The short version
Orbit is an iPhone app made by an independent developer in the Netherlands. Your routines, steps, streaks, completion logs and notes are stored on your device. If you turn on iCloud sync, that data travels through your own private iCloud container — we have no server that could read it.
Orbit contains no advertising, no tracking and no third-party trackers, and it does not ask for the App Tracking Transparency permission. It does send anonymous usage statistics — which screens and features are used, never what you write — so we can see where the app gets in people's way. You can switch this off in Profile → Data. One exception: if you answer a short check-in in the app, for example near the end of a free trial, the answers you choose to send reach us too, including anything you type.
Apart from those statistics, two features send anything off your device, and both are optional: iCloud sync (into your own iCloud account) and the friend leaderboard (opt-in, and only what you choose to share). Purchases are handled by Apple.
1. Who we are (data controller)
Orbit is operated by Aron de Groot, an independent app developer established in the Netherlands. Under the EU General Data Protection Regulation (GDPR) we are the controller for the limited personal data described below.
- Controller: Aron de Groot, trading as Groot Apps
- Privacy contact: privacy@groot-apps.com
- General contact: hello@groot-apps.com
We are not required to appoint a Data Protection Officer, because Orbit does not carry out large-scale monitoring or process special categories of data. Privacy questions go straight to the developer at the address above.
2. What data is processed, why, and on what legal basis
The table below is the complete picture. Anything not listed here is not processed by us.
| Data | Where it lives | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Routines, steps, schedules, notes, palettes, orb style | Your device; your private iCloud container if sync is on | Running the app you asked for | Performance of a contract, Art. 6(1)(b) | Until you delete it or uninstall the app |
| Completion logs, streaks, freeze balance | Your device; your private iCloud container if sync is on | Showing your progress | Performance of a contract, Art. 6(1)(b) | Until you delete it or uninstall the app |
| App settings (notification times, reduced motion, theme) | Your device (UserDefaults) | Remembering your preferences | Performance of a contract, Art. 6(1)(b) | Until you delete the app |
| Display name, pseudonymous CloudKit user ID, shared streak count | Public CloudKit database (Apple) | Friend leaderboard | Your consent, Art. 6(1)(a) — opt-in | Until you leave the leaderboard or delete your data |
| Anonymous App Store transaction ID, receipt, app/OS version, country | Apple; RevenueCat (our processor) | Verifying your subscription across devices and reinstalls | Performance of a contract, Art. 6(1)(b) | As long as you hold a subscription, plus statutory retention at Apple |
| Crash and hang diagnostics (Apple MetricKit) | Your device only | Fixing crashes you can report to us yourself | Legitimate interest in a working app, Art. 6(1)(f) | Rolling window on device; oldest reports are pruned automatically |
| Usage events (for example “routine started”, “paywall shown”), app version, language setting, days since install, linked to a random pseudonymous ID | TelemetryDeck GmbH, Germany (EU) | Understanding and improving the app | Legitimate interests, Art. 6(1)(f); you can object at any time in Profile → Data | As long as needed for aggregate statistics; deleted when our TelemetryDeck account is closed |
| Answers you choose to send in a check-in: why you are unsure, a price you would consider fair, and any text you type (for example a feature you miss) | TelemetryDeck GmbH, Germany (EU) | Improving Orbit's features and pricing | Your consent, Art. 6(1)(a) — nothing is sent until you tap Send or That's fair | As long as needed to act on the feedback; you can ask us to delete it at any time |
No health data ever reaches us, and Orbit holds no diagnosis or medication data (Art. 9 GDPR). Saving to Apple Health only happens after you allow it: Orbit asks for HealthKit permission to write only, and never reads your Health data (see section 3).
3. Data that never leaves your device
By default, everything you create in Orbit is stored locally using Apple's SwiftData framework, inside the app's encrypted sandbox on your iPhone.
- Time-of-day palette. Computed on-device from your clock and time zone. No location permission is requested and no GPS is used.
- Approximate sunrise and sunset. Derived from your time zone identifier (for example
Europe/Amsterdam) using a built-in table. Never sent anywhere. - Siri and Shortcuts. Orbit exposes App Intents so you can start a routine by voice. Intent donations are handled on-device by iOS; we receive nothing.
- Widgets and Live Activities. These read the same on-device store through a shared app group. They make no network requests.
- Photo proof. If a step asks for a photo, the photo is stored only in the app's storage on your device. It is not synced to iCloud and never uploaded.
- Apple Health. Once you allow it, Orbit writes what you finish to Apple Health on your device: workouts, mindful minutes, how you felt (only when you answer the question), toothbrushing, handwashing and water. What a step counts as comes from its name, and you can change it or switch it off for each step. Orbit asks for permission to write only and never reads your Health data. None of it is sent to us, to our usage statistics or to Orbit's iCloud sync; only the setting itself — what a step saves — is part of the routine and syncs with it. You can withdraw the permission at any time in the Health app.
4. iCloud sync (optional)
If you enable sync, Orbit stores your data in the private database of its CloudKit container, inside your own iCloud account. This is the same mechanism Apple Notes and Reminders use. Apple encrypts the data in transit and at rest.
We have no server, no admin panel and no credentials that would let us read your private container. Apple acts as an independent controller for your iCloud account; see the Apple Privacy Policy.
You can switch sync off inside Orbit, or revoke it entirely in Settings → [your name] → iCloud → Apps using iCloud.
5. Friend leaderboard (opt-in)
The leaderboard is off by default. It only starts when you generate an invite link or accept one. At that point the following is written to a public CloudKit database, readable by people who hold the invite:
- A pseudonymous identifier — Apple's anonymous CloudKit user record ID. It is not your Apple Account, not your email address, and cannot be linked back to you by us.
- A display name that you choose and can change or clear at any time.
- The streak count for the routine you explicitly shared.
No completion times, step contents, notes or schedules are ever shared. Leaving a leaderboard removes your row from the public database. Because you choose a display name freely, please do not use your full name if you would rather not be identifiable to other members.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by leaving the leaderboard, with no effect on the rest of the app.
6. Subscriptions and payments
All purchases run through Apple's App Store and StoreKit. We never see your card details, billing address or Apple Account email. Apple is the merchant of record and an independent controller for payment data.
To recognise your subscription across reinstalls and devices, Orbit uses RevenueCat, Inc. as a processor acting on our instructions. RevenueCat receives an anonymous app user ID, the App Store transaction data for your purchase, and standard technical metadata sent by its SDK (app version, OS version, country, device model).
RevenueCat also receives a few non-personal attributes about how you set up the app — the kinds of routine you picked, your orb style and the app version — so we can see which set-ups lead people to keep using Orbit.
RevenueCat is established in the United States. Transfers are covered by the European Commission's Standard Contractual Clauses together with the technical measures described in RevenueCat's documentation.
7. Notifications
Routine reminders are scheduled locally by your device through Apple's UserNotifications framework. Orbit runs no push server and sends no remote notifications aimed at you personally. You can revoke the notification permission at any time in iOS Settings. If you start a free trial, Orbit can also schedule one local reminder a day or two before the trial turns into a paid subscription.
8. Crash diagnostics
Orbit uses Apple's MetricKit to receive crash and hang reports from iOS after the fact. These reports are written to the app's own storage on your device and are pruned automatically. They are not uploaded. If you want to help us fix a crash, you can export them yourself and attach them to an email.
Orbit contains no third-party crash reporting SDK such as Crashlytics or Sentry.
9. No tracking, no advertising, privacy-friendly statistics
- No advertising identifier (IDFA), and therefore no App Tracking Transparency prompt.
- No advertising SDKs, no ad networks, no attribution or install-referrer services.
- Orbit sends anonymous usage statistics to TelemetryDeck GmbH, an analytics provider based in Germany that stores data in the EU. Each event contains the name of the event (for example “routine completed”), a few numbers such as a duration, the app version, your language setting and a pseudonymous ID — the random customer ID assigned by RevenueCat, which is not your name, email address or Apple Account. We never send routine names, step names, notes, photos or your leaderboard display name. You can switch statistics off at any time in Profile → Data → Share anonymous usage data; the app then deletes any events still waiting to be sent. The only text we ever receive is what you type into a check-in and choose to send; please don't include personal details there.
- No device fingerprinting, no cross-app or cross-site tracking, no data brokers, no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
- We never sell or share personal data, in the sense given to those words by the California Consumer Privacy Act or any comparable law.
10. Who else is involved
| Party | Role | What they get | Where |
|---|---|---|---|
| Apple Inc. / Apple Distribution International | Independent controller | App Store purchase and account data; your iCloud container contents, which are encrypted and inaccessible to us | Ireland, United States |
| RevenueCat, Inc. | Processor | Anonymous app user ID, transaction data, SDK metadata | United States |
| TelemetryDeck GmbH | Processor | Pseudonymous usage events, and check-in answers you choose to send | Germany (EU) |
That is the entire list. There are no other recipients, no affiliates and no advertising partners. We do not transfer personal data to any other third country. If we ever engage a new processor, this table is updated first.
For transfers to the United States we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.
11. How long data is kept
- On-device data stays for as long as the app is installed. Deleting the app removes it.
- iCloud data stays in your iCloud account until you delete it in the app or remove Orbit's data from iCloud settings.
- Leaderboard rows are removed when you leave the leaderboard or delete your data in the app.
- Purchase records are kept by Apple and RevenueCat for as long as required by tax and accounting law — in the Netherlands, seven years.
- Usage statistics are kept by TelemetryDeck only as long as needed for aggregate statistics, and are deleted when our TelemetryDeck account is closed.
12. Security
Orbit relies exclusively on Apple's first-party storage and transport: the encrypted app sandbox, CloudKit, and TLS for anything that leaves the device. We write no data to disk in plaintext outside that sandbox, and we operate no server of our own that could be breached.
If a personal data breach ever occurs that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority within 72 hours and inform you directly where the law requires it.
13. Your rights
Under the GDPR — and comparable rights exist under UK GDPR, the Swiss FADP, Brazil's LGPD, and the privacy laws of California, Colorado, Connecticut, Virginia and other US states — you have the right to:
- Access your data. Most of it is already on your device; open the app, or use Settings → Data → Export for a JSON file.
- Rectify anything inaccurate — you can edit everything directly in the app.
- Erase your data: Settings → Data → Delete everything, or simply delete the app.
- Restrict or object to processing based on legitimate interests.
- Data portability — the JSON export is machine-readable and yours to take elsewhere.
- Withdraw consent for iCloud sync or the leaderboard at any time, without any penalty in the app.
- Lodge a complaint with a supervisory authority.
Because Orbit is designed so that we hold almost nothing about you, most requests are things you can do yourself in seconds. Where you need us, write to privacy@groot-apps.com and we will respond within one month, as Art. 12(3) GDPR requires. Exercising your rights is free; we do not discriminate against anyone who does.
In the Netherlands the supervisory authority is the Autoriteit Persoonsgegevens. You may also complain to the authority in your own EU country of residence.
14. Children
Orbit is not directed at children under 13, and we do not knowingly collect personal data from them. Where local law sets a higher age of digital consent — up to 16 in some EU countries — that age applies instead.
If you are a parent or guardian and believe a child has provided personal data through the leaderboard, contact us and we will delete it promptly. Orbit complies with Apple's Kids Category rules by not participating in it, and contains no third-party advertising of any kind.
15. Country-specific information
United Kingdom
Processing is governed by the UK GDPR and the Data Protection Act 2018. Complaints go to the Information Commissioner's Office (ico.org.uk).
Switzerland
The revised Federal Act on Data Protection (revFADP) applies alongside this policy. The Federal Data Protection and Information Commissioner (FDPIC) supervises.
California and other US states
We do not sell or share personal information and have not done so in the preceding twelve months. We do not use or disclose sensitive personal information beyond the purposes permitted by CPRA §7027(m). California residents have the rights to know, delete, correct, and to opt out of sale or sharing — the last of which is moot here, as no sale or sharing occurs. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and comparable states hold equivalent rights and may exercise them at the same address. We do not process personal data for targeted advertising or profiling with legal effects, so no opt-out mechanism is required.
Canada
PIPEDA applies. You may complain to the Office of the Privacy Commissioner of Canada. Quebec residents also hold the rights created by Law 25.
Brazil
The LGPD applies. Your legal bases are execution of a contract (Art. 7, II) and consent (Art. 7, I) for the leaderboard. The supervisory authority is the ANPD.
Japan
The Act on the Protection of Personal Information (APPI) applies. Purposes of use are those set out in section 2 above; we do not provide personal data to third parties beyond the processors named in section 10.
South Korea
Under PIPA, the items collected are those listed in section 2, collected for the purposes stated there and retained for the periods stated in section 11. You may refuse consent for the leaderboard; the rest of the app remains fully usable.
Australia
The Privacy Act 1988 and the Australian Privacy Principles apply. Complaints may be made to the OAIC.
India
The Digital Personal Data Protection Act, 2023 applies to users in India. You may contact us at the address in section 1 to exercise your rights as a Data Principal.
Türkiye
KVKK (Law No. 6698) applies. Requests under Art. 11 may be sent to the contact address in section 1.
Mainland China
Orbit is not distributed on the mainland Chinese App Store, and no personal data is processed within mainland China. The Chinese translation of this policy is provided for readers elsewhere who prefer it.
16. Changes to this policy
If we materially change how Orbit handles personal data, we will update the date at the top of this page and, where the law requires it, show a notice inside the app before the change takes effect. Previous versions are available on request.
17. Contact
Questions, deletion requests, or general worries: privacy@groot-apps.com.