Everything you enter into Orbit — people, dates, ratings, notes — stays on your device. Orbit has no account system, no server, and no company on the other end collecting or receiving any of it. There is nothing to leak, because nothing is ever sent anywhere.
Names, notes, and your date answers are encrypted at rest (AES-256) before they touch the database file. The encryption key lives in your device's secure hardware-backed keystore (iOS Keychain / Android Keystore) — the same system your device uses to protect passwords and payment credentials — and never leaves the device.
None of this is backed up to a server we control, because there is no such server. If you use your device's own backup system (iCloud Backup, Google Backup), that backup is between you and Apple/Google — Orbit has no part in it.
If you turn on Orbit's passcode lock, the code you set is stored locally in the same secure keystore, never in plain text and never transmitted anywhere. Face ID / fingerprint unlock is handled entirely by your device's operating system — Orbit never receives or stores any biometric data itself; it only receives a yes/no result from the OS.
If you forget your passcode, there is no way for us to reset it remotely — there is no “us” to ask, since Orbit has no account or server to verify your identity against. The only recovery option is to erase and start over, which permanently deletes the on-device journal.
If you turn on reminders (post-date nudge, weekly reflection), Orbit schedules ordinary local notifications directly on your device. These are not push notifications — no token is generated, no notification content is ever sent to or through a server.
Settings includes an “Export my data” option. This writes an unencrypted copy of your journal to a file that you choose where to save or share — the export only happens when you explicitly ask for it, and what you do with the resulting file afterward is entirely up to you.
Uninstalling Orbit removes the on-device database along with it. Inside the app, Settings → “Reset to empty state” does the same thing without uninstalling — both are permanent and cannot be undone, since there's no server copy to fall back on.
Orbit is intended for adults using it to reflect on their own dating life. It is not directed at children, and does not knowingly collect any information from children, because it does not collect information from anyone — everything stays on the device it was entered on.
If this policy changes, the effective date above will change with it. Material changes will be reflected in the app's release notes.