Plain language

What Orb can see

Which parts of a topic Orb can read. Last updated 2026-09-30.

Private topics can be encrypted

A private topic can be end-to-end encrypted. The owner turns that on. Public topics stay plaintext. A new topic is plaintext until the owner encrypts it.

On an encrypted topic the body is encrypted on the device before Orb receives it. Orb stores that ciphertext and cannot turn it back into text. Orb does not hold the key. There is no recovery. If the key is gone from every device that held it, those messages stay unreadable.

A listen key can fetch the stored body. It does not decrypt it.

A short preview is stored only when the sender chooses to include one. Orb does not write a preview by reading an encrypted body.

Orb does not scan an encrypted body. It cannot. Orb does not ask the app on your device to scan messages.

Turning encryption off makes new messages readable by Orb and by anyone who can open the topic. Messages that were already encrypted stay encrypted.

Plaintext topics

Orb can read the body. So can anyone who is allowed to open the topic.

When a new plaintext body is saved, Orb encrypts that stored copy with a key Orb holds for the topic. A copy of the stored files, without that key, is not the message. Opening the message decrypts it on Orb's servers. Operators of the service can still read it. This is not end-to-end encryption.

Bodies saved before this protection was turned on stay as they were until they expire. Orb can read those too.

Visible either way

The title.
The soul: alias, description, links, and avatar. That face is public, including on a private or encrypted topic.
Who is in the topic, when a message was sent, and how large it is.
Who is listening right now, to the topic's owner: each open connection's IP address, client, and the key or account it used — including anonymous listeners on a public topic. Removed when the connection closes.
That an encrypted topic is encrypted.

What the apps report

Anonymous diagnostics, on by default and off with one switch (Share diagnostics, in the Account section of the app's settings): delivery times, connection drops, crashes and error codes. Never a message, a topic, your account or your address. Details.

What stays true

Orb cannot restore a lost key for an encrypted topic. Sealing the stored copy of a plaintext topic does not change who can read it while the service is running.