PRIVACY
Privacy Policy
Last updated: 1 November 2026 · Operated by Anitaben Wankhede at orbit-gs0d.onrender.com
Orbit is a personal AI tutor. This policy explains exactly what we keep about you, why we keep it, who else sees it, and how to get it removed. We do not sell your data and we do not run advertising trackers on this site.
1. What we store
| Data | Why it exists | Where it lives |
|---|---|---|
| Your email address and a hashed password | To sign you in and tie your progress and paid plan to you | Supabase (authentication) |
| Learning profile: name you choose, skill, level, goal, minutes per day | To teach at the right level instead of starting from zero every time | Supabase table learner_state |
| Progress: XP, streak, completed concepts, mastery scores | To show your path and pick the next lesson | Supabase table learner_state |
| Which skills you started, and in which month | To apply the free plan's monthly skill allowance. Paid plans are not limited | Supabase table learner_skill. It has no access policy for your own account key — only Orbit's server writes it, so a learner cannot rewrite their own count |
| Lesson conversations you have with the tutor | They are the lesson itself; the tutor needs them to continue | Sent to an AI provider to generate the reply; kept only for the request |
| Plan, order id, payment id, expiry date | To know whether your paid plan is active | Supabase table learner_plan |
| A random device id in your browser | To apply the free plan's daily lesson limit when you are not signed in | Your own browser storage |
We never see or store your card number, UPI PIN, CVV or net-banking password. Payment is handled entirely inside Razorpay's own window; we only receive back a payment id and whether the money was captured.
2. Who else processes your data
- Supabase — our database and sign-in provider.
- Razorpay — payment processing, subject to their own privacy policy.
- AI providers (OpenRouter, which routes our lessons to DeepSeek, and also Google, OpenAI and Anthropic) — each lesson question you send is forwarded to one of them so it can generate a reply. Their use of that text is governed by their terms; we send only the current conversation and your level, never your password or payment data.
- Render — the server that runs this app.
No data is sold, rented or shared for marketing. There is no third-party analytics or advertising script on this site.
3. Cookies
After you sign in we set two HTTP-only cookies (orbit_access, orbit_refresh) so your browser can prove who you are on the next request. They are not readable by page scripts, are not used for tracking, and are cleared when you sign out. If you use Orbit without an account, no cookie is set at all and your progress stays only in your own browser.
4. Security
Every learner's rows are protected by row-level security, so an account can read and write only its own data. API keys for AI and payments live only in server environment variables — never in the app, never in the Android APK. Production traffic runs over HTTPS and sign-in cookies are flagged HTTP-only, Secure and SameSite.
No system is perfectly secure, so please use a password you do not reuse elsewhere and sign out on shared devices.
5. Retention and your choices
- Download your data: ask us by email and we will send your learning profile, progress, the skills you started and your plan records.
- Correct it: edit your profile in the app, or tell us what is wrong.
- Delete it: email vankhederamesh909@gmail.com from your registered address and we will remove your account, your learning state, your skill history and your plan row. Deleting a paid account does not create a refund outside the window in our refund policy.
- Stop syncing: sign out and Orbit keeps working with progress stored only on that device. You can keep studying the skills you already started; starting a new one needs a signed-in account, because that is where the monthly allowance is counted.
Payment records that Indian law requires us to keep for accounting are retained for the statutory period even after account deletion; those records are not used for anything else.
6. Children
Orbit is meant for learners aged 16 and above. A learner under 18 should use it with a parent or guardian's consent, and a parent or guardian may request deletion of that learner's account at any time by emailing vankhederamesh909@gmail.com.
7. Changes
If this policy changes materially we will update the date above and, for signed-in learners, show a note in the app. Continued use after an update means the new policy applies.
8. Grievance officer
Questions, corrections or complaints about your data: vankhederamesh909@gmail.com. We acknowledge within 48 hours and aim to resolve within 15 days. Full contact details, including our registered address, are on the contact page.