Trust

Security and privacy in Orbit

Orbit is a desktop app, so most of what you do in it never leaves your computer. This page explains, in plain English, where your data lives, what reaches our server and the AI companies, and how Orbit stops your Orbs doing things you didn't agree to. The legal detail is in the privacy policy.

What stays on your computer

Your chats, files, projects, the Moon's memory, your settings and your sign-ins to Claude and Grok are stored on your own computer. SUPERORBIT doesn't receive, store or read them.

The most sensitive things are encrypted on disk as well, with a key kept in your system's secure storage (the Keychain on a Mac):

• The Secret box, where you keep API keys, tokens and logins for your Orbs to use.
• Your Journal. Each day is its own file, sealed with AES-256-GCM under a key that lives only in the Keychain, so a copy of Orbit's data folder or a backup can't read it.
• Connector sign-ins for tools like Notion, Linear or Stripe. Orbs only ever see the tools, never the sign-in.

What goes to the AI companies

When you send a message, Orbit passes it from your computer to the company whose model you chose: Anthropic for Claude, xAI for Grok, and OpenAI for Codex (on your own API key). It goes on your own account with them, not through SUPERORBIT. Their own terms and privacy policies cover what they do with it.

What Orbit's server keeps

Orbit's account server runs your subscription. It keeps your email address, your subscription status from Stripe, and your signed-in devices so you can sign one out. Sign-in codes are stored only as a secure hash. Stripe takes payments, so SUPERORBIT never sees your card.

If you use Teams, what you share with teammates (Chat messages and files, shared Docs, and the projects, tasks and events you assign) is stored on the server so they can see it. It is sealed with AES-256-GCM before it reaches the database, so a stolen copy of the database or a backup can't be read without a key only the server holds.

A few features you choose to use also go through the server:

• Google Calendar. When you connect it, Google gives Orbit a lasting sign-in so the Planner can read and add events. The server keeps that sign-in (and your Google email and calendar time zone), encrypted with AES-256-GCM. Disconnecting revokes it with Google and deletes it from the server.
• Booking pages. If you publish one, the server keeps your page's name and working hours, your meeting types, and each booking: the time, and the name, email and note the person booking gives.
• Voice calls (Mac). Calls use cloud hearing and voices unless you choose On this Mac in Settings. In cloud mode your call audio streams from your Mac straight to AssemblyAI to be turned into text (set to be deleted after a day, never used for training), and the replies Orbit speaks come through the server from Inworld. The server counts the seconds and characters you use each month; it doesn't keep the audio or the words. On this Mac, calls hear and speak on your Mac only.
• Transcripts (Mac and Windows). While Orbit transcribes a call you've said yes to, the call's audio (your microphone and the other people) streams from your computer straight to AssemblyAI, which turns it into text, is set to delete the audio and text after a day, and never uses them for training. The server hands your computer a short-lived pass for each call and counts the minutes you use each month (20 hours of calls are included); it never receives the audio or the words. The transcript is saved only on your computer.
• Sign in with Google or Apple. The server keeps which Google or Apple account is linked to your Orbit account, and its email.
• Ideas and feedback. Ideas you post, votes, and bug reports or requests you send from the app (with a screenshot, if you add one).

Keys your Orbs can use but never see

The Secret box lets an Orb use a key without reading it. The Orb writes a placeholder where the value goes. Orbit puts the real value in at the last moment, in a terminal command, an environment variable or a form field, and takes it back out of everything the model and the transcript see afterwards.

Orbit asks you before a chat uses a secret, unless you've said that chat may always use it, and it keeps a log of which chat used which secret and when. See Secret box.

Nothing happens without your OK

• Permissions. You choose how much Orbs ask first, from asking before every change to full access. Change it any time from the shield in the message box or in Settings. See Permissions and plan mode.
• The Moon's rules. For each kind of job you choose whether the Moon acts on its own, asks first or hands it back to you. Out of the box it hands back sending, publishing, payments and passwords.
• Drafts never send themselves. Replies the Moon writes wait for you in Inbox.
• Waiting on you. Every approval from every Orb is in one list, on your computer and your phone.
• Changes before commits. Every edit an Orb makes to your code shows in Changes before anything is committed.
• Connectors. Read-only lookups run on their own; anything that changes something in the other app asks first.

The browser

Your Orbs work in tabs of their own and never take over the tab you're using. Orbit has its own password manager, encrypted with a key in your Keychain. Orbit fills forms itself, so no model ever sees a password.

Your phone

Linking a phone is optional. At home it talks to your computer directly. Away from home it reaches your computer through Orbit's relay, and everything the phone and computer say to each other is encrypted end to end, so the relay only passes on data it can't read. Notifications are encrypted for your phone before Google's push service carries them.

Blocks you share

Before a block goes into the Block Store it's checked for anything personal, and you see exactly what will be published.

The website

superorbit.app doesn't use analytics, advertising or tracking cookies, and its fonts are served from the site itself.

Common questions

Updated 24 October 2026