Privacy policy

About Orbit

Orbit is a Windows application for tasks, habits and personal progress. Its related project is Aktivnaya Faza (“Active Phase”). Contact the Orbit team about data and this policy at Orbitaktivfaz@yandex.ru.

This policy covers Orbit Desktop 1.0 and the official informational Orbit website. Document version: October 25, 2026.

Data on your computer

Tasks, habits, notes, time records, attributes, rewards, settings, images and your avatar are stored on your computer. Guest mode is available without an account. This website does not receive the contents of your local profiles.

Local profiles and backups remain until you remove them. Automatic backups have limited rotation; you manage and delete manual backups and exports yourself. Profile files are not encrypted in their entirety: access depends on the security of your Windows user account.

Google and Yandex sign-in

When you sign in, your provider supplies a verified email address and account identifier. Orbit uses these to display the selected account, remember your session on the computer and associate service connections with the correct user.

You enter your password on the provider’s page in your system browser. Orbit does not receive your password. The saved session is protected by Windows encryption. Sign-in alone does not grant Drive or Calendar access; you connect those services separately.

Google Drive and Yandex Disk backups

Connecting Google Drive requests drive.appdata, access to Orbit’s hidden application data folder. Orbit does not read your ordinary Google Drive files. Yandex Disk uses permission limited to the application folder.

Snapshots sent to the selected Drive contain local Orbit profiles, including tasks, notes, history, settings and added images. This includes imported calendar events when they have been saved as tasks in a profile. Passwords, access tokens, drafts and running timers are excluded. There are current device snapshots and at most two weekly backup slots. Transfers go directly to the provider you selected.

You can preview another device’s snapshot and add copies of its profiles. Version 1.0 does not automatically merge changes across devices. Disconnecting Drive removes the local connection token and keeps the cloud files.

Google Calendar and Yandex Calendar data

Orbit separately requests calendar.calendarlist.readonly to list your available Google calendars and calendar.events to access events. The events permission allows reading and editing events on accessible calendars; Orbit exchanges data only with the calendar and task lists you select.

Orbit processes calendar names and access roles, event identifiers and versions, titles, descriptions, dates, times and duration to preview changes, receive events as tasks and send selected tasks. Recurrence, organizer and attendee information may also be processed to determine whether an event is editable. Series and invitations are read-only; Orbit does not change their recurrence rules or attendees.

You can choose receiving, sending or two-way exchange. Manual exchange shows a preview; automatic exchange applies only allowed changes without conflicts. Orbit does not delete events using the Google Calendar API. Disconnecting keeps events at the provider. Yandex Calendar serves the same exchange purpose with a separate Yandex authorization.

Transfers, protection and use

Service tokens are stored separately from profiles using Windows encryption. Requests go directly to Google and Yandex over HTTPS. Cloud snapshots are compressed but do not have separate end-to-end encryption; their storage is protected by the selected provider.

The Orbit team does not receive your profiles through this website, sell Google user data, use it for advertising or use it to train generalized models. Orbit’s use of Google user data follows the Google API Services User Data Policy, including Limited Use requirements.

At your request, data can be sent to your selected Drive or Calendar, exported to a file or included in a support request. If you email support, your message and attachments are used to respond to that request. Do not send passwords or access tokens. Attendee data is not used for mailing lists.

Optional local assistant

If you enable the assistant, request context is sent to Ollama installed on your computer through the local 127.0.0.1 address. A separate Ollama installation and selected model are required. The Orbit team does not receive these requests through the website or use them to train generalized models. Other features do not require the assistant.

Disconnecting and deleting data

• You can disconnect Drive and Calendar in Orbit settings. This removes the relevant local access while retaining remote events and files.
• Revoke Google permissions on your Google account connections page. Revoke Yandex permissions in Yandex ID settings.
• For local information, use the reset controls and remove your backups and exports. Standard uninstallation preserves the profiles folder. After closing Orbit, you can delete it manually: %APPDATA%\orbit-personal.
• Remove cloud copies separately through the corresponding Drive service. Revoking permission alone does not remove them. The Orbit team has no server-side access to delete your personal cloud data on your behalf.

To request deletion of information you sent to support, contact Orbitaktivfaz@yandex.ru.

Website and policy changes

This informational website has no registration forms or advertising trackers added by the Orbit team. Hosting provider Cloudflare may process IP addresses, request times, browser information and technical logs to operate and protect the website, under Cloudflare’s privacy policy. External services such as Telegram, VK, Google and Yandex have their own policies.

Changes to data practices will be described on this page. Before introducing a new use of Google user data, users will receive an explanation and, where needed, a new permission request.