Orbit Privacy Policy (draft, to be reviewed by counsel)
1. What this covers
Orbit is an app for meeting new people who share your interests and chatting with them safely. This policy explains which data we process, why, for how long, and what your rights are. It applies to the app (iOS, Android) and the admin web. Swiss data protection law (FADP) applies; for people in the EU/EEA, the GDPR applies as well.
2. Data we process
| Data | Source | Purpose | Legal basis (GDPR) | |---|---|---|---| | Email address, sign-in provider (Apple, Google) | you | account, sign-in, security | contract (Art. 6(1)(b)) | | First name, pronouns, photos, videos, audio prompt, prompt answers, languages, interests, intent, region (country) | you | your profile, shown to people in your age group; matching | contract | | Date of birth | your ID document (Stripe Identity) | minimum age; strict separation of teens (13–17) and adults (18+) | contract; legal obligation / youth protection (Art. 6(1)(c), (f)) | | ID document image, selfie, document data | you, processed by Stripe Identity | checking that you are real and how old you are | contract; special category (biometric comparison) with your explicit consent (Art. 9(2)(a)) | | Identity hash (non-reversible value from document number and country), device hash | derived | keeping banned people out permanently | legitimate interest (safety, Art. 6(1)(f)) | | Likes, skips, matches, blocks, reports | your usage | discovery, match principle, protection from harassment | contract | | Messages, images, videos, voice messages, calls | you | chat and calls between matches | contract. Content is end-to-end encrypted; we cannot read it. We only see metadata (who, when, with whom, size). | | Orbs bookings, purchases, subscription status | you, Apple/Google, RevenueCat | currency, shop, "Orbit+" subscription | contract | | Push token, notification settings | your device | push notifications | contract, consent (system dialog) | | Advertising ID | your device, only with consent | rewarded ads for Orbs (free users only, never minors) | consent (Art. 6(1)(a)); revocable at any time | | Crash reports, technical logs (device model, app version, errors) | automatic | stability, debugging | legitimate interest | | Moderation data (results for photos/texts, cases, sanctions) | automatic, our team | community safety, youth protection | legitimate interest, legal obligation |
No GPS location. No address-book access. Your profile is never shared outside the app.
3. Encryption and what we still check
Chats and calls are end-to-end encrypted (Signal protocol, WebRTC/SRTP). Keys exist only on your device, so we do not scan chats on the server. Instead: (a) your app checks messages locally before sending and warns or blocks; (b) when you report a chat, your app sends the last messages decrypted to our moderation team, and media of the reported person is stored encrypted for the team in a quarantine (max. 90 days, access only after approval by two people, fully logged).
Profile content (photos, prompts, audio) is not encrypted and is checked automatically (Hive) before it becomes visible, and manually when flagged.
4. Recipients and processors
| Service | Purpose | Location | |---|---|---| | Supabase (AWS) | database, storage, auth, server functions | Zurich (Switzerland); backup fallback Frankfurt (EU) | | Stripe Identity | ID verification | EU/USA (standard contractual clauses); document data is deleted at Stripe after verification (redaction) | | Hive | automatic image/text moderation | USA (SCCs); profile content only, never chats | | RevenueCat, Apple App Store, Google Play | purchases, subscriptions | USA/EU | | Google AdMob | rewarded ads (consent only, never minors) | USA | | Firebase Cloud Messaging / Apple Push | push notifications (no message content) | USA/EU | | LiveKit (TURN) | relaying calls behind strict firewalls (encrypted, unreadable) | EU | | Sentry | crash reports (no personal content) | EU |
Authorities receive data only where legally required.
5. Retention
- Account and profile: until you delete it (Settings → Delete account) or after 24 months of inactivity following a warning.
- Disappearing messages: 24 hours after sending, irreversibly on server and devices. Kept messages: until the chat/account is deleted; the other person keeps their copy.
- Quarantined evidence from reports: max. 90 days.
- Identity and device hashes of banned accounts: indefinitely (purpose: preventing re-registration). To be confirmed by counsel.
- ID document data: only at Stripe during verification, then deleted; we keep the date of birth only.
- Purchases and bookings: 10 years (accounting).
- Backups: 7 days. Data exports: 7 days. Logs: 30 days.
6. Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent. In the app: Settings → "Export my data" (ZIP with all data) and "Delete account". Otherwise by email to privacy@vyntro.dev. Complaints: Swiss Federal Data Protection and Information Commissioner (FDPIC) or your EU supervisory authority.
7. Teens
Orbit is for people aged 13 and over (higher in some countries, per national law). Teens only see teens; adults only see adults. Teens get no personalised ads, stricter content filters, and no calls during the first 48 hours after a match. Parents can contact privacy@vyntro.dev.
8. Changes
We notify you in the app about material changes. Earlier versions are available on request.