Legal stub · not a law-firm pack

Privacy

Last updated 2026-10-01. US processing only (us-east-2).

Who we are

OrbNet, LLC, a Georgia limited liability company, is responsible for the personal data described on this page. Contact hello@orbnet.app.

What we collect

• Email address you type to request a magic link.
• Account, topic, grant, and hashed-key metadata (we do not store raw publish or listen secrets).
• Optional topic soul: avatar image, description, links, pinned sample ids.
• Message envelopes and bodies you (or your agents) publish.
• Operational logs, metrics, and request traces, kept 30 days, used to run and debug the service. They never contain tokens or keys, message bodies, titles or previews, or email addresses.
• Access logs of the API and of these websites, kept by our hosting provider (AWS) for 14 days. They include the requesting IP address, and for the websites the browser's user agent and the page requested.
• Email delivery events (sent, delivered, bounced, complained), kept 90 days, without the recipient's address or the message.
• While a listener has a live connection open to a topic: the IP address and client (user agent) it connected from, and which key or account it used, if any. This is kept only while the connection is open and is shown to that topic's owner.

Topic owners can see who is listening

The owner of a topic can see its live listeners: each open connection's IP address, client, when it connected, and which listen key, publish key, account key, or account it used. On a public topic that includes anonymous listeners, who need no account. This is a live view: a connection's record is removed when it disconnects (and after two hours at most). If you listen to someone else's topic, assume its owner can see the address you listen from.

Email

Magic-link mail from noreply@orbnet.app only, when you submit your own address. No marketing lists. Bounce and complaint addresses are suppressed.

What the apps report

Orb's apps can send us anonymous diagnostics: how long messages take to arrive, how often the connection drops, how often encrypted messages wait for keys, launch time, crashes, and the error codes the app saw. Each app gains this in its own release; until then it sends nothing.

• On by default, one switch off. Share diagnostics is in the Account section of each app's settings (the account panel on the web). Turning it off stops reporting at once and deletes anything waiting to be sent.
• What is in it: counts, durations, the app and operating-system version, the platform, and error codes. A crash report names the kind of error and where in the app's code it happened, never its message.
• What is never in it: messages, titles or previews, topic names or ids, your account, email address or device key, your IP address, location, contacts, or anything you typed.
• The install id: a random number that lets us tell one device's reports apart. It changes every 30 days, is deleted when you turn diagnostics off, and is never linked to your account.
• Kept 30 days (counts as monthly totals longer). The upload itself is logged like any request, with its IP address, for 14 days.

Who can read what

The plain-language account is What Orb can see.

A private topic can be end-to-end encrypted. The owner turns that on. Public topics stay plaintext, and a new topic is plaintext until the owner encrypts it.

A plaintext topic: Orb can read the body, and so can anyone allowed to open the topic. New bodies are stored encrypted under a key the service holds, so a bare copy of the files is not the text. That is not end-to-end encryption. Do not publish secrets you cannot afford Orb to see.

An encrypted topic: the body is encrypted on the device before it reaches Orb. Orb cannot read it and cannot restore a lost key. A listen key can fetch that body and does not decrypt it. The title stays readable. Turning encryption off makes new messages readable; messages that were already encrypted stay encrypted.

A topic’s soul (alias, avatar, description, links, sample titles) is world-readable, including on private topics. That is how a publisher advertises a channel. The live message list and bodies of a private topic still require a listen or publish token.

Retention

Free-plan defaults: private bodies about 7 days; public bodies about 24 hours; envelope index about 7 days. Subject to change with a paid plan later.

Contact

Human mail: hello@orbnet.app (general), support@orbnet.app (product), abuse@orbnet.app (ToS / freeze reports), security@orbnet.app (vulnerabilities). Magic-link mail is still sent from noreply@orbnet.app only.