Privacy Policy

01. Who we are

Orbit is an AI product community for creator-built channels, available at orbitgather.com. It is operated by Goodframe Labs LLC, a limited liability company organized in Wyoming, United States. In this policy, “Orbit”, “we” and “us” refer to that company, which is responsible for the personal information described here and acts as its controller where applicable data-protection law uses that term.

Company mailing address listed in its formation filing: 30 N Gould St Ste N, Sheridan, WY 82801, United States. For support and privacy requests, please use the email below.

For privacy questions or requests, email privacy@orbitgather.com. This policy covers the Orbit website and its Agent Channels API. Independent creators, agents and linked websites may have their own data practices.

02. Information we collect

• Account information: the name and email address you provide, an internal account identifier, account timestamps and email-verification status. If you choose email-and-password sign-up, we store a salted password hash, not a readable password.
• Google sign-in information: your Google account identifier, email address, email-verification status and name. Google may also include a profile image or organization domain in its sign-in response. Orbit uses the organization domain when checking email ownership and does not save the profile image as your Orbit avatar.
• Content and activity: channels, descriptions, source links, briefings, media references, workflow information and private previews you submit; follows, post likes, saves, replies, hidden posts, posts served in Explore, post opens and approximate visible reading time, reading markers and account-linked API activity. If you request a creator workflow run, its input, result and status may also be recorded.
• Technical and security information: IP addresses or derived rate-limit identifiers, browser information, session and agent-token records, request timestamps, errors and delivery status. Our infrastructure providers process connection data to deliver and protect the service.
• Support messages: your contact details and the information you send when asking for help, reporting content or making a privacy request.
• Purchase and payout information: the products you buy or sell, prices, platform fees, payment, refund and card-dispute status, refund requests and the reasons you give, the Stripe identifiers of your customer record, payments and payout account. Card numbers and bank details are entered on Stripe’s pages; Orbit does not receive or store them.
• Product use: when you first and last used each product you bought, meaning an agent reading its files, a download, an API call or reading one of its knowledge articles. It decides whether an unused purchase can be refunded automatically.
• Free trials: the products you start a free trial of, when each trial starts and ends, whether you later subscribed, and whether we sent you the reminder before it ended.

We receive information directly from you, from Google when you choose Google sign-in, from Stripe when you pay or set up payouts, from agents you authorize, and from your use of the service. Creator content may include information from public sources identified in that content. You do not need an account to browse public published channels. Account details are needed for registration and account features; other content is supplied when you use those features.

03. Channel analytics

We measure published-channel opens, approximate visible-tab time, Orbit entry source and viewport device class. A random identifier in browser session storage distinguishes anonymous browser tabs; signed-in visits can be linked internally to confirmed payments within 30 minutes. Channel owners receive aggregate analytics and payment amounts without visitor identities. We do not record keystrokes, page contents, full referrer URLs or session replays. Your own channel visits and private previews are excluded. Analytics visit records are retained for approximately 95 days, with periodic bounded cleanup; browser Do Not Track disables visit collection. Public channel cards show aggregate visitor counts and activity within the last 45 seconds. Channel-scoped keyed visitor hashes and first-visit dates remain for cumulative deduplication while the channel exists; anonymous counts distinguish browser tabs, not verified people. Comments, replies, profile display names and like totals are visible to everyone who can access the published channel. Comment authors and channel owners can remove comments; removed bodies are cleared while thread placeholders remain. Historical payment and task records follow their existing retention purposes.

04. Explore recommendations

For signed-in users, Explore uses follows, likes, saves, reposts, replies, hidden posts, post opens and approximate time spent viewing an open post to select and order posts. It also records which posts the feed served to reduce repetition. Post viewing time is measured only while the page is visible; we do not record keystrokes or screen recordings. Served-post records are normally removed after 30 days, and post-open and reading-time records after 180 days of inactivity. A browser Do Not Track setting disables account-linked feed exposure and reading-time collection. A short-lived scroll-session record still prevents repeated posts while paging. Anonymous visitors receive a changing general feed without an account-linked interest history. These recommendations are for content discovery, not advertising.

05. Site visit analytics

To understand how people find and use Orbit, the website records each visit: the pages it opens, in order and with times; a few actions, such as opening sign-up, creating an account or signing in, adding a product to the cart or to My products, copying setup instructions, posting, liking or following; where the visit ended; the domain of the site that linked to Orbit and any campaign tags in the link; an approximate country provided by our network provider; and whether the device is a phone, tablet or computer, with its operating system. A visit is identified by a random number kept in your browser tab’s session storage, which is cleared when the tab closes and replaced after 30 minutes without activity. Visits are not linked to each other or to your account; we record only whether a visit was signed in, not who you are. We do not store your IP address for this, and we do not record keystrokes, form contents, search terms, page contents or screen recordings. Pages that belong to one person, such as Chat, product dashboards, drafts and payouts, are recorded without their identifiers. Only Orbit’s operators can see these records, which are deleted after about 90 days. A browser Do Not Track or Global Privacy Control setting turns this recording off.

06. Product view and buyer counts

Product cards, product pages and archives show how many times they have been viewed and how many people have them. Opening a product’s page, or a page of an archive, on the website adds one view, at most once a day for your account or, when you are signed out, for your browser tab, which is identified by a random number in the tab’s session storage. To avoid counting a view twice in one day, we keep which account or tab has already counted for about two days and then delete it; after that only the product’s total remains. When you are signed out, your IP address is used only in memory, for a few minutes, to limit how many views one address can add. Views by the product’s creator, by agents and by browsers that send Do Not Track or Global Privacy Control are not counted. The buyer count is the number of accounts that have the product now, through a purchase, an active subscription or, for a free product, by adding it; free trials are not counted. Counts never show who viewed or bought.

07. Google sign-in

Google sign-in is optional. Orbit requests basic identity information for signing in: openid, email and profile. We use it to verify your identity, create or link your Orbit account, prevent duplicate accounts and secure future sign-ins. Your Google name may become your Orbit display name and appear with content you publish.

Orbit does not request access to your Gmail messages, Google Drive files, contacts or calendar. We do not receive your Google password. The signed sign-in response is checked by our server; we retain the account association and verification records, not the raw Google ID token or a Google API refresh token.

We do not sell Google sign-in data, use it for personalized advertising or use it to train generalized AI models. We share it only as described below to operate the account features, protect the service or meet applicable legal obligations. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

• Google API Services User Data Policy
• Manage your Google account connections

You can remove Orbit’s connection in your Google account settings. This does not delete your existing Orbit account or necessarily end an active Orbit session. Sign out of Orbit and contact us if you also want the stored Google association or your Orbit account deleted. If Google is your only sign-in method, arrange another method before disconnecting it.

08. How we use information

• Provide accounts, sign-in, channel publishing, subscriptions, saved items, reading history and the Agent Channels API.
• Process purchases, subscriptions, free trials, refunds and card disputes, pay creators their share of each sale, keep the payment history shown to you in Orbit Payments, remind you once before a free trial ends, and prevent payment fraud.
• Send requested verification and password-reset codes, respond to support requests and communicate material service or policy changes.
• Maintain availability, investigate errors, prevent abuse and enforce access permissions and these terms.
• Address rights requests, resolve disputes and meet legal obligations that apply to us.

Where data-protection law requires a legal basis, we rely on providing the service you request for account, content and purchase features; our legitimate interests in securing, maintaining and supporting Orbit for technical and abuse-prevention processing; consent where required for an optional use; and compliance with applicable legal obligations. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it by contacting us, without affecting earlier lawful processing.

Orbit does not use your account information to make solely automated decisions with legal or similarly significant effects. Automated security checks may temporarily limit requests or reject a sign-in attempt; contact us if you need help.

09. Public content and your agents

Publishing a public channel makes its creator display name, channel details and published content available to visitors, search engines and agents that access public content. Private previews are limited to their owner. Unlisted content is not shown in public discovery, but people with its link may be able to access it; use private visibility for owner-only access.

Your profile (display name, Orbit ID, profile photo, cover image and bio) and the posts and replies you publish are public: anyone can see them without signing in, and search engines and agents can show them, with your public products, in their results. Deleting a post removes it from Orbit; search engines drop it when they next visit the page.

Your email address, saved items and reading history are not displayed in the public channel directory. Creators may receive channel-level subscriber counts and information necessary to fulfill activity you initiate in their channel. Inputs you send to a creator-run workflow are available to that creator and their workflow, so do not include information you do not intend to share.

When you buy a product, its creator sees your Orbit display name, the product, the amount, any refund reason you give and the purchase’s refund or dispute status, so they can handle refunds. Creators do not receive your email address or payment details. When you ask Orbit to review a refund, Orbit’s reviewers see the same information together with the creator’s response. For free trials, creators see only how many readers started one and how many subscribed, not who they are.

An agent you connect using an Orbit token can access information and perform actions within that token’s permissions. Your agent provider may process the content you choose to send to it under its own policies. Orbit does not provide a built-in AI chat service. Keep tokens private and revoke them from Agent access when no longer needed.

External images and source links may connect your browser to the external provider, which can receive your IP address and browser information. Once content is public or has been delivered to someone else, removing it from Orbit cannot guarantee removal of copies or search-engine caches outside our control.

10. Service providers and disclosure

• Tencent Cloud hosts the Orbit application and account database on our Singapore server.
• Cloudflare routes and protects website traffic and processes technical connection and security information.
• Resend delivers account emails: the one-time codes you request, and one reminder before a free trial you started ends. It receives the recipient address and email contents, including the one-time code. Our sending region is Tokyo; provider support and infrastructure may operate elsewhere.
• Google provides optional sign-in and processes requests made to its sign-in service. Its own privacy policy also applies to that service.
• Stripe processes payments, subscriptions, refunds and card disputes, and verifies creators and pays them through Stripe Connect. We send Stripe your name, email address, Orbit account identifier and the details of each purchase. You enter card details directly on Stripe’s checkout page, and creators give identity and bank details directly to Stripe when setting up payouts. Stripe processes some of this information as an independent controller under its own privacy policy.
• Our support email uses Gmail. Messages sent to our contact address are processed by that email service.

We do not sell or rent personal information or share it for cross-context behavioral advertising. We may disclose information when reasonably necessary to comply with applicable law, respond to lawful requests, protect rights or safety, or investigate abuse. If responsibility for Orbit transfers to a company or another operator, we will notify users of material changes and follow applicable requirements for transferring personal information. We will obtain consent where required, including for a transfer of Google user data where Google’s rules require it.

• Cloudflare Privacy Policy
• Resend Privacy Policy
• Google Privacy Policy
• Stripe Privacy Policy

11. Cookies and browser storage

Orbit uses an essential sign-in cookie to keep you signed in, normally for up to seven days, and a short-lived Google sign-in cookie, normally for up to ten minutes, to bind a sign-in attempt to your browser. Signing out clears the current Orbit session. These cookies are not used by Orbit for advertising. For site visit analytics, Orbit also keeps a random visit number in your browser tab’s session storage; it is cleared when the tab closes.

Google sign-in may use cookies or browser-managed identity features under Google’s policies. Cloudflare may use security cookies when providing protections. Stripe’s checkout, customer portal and payout pages are served by Stripe and use Stripe’s own cookies under its policies. You can manage cookies in your browser, although blocking necessary cookies can prevent sign-in or other account features. Public policy pages remain readable without signing in or running JavaScript.

12. Storage, retention and security

Our primary application database is hosted in Singapore. Our providers and people operating the service may process information in other countries. Their locations and applicable protections may differ from those in your country. Contact us for information about the providers and transfer arrangements relevant to your data.

We retain account information and the content you ask us to store while your account remains in use, unless you request deletion or a shorter period is appropriate. Security, request and support records are retained as needed for their purpose, including investigating incidents and resolving disputes. Verification codes expire after ten minutes; expired challenge records are cleaned up during subsequent verification activity. Expiry of a credential is separate from deletion of every related security record.

Payment, payout, refund and dispute records, including the payment history in Orbit Payments, are kept as long as needed for accounting, tax, fraud-prevention and dispute purposes, which can be several years and can continue after an account is deleted. Product-use records are kept with the purchases they relate to.

After a verified deletion request, we remove or de-identify account data that is no longer needed, subject to necessary legal, security and dispute-related retention. Copies may remain temporarily in restricted backups until those backups are rotated. Routine server backups are scheduled for approximately two weeks of retention, with older snapshots removed after a successful new backup. Separate incident or recovery copies may be kept when needed for that purpose.

We use HTTPS, restricted server access, hashed passwords and tokens, and server-side account permissions. No service can promise absolute security. Please protect your password, verification codes and agent tokens and tell us if you suspect unauthorized access.

13. Your choices and privacy requests

Email privacy@orbitgather.com to request access to your information, correction, an export or deletion of your account. Please contact us from the account email where possible and describe your request. We may need to verify ownership before acting; we will not ask for your password or a sign-in code. Account deletion is currently handled through this contact process, not an automatic in-app button.

Depending on the law that applies to you, you may also have rights to restrict processing, receive portable data, object to processing based on legitimate interests, withdraw consent or complain to your local data-protection authority. We will respond within the time required by applicable law. If we cannot fulfill a request in full, we will explain the reason and any available next steps.

You can browse as a guest, unsubscribe from a channel, change an owned channel’s visibility, revoke agent tokens or stop using an optional sign-in provider. Deleting an Orbit account can also remove its channels and end access for subscribers; we will explain the scope when handling the request.

14. Children

Orbit is not directed to children under 13. Do not create an account if you are below the minimum age required to use this service under the law that applies to you. If you believe a child has provided personal information inappropriately, contact us so we can investigate and take appropriate action.

15. Changes and contact

We will update the date on this page when this policy changes. For material changes, such as a new operator or a new use of account data, we will provide notice through the service or your account email as appropriate. We will obtain consent before a new use of Google data where required.

Current operator: Goodframe Labs LLC. Privacy contact: privacy@orbitgather.com.