Orbit Privacy Policy

Effective date: 30 August 2026
Last updated: 7 September 2026

Orbit is an app that helps students find other students to study with at the same time, on the same thing.

This policy explains what we collect, why, who can see it, and how you get rid of it. It's written to be read, not skimmed past. If something here isn't clear, email us and ask.

Orbit is not affiliated with, endorsed by, or connected to the University of British Columbia. We are an independent app. UBC has no involvement in Orbit and no access to your Orbit data.

1. Who we are and how to reach us

Orbit is operated by an independent developer based in British Columbia, Canada. Orbit is not incorporated and is not a company.

Privacy Officer: the developer of Orbit, reachable at the address below
Privacy email: orbitstudyapp@gmail.com
General support email: orbitstudyapp@gmail.com

The Privacy Officer is the person accountable for your personal information at Orbit. Send privacy questions, access requests, correction requests, and complaints to the privacy email above.

Orbit is run by one person and has no business premises, so email is how we're reached. If you need a postal address — to send a formal privacy request or a legal notice — email the privacy address and we'll provide one.

We are subject to British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What we collect

Everything below is information you type in or upload. We do not buy information about you from anyone.

Required — you can't use Orbit without these

That is the whole gate. Everything else on your profile is optional and can be added later, or not at all.

You need a UBC email address to sign up (@student.ubc.ca, @alumni.ubc.ca, or @ubc.ca), and you have to click a confirmation link sent to it. So every account on Orbit was created by someone who controls a UBC address.

Be clear about what that does and doesn't prove. It shows the person could receive email at a UBC address. It is not proof of current enrolment, not an identity check, not a background check, and not a UBC endorsement. Addresses get shared, kept after graduation, and occasionally used by someone other than who you'd expect. Treat it as a weak signal, not a guarantee.

A very small number of accounts belonging to the developer are exempt so the app can be tested and reviewed by Apple. They are not used for matching.

Optional — you choose whether to add these

Created as you use the app

What we don't collect: we don't collect your location, we don't track you across other apps or websites, we don't have advertising, we don't have an analytics vendor, and we don't run a crash-reporting service. If we ever add analytics or crash reporting, we'll name the provider in this policy and in section 8 before we turn it on.

3. Why we collect it

We use your information for these purposes and no others:

• To run matching. Your courses, availability grid, year, faculty, and preferences are compared against other users' to find people studying the same subject at the same time.
• To show you a profile and show your profile to others. See section 4 for exactly who sees what.
• To let you message and plan sessions with people you match with.
• To keep Orbit safe. Blocks, reports, and reviewing reported content.
• To send you account emails, such as confirming your email address or resetting your password. Orbit does not currently send push notifications and does not collect a push token.
• To operate and fix the app, including debugging problems.

We do not sell your personal information. We do not share it with advertisers. There are no ads and no payments in Orbit.

4. What other users can see — read this section

This is the section that matters most. Be honest with yourself about what you're comfortable making visible before you fill in your profile.

The information other students can see

If someone can see your profile, they can see:

• Your display name — the name you gave when you signed up
• Your profile photo (if you added one)
• Your year of study
• Your major
• Your pronouns
• Your gender — unless you selected "prefer not to say", in which case nothing is shown
• Your study style
• The courses you're taking
• Your whole weekly availability grid — every block you marked free. Read the next part before you fill it in.

Your faculty is used to filter matches — you can limit who you're shown by faculty, and other people can do the same — and it is not displayed on your profile.

Your intensity, session length, preferred environments and study goals are stored and shown back to you when you edit your profile, but the current version of Orbit does not use them for matching and does not show them to anyone else. They exist for a matching improvement that hasn't shipped. If that changes, we'll update this policy before it does.

Your availability grid reveals when you are and are not free

This deserves saying plainly, because it's the least obvious thing on this page.

Anyone who can see your profile sees your entire weekly availability grid — all 35 blocks, exactly as you filled it in. Not just the times you overlap with them. All of it.

From that, a stranger can infer a good deal about your week: when you're in class, when you work, which evenings you're out, whether you're around on weekends. Marked free every weekday at 9am and never on Friday nights? That is now visible to every person you match with, and you cannot see who looked.

So fill it in as an invitation, not as a diary. Mark the blocks you actually want someone to contact you about, and leave the rest unmarked — including blocks where you're free but would rather not be asked. Unmarked doesn't mean "busy", it just means "don't ask", and nobody can tell the difference.

Who can see your profile

Signed-in users can read your discoverable profile unless either of you has blocked the other or your account is banned. Other students can open profiles from conversations as well as matching. Turning off discoverability prevents new profile reads by other users, but it does not erase messages or copies they already have.

The matches list applies additional preferences for year, faculty, gender, group size and shared courses. Those filters control recommendations; they do not make your profile private from every other signed-in user. Passing on someone removes them from recommendations; use Block to cut profile and conversation access in both directions.

Availability is optional. Overlapping free blocks help rank matches, and an empty grid does not prevent you from using Orbit.

What other users never see

• Your email address
• Your gender, if you selected "prefer not to say" — that choice is honoured and no gender is shown
• Your deadlines
• Your blocks — the person you blocked is not told
• Your reports — the person you reported is not told who reported them

• Whether you've read a message. There are no read receipts on Orbit. We store when you last opened a conversation so we can show you what's new, and that timestamp is visible to nobody but you. The person who messaged you is never told whether or when you opened it

• Your match preferences — the filters you set for year, faculty, gender and group size are yours alone. They are used to decide who you're shown, but no other user can see them, including through our API directly.

How photos are handled

Images you send in a chat or a direct message are private. They're stored in a locked container, and when someone who's allowed to see the message opens it, the app mints a temporary link that stops working within the hour. A link copied out of the app is dead by the time most people would try it.

The database checks chat-image access each time. Only the uploader or someone who can read the message that references the file can request a temporary link. Knowing or copying the file's internal address is not enough, and blocking cuts off the other person's access.

Your profile photo is different — it is served from a public web address. That's deliberate: profile photos are meant to be seen by the students you match with, and they appear across several screens. The filename is random, so nobody can guess it or work through a list of users to collect everyone's photos. But if someone who can see your profile copies the image address and passes it on, whoever receives it can open the picture without an Orbit account, and that stays true.

So: treat your profile photo as public. Use one you'd be comfortable with a stranger seeing. Chat images are private, but a screenshot isn't — see below.

Once you send it, you can't take it back

Anything you type into a message or a profile field can be screenshotted, copied, or remembered by the person who sees it. Deleting it from Orbit does not delete it from someone else's phone. Don't put anything in your profile or a message that you'd be upset to see shared.

5. Consent, and how to withdraw it

By creating an Orbit account and filling in your profile, you consent to us collecting and using your information for the purposes in section 3.

You can withdraw consent at any time:

• Turn off discoverability. You stop appearing in other people's matching. Your account stays.
• Change or clear the optional parts of your profile. You can set your gender to "prefer not to say", clear your study and match preferences, empty your availability grid, and delete any deadline, at any time.
• Delete your account. This removes your information from Orbit. See section 10.

Being straight with you about two limits in the current version of the app:

• You can remove your profile photo at any time — open your profile and tap Remove photo. That deletes the image file itself, not just the link to it.
• Your name can be edited but not left blank, and your year and major are collected when you set up the account. Everything else on your profile — faculty, pronouns, study style, photo, gender, courses, availability — can be left empty or cleared at any time. Pronouns include a "prefer not to say" option.

Withdrawing consent for required account information means you can't keep using Orbit. Courses and availability are optional: you can clear either and keep your account, although matching may be less useful.

Withdrawal isn't retroactive. It doesn't undo things that already happened, like a message someone already read.

6. Messages

Messages between users are stored in our database so they can be delivered and so you can read your history.

Messages are not end-to-end encrypted. They are encrypted in transit and at rest by our hosting provider, but they are not encrypted in a way that stops us from reading them. That means:

• If a message is reported, we may read it — the reported message and enough surrounding conversation to understand what happened.
• We do not read messages for any other routine reason. We don't read them out of curiosity, we don't scan them for marketing, and there is no advertising to target.
• We may also access messages if we're legally required to — for example, a valid court order — or if we genuinely believe someone is at risk of serious harm.

If you need a private, encrypted conversation, use a messaging app built for that. Orbit is built for coordinating study sessions.

7. Automated filtering and moderation

The automatic filter

Orbit checks the text you type against a list of slurs, explicit sexual solicitation and self-harm goading before it is stored. This covers messages, your display name, your pronouns and your major.

• The check runs in our database, not just in the app. The app checks first so you get an instant, readable message instead of an error — but the database refuses the content regardless, so the filter can't be skipped by anything running on a phone.
• It sees through common evasion: letter substitution (n1gg3r), padding (niiiggger), and spacing or punctuation between letters.
• If text matches, it is refused and never stored — you're shown a message and can edit it. We don't keep the refused text, and a refusal on its own is not reported to us or held against your account.
• The filter only reads text. It does not scan images. Images are reviewed only when someone reports them.
• Nothing here is sent to a third party to be scanned, and no AI classifier is involved.

It is deliberately narrow, and tuned to avoid false alarms on ordinary coursework talk — "I'm suspicious of that answer" and "the therapeutic approach" are not flagged, though a naive word filter would flag both. It does not police rudeness, disagreement or bad jokes. Those are handled by reporting and blocking.

No automatic filter catches everything, and this one is not meant to. It is a first line. Reporting is the real one.

Human moderation

Moderation at Orbit works like this today:

• You report. Reports come from users. Every report goes into a queue that a human — currently the founder — reviews.
• We act within 24 hours. We commit to reviewing and acting on reports of objectionable content and abusive users within 24 hours of receiving the report.
• Acting can mean removing content, hiding a profile, suspending an account, or permanently banning a user.
• Blocking is instant and automatic. When you block someone, visibility is cut in both directions immediately. No review needed, no explanation needed.

Decisions are made by a person, not an algorithm. If you think a moderation decision about your account was wrong, email the support address in section 1 and a human will look at it again.

8. Service providers

We use a small number of companies to run Orbit. They only get the information they need to do their job, and they aren't allowed to use it for their own purposes.

That is the complete list. We do not use a separate analytics, advertising, crash-reporting, or email-marketing company. If we add one, we'll name it here before it goes live.

9. Where your data is stored

Your data is stored in Canada

Orbit's database, authentication records, and stored files are hosted by Supabase in the Canada (Central) region, on servers in Canada. Your personal information does not leave the country in the ordinary course of using Orbit.

The honest caveat. Supabase is an American company. Where data physically sits and whose laws can reach it are two different questions: under the US CLOUD Act, a US-based provider can in some circumstances be compelled by US authorities to produce data it controls, including data stored on servers outside the United States. So Canadian storage reduces that exposure — it does not eliminate it, and we would rather say so than imply a guarantee we can't give.

We think the practical risk to a study-matching profile is low, but you're entitled to know before you sign up, and BC privacy law requires us to be straight with you about it.

How to ask about it: if you have questions or concerns about where your information is held, contact our Privacy Officer at the email in section 1.

10. Retention and deletion

While your account is active, we keep your information so the app works.

When you delete your account, we delete:

• Your profile and every field in it
• Your profile photo file, and every image you sent in a chat, from storage
• Your messages, in both course chats and direct messages
• Your matches
• Your study sessions and invitations
• Your deadlines, study preferences, match preferences, and availability grid
• Your authentication record — the login credential itself, so the account is genuinely gone, not just hidden

Deletion is not reversible. We can't restore an account after you delete it.

What may survive deletion, and why:

• Anything the other person already saved themselves. Your messages are removed from our database, so the person you were talking to opens the conversation and finds it empty — your messages are gone from their app, not just hidden. What we cannot undo is a screenshot, a copied link, or a saved image already on someone else's phone.
• Safety records. If you were reported or banned, we keep a minimal record — an internal identifier and the reason — so a banned user can't immediately return with a new account. Reports filed about you are kept but stripped of the link to your identity. We keep this for 12 months and no longer than needed for that purpose.
• Records we're legally required to keep, for as long as the law requires.
• Backups. Our database provider keeps encrypted backups so the service can be restored after a failure. Deleted information can remain in those backups until they roll over, currently up to 7 days, after which it is gone. Backups are never used to bring a deleted account back.

11. How to delete your account

In the app: open Settings, scroll to Account, and tap Delete my account. You'll be asked to confirm. Once you confirm, deletion happens immediately and as described in section 10. You do not have to email us, and you do not have to leave the app.

If the in-app option isn't working, email the privacy address in section 1 from the email address on your account and ask us to delete it. We'll do it and confirm within 30 business days, usually much faster.

12. Your rights

Under BC PIPA and PIPEDA you have these rights, and we'll honour them.

Access. You can ask for a copy of the personal information we hold about you, and for information about how it's been used and who it's been disclosed to. Email the Privacy Officer. We'll respond within 30 business days. If we need more time, we'll tell you why and how long we need. Access is free. In rare cases the law requires or permits us to withhold something — for example, information that would reveal another person's personal information, or the identity of someone who reported you. If we withhold anything, we'll tell you which part and why.

Correction. If something we hold about you is wrong, tell us and we'll fix it. Most of it you can fix yourself in the app.

Withdraw consent. See section 5.

Delete. See sections 10 and 11.

Complain. Start with our Privacy Officer — email the privacy address in section 1. We'd rather fix it directly. If you're not satisfied with our answer, you can escalate:

• Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) PO Box 9038, Stn. Prov. Govt., Victoria, BC V8W 9A4 Phone: 250-387-5629 · Toll-free in BC: 1-800-663-7867 oipc.bc.ca

• Office of the Privacy Commissioner of Canada (OPC) — where PIPEDA applies 30 Victoria Street, Gatineau, QC K1A 1H3 Toll-free: 1-800-282-1376 priv.gc.ca

You don't need our permission to contact either office, and you don't need to go through us first.

13. Security

What we do:

• Your data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our hosting provider.
• Access to the database is controlled by row-level security rules — the rules that enforce who can see whose profile are enforced by the database itself, not just by the app on your phone.
• Passwords are handled by Supabase Auth and stored hashed, never in plain text. Nobody at Orbit can see your password.
• Access to the production database is limited to one person — the developer, who is also the Privacy Officer — through an account protected by multi-factor authentication. Nobody else has credentials. If that ever changes, we'll update this policy.
• Chat images are stored privately and reached only through temporary links that expire within the hour.
• Exception: profile photos, which are served from a public web address by design, under an unguessable filename. Section 4 explains what that does and doesn't mean.
• Content rules and the UBC email requirement are enforced by the database, not only by the app, so they can't be bypassed by anything running on a phone.

What we can't promise: no system is perfectly secure. We can't guarantee your information will never be accessed by someone who shouldn't have it. What we can promise is that we'll take it seriously and tell you if it happens — see section 15.

Your part: use a strong, unique password, don't share your login, and don't put sensitive personal information (financial details, health information, your home address) into your profile or messages. Orbit has no reason to ask for any of that.

14. Age restrictions

You must be 17 or older to use Orbit.

We set the floor at 17 because some first-year university students are still 17 when term starts, and excluding them would cut out part of the group Orbit is built for.

This means some people on Orbit are under 19, which is the age of majority in British Columbia. If you are an adult using Orbit, assume you may be matched with, or messaged by, someone who is a minor. Behave accordingly. If you are under 19, everything in our safety guidelines applies to you with more force, not less — read them before you agree to meet anyone.

We do not verify anyone's age. We ask you to confirm you're 17 or older at sign-up and we take your word for it. Anyone can type anything into that box.

We don't knowingly collect personal information from anyone under 17. If we find out an account belongs to someone under 17, we'll delete it and its data.

If you believe someone under 17 has an Orbit account, or that an adult is behaving inappropriately toward a minor, email the privacy address in section 1. Reports involving a minor's safety go to the front of the queue.

15. If there's a data breach

If your personal information is lost, stolen, or accessed by someone who shouldn't have it, and there's a real risk of significant harm to you, we will:

1. Tell you as soon as feasible — what happened, what information was involved, what we're doing, and what you should do.
2. Report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires, and notify the OIPC BC where required.
3. Keep a record of the breach, as the law requires.

We'll notify you by email at the address on your account, and in the app if we can.

16. Changes to this policy

We'll update this policy when the app changes or the law does.

• Minor changes (typos, clarifications): we update the "last updated" date at the top.
• Meaningful changes — new information collected, a new purpose, a new service provider, a change to what other users can see: we'll tell you in the app and by email at least 30 days before the change takes effect, and give you a chance to review it or delete your account first.

We won't quietly start using your information for something new. If a change means collecting or using your information for a purpose you didn't agree to, we'll ask for your consent again.

Past versions are available on request from the Privacy Officer.

Questions? Email orbitstudyapp@gmail.com. A real person reads it.