Orbit Privacy Policy

Last updated: October 2026 (Orbital reads your record, calendar links, photo readers)

Orbit is a study planning app for IB Diploma students, AP students and their teachers, built and run by Saturn Designs Studio (the "operator"). This policy explains what Orbit collects, why, and what you can do about it. Plain language on purpose.

What Orbit collects

Account: your email address and a password (stored only as a secure hash). You join with an invite code; Orbit does not run open registration.

Study data you enter: subject choices, confidence ratings, logged errors and any photos you attach, doubts, deadlines, ideas, assessment scores, settings, and your activity history (which powers the streak and review scheduling).

Google Calendar, only if you connect it: Orbit asks Google for two narrow permissions: to read and write calendar events, and to read the list of your calendars. It uses these to write its own events (your review blocks and deadlines, the deadlines read from a calendar link you paste included, unless you turn that link's Show in Google Calendar off) to a calendar you choose, your primary calendar by default, and to show your day's events in the plan. Every deadline event Orbit writes carries a private mark naming your account by a code (never your name or email), so Orbit never reads your own events back in as deadlines, while a calendar you share with someone else who uses Orbit still shows you theirs. About once a day Orbit lists its own events on that calendar to put right any that are out of step with your deadlines: one Google refused to move, a second copy, or one whose deadline you have since removed. Orbit does not create a calendar for you and does not request full calendar access. It stores a refresh token to keep this connection alive, and it never stores your calendar contents beyond what is needed to render your plan.

Calendars you ask Orbit to read, only the ones you tick: in Settings, Connections you can tick calendars (typically the school feed you already subscribe to in Google) for Orbit to read deadlines out of. Orbit then reads the titles, dates and times of their upcoming entries, once a night and whenever you press Sync now, and turns the ones that are deadlines into deadlines of your own. Reading a calendar never writes to it, Orbit's own events on a calendar you tick are left out of the read, it keeps only the entries it turned into deadlines, and untick one and it stops reading it. An imported deadline says which calendar it came from and can be removed in one tap, which also tells Orbit not to bring that entry back.

Calendar links you paste, only the ones you add: in Settings, Connections you can also paste a calendar link (an iCal, ICS or webcal address from Schoology, Toddle, ManageBac or any school system) for Orbit to read without Google. Orbit stores that link on your account, reads it from its own server on its own at most once every 10 minutes (asking only whether anything changed, whenever the calendar's server can answer that) and whenever you press Read now, and turns the entries that are deadlines into deadlines of your own, exactly as it does for a calendar you tick above. It writes nothing back to that calendar. If Google Calendar is connected, the deadlines it read from the link are also written to your Google calendar as Orbit's own events, as any deadline is; each link has a Show in Google Calendar switch that takes them off, for a link you also added to Google Calendar yourself. It keeps only the entries it turned into deadlines, plus when the link was last read and when you last pressed Read now, whether that worked, a fingerprint of the entries it last held (their dates, times and titles, so an unchanged calendar is not read into deadlines again), when a read last changed one of its deadlines, how many it brought in today, and how long to wait before asking a calendar's server that asked for a pause; and, for an hour each, the times you pressed Read now or Sync now or pasted a link, so that no one account can have Orbit ask a school's calendar too often (thirty an hour at most). The link usually works as a password to that calendar, so Orbit never shows it back in full, never puts it in a log and never sends it anywhere else; it is in your data export, since it is yours. Remove it and Orbit stops reading it; the deadlines already read from it stay until you remove them.

Push notifications, only if you turn them on: a device subscription so Orbit can send you the morning digest, streak guard, and deadline alerts. You can turn these off per type or per device at any time.

Technical basics: timezone (so your day boundary is correct), and server logs that record errors and timings without page content.

Your school's holidays, and public holidays: the term dates, holidays and event days you enter or have read from your school's calendar, kept in your settings so Today and the calendar know when there is no school. While you have entered no holidays of your own, Orbit uses its own fixed list of public holidays for your country, which is the country your time zone is in or the one you pick in Settings. Nothing is looked up for this: the list is part of Orbit. When your time zone names no country, Settings may suggest the one your school is in or the one your connection comes from, and that suggestion is stored only if you save it.

What Orbit does not do

Orbit does not sell your data, show ads, share your data with advertisers, or use your data to train AI models. Your study data is visible only to you. The operator can access the database for maintenance and support, and does not browse individual accounts without a reason you have raised.

Orbital AI

Orbital AI is the study tutor built into Orbit. It answers by sending your question to Anthropic, which runs the Claude models Orbital uses. This section says exactly what that means.

It runs when you ask it to, with three exceptions you control. Almost nothing is sent in the background, on a schedule, or because you opened a screen: every request starts with you tapping one of Orbital AI's options. The three that do not are the overnight error read, the calendar deadline read and, in the teacher edition, the weekly brief, all described below, and each has its own switch in Settings. The first exception: if you tick a calendar or paste a calendar link for Orbit to read deadlines out of (above), a read of them may send a handful of entry titles, and nothing else, to be told whether they are deadlines. Rules read almost every title without a model; only a title the rules cannot read at all is sent, at most twenty a day, and no date, no calendar name or link, no account id and nothing of your study data goes with it. Untick every calendar and remove every link and this never happens.

What is sent. The question Orbital builds from what you tapped, or the one you typed yourself, plus a slice of your syllabus so the answer fits what you actually study, and a short summary of your own record so it can answer questions like "am I ready for Thursday's test". In practice that is:

• The subject, its level, and the topic and subtopic names from your own tree, including any you have renamed.
• The note you wrote on an error, and where you said it came from, when you ask Orbital AI to explain that error.
• The title and date of an assessment, when you ask what to review before it.
• With every question you ask and every follow up, a short summary of your own record, counted by Orbit itself: your subjects with how many subtopics you rate solid, shaky, weak or untaught, the weak and shaky ones by name, and how many errors are still open in each; your assessments in the next two weeks by title and date; your most recent results in each subject (the kind, the date, the marks and the grade they come to); how many doubts you have open and the words of the newest few; how many reviews are waiting; where your ratings and your review record disagree; and your exam session or sitting dates. In the Diploma it also carries your CAS record (the strands, the learning outcomes, the one line you wrote for each experience and the next CAS date) and your IA, EE and TOK ideas. It is capped in length, it never carries your name, your email or any id, and it is left out of a PLAB station rehearsal, where Orbital AI is playing a patient. The teacher edition sends no such summary, because it holds no student record.

What is never sent. Your error log photos. A photo you logged against a mistake stays in Orbit's storage and never reaches the model provider. Your email address, your name and your account id are not sent either: requests are not tied to you at the provider. The things you can choose to send are material you attach to a subtopic, a file you put on a message, and a photo or a PDF of your timetable, of your school's unit list or of your school's calendar, and the next three paragraphs are about them.

Material you attach, if you attach any. You can attach your own material to a subtopic or a topic: text you paste, a photo, a PDF, or a public web link. This is the one place you can hand Orbital AI something of your own, and it only happens when you do it.

• It is read once, when you attach it. A photo or a PDF is sent to the model provider that one time to be turned into text; a link is fetched by Orbit's server, which only ever opens ordinary public pages (never anything behind a login, never an address on a private network), and the page's text is kept.
• After that reading, the text is what is used. The file is never sent again and the page is never fetched again, so attaching something costs one reading, not one per question.
• That text is then included in Orbital AI requests about the subtopic it is attached to, so answers can use your class notes and your teacher's wording.
• It is yours alone. It is stored against your account, it is never shared with another account, it never appears outside your own threads, and no part of Orbit joins it to anybody else.
• You can remove any piece with one tap on the subtopic it sits on, which deletes the text and the file together. Deleting your account deletes all of it.
• The same licence notices and web addresses that are stripped out of your syllabus are stripped out of attached material before anything is sent.

Files you put on a message. In a conversation with Orbital AI you can attach a photo or a PDF to the message you are sending: a photo of a question, a page of your notes, a worksheet. This is a deliberate act every time, and nothing is attached unless you attach it.

• It is sent to the model provider with that one message, as the file itself rather than as a transcription, because a photo of your working is the working and what went wrong is often in the crossing out.
• It goes with that message and no other. It is not added to a subtopic, it is not carried into later questions, and Orbital AI does not see it again on the next turn.
• The file is kept in Orbit's storage so you can see what you sent, and it is deleted when the conversation is deleted, which happens on the schedule your plan keeps threads on.
• If you want Orbital AI to keep reading it, "Keep" on the file makes it material on that subtopic, and the paragraph above then describes it.
• If what you send is work you are being assessed on, Orbital AI answers it under the same rule as a typed question: it explains the method and where the working goes wrong, and it does not produce the final answer you are being marked on.

A timetable, a unit list or a school calendar read from a photo. You can ask Orbit to read a photo or a PDF of your school timetable, of your school's unit list for a subject (in the tree editor, beside the paste box), or of your school's calendar (in Settings, beside your term dates). This is a deliberate act every time.

• The file is sent to the model provider once, to be read into rows: the periods of your week, the sections of the unit list with their numbers and any practice question numbers printed beside them, or the term dates, holidays and event days on the calendar. The subject's name goes with a unit list, so the read knows what it is looking at, and today's date goes with a calendar, so a page that prints no year is read into the right one.
• The file is deleted from Orbit's storage straight after that one reading, whether or not the reading worked. It is never kept and never sent again.
• Nothing changes until you have checked what was read. A timetable or a school calendar is saved only when you press Save on what was read, and a unit list only fills the paste box: you see the same preview a paste gives you, and nothing in your tree moves until you apply it.
• Each photo or PDF read counts against your plan's photo reads, however many pages the PDF has.

The overnight error read, which you can turn off. This is the one thing Orbital AI does without you asking for it that night. On a night when there is something new in your error log, Orbit counts your own rows itself and sends the counts to be read: which subtopics keep coming back, how many of them are still open, how many reviews held, the kind of mistake each note reads as, the time of day they happen, the subject, and where the work came from. What comes back is a short piece in the bell about what keeps happening and one thing to do about it.

• The notes you wrote on your mistakes are not sent. They are sorted into kinds (a slip, a unit, a misread, a method) by Orbit itself, by matching words, and only the kind and the count go over.
• Your name is not sent and your account id is not sent. The request calls you "this student".
• It reads the hat you are wearing, so a subject you study in one edition never appears in a read written for another.
• The counting is arithmetic and is done by Orbit, not by a model, so nothing is guessed and nothing extra is sent to be counted.
• Settings, Notifications has the switch. Turn it off and no night reads anything and nothing is sent. It is on by default, because the read is the whole of the feature.

Nudges from the disc, which you can turn off. At most once a day, Orbit may show one short line beside the Orbital AI disc when your own record gives it a reason: a test in the next three days, or an AP exam or a PLAB sitting in the next two weeks, on a subject with subtopics you still rate weak; in the Diploma, a CAS strand still empty a month after your first CAS experience; or a subtopic you rate solid that your reviews keep disagreeing with. This is worked out in Orbit's own code from your own rows. No model is asked and nothing is sent anywhere, so it is not one of the exceptions above.

• Tapping it opens Orbital AI with that option already chosen, and nothing is asked until you press Ask, so a nudge never spends a question.
• "Not now" closes it in one tap. A nudge once shown stays away for thirty days even if it is still true, and after two "Not now"s in a row the disc stays quiet for a week.
• Settings, Notifications has the switch, under Orbital AI. Turn it off and none are shown. It is on by default. The teacher edition shows none.

Mixed practice and explaining it back. Two more of Orbital AI's options, both started by you. Mixed practice deliberately jumps between topics and subjects: Orbit chooses the running order itself from your own ratings, your review outcomes and your error log, and sends the finished order, so what goes over is subtopic names from your tree and nothing about how you have done on them. Explaining it back is the one place you write first: you explain a subtopic in your own words and what you wrote is sent to be marked against your syllabus, which is what marking it means. Both are yours, both stay in their thread, and both go when you delete your account.

CAS planning, in the Diploma edition. "Help me plan CAS" sends what Orbit has already counted for you: how many experiences sit in each strand and what state each is in, the one line you wrote for each of them, which of the seven learning outcomes have something on them and which do not, whether you have marked a project, the next CAS date in your diary, and roughly how long is left until your exam session. If you type an idea you are weighing up, that goes too, because judging it is what you asked for. Orbit holds no reflections and never has, so none are sent: there is no reflection field in the app. Orbital AI will not write one for you either, which is refused in Orbit's own code before anything reaches the model, and every CAS answer ends by saying that your CAS coordinator is the one who decides what counts.

The teacher edition sends syllabus and coverage information only. When Orbit is worn as a teacher, Orbital AI works from the class syllabus (topic and subtopic names, level, exam session) and the coverage log (what has been taught, practiced or assessed, term dates and the rotation). No student work, no student names and no marks are sent, because the teacher edition holds none: Orbit's teacher mode records what a class has covered, never what an individual has done. Nothing there predicts a student's grade, writes a report card comment or marks coursework, and everything it writes for a classroom is labelled as a draft to check.

The weekly brief, which you can turn off. This is the one thing Orbital AI does in the teacher edition without you asking for it. On your reset day morning, Orbit counts your own rows itself and sends the counts to be read: how many lessons you logged last week and which subtopics they covered, how much of each class tree is taught against how much of its run has gone, what is next in syllabus order, how many pieces are waiting to be marked and how late they are, and how many lessons each class has on your timetable that week. What comes back is a short brief on Today and on the weekly reset.

• Nothing of any student's goes with it, because the teacher edition holds none, and every figure is a count over your own coverage log, your own lesson log, your own marking queue and your own timetable.
• Your name is not sent and your account id is not sent.
• The counting is arithmetic and is done by Orbit, not by a model, so nothing is guessed and nothing extra is sent to be counted. Every sentence that comes back names the figures it was written from, and one that names none is thrown away before you ever see it.
• Settings, Notifications has the switch. Turn it off and no morning writes anything and nothing is sent. It is on by default, because being there without being asked is the whole of the feature. Writing one again from the card is yours to do and is never automatic.

Your school's slide template, if you upload one. A teacher can upload their school's own PowerPoint template once, so that a lesson deck comes out in the school's real layouts, fonts and colours instead of something Orbit invented.

• The file is stored in Orbit's private storage, under your account's own folder, and nobody else can read it.
• It is never sent to the model provider. Orbit opens the file itself, in code, and fills the placeholders the template already has. What the model is asked for is the lesson: the outcomes, the definitions, the worked example, the questions and the speaker notes, as words. It never sees the template and never sees the finished deck.
• Each deck Orbit builds from it is stored the same way, under your own folder, and is yours to download.
• Replacing the template deletes the old file. Removing it deletes the file and the mapping. Deleting your account deletes the template and every deck built from it.

It is not used to train models. Anthropic does not train its models on what Orbit sends through the API. Orbit does not train anything of its own on your data either.

What Orbit keeps. Every Orbital AI request is a conversation, kept in your account: your question, the answer, and any follow ups, so you can read a study guide again next month and carry on from it. Orbit also records the model used, how many tokens went in and out, and what it cost, so the operator can watch the bill. Threads are kept for as long as your plan keeps them, which Settings and the plans page both say; on the free plan that is thirty days, after which they are deleted. You can see everything kept on the Orbital AI screen, and every word of it goes when you delete your account. The billing record is the one thing that stays: the date, the model, the token counts and the cost, with your account id beside them and nothing else. No question, no answer, no subject, no email. It stays because the money was spent and a bill has to be answerable for after the person has gone; the section on deleting says the same thing again in one place. If you are past your daily allowance a study guide is written overnight instead, and the request waits in Orbit's database until the finished guide lands in its thread.

Answers can be wrong. Orbital AI is a language model. It can be confident and mistaken, it does not know your school's mark scheme, and it is not your teacher. Check anything that matters against your syllabus, your notes or a person, and never hand in its words as your own: doing so is academic misconduct at every school Orbit is built for.

Google user data

Orbit's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Orbit requests only the minimum scopes it needs: calendar.events (read and write events) and calendar.calendarlist.readonly (read your list of calendars). Calendar data is used only to provide the calendar features you see in the app, is not transferred to anyone else except as needed to provide those features, and is not used for advertising. Disconnecting Google in Settings revokes Orbit's access and deletes the stored token.

How your data is protected

All traffic uses HTTPS. Data is encrypted at rest by our database provider. Google Calendar tokens are stored server side in a table no browser can read, accessible only to Orbit's server code, and are deleted the moment you disconnect Google. Access to production data is limited to the operator and protected by row level security, so each account can only ever reach its own rows. Photos live in private storage reachable only through short lived signed links. Orbit holds Google user data only while your connection is active and never shares it with third parties. If we ever discover a security incident affecting your data, we will notify affected users promptly.

Backups, and what deleting leaves behind

Orbit's database is copied once a night so an account can be put back after a mistake or a failure. The copy is encrypted before it is stored, with a key the operator alone holds, and each one is kept for thirty days and then destroyed. Nobody reads a backup to look at an account; it exists to be restored whole.

This is the first of two honest exceptions to deletion. When you delete your account, everything of yours goes from the live database and your photos go from storage straight away, and nothing you deleted comes back on its own. For up to thirty days after that, copies taken before you deleted still hold your rows, until each one ages out. The photos and files themselves are not in a backup at all, only the rows that name them. If a restore ever happens inside that window, the operator deletes any account that had asked to go before bringing the restored database back into service.

The second is the billing record for Orbital AI. Every model call Orbit makes is written down with its date, the model, how many tokens went in and out and what it cost, and that row stays after the account goes, carrying the account id and nothing else: no question, no answer, no subject, no email, nothing anybody wrote. It is a record of money spent rather than a record of you, and keeping one is ordinary practice. If you would rather it went too, ask the operator.

Bot protection (captcha)

The login and signup screens use Cloudflare Turnstile, a privacy friendly captcha, to tell real students apart from bots. When you sign in or sign up, Turnstile runs in your browser and processes a small amount of technical information (such as your IP address and browser signals) to decide whether the request is human. Orbit uses this only to protect accounts; Cloudflare processes these signals on the operator's behalf and states that they are not used to build advertising profiles or to train models. For the specifics of what Turnstile processes, see Cloudflare's Turnstile Privacy Addendum, which supplements Cloudflare's Privacy Policy.

School enquiries

If you fill in the schools form on the plans page, Orbit stores what you typed: the school's name, your role, your email address, roughly how many students, and anything you wrote about what you are hoping to solve. It is stored so the enquiry can be answered, and it is read by the operator and nobody else. It is not an account, it signs you up for nothing, and it is never shared or sold. Stored with it are the country your browser's request came from, a one way hash of the address it came from, and your email address lowercased, all so the form cannot be flooded; the address your request came from is not stored. Ask at hello@saturndesigns.art and the enquiry is deleted. That is done by hand: the console can mark an enquiry answered and put it back, and it has no way to delete one, because an enquiry a button can make vanish is an enquiry nobody answers.

Where data lives

Data is stored with Supabase (database and photo storage, private buckets) and the app runs on Vercel; the nightly encrypted backup is held by GitHub, where Orbit's code lives. The login and signup captcha is provided by Cloudflare. Push delivery uses your browser's push service. These providers process data on the operator's behalf under their own security commitments.

Your controls

• Export your data from Settings at any time.
• Delete your account from Settings; this removes your data and stored photos. Encrypted backups taken before you deleted still hold your rows until they age out, at most thirty days; the section above says exactly what that means.
• Disconnect Google or turn off notifications from Settings.
• Change or correct anything you entered directly in the app.

Students under 18

Orbit is made for students, many of whom are under 18. If you are under the age required in your country to consent to data processing, you should have a parent or guardian's permission to use Orbit. A parent or guardian can ask for an account and its data to be deleted by contacting the operator.

Changes and contact

If this policy changes in a meaningful way, Orbit will show a notice in the app. Questions or requests: hello@saturndesigns.art.

This policy is written by a student operator in plain language and is not legal advice; it describes practices truthfully and will be updated as the app grows.