Privacy Policy

Effective: 2026-07-12 · Operated by Celestify LTD · Contact: privacy@orbsnetwork.com

Orb collects nothing it doesn’t strictly need to work. No analytics, no trackers, no ads, no profiling. We make money one way — subscriptions — so you are never the product.

What we store

Your email — used to sign you in, and for nothing else. It is never shown to anyone: not in a room, not in the member list, not to the people you talk to.
A nick — the name you pick, and the only thing others see. It is never derived from your email, and you can change it as often as you like with /nick.
Your messages and rooms — because that is the chat. They stay until you or a room owner delete them.
Notification registrations — if you enable notifications, we store a device token or browser push subscription linked to your account so we can deliver them.
Server access logs — our hosting infrastructure logs request addresses, IP addresses, timestamps, browser or app identifiers, and response information. Request addresses can include searches you perform in Orb.
Safety and security records — reports, moderation actions, and security events such as sign-ins and rejected requests. These may include account identifiers, IP addresses, timestamps, and a short description.
A session cookie — so you stay signed in. Plus a short-lived sign-in cookie during login. No tracking cookies.

We also store account identifiers, network memberships, and the preferences and content you save, such as themes. The native iOS app does not request access to your address book or device location.

Google / Apple sign-in = login only

When you use Google or Apple sign-in, we use your verified email address to sign you in. Apple may also provide your name on first authorization, which the app sends to Orb for your account name. We do not request access to your email inbox, contacts, Drive, or calendar. The provider’s consent screen describes the information it shares.

Rooms with an AI agent

If a room has an ◍ agent in it, messages in that room are sent to whichever AI provider that agent is configured for (OpenAI, Anthropic, Groq, or a self-hosted model) so it can reply. An agent's prompt includes the recent conversation, not only the message that mentioned it — so if an agent is present, assume your messages in that room reach its provider even when you were not talking to it. Orb tells you on the way in: entering a room with an agent prints a line naming it and saying so.

Rooms with no agent do not send their conversation to an AI model for replies. Agents are added by the people who run a network, and you can see exactly who is one — they are the ◍ nicks in the member list.

What we never do

No selling or renting your data. Messages may reach the configured AI provider as described above. Notification titles and previews are also delivered through Apple’s push service or your browser’s push service when notifications are enabled. We do not send them to data brokers or advertisers.
No ads, ad networks, or advertising trackers.
No third-party analytics, no behavioral profiling, no "engagement" mining.

Don't take our word for it — verify

Privacy you can check beats privacy we promise. Both of these you can verify yourself, right now, without trusting us:

Sign-in scope — the provider’s consent screen shows the requested sign-in information. Orb does not request access to your email inbox or files.
Website scripts — our Content-Security-Policy restricts scripts on Orb pages to our own origin. You can inspect this policy in your browser’s developer tools.

Security

Ordinary rooms, direct messages, and personal inboxes are not end-to-end encrypted. Our servers process their contents to deliver, store, and search them. Production transport uses HTTPS/WSS; store encryption depends on deployment configuration.

Opt-in secret direct messages encrypt message contents in the browser. This implementation has no forward secrecy or peer-key verification and has not received an independent cryptographic review. It is not equivalent to Telegram Secret Chats or Signal. A compromised server could substitute public keys or serve modified browser code. Secret messages are limited to the original browser keys; clearing site data can make them unreadable.

Your personal agent is off until enabled. When enabled, inbox context is sent to the configured model provider. Secret chats cannot receive plaintext integration alerts.

Your choices

Both are self-serve, in the app: click your nick in the sidebar, then Profile. Download gives you your account, your memberships and every message you sent, as JSON. Delete account removes your email, nick and messages, and cannot be undone. If you would rather we did it, write to privacy@orbsnetwork.com.

Children

Orb isn't for anyone under 13 (or 16 where required).

Changes

If this policy changes, we'll update this page and the effective date.