Privacy Policy

Last updated 12 September 2026

Orbit is a location app. Almost everything it does involves data about where people are, which is about as sensitive as personal data gets. This page says exactly what is collected, who can see it, how long it lives and how to get rid of it.

The short version

Your location is shared with the people in your circles. Nobody else.
We do not sell location data, to brokers, advertisers or anyone else.
There are no adverts and no analytics or tracking SDKs in the app.
You choose how long your location history is kept — off, 24 hours, 7 days or 30 days — and you can delete all of it in one tap.
You can hide from one person while staying visible to the rest of a circle, and that is enforced on our server, not just hidden in their app.
Background location is used only while you have sharing switched on.

Who is responsible for your data

Orbit is operated by [legal entity name] of [registered address], United Kingdom, who is the data controller for the personal data described here.

Questions, requests or complaints: support@londonj.co.uk.

What Orbit collects

Everything below is collected because a feature needs it. Nothing is collected speculatively.

Data	What exactly	Why
Location	Latitude and longitude, the accuracy radius of the fix, speed, heading, and whether you appear still, walking or driving	To show you on your circle's map, and to judge whether a fix is good enough to draw at all
Location history	A trail of past positions, each with its accuracy, speed and battery level	So your circle can replay a day. Kept only as long as you choose, and off entirely if you prefer
Battery	Charge percentage and whether the phone is charging	To show your circle when a phone is about to die, and to explain gaps in history
Account	A user ID, your display name, and your email address if you add one. If you choose Continue with Google, Google gives us the email address and name on that Google account and nothing else — no contacts, no Drive, no access to any other Google service. Continue with Apple gives us the same two things, and if you use Hide My Email we only ever receive Apple's relay address, never your real one	To identify you to your circle and let you sign in on a new phone or on the web
Circle data	Circle names, invite codes, membership, the places you save (name, position, radius) and events such as arrivals, departures, check-ins, low battery and SOS	These are the features
Notification token	A push token identifying this installation	To deliver alerts. Without it your phone cannot be told about an SOS
Preferences	Who you share with, who you have hidden from, which alerts you want, quiet hours, history retention	To honour your settings. Your mute list is private to you

What Orbit does not collect. No contacts, no photos, no microphone or camera access, no browsing history, no advertising identifier, no device fingerprint. There is no analytics SDK, no advertising SDK and no crash-reporting SDK in the app.

Background location

Orbit collects location in the background — while the app is closed or not in use — because a family map that only updates when someone opens the app is not a family map. This is the core function of the product.

Background collection happens only while you have location sharing switched on. Turn sharing off and collection stops. On Android a permanent notification is shown the whole time your location is being shared, so it is never happening invisibly.

Our lawful basis

Consent for collecting and sharing location, including in the background. You give it by turning sharing on, and you can withdraw it at any time by turning sharing off, which stops collection immediately.
Performance of a contract for your account and circle membership — we cannot provide the service without them.
Vital interests for an SOS, which deliberately reaches everyone in your circle including anyone you have hidden from.

Who can see your location

The members of the circles you belong to, and no one else. Within that:

Per-circle pausing. You can stop sharing with one circle while continuing with others. When you pause, your coordinates are erased rather than hidden, so nobody can see where you were.
Per-member hiding. You can hide from an individual. This is enforced by our database security rules — their app never receives your position — rather than by their app choosing not to display it.
Pausing is not announced. Your circle sees "not sharing". They are not sent a notification telling them you switched it off.
SOS overrides everything. An SOS sends your location to every member of the circle, including anyone you have hidden from. The app tells you this before you send one.

If you leave a circle, your last position and your entire location history for that circle are deleted before your membership ends. The people left behind keep no copy.

Who processes data for us

We use a small number of service providers. They process data on our instructions and are not permitted to use it for their own purposes.

Provider	What it handles	Where
Google Firebase	Sign-in — including Continue with Google and Continue with Apple — and the database holding positions, circles, places, events and preferences, and push message delivery	Servers in the United Kingdom and European Union
Expo	Push notification delivery. Receives your push token and the text of an alert	United States
Google Maps	Map imagery inside the Android app	Global
Cloudflare	Hosting for this website and the web dashboard	Global edge network

Transfers outside the UK are made under the UK International Data Transfer Addendum or equivalent safeguards.

We do not sell your data. Orbit does not sell, rent or share personal data with data brokers, advertisers, insurers or analytics companies, in identifiable or aggregated form. There is no commercial arrangement under which anyone outside the list above receives information about where you have been.

How long it is kept

Data	Kept for
Your current position	Until replaced by the next update, erased when you pause, or deleted with your account
Location history	Exactly as long as you choose: off, 24 hours, 7 days or 30 days. Expiry is enforced by the database itself, not by us remembering to run something. Shortening the setting deletes anything already older than the new window
Events	Until the circle or your account is deleted
Account and profile	Until you delete your account
Circles and places	Until deleted by their members

Deletion is not always instantaneous: expired history is removed by an automated process that usually completes within 24 hours, and backups are overwritten on a rolling basis within 30 days.

Your rights

Under UK data protection law you have the right to:

ask what personal data we hold about you and get a copy
have inaccurate data corrected
have your data erased
restrict or object to how we use it
receive your data in a portable format
withdraw consent at any time, which for location means turning sharing off

Several of these are built into the app so you do not have to ask: turning sharing off, hiding from someone, setting history retention, and deleting all of your history from Settings.

For anything else, email support@londonj.co.uk and we will respond within one month. To delete your whole account, see Deleting your account.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

Children

Orbit is designed for families, and children's locations are among the data it handles. It is not directed at children as customers: an account must be set up by someone aged 13 or over, and a child is added to a circle by a parent or guardian, on a device that parent or guardian controls.

Where a child is under 13, the parent or guardian is responsible for consenting on their behalf and for the decision to share that child's location. We ask that families discuss it rather than install it silently — and the app is deliberately built so that the person being located can see they are being located, pause it, and hide from individuals.

How it is protected

All traffic is encrypted in transit, and data is encrypted at rest by our database provider.
Access is enforced by database security rules evaluated on the server for every single read, not by the app deciding what to show. A member you have hidden from is refused the data itself.
Only members of a circle can read anything within it.
Your preferences — including who you have muted — are readable only by you.

No system is perfectly secure. If we discover a breach affecting your rights we will tell you and the Information Commissioner's Office as the law requires.

Changes to this policy

If we change this policy we will update the date at the top, and for anything that materially affects how your location is used we will tell you in the app before it takes effect.

Contact

support@londonj.co.uk