Draft for the private beta — subject to operator review before public launch.
Orbiting

Privacy Policy

Effective date: November 2, 2026 Operator: Patrick Jarrett Contact: hello@orbiting.us
In summary: Orbiting is built for small private groups of friends. We do not run advertisements, we do not track you across the web, we do not sell your personal data, and we do not use third-party analytics scripts. This document details exactly what the software collects, stores, and sends.

1. Who operates Orbiting

Orbiting is operated by Patrick Jarrett, an individual in the United States, reachable at hello@orbiting.us. Orbiting is currently in a closed, private beta.

2. What information is collected and how it is handled

Orbiting collects only the data needed to run a private social hub for you and your group:

  • Account information: When you join a group or set up Orbiting, we store your handle (username), display name, and an optional bio. Passphrases are never stored in plaintext; they are salted and hashed using scrypt (cost exponent 15) before being written to the database.
  • Two-factor authentication (TOTP): If you enable two-factor sign-in, your secret key is encrypted at rest using AES-256-GCM with a server secret key (or a 0600-permission key file stored beside the database). Single-use recovery codes are stored as SHA-256 hashes. Temporary sign-in challenges expire after 5 minutes.
  • Sessions and cookies: Signed-in sessions use a single HTTP-only cookie named orbit_session with SameSite=Lax and the Secure flag enabled over HTTPS. Sessions last for 30 days. The database stores the session token's SHA-256 hash, your user agent string, and last-seen timestamps to allow you to inspect active sessions and sign out.
  • Posts and group activity: Posts, replies, reactions, poll votes, event RSVPs, collections, and nudges that you create are stored in the application database and associated with your account and group.
  • Photo and video uploads: Uploaded media (JPEG, PNG, WebP, GIF, MP4, WebM) is stored on the server's disk with restricted file permissions (0600). Note on metadata: Files are served without embedded metadata; the location and time a photo was taken are stored separately and used only for features the poster chooses.
  • Feed subscriptions and remote media: When you subscribe to feeds or request link previews, Orbiting's background server fetches the feed metadata and article text using a guarded fetch routine. Remote servers see our server's IP address during those polling fetches, not your device's IP address. However, when you open a feed item in the application, its images and audio/video may load from the publisher's own site directly in your browser. When remote media loads, those publisher servers see your device's IP address and browser user-agent, just as when visiting any third-party website; those remote sites have their own independent privacy policies.
  • Connected Mastodon and Bluesky accounts: If you connect an account for outbound cross-posting, your Mastodon access token or Bluesky app password is stored encrypted in the database, used only to publish posts you choose to cross-post, never exported, and deleted when you disconnect the account.
  • Waitlist submissions: If you join the public waitlist on this website, we store your email address and the submission timestamp in a dedicated table. We do not store your IP address or user-agent with your waitlist entry.
  • Abuse limits: To prevent brute-force attacks and abuse, sign-in attempts, feed lookups, and waitlist submissions are rate-limited using in-memory sliding window counters. These counters are kept in memory only and discard all history when the server process restarts.
  • Logs: Orbiting outputs diagnostic logs to standard console output (stdout/stderr). Caddy reverse-proxy logging is not configured to record persistent access logs to disk.

3. Who can see your content

Orbiting has no public directory or public profile pages. Your posts, reactions, and media are visible only to fellow members of the group or circles you share with.

As the system administrator with root access to the hosting server, the operator has access to the server filesystem and SQLite database for operations, software upgrades, and troubleshooting.

4. Hosting and third-party services

Orbiting is hosted on virtual server infrastructure provided by Hetzner Online GmbH in their United States data centre located in Hillsboro, Oregon.

We do not use advertising networks, tracking scripts, customer analytics platforms, or external content delivery networks (CDNs). The marketing website itself loads nothing external and self-hosts all fonts and media.

Within the Orbiting application, when you open a feed item, its images and audio/video may load from the publisher's own site directly in your browser. Those remote publisher sites operate under their own independent privacy policies.

5. Data retention and backups

Personal data is retained according to the following policies:

  • Database backups: Orbiting takes atomic SQLite snapshots every 6 hours, keeping the 10 newest snapshots (retained for up to about 2½ days).
  • Host server images: Hetzner creates automated daily server snapshots, keeping 7 daily images (retained for 7 days).
  • Off-site backup copies: The operator keeps an additional backup copy on his own computer for no more than 30 days.
  • Feed articles: Ingested feed articles are automatically purged after 90 days by default.
  • Waitlist: Email addresses on the waitlist are retained until invites are issued or upon request for removal.

6. Data export and deletion

Members can download a complete portable archive of their group content and media from the Settings panel in the application.

Orbiting does not currently include a self-serve "Delete Account" button in the interface. To request account deletion, write to hello@orbiting.us with your handle and group. The operator confirms the request with you inside Orbiting, or through your group's owner, before deleting anything. To remove an address from the waitlist, write to the same address. Once an account or address is deleted from the active database, any copies in backups age out within no more than 30 days.

7. Children's privacy

Orbiting is not directed to children under 13 years of age. We do not knowingly collect personal information from individuals under 13. If you become aware that a child under 13 has joined Orbiting, please notify us at hello@orbiting.us so we can remove the account.

8. Changes to this policy

We may update this Privacy Policy from time to time as Orbiting develops. Any modifications will be posted to this page with an updated effective date.

9. Contact

For questions or requests regarding this Privacy Policy or your data, please contact Patrick Jarrett at hello@orbiting.us.