot be deleted with your account; it is deleted on its own after 30 days. We ask for your consent each time, or once with the switch, and you can turn the switch off at any time; it also turns off when you sign out, and any report you have not agreed to send is then deleted from your phone, so the next person to sign in on it never sees it.

Google and Apple also collect crash reports from phones whose owners allowed it in the phone's own settings, and show them to us; that is their collection, under your settings with them, not Orbit1's.

On your phone

Orbit1 keeps on your phone the positions it has not yet sent (the oldest are dropped after a few thousand), its own technical log, and your settings, in the app's private storage. Positions waiting to be sent are discarded when you sign out. So are costs and payments you recorded while offline and not yet sent (up to 50). On an iPhone, your phone's own backup, if you use one, may copy this storage under your backup settings. Android does not copy Orbit1's data into your Google backup or onto a new phone. Export saves what we keep about you to a file in a folder you choose; we keep no copy of that file. It leaves out, and says so: whether anyone reported you and who (in a small circle that would name them), your phone's push address, the counters that limit how often something can be done, the code of an invitation, and the developer's diagnostic records.

When you sign out or delete your account, the app removes from your phone its technical log (which holds recent positions, including ones never sent), your last position, the places it suggested, and its copy of what you were shown, other people's included.

Moving to a new Android phone. When you are signed in, the app asks Android to make a restore key: a key Android keeps for Orbit1 and copies, encrypted end to end under your screen lock, with your Google backup or a cable transfer to a new phone. Our server keeps only the key's public half, which cannot sign anybody in, with which phone made it and when. When you set up a new phone from that backup or transfer, Orbit1 uses the key once to sign you in, then makes a new one. Your other phones are sent a notification that Orbit1 was signed in on a new phone, and the app shows when under Sign out; we keep only that time, until the next such sign-in or your account is deleted. Your sharing does not start on the new phone until you tap Start sharing there. Signing out removes the key from that phone and from our server; deleting your account removes every key. It is not offered on iPhone or on the website.

The website

At orbit1.uk you can sign in and use your circles, trips and account as you do in the app. The website never takes, shares or sends your position, and it gets no notifications: start, stop and pause are on your phone. It shows you on its map from the last position your own phone sent, greyed when it is not live; your browser's own location is never asked for. Everything you see follows the same rules as the app, and opening someone's card or timeline there is recorded in their Who looked at you, as it is in the app.

• In your browser. While you are signed in, your browser keeps your sign-in and your display settings. Closing the browser ends the sign-in (a tab the browser reopens within 5 minutes may still be signed in), unless you tick Keep me signed in on this computer when you sign in; then it lasts until you sign out. Signing out removes everything the website kept in your browser except how it looks (light or dark, and colours). On a shared computer, never tick it, and always sign out.
• The map on the website is drawn only from our own map files (see The map): outside the area they cover it shows an empty map, never Google Maps or Apple Maps. Google sees your IP address and which pieces your browser fetched.
• Hosting. Google (Firebase Hosting) serves the website, so it receives your IP address, your browser's details and the pages you open. Continue with Google opens Google's own sign-in window, and nothing of it is loaded until you press it.
• Export on the website downloads the file to your browser's downloads folder, after saying so. We keep no copy; on a shared computer, delete it after.

The website has no analytics, no advertising and no tracking cookies.

Pets

You set up a collar with the code on the card that came with it. We keep which account set up which collar, so that nobody else can, until you remove the pet or delete your account; then the collar can be set up again by whoever it is sold to next, and nothing of yours is kept with it.

If you add a pet with a GPS collar, the collar sends its position, the time, its speed and direction, its battery and what it is doing (for example still, or an SOS press) about every 30 seconds while it moves. It sends them over its own mobile SIM to 1NCE, the SIM's network, which passes each report to our server. Nothing about the collar is sent from your phone.

You see your pet, and its timeline. You choose which of your circles it is shown in, and you can switch that off at any time, apart from your own sharing. In those circles only the people you let see you exactly see it, while you share it with them; anybody you show roughly, by town, at set times, or have paused or blocked, sees no pet at all. A pet's position shows where whoever walks it is, so tell anybody who walks your pet that it is on the map; your pet is on their map too. A pet's photo, if you add one, is checked and has its hidden details (such as where it was taken) removed, as your own picture is.

A pet's timeline is kept for your timeline window (90 days), then deleted automatically. Removing the pet, or deleting your account, deletes it, its timeline and its photo at once, and your export includes them.

Cars and breakdown cover

You can add your cars and your breakdown cover under Cars & cover. For a car we keep what you type: its registration, a name for it if you give one, and its MOT and road-tax dates. For breakdown cover we keep the provider, the number to call, your membership or policy number, the name on the cover, whether it is for you or for one of your cars, and the renewal date and note if you add them. None of this is your location, and we never keep where a car is.

Only you see them, until you share a car or a cover with people you choose from your circles. Each person is asked first and sees it only after they tap Accept; until then they see only that you offered it and what it is called (its name, or “a car” if you have not named it). Once they accept, they see it as you keep it, so a renewed number or a new MOT date reaches them, and they keep a copy on their phone so that the calling card works with no signal. A phone that is offline when sharing stops keeps showing it until it next connects. You can stop sharing at any time, and so can they. Sharing also ends if either of you blocks the other, or if you no longer share any circle. Anybody who has seen your membership number could have written it down.

Call opens your phone's dialler with the provider's number in it; nobody is told, and nothing is sent to the breakdown company or to anybody else. We do not sell cover or pass your details to any provider.

Your cars and cover are kept until you remove them or delete your account. Removing one ends every share of it. Deleting your account deletes them and every share you made or were offered, and ends your access to what others shared with you. Your export includes them.

Medical info

You can keep medical information for a doctor or paramedic under Medical info: your blood type, allergies, medical conditions, medicines, implants and devices, whether you are an organ donor, your NHS number, your UK Global Health Insurance Card number and expiry date, private or travel insurance (the insurer, the policy number and the 24-hour number), and a note for staff. This is health data, which the law treats as a special category of personal data. We keep it only with your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)): before anything is kept you tick I agree to Orbit1 keeping my health details, and we record when you agreed and to which wording. You withdraw that consent with Delete medical info, which deletes all of it.

Only you see it, until you share it with people you choose from your circles. Each person is asked first and sees it only after they tap Accept. A share ends when you stop it, when either of you blocks the other, when you no longer share a circle, or when either of you deletes your account. Each phone that can see it keeps a copy, so it can be shown with no signal; a phone that was offline when a share ended keeps its copy until it next connects, and anybody you shared it with could have written it down. On an iPhone, the copy the app keeps for you is in a place iCloud backups do not reach.

Show doctor shows your medical info in the language of the country your phone is in, worked out on your phone from its time zone or region setting. Headings and anything picked from a list are translated from words built into the app. Words you typed are shown as you typed them, marked as written in English. Medicine names are never translated. Nothing medical is sent anywhere to be translated.

It is kept with your account on our backend (Google Cloud, Firebase, as for every account), encrypted in transit and at rest, but not end-to-end encrypted. We use it for nothing but showing it to you and the people you shared it with, with one exception: if somebody you shared it with reports what you typed, the report keeps a copy of the words you typed (typed allergies, conditions, medicines and implants, an insurer's name and your note — never anything picked from a list, your blood type or any number) for 90 days so we can look at it, even if you delete your medical info in that time. Orbit1 does not check it and gives no medical advice. Your export includes it; what others shared with you is listed in your export by who and when, without their details, which are theirs.

What Orbit1 does not do

No ads, and your location is never sold. Orbit1 has no advertising identifier, no analytics service and no other company’s crash-reporting service, and does not follow you across other apps or websites. It does not read your contacts, files or microphone, and uses your camera or your photos only when you tap to take or choose a photo — for your picture, a cost, a pet or a logo — or to scan the code on a pet collar’s card, and then only the one photo you take or choose. The Google and Apple software built into the app talks to its own services to do its job, and may send them technical information about the app installation, as each describes in its own documentation.

3. Who else handles your data

The people in your circles see what section 2 describes, as you choose for each of them.

Service providers run parts of Orbit1 for us. We share personal data with them only so that they can provide that service, and each of them is bound to give it the same or equal protection as this policy and the app stores' rules require. They are:

• Google (Firebase and Google Cloud): sign-in (Firebase Authentication and Google Sign-In); our database for your account, timeline, circles, trips, places, alerts, cost tallies and records (Cloud Firestore, in London); live positions (Realtime Database, in Belgium); our server code (Cloud Functions, in London); the check of a photo you choose as your picture or add to a cost, and reading the frame of a receipt you send (Cloud Vision); notifications (Firebase Cloud Messaging); App Check and Play Integrity; the map files (Cloud Storage, in the United States); the jobs that end temporary circles and pauses, open and close sharing schedules, and look for a phone in one place too long (Cloud Scheduler); the deadlines of possible incidents and safety alerts, a second pass of an account deletion an hour later, and a repeat, 30 seconds later, of the tidy-up when someone leaves a circle (Cloud Tasks); and our server's own logs (Cloud Logging).
• Apple, on iPhone: Sign in with Apple, Apple's push notification service and DeviceCheck; and Apple Maps, which draws the map when you look outside the area our map files cover (The map), under Apple's own terms.
• Google Maps, on Android: draws the map when you look outside the area our map files cover (The map), under Google's own terms.
• Expo (650 Industries, Inc.): the server the app asks for updates.

Google handles your data for us under the Firebase Data Processing and Security Terms and the Google Cloud Data Processing Addendum, which we have accepted for our project. Expo receives your phone's operating system, a random number for this installation and your IP address when the app checks for an update, under its own privacy policy (expo.dev/privacy); Expo is certified to the EU-U.S. Data Privacy Framework and its UK Extension, which protects personal data sent from the UK to the United States.

The maps app on a viewer's phone receives your position only when someone who sees you exactly taps Directions.

1NCE (1NCE GmbH, Germany), the network of a pet collar's SIM, carries the collar's reports and passes them from its service in Frankfurt to our server, under its data processing agreement. It handles only what the collar sends; it is never sent your name, your account or your circles.

Flight positions come from adsb.lol, a free public service that collects what planes broadcast by radio (data © adsb.lol contributors, under the Open Database License). Our server asks it about a flight's call sign or the plane's radio address. It receives our server's address, that call sign or address, and the time; it is never sent your name, your account, your trip, your position or your phone's address. The airline and route codes we use to find a plane come from a public list our server downloads; nothing about you is sent to fetch it.

Twilio, our SMS provider, sends the text messages of an SOS for us, and Resend, our email provider, sends its emails, from sos@orbit1.uk. Twilio receives the contact's phone number, and Resend the contact's email address, with your first name and a link that shows your position while your SOS is on, and each handles them under its data processing terms and privacy notice (Twilio, Resend). Google's Cloud Tasks also keeps the time at which an unanswered SOS tells the next contact.

Because these providers work in the United Kingdom, the European Union and the United States, your data may be handled in any of them. We give your data to nobody else, unless the law requires it.

4. How we keep your data secure

• The app talks to our services over encrypted connections.
• Our database refuses every read and write its rules do not expressly allow, and they let each person read only what they have been given.
• The precision you choose is enforced by our server: a person who sees you roughly or by town is given only the blurred copy, never the exact one.
• Your date of birth and your phone's notification address cannot be read by any app, Orbit1 included.
• Invitation codes, fresh-position requests, alerts and exports are limited on our server, where no app can change the limits.
• Administrative access to our database is held only by the developer named in section 1; the other accounts with roles on our project are Google's own services.
• On your phone, Orbit1's data is in the app's private storage, protected by your phone's own security. Orbit1 adds no encryption of its own there.
• If a breach puts your data at risk, we will tell you, and the regulator, as the law requires.

5. How long we keep it

When you delete your account, everything above that is yours is deleted at once, except the few records listed on the account deletion page, which says why each is kept and for how long. Google, Apple and Expo keep their own operational records as their own policies describe.

6. Your choices and your rights

• Stop sharing, at any time. Tap the word at the foot of the map (Sharing), then Stop sharing. If someone asked to be told when you stop, the app names them first, and they are told. You stay stopped on every phone until you start again.
• Choose what each person sees. On their card, tap Change, then Exactly, Roughly, Town or Paused, and choose how much of your timeline they can see. Under When, choose whether they see you always or only on the days and between the times you pick. Block on their card pauses your sharing to that person. Anything you chose other than Exactly at all times — Roughly, Town, Paused, Block or a When schedule — stays if the circle you share with them ends and you share another later.
• Leave a circle. Tap the circle's name at the top of the map, then Leave.
• Decline an alert someone asked for: open Alerts and tap Decline.
• Turn location off for Orbit1 in your phone's settings, and it cannot collect your location at all.
• Get a copy of your data. Tap your picture at the top of the map, then Export.
• Delete part of your history. Tap your picture at the top of the map, then Delete part of your history, choose the last hour, the last 2 hours, today, a whole day or between two times, then Continue, the Delete button, and Yes, delete it. Where you were in that time is deleted from your phone and from our server; your account, circles and sharing stay, and nobody is told. What stays:
  • a file you already exported
  • a screen already showing your day, until it is closed
  • alerts already sent about you
  • drives you sent and safety alerts from that time
  • your places and meeting points
  • positions another of your phones has not sent yet
  • your phone’s own backup, if you use one
  • the app’s technical log on your phone, until it is overwritten
  While you are sharing, your circle still sees where you are now.
• Delete your account. Tap your picture at the top of the map, then Delete account, then Delete account again, then Yes, delete it. Without the app, see the account deletion page.

You can also ask us, at the address in section 1, to see, correct or delete your data, or to object to how we use it. We share your location only because you choose to, and you can withdraw that choice at any time with Stop sharing; we keep your account because you asked us to provide Orbit1. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office, the UK's data protection regulator (ico.org.uk).

Age

Orbit1 is not for anyone under 18. If we learn that an account belongs to someone under 18, we delete it.

Changes to this policy

When this policy changes, the date at the top changes. Earlier versions are available from the address in section 1.