ORBITPrivacy Policy
This explains what Orbit Software LLC ("ORBIT", "we") collects, why, who else sees it, and what you can do about it.
THE SHORT VERSION
Most of your data never reaches us. ORBIT runs on your computer. Your charts, trades, journal, labels, settings and — importantly — your broker and market data credentials are stored on your machine. When you use our natural voice service, the text ORBIT is about to speak passes through our server to ElevenLabs. That text can include details of your trades (see section 3); we do not log or store the spoken text. The desk also contacts services directly for broker access, Ask ORBIT, voice, alerts, public information and page resources, as listed in section 3. Those services receive the information needed for those calls.
We never see your card. Payments go through Stripe. We receive confirmation that you paid and an identifier, never your card number.
We do not sell your personal information. Not to anyone, for anything.
We do not relay your market-data feed. Quotes, bars and depth flow from your data provider to your computer. A sentence sent for natural voice can include market details, as described above.
1. WHAT WE COLLECT
Things you give us
| What | When | Why |
|---|---|---|
| Email address | Signup, waitlist | Your account, receipts, service notices |
| Username | Signup | Identifying your account |
| Password | Signup | Stored only as a salted hash — we cannot read it |
| Name, billing address | Checkout | Held by Stripe, not by us |
| Free-text answers | Waitlist form | Understanding what to build |
| Your consent, and which version of these terms you agreed to | Waitlist form, signup | Proving that consent was actually given, and to what wording |
| Support messages | When you write | Answering you |
| Text ORBIT speaks aloud | When you use our natural voice service while signed in | Turning it into speech through ElevenLabs (section 3); we do not log or store the text |
Things collected automatically
| What | Why |
|---|---|
| Device identifier | Enforcing the two-device limit. It is a one-way hash of hardware characteristics — not a serial number, not your name, and it cannot be reversed into anything identifying |
| Device name and OS | So you can recognise your own machines in a device list |
| Subscription status and dates | Deciding whether your access is current |
| Last-seen timestamp per device | Showing you which device is which |
| Voice usage counts (characters and requests per day, linked to your username) | Enforcing the account's voice allowance |
| Website analytics | Understanding traffic — see the section below, which explains exactly what this is |
Website analytics, in full
We measure our own website. We do it ourselves, on our own servers, and we do not use Google Analytics, advertising pixels, or any third-party tracking service. Specifically:
- We set no cookies on visitors. There is nothing to consent to, which is why this site has no cookie banner.
- We never store your IP address. To count visitors without identifying them, your IP address and browser user-agent are combined with a secret that changes every day and turned into a one-way hash. That is enough to say "412 people visited" and not enough to say who any of them were. Because the daily secret changes, yesterday's hashes cannot be matched against today's — we cannot follow the same person from one day to the next, by design.
- What is recorded: which pages were viewed, the referring site, any campaign tag in the link you clicked, how far down a page people scrolled, which links and buttons were clicked, roughly how long the page was open, your country (from Cloudflare, at country level only), and whether the browser was a phone, tablet or desktop.
- What is not: your name, your email (unless you type it into a form), your IP address, your precise location, anything about other sites you visit, and anything at all from inside the ORBIT application.
- We honour Do Not Track. If your browser sends that signal, the analytics script stops before it records anything.
Things we do NOT collect
- Your trading data. Positions, orders, P&L, journal entries, chart drawings and training labels are written to your own disk. These records are not uploaded to us. The exception is text sent for natural voice: it can mention symbols, position sizes, P&L or other details (section 3).
- Your broker or market data credentials. Entered on your machine, stored in your own local configuration.
- Your market data. It flows from your provider to your computer. It does not pass through us as a feed; spoken text can include excerpts.
- Your card number. Stripe handles it; we never receive it.
2. WHY WE USE IT
- To provide the Service and keep your account working
- To take payment and send receipts
- To enforce the device limit and subscription status
- To send service messages — payment failures, security notices, significant changes. These are not marketing and you cannot opt out of them while you hold an account.
- To send product news, only if you asked for it. Unsubscribe any time.
- To answer support requests
- To detect and prevent fraud and abuse
- To comply with law
We do not use your information for automated decisions with legal effects.
3. WHO ELSE SEES IT
We use a small number of providers. Each sees only what it needs.
| Provider | What it gets | What it does |
|---|---|---|
| Stripe | Email, your ORBIT username (as a subscription reference and metadata), name, billing address, card details | Payments and subscriptions. Stripe is a PCI-compliant processor with its own privacy policy |
| Google Workspace | Email you send us, and copies of the notifications below that reach our inbox | Our email |
| Cloudflare | IP address and request data for site visits and the app's calls to our servers; the database holding your account record and voice usage counts | Hosting, storage and protection for tradeonorbit.com |
| Resend | Your email address and username, and the content of account emails (welcome and download details, password-reset links) | Delivers our account emails |
| ElevenLabs | The text ORBIT is about to speak when you use our natural voice service while signed in. It can include symbols, position sizes, P&L and other personal details in the text. We do not attach your ORBIT username or email as separate fields | Turns the text into speech; our server relays it without logging or storing the text |
| FormSubmit | (1) Waitlist signups: your email, free-text answers, the terms version you agreed to and your country. If our endpoint fails, your browser sends the form directly to FormSubmit, which also sees your IP address. (2) Internal billing alerts: the account's username, Stripe customer and subscription identifiers and status, and for refunds and disputes, the amount and Stripe charge or dispute reference | Relays signup and owner notifications, including billing alerts, to our inbox by email. See section 9 |
What the desk reaches directly
These connections run from your computer. The receiving service sees your IP address and the request data described below. Calls made with your own keys use your account with that provider; ORBIT's servers do not relay those calls. The signed-in natural voice service in the table above is a separate path through our server.
| Service | What it receives | When it is contacted |
|---|---|---|
| Rithmic | Your broker login, account and contract selections, orders (including changes and cancellations), and market data subscription requests | When you connect your own Rithmic broker/data account. Your broker credentials and orders go directly from your desk, not through ORBIT's servers |
| Anthropic | Your Ask ORBIT question, conversation history, notebook notes and trading context: the chart/account fact snapshot sent with the question | When Ask ORBIT uses your own API key |
| ElevenLabs | The spoken text, which can contain trading or personal details, plus the selected voice and voice settings; your key authenticates speech and voice-list requests | When you configure your own API key for direct voice |
| OpenAI | The spoken text, which can contain trading or personal details, plus the selected voice and model; your key authenticates the request | When you configure your own API key for direct voice |
| ntfy.sh | Your chosen topic and alert titles and bodies about entries, exits, risk halts or feed status | When you choose ntfy alerts and configure a topic. ntfy.sh is the default server for that choice; no API key or account is required. You can choose a different ntfy server, which receives the same data |
| Pushover | Alert titles and bodies, priority, and your Pushover application token and user key | When you choose and configure Pushover alerts |
| Your webhook | Alert titles and bodies, priority and an ORBIT source label, sent to the URL you choose | When you choose webhook alerts. The destination operator receives the payload; any credentials in your URL go to that destination |
| Yahoo Finance | Your IP address and requests for symbols, quote/chart intervals and date ranges, or news feeds | Public quotes, stock charts and footer news; no API key required |
| CNBC | Your IP address and news feed requests | Footer news headlines; no API key required |
| MarketWatch | Your IP address and news feed requests, sent to its Dow Jones feed service | Footer news headlines; no API key required |
| Open-Meteo | Your IP address and the town you type for place lookup; the resulting latitude/longitude coordinates for the forecast | Footer weather through its geocoding and forecast services; no API key required |
| Alpaca | Your IP address, your own API key and secret, and requested stock symbols, intervals and date ranges | Stock-chart data when you configure Alpaca credentials. This is a data request, not a futures order route |
| Google Fonts | Your IP address and requests for font stylesheets and font files | Downloads missing local fonts and provides the desk page's fallback when the local copy cannot load; no API key required |
| unpkg | Your IP address and the chart library resource request | Downloads a missing local library and provides the desk page's fallback when the local copy cannot load; no API key required |
Alerts are off by default. Once configured, their titles and bodies can include symbols, prices and trade results in R. Dollar amounts are sent only if you enable them. A public ntfy topic can be read by anyone who knows its name; choose the destination and topic with that in mind.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We may disclose information if legally required, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case you will be told before your information moves.
4. HOW LONG WE KEEP IT
- Account information: while your account exists, then up to 12 months, then deleted
- Payment records: as long as tax and accounting law requires, typically 7 years
- Waitlist entries: until you ask to be removed, or 24 months of no contact
- Support messages: 24 months
- Device records: until you release the device or close the account
- Voice usage counts: stored in the account database with no automatic expiry currently configured. The spoken text itself is not logged or stored by us
5. YOUR RIGHTS
Wherever you live, you may ask us to:
- Tell you what we hold about you
- Correct anything wrong
- Delete it (subject to records we must keep by law)
- Send you a copy in a portable format
- Stop marketing — instantly, via any unsubscribe link
Email privacy@tradeonorbit.com. We respond within 30 days, and we will not treat you worse for asking.
If you are in California, you have these rights under the CCPA/CPRA, including the right to know what is collected and shared and the right to opt out of sale — we do not sell, so there is nothing to opt out of.
If you are in the EEA or UK, our lawful bases are: performing our contract with you (account and subscription), legitimate interests (security, fraud prevention, improving the product), consent (marketing), and legal obligation (tax records). You may object to processing based on legitimate interests, withdraw consent at any time, and complain to your data protection authority.
6. SECURITY
Passwords are stored as salted PBKDF2 hashes — we cannot read them, and neither can anyone who obtains the database. Sessions use short-lived signed tokens rather than storing your password. Traffic is encrypted in transit. Access to production systems is limited.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will tell you and the relevant authorities as the law requires.
The strongest protection here is structural: most of your sensitive data never leaves your computer, so most of it cannot be exposed by any breach of ours.
7. CHILDREN
The Service is for people 18 and over. We do not knowingly collect information from children. If we learn we have, we delete it.
8. INTERNATIONAL
We operate from the United States. If you use the Service from elsewhere, your information is processed in the US, which may have different data protection law than your country. Where required, we use appropriate safeguards for transfers.
9. CHANGES
We may update this policy. Material changes get 30 days' notice by email or in the app before taking effect, and the "last updated" date always reflects the current version.
Waitlist signups are stored through our own endpoint, which also forwards email notifications to FormSubmit. The browser can send the form directly to FormSubmit if that endpoint fails. Internal billing alerts also use FormSubmit. Moving notifications to another provider would change who receives the data; it would not end third-party processing. We will update this policy if these arrangements change.
10. CONTACT
Orbit Software LLC privacy@tradeonorbit.com