Partner-blind, on purpose
The person you pair with never sees your raw answers or your hard-no list. Conjunction is weather, not a list of what they like. Limits stay in the engine so a rendezvous can avoid them. They are not a conversation starter.
Privacy
You can tell the truth here
Orbit hears both of you in private. We do not sell what you want, advertise from it, or train on it. Your partner gets a night, not the interview.
Not a social network
There is no directory, no browse, no public profile of desire. Pairing is a code you choose to share: ORBIT-XXXXXX. A share card shows a nickname and an abstract constellation. It does not show what you like.
No marketing use of your desire
We do not sell your answers, fingerprint, or pairing data. We do not use them for advertising, retargeting, lookalike audiences, or data-broker lists. We will not email you promotions built from what you marked as a craving.
No model training on your interview
Your answers are not a dataset for someone else’s model. We do not train foundation models on what you typed, ranked, or refused. When a rendezvous is written, a language model may see a beat card: the setting, this night’s assignments, and a short summary of the style you leaned toward. Not your raw interview, and not your partner’s brief.
Nobody is reading these
There is no moderation queue, no support agent with a window into your account, and no review step where a person checks a night before you get it. The machine writes it and you are the first reader. Our own dashboard shows counts and pair status, never a sentence you wrote. Country and device appear there as totals, never next to a name. The one thing it does show beside an account is the setup answer about your body, because that decides which questions you are asked at all.
The model does not keep it either
Briefs are written through Fireworks, whose zero-retention policy is the default on the endpoint we use: prompts and generations live in memory for the length of the request and are not written to storage. We have not opted into any logging feature that would change that. Orbit keeps your answers, because it has to. The model keeps nothing.
Which is why we need you to tell us
The other side of not looking is not knowing. If a rendezvous comes out wrong, ignores a hard no, or reads like it was written for somebody else, we cannot find that by going through your account. There is a note in your account for that, under Write to us. We read those on purpose. They never sit next to your answers. If you would rather not be signed in to say it, the box at the end of this page reaches the same desk.
Honest about what the server sees
Orbit is partner-blind, not magic zero-knowledge. The service has to see answers to score complementarity and write a rendezvous. That is the trade: the machine keeps the list so your partner does not have to. Email is for signing back in, not a public identity. We also keep a country code and a device class, phone or computer, so we can see where the product is used. Page opens are counted as daily totals: the path with any id stripped, that same country code, and phone or computer. We do not count people. There is no analytics cookie and no visitor number. We do not store your IP or the raw browser string. We do not mix this with your answers, and we do not use it to retarget you.
18+, and no extra biography
Signup is an adult checkbox. Birth year lives on setup, once, so we can keep the room adult. Setup also asks what you have and what your partner has, because a question about a prostate should not appear for someone who has not got one. That is a body fact used for filtering, not a gender, and Orbit never asks for one. No legal name. No social graph. A nickname is enough to find your own fingerprint again.
You can leave
Settings lets you unpair by name, change your password, or delete the account. Delete wipes email, answers, fingerprint, any pair, the country and device we remembered, any note you sent us, and the address we use to tap your phone in the evening. Page totals stay, because they were never attached to you. Password reset mail is transactional only, never a campaign.
An evening tap
If you allow it, we send one push when a quest card is open. The lock screen names the kind of night. It does not name the card. We do not ask if you did it. A rest night stays quiet. You can mute it in Settings. Delete wipes the endpoint.
Public shape. Private answers.
If someone opens /c/ORBIT-XXXXXX, they see a nickname, a constellation, and a way to start their own fingerprint. They do not see your interview. Hard nos never become decoration.
See how pairing worksWrite to a person
A night that came out wrong, a hard no that got through, a privacy question, a delete request you cannot finish in settings, or a stolen code. This box goes straight to the desk. You do not need an account to use it, and you do not have to leave an address unless you want a reply.
A letter carries what you typed, nothing from your interview, and no address unless you gave one. We delete it once it has been dealt with. If you were signed in when you sent it, deleting your account takes it too. Delete itself still lives in settings, password required, no undo.