Where your data goes
Orbit1 exists to show your location to a few people you choose. That is some of the most sensitive data a phone holds, so we have built the app around one idea: your data goes to the people you chose, and as little of it as possible goes anywhere else.
The short version
- We never sell your data. There are no ads, no advertising identifier, and no analytics or tracking software in the app or on the website.
- Only the people you chose see where you are, and only as precisely as you chose for each of them. Our server enforces that, not the app.
- You always know you are sharing. You can pause or stop at any time, and you can see who looked at you.
- In the United Kingdom the map is our own. It is drawn on your phone from map files we keep ourselves, not from a map company.
- Your timeline is deleted after 90 days, automatically. You can export everything, delete part of your history, or delete your account, from inside the app.
- A handful of outside services do specific jobs for us. Each one is named below, with exactly what it receives.
How your location travels
Your phone sends your position to our backend and nowhere else. Our backend checks every single read against rules you set. It hands each person only what you allowed them, and refuses everyone else.
Who sees you, and how precisely
- You choose, person by person. Each person in your circles sees you Exactly, Roughly (an area about half a kilometre across), by Town (an area a few kilometres across), or not at all (Paused). You can also limit them to set days and times with When.
- The blurring happens before anyone can read it. Your phone writes a separate, already blurred copy for each level in use, and our server hands each person only the copy they are allowed. Someone who sees you roughly is never sent the exact one, whatever app they use. People who see you roughly or by town are not given your speed or direction either.
- Your timeline can be read only by people who see you exactly, only as far back as you allow each of them (90 days unless you choose less), and never by someone you show only at set times.
- No hidden mode. Sharing starts only when you tap Start sharing on your own phone. Everyone who can see you is listed in the app. On Android a notification says Orbit1 is on while it shares, unless you turn Orbit1's notifications off; on an iPhone, iOS shows its own location indicator when Orbit1 is using your location. You are told when someone sets an alert about you.
- Who looked at you. When someone opens your card, your timeline, or asks your phone where you are now, it is recorded in a list only you can read, and the person who looked cannot erase it. We are careful about what this promises: seeing you on the map or in the list is not recorded, and a modified copy of the app could look without being recorded. What we can promise is that every look from the app is recorded and cannot be erased.
- Stop or pause at any time. Stop sharing takes effect straight away. If someone asked to be told when you stop, the app names them first.
What we will never do
- Sell your data, or your location, to anyone.
- Show ads, or use your data for advertising or marketing.
- Put analytics, advertising or tracking software in the app or on the website.
- Follow you across other apps or websites.
- Read your contacts or your microphone, or look through your photos or files. The camera, a photo or a file is used only when you tap to take or choose that one.
- Put a place name or a position in a notification.
- Let someone see you through Orbit1 without you being able to see that they can.
What we collect, why, and how long we keep it
"Collect" means the data leaves your phone. The full list, with every detail, is in the privacy policy.
| What | Why | How long |
|---|---|---|
| Your email address and how you sign in | To sign you in | Until you delete your account |
| Your date of birth | Only to check you are 18 or over. Never shown, and no app, ours included, can read it from our database | Until you delete your account |
| Your name, the face you make, and a photo if you choose one | So your circles know who is who. A photo has its hidden details, such as where it was taken, removed before it is kept | Until you change them or delete your account |
| Your latest position, while you share | To show the people you chose where you are | Until a newer one replaces it; removed when you leave a circle |
| Your timeline (past positions) | So the people you allow can look back | 90 days, then deleted automatically |
| Your places | So your phone knows when you arrive or leave | Until you delete them or your account |
| Who looked at you | So you can see it | 30 days |
| Alerts others asked for, and what they saw | To tell them what they asked for, with your agreement | The shorter of 90 days and how far back you let them look |
| A possible crash, a missed safety alert, an SOS (never a position) | To tell the people who can see you | 30 days; an SOS link shows nothing after 24 hours at most |
| Costs in a shared tally | To work out who owes whom. No money moves through Orbit1 | On a trip, 30 days after it ends; otherwise 90 days after the newest cost |
| Medical info, if you add it | To show it to you and to people you share it with, only with your explicit consent | Until you delete it. If someone reports words you typed in it, the report keeps those words for 90 days |
| A pet collar's positions | To show your pet to you and the people you choose | 90 days |
| A crash report, only if you tap Send | To fix the app. It holds no location, name, account or phone identifier | 30 days, not linked to you |
| Our server's own logs (account numbers and counts, never positions) | To run and protect the service | 30 days |
| Backups | None. Our database keeps no backups, so nothing you delete survives in one. | |
A few records outlive an account for good reason, such as a report someone made. The account deletion page lists each one and why.
The few outside services, and exactly what each gets
Orbit1 has no ad networks, data brokers or analytics companies to list. These are the only services that receive anything, and what each one gets.
| Service | Its job | What it receives |
|---|---|---|
| Google Cloud and Firebase | Runs our backend: the database, our server code, sign-in and notifications | What Orbit1 stores, held for us under Google's data processing terms. The database is in London, live positions in Belgium, and our map files in the United States |
| Google Cloud Vision | Checks a photo you chose (your picture, a cost, a pet) or a trip or company logo for nudity and violence; reads a receipt you frame | That photo, with its hidden details already removed, or only the part of a receipt you framed and approved. Google states it does not keep these or train on them |
| Google Maps (Android), Apple Maps (iPhone) | Draws the map only when the map shows somewhere outside the UK | Your IP address and the area of map being drawn; Google also gets technical details of its map software. Never a position, name, place or route from us |
| Twilio (texts) and Resend (emails) | Send an SOS, or an alert after a crash or a missed safety alert, to emergency contacts you added and chose | That contact's phone number or email address, your first name, and a link that shows where you are while it is live. No coordinates or place names in the message |
| 1NCE | The mobile network of a pet collar's SIM | Only what the collar sends, which it already carries as the network. Never your name, account or circles |
| A public flight-position service (adsb.lol) | Finds the plane for a flight you add to a trip | Asked by our server, never your phone: a plane's call sign or radio address and the time. Never you, your trip or your phone's address |
| A public exchange-rate service | Gives the European Central Bank's daily rates for costs in other currencies | Asked by our server for the day's whole table. Nothing about you |
| Expo | Tells the app when a new version of its code is ready | Your IP address, a random number for this installation, your phone's platform and the app's version. Nothing about your account or location |
| Google and Apple sign-in | Sign you in, if you choose them | What any sign-in needs; Orbit1 asks Apple only for your email address |
| Google and Apple notifications, Play Integrity and DeviceCheck | Deliver notifications; confirm requests come from the real app | A notification address and the notification's words, which name a person and never a place; information about the phone and app. No location |
| Your phone's own location service | Tells your phone where it is | This is part of your phone, not something we add, and works under your phone's own settings with Google or Apple |
Text messages for an SOS are still being set up, so for now email is the dependable way to reach an emergency contact. Your card shows which contacts were sent the link and which could not be. The tracker shop has no payment service in the app at present.
What stays on your phone
A lot of Orbit1's work is done on your phone, so the data never has to leave it:
- Searching for a UK place name happens on your phone, in a list of UK places it downloads whole from our own storage. What you type is sent to nobody. Coordinates and most map links are read on the phone too; only a short map link or a postcode goes to our own server to be looked up, and is not kept.
- Speed limits come in one file for the whole of Great Britain, the same for everyone, so downloading it says nothing about where you are. Whether you were over the limit is worked out on your phone and stays there unless you choose to send your driving week.
- Journeys, drives, hard braking and how far away someone is are worked out on your phone from positions it already has.
- Whether a place is occupied is worked out on each person's phone, from people that phone already sees exactly. Nothing about it is sent.
- Showing your medical info to a doctor in another language uses words built into the app. Nothing is sent to be translated.
- Your ticks on a trip's list, and anything marked Only me, stay on your phone.
- The app's technical log stays on your phone. Only test accounts belonging to the developer send it, with every coordinate removed.
The map
In the United Kingdom, the map is our own. It is drawn on your phone from map files we keep in our own storage (on Google Cloud), built from OpenStreetMap. No map company draws it, and the people, places and routes are drawn by Orbit1 itself. To be exact about what that means: your phone still has to download the pieces of map it shows, so Google, which hosts our storage, sees your IP address and which pieces were fetched. We have not switched on access logs, so we keep no record of who fetched what.
Outside the UK, our map files run out, so the app switches to Google Maps on Android or Apple Maps on iPhone, and back again when you return. They then see your IP address and the area being drawn, which may be where someone in your circle is. They never receive a position, a name, a place or a route from Orbit1, and we switch off their own location dot and extras. The website never uses them: outside the UK it shows an empty map instead.
How it is protected, and what we do not claim
- The app and website talk to our services over encrypted connections, and Google encrypts the data where it is stored.
- It is not end-to-end encrypted. Our server can read what it stores, because it has to, to apply the rules about who may see what.
- Our database refuses every read and write its rules do not expressly allow. The rules check who you are and what the other person allowed, on every request.
- Limits on invitation codes, requests for a fresh position, alerts and exports live on our server, where no app can change them.
- Only the developer named in the privacy policy has administrative access to the database.
- The website has no analytics, no advertising and no tracking cookies.
Your controls
- Stop sharing: tap Sharing at the foot of the map, then Stop sharing.
- Change what one person sees: open their card and tap Change.
- Get a copy of everything: tap your picture at the top of the map, then Export.
- Delete part of your history, or Delete account: tap your picture at the top of the map.
- Turn location off for Orbit1 in your phone's settings, and it cannot collect your location at all.
- Questions: support@orbit1.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.