Privacy policy

1. Who is responsible

This policy covers the Orbis service at orbisapp.me, its legacy c-o.pw links, and the Orbis applications that connect to it. The controller responsible for your personal data is George Evans, an individual operating Orbis in Germany:

Orbis is the service name. Contact us at the address above for privacy questions and requests. This policy describes current processing; a feature described here may not be available in every application or preview build.

2. Information we process

• Account and profile: email, username, display name, password hash, verification and recovery records, two-factor settings, the version and time of your explicit Terms agreement, profile pictures/banners, biography and the optional profile fields you provide. An optional birthday stores its day and month, not a birth year.
• Conversations and relationships: ordinary message content, edits, attachments and voice messages; friends, blocks, room/group membership and roles; reactions, mentions, read state, saved items, GIF folders, plans, scheduled messages and reminders. We also process the identifiers, recipients, permissions and timestamps needed to deliver them.
• Calls and activity: participant identifiers, call invitations, connection state, timestamps and call-history records. Optional game/music sharing and profile statistics can include recognized games, tracks, playback progress, play history and screen-sharing time. Desktop activity detection reads relevant process, window or media information locally when enabled and shares the recognized activity according to your settings.
• Device, security and diagnostics: sessions, IP/network observations, user-agent and installation information, push subscriptions, security/rate-limit events, and limited error reports such as an error fingerprint, app build and affected interface. Orbis’s client error reporter is designed to exclude message text, account identifiers, full URLs and query strings; server and provider logs can contain additional request/security metadata.
• Support and safety: information you send to support, reports and selected evidence, moderation decisions, appeals, restricted-access investigation records and audit history.

Account credentials and a deliverable email are needed to create and maintain an account. Additional profile fields and optional activities are your choice. Refusing microphone, camera, screen-capture or notification permissions prevents the corresponding feature; it does not grant Orbis permission to access those devices for unrelated purposes.

3. Ordinary and secret conversations

Ordinary DMs, groups and community channels are not end-to-end encrypted. Connections use encryption in transit, but ordinary message content and uploaded files are processed by Orbis’s servers for delivery, history, search and service operation. People with access to a conversation can read, save or share its content. Community owners and moderators have the permissions assigned to them.

Secret chats use end-to-end encryption. Message keys belong to the participating devices; another device can be approved by an existing device or restored using a saved secret-chat recovery key. Your ordinary account password or an email reset cannot recover old encrypted history without the required keys. The service still processes account/device identifiers, participants, timestamps and encrypted content. Encryption cannot prevent a recipient from copying a message, a compromised device from exposing it, or an approved device from sharing its keys through the intended approval flow.

Reporting a secret-chat message is an explicit exception: after confirmation, the reporting device discloses text from the selected message and up to ten preceding messages for review. The current report flow does not preserve or submit attachment bytes. It does not disclose the chat’s encryption keys or give staff general access to the rest of its encrypted history.

Calls use encrypted WebRTC transport and LiveKit infrastructure. They do not currently use end-to-end encryption. Orbis does not provide automatic call recording; participants may still make recordings or screenshots with other tools.

4. Purposes and legal bases

• Providing the service — Article 6(1)(b) GDPR: creating and authenticating your account; delivering messages, files, calls and the features you request; maintaining your settings, memberships and support relationship; recording which Terms version you explicitly agreed to and when. This agreement record is separate from consent to optional processing.
• Security and service integrity — Article 6(1)(f): preventing account takeover, spam, fraud and abuse; enforcing proportionate service rules; investigating serious safety concerns; maintaining limited diagnostics and disaster-recovery backups. Our legitimate interests are protecting users, securing the service and keeping it reliable. You can object to processing based on legitimate interests.
• Consent — Article 6(1)(a), where requested: optional browser push notifications and any other processing for which we specifically ask your consent. You can withdraw it through the relevant settings, browser controls or our contact address. Withdrawal does not affect earlier lawful processing. Accepting the Terms is not blanket consent to unrelated data processing.
• Legal obligations — Article 6(1)(c): responding to a binding legal request, preserving or reporting information when applicable law requires it, and handling statutory data-protection obligations.

We do not use private conversations to build an Orbis advertising profile. Sharing a message with other people, enabling an optional provider feature and submitting a report are separate actions with different recipients, described below.

5. Safety, moderation and illegal material

Orbis prohibits child sexual abuse material (CSAM), child sexual exploitation, grooming and other illegal content. Users can report content or accounts through the service, appeal eligible moderation decisions, or contact support. Please provide a relevant Orbis reference or description rather than emailing illegal images or videos.

Automated security, anti-spam and room-moderation rules can flag activity, limit actions or restrict access. Authorized staff review reports and appeals. For a reported incident or a documented serious safety concern, authorized staff can obtain scoped, time-limited, audited access to relevant ordinary conversations and media; staff access is not limited solely to content a user has reported. This does not bypass secret-chat encryption.

PhotoDNA and Arachnid Shield scanning are not currently integrated into Orbis. Having a provider account or API credentials does not activate screening. File validation, image conversion and spam checks are not a known-CSAM matching service. Before introducing a new media-screening provider, we will update the relevant disclosures and review its processing, recipients and transfer arrangements. We will not describe provider matching as a guarantee that content is safe.

We may restrict access to suspected illegal material and disclose relevant information to competent authorities where required by law or otherwise supported by an applicable legal basis. We do not promise that every report is automatically sent to a particular authority. If a restriction was automated or mistaken, you can request human review through an available appeal or the support contact.

6. Service providers and external features

• Railway and associated storage: application hosting, databases, the private encryption-message service, uploads and backups.
• Cloudflare: domain/DNS services and redirects for supported www addresses. Network metadata is processed when your connection uses those services.
• Resend: account verification, recovery, security and service/moderation emails. It receives the delivery address and the email’s content.
• LiveKit: call signaling and media transport, including the participant/connection information and network addresses necessary to connect a call.
• Browser/OS push services: when you enable message push, the service associated with your browser or device processes its subscription and a reference-only notification payload. Message previews are separately controlled. Push delivery may use infrastructure operated by Google, Mozilla or Apple; it is not guaranteed and does not currently provide closed-tab call ringing.
• KLIPY and saved GIFs: using the GIF picker makes direct provider requests, which can disclose a search query, IP/network metadata and an ephemeral identifier. Orbis stores saved GIF references and your folder names. Viewing a provider-hosted GIF can also contact that provider. Legacy media may refer to earlier providers such as Tenor.
• Optional music and activity artwork: Audius, supported experimental YouTube/Google playback and relay/proxy infrastructure (including Decodo), and game-art sources such as Steam may receive the searches, media identifiers and network information needed for the chosen feature. Their availability and terms are independent of Orbis.

External link previews request the shared public URL from Orbis’s server, including in ordinary DMs and personal notes. The destination sees the requested URL and server network address. Surround a link with angle brackets to suppress that link’s preview. A display-only preview preference does not itself stop the server lookup. Do not post confidential token-bearing URLs to a conversation if you do not want a preview lookup.

Other recipients include the people with whom you share content, authorized support/moderation staff, and authorities or professional advisers where a lawful, necessary disclosure applies. We do not give a provider your secret-chat encryption keys through these features.

7. Processing locations and transfers

Orbis is operated from Germany, but this does not mean every hosting, email, media, push or external-feature provider processes data only in Germany or the EEA. Processing locations depend on the service and its configuration. Optional third-party features can make direct connections from your device.

Transfers outside the EEA require an applicable transfer mechanism where the GDPR requires one, such as an adequacy decision or appropriate safeguards. The providers publish their arrangements in the Railway DPA, Resend DPA and LiveKit DPA. Railway’s DPA requires a separate execution step. Publication of this policy does not establish that step is complete, or that every provider’s contractual and regional configuration has been independently verified. Contact us for the arrangements relevant to your use of Orbis and any applicable safeguard documentation.

8. Retention and account deletion

• Active accounts and shared content: account data is kept while needed to provide your account and features. Messages, files and shared records remain for the conversation’s operation until removed through the applicable controls or another valid erasure process, subject to necessary safety/legal preservation.
• Deleted accounts: access and sessions are revoked when closure succeeds. Limited recovery information is retained for a 30-day recovery window so authorized staff can assist with mistaken or compromised-account deletion. Recovery is not guaranteed. After that window, recovery data is due for permanent cleanup.
• Terms agreement: the version and time of your agreement are kept with your account, including its 30-day recovery window, and erased during permanent account cleanup. These records do not include a separate IP address or user-agent field. Backup retention is described below.
• Shared history after closure: closing an account does not automatically delete its messages and shared attachments. These remain under “Deleted account.” This label does not make message content anonymous, and it does not remove your statutory erasure rights. Delete content beforehand where controls allow, or contact us about content you cannot remove.
• Reports and security: submitted report-evidence snapshots normally have a 180-day expiry. That is not a blanket retention period for every appeal, decision or audit record. Other moderation/security records are retained according to their continuing safety, appeal, abuse-prevention or legal need. Network observations use a 30-day window; expired-session IP/user-agent data is eligible for cleanup after a further 30 days.
• Backups: the intended schedule is hourly copies for 48 hours and daily copies for 30 days. Automatic backup expiration is currently disabled because the storage provider did not reliably enforce the conditional-delete safeguard used by Orbis. Copies can therefore remain longer than those targets. They are restricted recovery copies, not ordinary chat access; contact us about the current position or an erasure request affecting backups.

Necessary legal holds or the establishment, exercise or defence of legal claims can justify retaining particular information longer. We assess erasure requests individually rather than treating account closure or a retention target as the only available right. Deleting data from Orbis cannot remotely erase recipients’ copies, screenshots or exports.

9. Cookies and device storage

Orbis uses first-party session cookies and local storage necessary for sign-in, security, device preferences, drafts/outgoing messages and optional encrypted-chat keys. Account sessions have a renewable 30-day lifetime; a separate first-party security installation cookie can last up to 365 days. Signing out or clearing site data affects these differently and may remove unsent drafts or device-held secret-chat access.

Browser and desktop storage is not the authoritative shared message database. Native previews can use the operating system’s protected credential store and local application metadata instead of browser cookies. Retention and background capabilities differ by application; see the build’s own availability notes.

Optional browser permissions and third-party requests are controlled through their features. If non-essential tracking is introduced, it will require its own disclosure and any consent required by law; these Terms or this policy do not pre-authorize it.

10. Your choices and rights

Settings provide controls for profile sharing, presence/last seen, read receipts, activity, notifications and other optional features. Group or room rules can affect some shared features. Muting a conversation changes alerts; it does not delete its history or stop its members from sending messages.

You may have rights to access, rectify or erase personal data, restrict processing, object to legitimate-interest processing, withdraw consent and receive portable data, subject to the GDPR’s conditions and exceptions. The account export contains accessible account information and file metadata; it is not a complete export of every recipient’s messages or every uploaded file.

Use the account tools where available or email george@c-o.pw. We may request proportionate information to verify that a request relates to your account, but will not ask for your password or two-factor codes. We normally respond within one month; where the law permits an extension, we explain the reason and timing.

You can complain to a data-protection supervisory authority, including the Baden-Württemberg supervisory authority, or the authority where you live, work or believe an infringement occurred. You do not have to contact us first.

11. Age, changes and contact

Orbis is intended for people aged 16 and over under its Terms of Service. The optional birthday feature is not an age-verification system. If you believe an underage account or a child’s safety is at risk, contact support or use the report controls.

We update the date and version when this policy changes. Material changes will be brought to users’ attention where required; a new processing purpose will be explained before it starts, and separate consent will be sought when required. Questions about this policy or the current provider/retention arrangements can be sent to the controller above.