ORBITS Privacy Policy

1. Overview & Data Philosophy

ORBITS (“we”, “our”, or “the Platform”) is an independent social communication service. We are committed to transparency and minimal data collection. This Privacy Policy details our actual data handling flows across our client applications, server architecture, and third-party infrastructure.

Notice to Readers: This policy accurately reflects current engineering implementations (Django backend, Supabase PostgreSQL, Firebase Cloud Messaging, ZeptoMail, and Encrypted Chat Backups). Legal entities and governing jurisdictions must be verified prior to commercial publication.

2. Information We Collect and Process

We process the minimum data required to facilitate real-time communication:

• Account Credentials: Usernames, display names, and password hashes (stored securely using PBKDF2/Argon2). If email verification is enabled, your email address is processed solely for account confirmation and password recovery via ZeptoMail.
• Conversations & Metadata: Message text, delivery statuses, timestamps, and group membership records required for real-time routing and offline delivery. These are stored in managed Supabase PostgreSQL databases with SSL connection pooling.
• Media & Attachments: Images, voice notes, and files you send in conversations are uploaded to isolated cloud storage to enable recipient download.
• Technical Logs: Server access logs containing IP addresses and request timestamps maintained strictly for rate-limiting, anti-abuse, and operational security.

3. Chat Backup & Restore

ORBITS provides local encrypted file export and optional self-hosted cloud backup features. When you create a backup:

• Your messages and media are encrypted locally on your Android device using authenticated AES-256-GCM with an encryption key derived via PBKDF2 (100,000 iterations) from your passphrase.
• You can export the encrypted archive (.enc) directly to your device storage using Android's system file picker, or upload it to your account's private server storage quota.
• ORBITS servers never receive, inspect, or store your recovery passphrases or unencrypted messages. Plaintext archives are never uploaded.

4. Service Providers and Infrastructure

We work with trusted infrastructure providers strictly to execute core application functionality:

• Supabase: Managed PostgreSQL database hosting with enforced SSL encryption.
• Firebase Cloud Messaging (FCM): Push notification delivery service for Android devices.
• ZeptoMail / Transactional Mailer: Verification and critical security alert emails.
• Self-Hosted Private Storage: Dedicated encrypted blob storage for optional chat backups.

We do not use third-party behavioral analytics, ad brokers, or data aggregation SDKs (e.g., no Facebook Pixel, no Adjust, no Google AdMob).

5. Data Retention & Ephemeral Purging

Messages transmitted under CHAT-TIME™ are configured with automatic expiration lifetimes. Upon expiry, the corresponding records are purged from both device databases and server storage. Users may delete their account or conversation threads at any time.

6. Contact & Data Rights

To request data export, account deletion, or clarification regarding our privacy practices, contact our privacy response team at:

support@orbitschat.com