ItalianoEnglish

Privacy Policy — Orbit

Last updated: 22 September 2026

Orbit keeps your things to do on your phone, and sends them to nobody.

Data controller: MindContact — privacy@mindcontact.net

In short

• Orbit creates no account, asks for no sign-up, and collects no name, email or contacts.
• We run no servers: no app data is ever sent to us.
• Two things leave your device, and neither of them is your list: what Google AdMob collects to serve ads, and the address you type if you look a place up by address instead of using “Here”.

Permissions and what they are for

Advertising

Orbit shows ads through Google AdMob. AdMob may collect and process:

• the device advertising identifier (Advertising ID / IDFA);
• the IP address and technical device information;
• ad interaction data.

Google processes this data as an independent controller. Policy and options: policies.google.com/technologies/ads

You can limit personalised ads from your system settings:

• Android — Settings › Privacy › Ads
• iOS — Settings › Privacy & Security › Tracking

In the EEA, the UK and Switzerland, Google's consent message appears on first launch; until you answer it, the app requests no ads at all.

Notifications and location

Orbit asks for two things, and asks only when they are needed, never at launch.

• Notifications — the first time you add something. They carry the quick add field in the shade and the deadline reminders. If you say no, the app works the same: it just does not tell you anything.
• Location — only when you attach a place to a task. The position is read once, at that moment, to store the point you are standing on inside that task's file, on the phone. From then on Orbit does not follow you around: that point is there to tell how far away you are while the app is open, so a task belonging somewhere weighs more when you are near it. This version does not ask for background location and does not warn you when you arrive: with the app closed it reads nothing.

Looking a place up by address

Besides “Here”, a place can be found by typing an address. In that case — and only in that case — the words you type are passed to Android's geocoding service (Geocoder), which is part of the operating system and on most devices is provided by Google: it turns an address into coordinates, and it needs the network to do it. Orbit has no server to send them to and keeps them nowhere else: it gets the results back, you pick one, and the coordinates end up in that task's file on the phone. If you would rather not, “Here” goes through no service at all.

The coordinates stay in the task's file with everything else: they are not sent to us, there is no Orbit server, and neither thing reaches the ad network. Take the place off a task and its coordinates go with it; revoke the permission and the app stays usable — the places simply stop weighing.

Your things to do

What you write in Orbit — the text of each task, its deadline, the place you may attach to it, the names of your lists and the deadline or place you give a whole list — is stored as files on your device: one per task, and one for each list that has settings of its own. It is not sent to us or to anyone else: there is no Orbit server, and the app has no account.

If you choose to keep that folder inside a synchronisation service you already use (Mega, Syncthing, Drive and the like), it is that service that copies it between your devices, under its own terms and privacy policy. Orbit only writes the files where you told it to.

Shared lists

A list can be shared with another person. Sharing it means exactly one thing: Orbit puts that list in a subfolder of its own and tells you where it is. From then on it is you who hands it over, with the synchronisation service you already use — Orbit sends nothing anywhere, has no server, has no account, and does not know who you are sharing it with.

What that entails, in full: the files of that list leave your device and pass through the service you chose, under its terms and its privacy policy; they are plain JSON files, not encrypted by Orbit; and whoever receives the folder sees everything in it, including entries you move in later. If you stop sharing, the files come back among yours and the other person's folder empties out.

The name you write in the settings ("Your name") is only used to sign what you do inside a shared list, so that the other person knows who ticked off what. It stays on the device until you share a list, nobody verifies it, and it never reaches us.

Deleted tasks stay in the folder as an empty marker for thirty days — this is what stops another device from bringing them back — and are then removed. Uninstalling the app deletes the app's own folder; a folder you chose yourself stays where you put it, and you delete it.

App preferences (settings, and a random device identifier generated locally to tell two copies of the same task apart) stay on the device and are removed when the app is uninstalled.

Children

The app is not directed at children under 13 and does not knowingly collect their data.

Your rights

With no account and no backend, we hold no data about you and cannot identify you. For data processed by Google AdMob, exercise your rights directly with Google, using the contacts in its own policy.

Any question: privacy@mindcontact.net

Changes

Any change to this policy updates the date at the top. Previous versions remain in the history of the public repository mcma-docs.