Privacy Policy for Orbito

Orbito is developed and maintained by Sumit Kumar.

Note for App Store & Play Store Review: The developer identity stated above aligns with the developer credentials registered in Apple App Store Connect and Google Play Console.

To deliver seamless multi-device habit tracking and real-time backup across iOS, macOS, and Android, Orbito operates with compulsory encrypted cloud synchronization. We collect and process only the minimal data categories required for application functionality:

2.1 Data Categories Collected & Synchronized

Under Apple App Store Privacy Nutrition Label guidelines and Google Play Data Safety standards, the following data types are collected and linked to your account:

Orbito uses compulsory cloud synchronization powered by Supabase to protect your progress against device loss and keep your routines in sync across all your hardware:

• Multi-Device Real-Time Continuity: Habits checked off on your iPhone instantly reflect on your Mac, iPad, or Android device.
• Offline Caching Layer: If your network connection drops, Orbito transparently caches your check-ins and timer sessions in local sandboxed storage and automatically synchronizes with Supabase the moment connectivity is restored.
• Zero Cross-Context Tracking: Your data is used exclusively to power your Orbito experience and is never associated with third-party tracking identifiers.

Orbito may provide multiple methods of authentication, including third-party providers such as Google Sign-In or Apple Sign-In.

When you authenticate using these providers, Orbito receives only the necessary information to authenticate your account:

• Email address
• Provider account identifier (UID)
• Name or basic profile information where provided by the provider

We use authentication information exclusively to:

• Create or access your Orbito account
• Verify your identity and maintain your account session
• Secure access to your synchronized data

We do not use your Google or Apple credentials to access any unrelated services, files, or contacts.

Orbito uses Supabase for cloud backend infrastructure, including database hosting and authentication-related functionality where applicable.

When Cloud Sync is enabled, information that you choose to synchronize is processed and securely stored using Supabase infrastructure. Supabase processes this data strictly on our behalf under applicable data processing agreements.

For more information about Supabase's privacy and security standards, visit the Supabase Privacy Policy.

Orbito may provide an optional App Lock feature using your device's built-in biometric hardware, such as fingerprint or face recognition.

When you use biometric authentication:

• Authentication is performed directly by the operating system and device security hardware (Secure Enclave / Android Keystore).
• Orbito does not receive your fingerprint, facial recognition scans, or biometric data.
• Orbito does not store any biometric templates.
• Orbito does not transmit biometric information to any server.
• Orbito only receives a cryptographic boolean result (success or failure) provided by the operating system API.

Orbito may process limited technical information strictly necessary to operate the application and execute its features properly. Depending on the device and OS, this may include:

• Operating system version and device configuration
• Application version build
• Device time zone and local date/time (essential for streak calculation and reminder triggering)
• Network availability status (to toggle offline/online synchronization mode)
• Technical diagnostics necessary to troubleshoot crashes or sync errors

Location Tracking Disclosure: Orbito uses the device's local clock and time zone exclusively for scheduling habits, streak counters, and reminders. Orbito does not track or store your physical location.

To respect your digital privacy, Orbito explicitly avoids collecting invasive data. The app does not require or collect:

Orbito requests specific device permissions only to enable particular user-facing features:

We may share or allow access to information only in the limited circumstances described below:

• Service Providers: We use reputable infrastructure partners (such as Supabase for database hosting and cloud sync) who process data strictly pursuant to their contractual data processing terms.
• User-Initiated Sharing: If you choose to export or share a streak, milestone badge, or progress graphic through the system share sheet, the chosen asset is sent only to the recipient or app you specify.
• Legal Requirements: We may disclose information if required to do so by lawful request, court order, or applicable law, or to protect the safety, rights, and integrity of users and Orbito.

• Orbito does not display third-party advertisements.
• Orbito does not sell personal information to advertising networks.
• Orbito does not use personal information for third-party personalized advertising or cross-context behavioral tracking.

Orbito does not incorporate third-party behavioral analytics, user tracking, or advertising SDKs.

Under Apple App Store Review Guideline 5.1.2 and App Tracking Transparency (ATT) requirements, Orbito does not track users across third-party apps or websites, nor do we collect IDFA or Google Advertising IDs (GAID). As such, an ATT tracking authorization prompt is not required.

If diagnostic crash reporting or telemetry is introduced in a future update to resolve crashes, we will update this Privacy Policy and publish corresponding Apple Privacy Manifest (PrivacyInfo.xcprivacy) and Google Play Data Safety declarations before deployment.

We implement comprehensive industry-standard technical and organizational measures to safeguard user data:

• Transport Layer Encryption: All communications between the mobile application and backend servers use HTTPS/TLS 1.3 encryption in transit.
• Row Level Security (RLS): Database tables use strict granular access policies ensuring users can only read and mutate their own verified records.
• Local OS Sandboxing: Local database records reside in your device's protected internal app storage sandbox.
• Authentication Tokens: Tokens are securely stored using device keystore mechanisms.

While we implement rigorous safeguards, no electronic transmission over the internet or storage system can be guaranteed to be 100% immune from unauthorized breach.

Local Data: Stored on your device until you manually delete individual items, clear application data via device settings, or uninstall Orbito.

Cloud Data: Retained for the active duration of your account to provide multi-device sync. Upon account deletion request, your account record and associated cloud entries are permanently deleted from active databases.

Residual copies in automated disaster-recovery backup snapshots are purged in accordance with standard backup cycle expiration (typically within 30 days).

In accordance with Apple App Store Review Guideline 5.1.1(v) and Google Play's Account Deletion Policy, Orbito provides multiple simple and immediate ways to permanently delete your account and all associated cloud-stored data:

Method 1: In-App Deletion (Immediate & Self-Service)

Open Orbito on iOS, macOS, or Android and navigate to: Orbito → Settings → Sync & Data → Cloud Synchronization → Delete Account (highlighted in red). Confirm the prompt to immediately and permanently delete your user authentication account and all associated database records.

Method 2: Web Deletion Request Form (App Store & Google Play Compliant)

If you have uninstalled the app or lost access to your device, you can submit an account deletion request online without re-installing:

Method 3: Direct Email Request

Send an email to sumitkumards07@gmail.com with the subject line Orbito Account Deletion Request from your registered account email. All records will be expunged within 7 business days.

When your account deletion is processed, we permanently delete:

• Your account identity and authenticated user record
• Your registered email address
• All synchronized habits, daily check-ins, and completion timestamps
• All tasks, to-do records, and project lists
• All focus timer records, sessions, and tags
• All streak information and notes
• All cloud synchronization logs

Limited data may remain temporarily in secure backup archives until routinely overwritten (under 30 days). No retained data is used for commercial purposes.

You can delete locally stored information anytime without contacting support:

1. Within Orbito: Clear specific habits, tasks, or use the in-app "Reset Data" option in Settings.
2. Android System Settings: Open Settings → Apps → Orbito → Storage → Clear Data.
3. Uninstall: Uninstalling Orbito purges local app storage on modern Android and iOS devices.

Note: Clearing local data does not automatically delete an existing Cloud Sync account. To remove cloud records, use the Account Deletion feature.

Orbito is not directed toward children under the age of 13. We do not knowingly collect personal identifiable information from children under 13 (or under 16 where required by European or local law).

If a parent or guardian discovers that a child has provided us with personal information, please email us at sumitkumards07@gmail.com, and we will promptly investigate and remove the information.

Depending on your location and applicable privacy legislation (e.g. GDPR, CCPA/CPRA, LGPD), you may hold the following rights:

• Right of Access: Request a copy of your personal data processed by Orbito.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your cloud account and stored records.
• Right to Restrict or Object: Object to or limit specific processing activities.
• Right to Data Portability: Export a machine-readable backup of your information.
• Right to Withdraw Consent: Revoke permissions or sync privileges at any time.

To exercise any of these rights, contact our Privacy Desk at sumitkumards07@gmail.com.

Because Orbito utilizes cloud infrastructure providers including Supabase, data associated with optional Cloud Sync may be processed or stored in secure data centers outside your country of residence.

Where required by applicable law, data transfers are protected under recognized international transfer mechanisms, including Standard Contractual Clauses (SCCs).

Orbito may integrate trusted third-party service providers for core functionality:

We may update this Privacy Policy from time to time to reflect modifications in application features, legal compliance requirements, or platform standards.

When changes are made, we will update the Last Updated date at the top of this page. For material updates, we may provide prominent in-app notification or notification through our store listing.

If you have any questions, feedback, inquiries, or deletion requests regarding this Privacy Policy or your data, please contact us: