Effective 13 October 2026

Privacy Policy

Orbit Social Manager processes social-account and content information only to provide account connection, authorised delivery, duplicate prevention and provider evidence requested by an authorised user.

Information processed

Orbit may process provider account identifiers, display names, public handles, OAuth access and refresh credentials, granted permissions, provider capability information, content selected by the user, captions and settings, approved delivery times, and provider-returned content identifiers, permalinks, status and supported metrics. Operational records include cryptographic hashes and receipt metadata used to verify the exact transaction.

How information is used

This information is used to identify the exact authorised account and destination, validate the user's approved release, make a supported provider request, prevent duplicate delivery, reconcile uncertain outcomes, refresh permitted provider data, and retain an operational audit record. Orbit does not use social-account data for targeted advertising and does not sell it.

Hosted storage and security

Orbit's headless service runs on Cloudflare infrastructure. OAuth credentials are encrypted before storage in the service database; the encryption key is kept separately as a protected service secret. Access and refresh credentials are not shown on this public website or returned in operational receipts. Authorised media remains in a controlled Google Drive folder and may be copied to a short-lived, content-addressed Cloudflare R2 cache when that feature is enabled. Media access is restricted to the exact approved transaction through short-lived signed delivery links.

TikTok data

When a user chooses to connect TikTok, Orbit uses TikTok's official OAuth consent process. Orbit requests basic identity information to verify the connected account and only the posting permissions needed for the approved integration. The direct posting route remains disabled until TikTok grants production access and Orbit completes live certification. If enabled, Orbit will send only the exact user-approved media, title and settings to TikTok and will read the resulting status and public object needed for reconciliation.

Service providers and sharing

Information is sent to a connected social platform only where needed for an authorised provider operation. Cloudflare processes hosted service data, and Google processes media held in the user's controlled Drive folder, subject to their applicable terms and privacy policies. Orbit does not sell personal information or share it with unrelated advertisers.

Retention and deletion

Credentials are retained only while needed to operate an authorised connection and may be deleted on request. Users can also revoke Orbit through the connected provider's settings. Media remains subject to the user's Google Drive controls. Operational receipts may be retained for audit, security and duplicate prevention, while unnecessary credential and account data is removed under the applicable retention process. A user may request access, correction or deletion through Support.

Choices and rights

Users can decline provider permissions, revoke provider access, remove or restrict media in their controlled Drive folder, and request access, correction or deletion of applicable personal information. A revoked or unavailable permission prevents the affected provider action.

Public website

This product-information site does not provide a login form and is designed without advertising trackers or behavioural analytics. Standard hosting security logs may still be processed by the hosting provider.

Children

Orbit is an operational business tool and is not directed to children.

Changes

Material changes will be published on this page with a new effective date.

Contact

Privacy requests can be made through the published Orbit support route.