Privacy Policy
The short version
- You sign in with Apple. We don't ask Apple for your name or email.
- Synced cards are encrypted at rest with a key unique to your account, but the Orbit service can read them to answer requests you've allowed. They are not end-to-end encrypted.
- Phone-only cards never leave your iPhone unless you export them or move them to Synced yourself.
- AI tools you connect get the cards their permissions allow. What they receive is kept under their own policies, and we can't take it back.
- Orbit chat sends your messages and permitted synced cards to Anthropic's Claude models on Amazon Bedrock. They aren't used to train models, and we keep no transcript.
- No ads, no tracking, no third-party analytics. We don't sell or share your personal information.
- You can export everything and delete your account in the app, on any plan.
1. Who we are
Orbit ("Orbit") is made by Cloudy Tuesdays LLC, a Florida limited liability company ("we", "us"). We are responsible for the personal information described here. Questions: help@cloudytuesdays.com.
Orbit stores short facts, called cards (for example "Me · preferred language: TypeScript for backend work"), and lets AI tools you connect read and save them within permissions you set. Cards are grouped into namespaces such as Personal or a project, and sorted into categories such as Preferences, Projects, Decisions, Goals, Constraints, Work and Profile.
2. Your account
You can use phone-only cards, imports, manual packets and local backups without an account. Syncing, connecting AI tools and Orbit chat need an Orbit account, which you create with Sign in with Apple.
- We don't request your name or email address from Apple, so we don't receive them.
- Apple gives us a stable identifier for you that is specific to our apps. We store a one-way hash of it, linked to a random internal account ID. That is how we recognize you when you sign in again.
- We keep sign-in session tokens (stored on your iPhone in the Keychain, and as hashes on our server) so you stay signed in.
- To connect a tool from a computer, you can sign in on the browser consent page with Sign in with Apple, or with a one-time pairing code shown in the app (Settings → Connect a browser). A code works once and expires after 5 minutes.
3. Synced cards
When you or a connected tool saves a card to your account, we store it with what's needed to manage it:
- Content: the card's subject, attribute and value; the short evidence excerpt and optional conversation label a tool submitted with it; correction reasons; and the names you give namespaces and connections.
- History: earlier versions of a card, which connection saved it, whether you confirmed it, and disagreements between versions.
- Settings: your namespaces, connections, and each connection's permissions.
- Activity: a content-free log of what was returned to or saved by each connection (card IDs, versions and counts, never the text).
How it's protected. Card content and the names above are encrypted at rest with AES-256-GCM, using a data key unique to your account that is itself protected by AWS Key Management Service. Data travels over TLS. This is not end-to-end encryption: the Orbit service decrypts cards to answer requests you've allowed (for example, a recall from a connected tool or an Orbit chat message), and to show them to you in the app. Some operational information is not encrypted this way: IDs, timestamps, categories, card states and version numbers, permission settings, and usage counts.
What isn't saved. Orbit skips anything outside the categories you allowed for that connection, anything that looks like a password, key or token, government ID numbers and payment card numbers, facts the tool inferred rather than you stated, and text that looks like instructions to an AI. Skipped content is not stored; only a count and a reason code (for example "2 skipped: not allowed") appear in Activity. Detection is automated and can't be perfect, so please don't share secrets with tools connected to Orbit.
Sensitive categories. Health, Finance and Relationships are off for every connection until you turn them on for that specific connection, after a warning. If you do, cards in those categories are stored and shared like other synced cards.
A copy of your synced cards is also kept inside the encrypted vault on your iPhone so you can read them offline. It's removed when you sign out or delete your account.
4. Phone-only cards
Cards marked This phone only stay in an encrypted vault on your iPhone (AES-256-GCM, with a key in your iPhone's Keychain). The vault is excluded from iCloud and device backups. Phone-only cards are never synced, never returned to a connected tool, and never sent to Orbit chat or any AI model. We don't receive them.
They leave your phone only when you choose to:
- Export: you can save or share your cards as a file. The app warns you first, because the place you save it may be a cloud service.
- Move to Synced: you can promote a card to your account after reviewing exactly what will be sent. From then on it's a synced card.
- Manual packet: you can build a text packet, review it, and paste it into another tool yourself.
- Local backup: an encrypted backup file, protected by a recovery key you keep. Where you store that file is up to you.
Orbit chat conversations are also stored only in this vault on your iPhone.
5. Connected AI tools
When you connect a tool (for example Claude, ChatGPT or Gemini) you approve it in your browser and choose one namespace and the categories it may read and save. After that:
- When the tool calls Orbit, we return synced cards from that namespace in the categories it may read (each card's text, category, source and dates). The tool, and the company that runs it, receive those cards and handle them under their own terms and privacy policies, not ours.
- When the tool saves a fact in an allowed category, it's stored automatically as a synced card, labeled with the connection that saved it.
- Disconnecting stops future access from the tool's next request. It can't recall copies the tool already received, and it doesn't change the tool's own memory.
- The name a tool gives itself is shown as reported; we don't always verify which app it is.
For a tool hosted in the cloud, such as Claude on the web, requests come from the provider's servers, not from your device.
6. Orbit chat
Orbit chat sends your messages to Anthropic's Claude models running on Amazon Bedrock (operated by Amazon Web Services, in the United States). With each message, the app sends the recent messages of that conversation, and our server adds synced cards from that namespace that Orbit chat's own permissions allow. Each answer shows how many cards were sent with it.
- Phone-only cards are never sent to Orbit chat.
- Under Amazon Bedrock's terms, your messages and the model's replies aren't used to train models and aren't shared with the model provider. Bedrock invocation logging is turned off, and we don't log message text.
- Our server doesn't keep a transcript. It processes each message, returns the reply, and keeps only content-free records (token counts, which card versions were sent, and your remaining allowance).
- If you state a fact in your latest message, Orbit chat may save it as a synced card, within the categories you allowed for it, like any other connection.
7. Optional cloud extraction
When you import text (for example a conversation you exported from another app), Orbit finds candidate facts on your iPhone, using Apple's on-device model or built-in rules. On iPhones where the on-device model isn't available, you can turn on cloud extraction. It's off by default, and the app asks you before each import is sent.
If you use it, the text you chose to import is sent to our server and to Claude Haiku on Amazon Bedrock, which returns candidate facts. The text isn't stored after it's processed and isn't used to train models. The app then shows the candidates for you to review; nothing is saved without your approval, and approved cards stay phone-only.
To keep this feature from being abused, the app proves it's a genuine copy using Apple's App Attest, which creates a random key ID for your installation. We keep that key ID and per-installation request counts, which expire automatically. The key ID isn't linked to your Orbit account.
8. Subscriptions
Orbit Pro is sold through Apple's App Store. Apple handles payment; we never see your payment details, name or Apple Account. To unlock Pro on your account, the app sends us the signed transaction Apple gives it. We verify it with Apple's certificates and keep your plan, product, expiry date and the transaction's original ID (so one purchase can't unlock many accounts).
9. Security and operations
- Our servers run on Amazon Web Services in the United States (us-east-1).
- Server logs record the route, status, timing and counts. They never contain card text, chat messages, tokens or IP addresses, and are deleted after 7 days.
- Every request is checked against the connection's current permissions. Connections can only reach the one namespace they were approved for.
- The app has no advertising, analytics, crash-reporting or tracking SDKs, and doesn't use an advertising identifier.
No system is perfectly secure. If we learn of a breach affecting your information, we'll notify you as the law requires.
10. Who processes data for us
| Service | What for | What it handles |
|---|---|---|
| Amazon Web Services | Hosting, storage, encryption keys, and AI models (Amazon Bedrock) | Everything stored in your account; chat and cloud-extraction text while it's processed |
| Apple | Sign in with Apple, App Store purchases, App Attest | Your sign-in and purchases, under Apple's privacy policy |
AI tools you connect are not our processors: you choose to share cards with them, and their providers' policies apply. We don't sell personal information, don't share it for advertising, and don't disclose it to anyone else unless the law requires it (for example a valid court order) or it's needed to protect someone's safety or our service from abuse.
11. How long we keep things
| What | How long |
|---|---|
| Synced cards | Until you delete them or your account |
| Deleted cards | Hidden from tools immediately; restorable for 30 days, then permanently deleted |
| Earlier versions of a card | Up to 90 days after they're replaced |
| Activity (content-free) | 30 days |
| Disconnected tools | Access ends immediately; their cards stay unless you choose to delete them |
| Retry records for saves | 24 hours (outcomes only, no card text) |
| Orbit chat and cloud extraction text | Not stored after the reply |
| Server logs (no content) | 7 days |
| Your account, after you delete it | Access ends and your encryption key is destroyed immediately, so stored content becomes unreadable; remaining records are removed within 7 days |
| Database backups | Up to 35 days after content is removed |
| Deletion marker | A hashed identifier and date, kept 45 days after account deletion so a backup restore can't bring the account back |
| Purchase ownership record | The subscription's original transaction ID and the account it unlocked |
| Phone-only cards and chat conversations | On your iPhone until you delete them, delete this phone's vault, or delete the app |
Deleting a single card through the app removes it from Orbit. It can't remove copies a connected tool already received.
12. Your choices and rights
- See and correct: every synced card, its history and Activity are in the app. You can edit, undo, restore or delete cards.
- Limit sharing: change a connection's categories, turn automatic saving off, or disconnect it (Connections → the tool).
- Export: Settings → Export synced account (JSON), plus exports of the phone's vault. Free on every plan.
- Delete your account: Settings → Delete Orbit account. See Delete your account for what happens.
Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have rights to access, correct, delete, or port your personal information, to object to or restrict processing, and to complain to your data protection authority. Most of these you can exercise directly in the app. You can also email help@cloudytuesdays.com. Because we don't know your name or email, we may need you to act from inside the app, signed in, so we can be sure the account is yours.
Where the GDPR applies, we process your information to provide the service you asked for (performance of a contract), and for security, abuse prevention and keeping the service running (our legitimate interests). If you turn on a sensitive category for a connection, you are explicitly choosing to store and share that information. Your information is processed in the United States.
13. This website
orbit.cloudytuesdays.com has no cookies, scripts, analytics or trackers. It's served by Amazon Web Services (Amazon S3 and CloudFront), which processes your IP address to deliver pages.
The browser consent pages you see while connecting a tool are part of the Orbit service. They set a short-lived cookie (15 minutes) to keep the steps of one consent together, and may show Apple's Sign in with Apple. If you email support, we use your message and address only to answer you.
14. Children
Orbit isn't directed at children under 13, or under 16 in the European Economic Area and the UK, and we don't knowingly collect their personal information. If you believe a child has created an account, email us and we'll help delete it.
15. Changes and contact
If this policy changes, we'll post the new version here with a new effective date, and tell you in the app if the change is significant. Contact: Cloudy Tuesdays LLC, help@cloudytuesdays.com.