Privacy
Orbit hears both of you in private. We do not sell what you want, advertise from it, or train on it. Your partner gets a night, not the interview.
Your answers are not a dataset for someone else's model. We do not train foundation models on what you typed, ranked, or refused. When a rendezvous is written, a language model may see a beat card: the setting, this night's assignments, and a short summary of the style you leaned toward. Not your raw interview, and not your partner's brief.
Briefs are written through Fireworks, whose zero-retention policy is the default on the endpoint we use: prompts and generations live in memory for the length of the request and are not written to storage. We have not opted into any logging feature that would change that. The model keeps nothing.
The server can read your answers. The person you pair with never can. Not their raw scores, not your hard-no list. Conjunction is weather, not a list of what they like. Limits stay in the engine so a rendezvous can avoid them. They are not a conversation starter. That is the trade: the machine keeps the list so your partner does not have to.
We store one row per question you answered: the score, curious, hard no, skip, and any picks. The fingerprint you see is computed from those rows when the page loads. There is no separate fingerprint object. After a night is written, we also store the brief on our side. That is the product. Quest cards and Tonight faces are stored the same way, and those never went to a model.
A parse failure logs shape: how long the reply was, whether it looked like JSON. A provider error logs the status and an error code. Never the body. Never the prompt. Never a sentence you wrote. Anything that logged those would be a privacy bug, not a debugging convenience.
There is no moderation queue, no support agent with a window into your account, and no review step where a person checks a night before you get it. The machine writes it and you are the first reader. Our own dashboard shows counts and pair status, never a sentence you wrote. Country and device appear there as totals, never next to a name. The one thing it does show beside an account is the setup answer about your body, because that decides which questions you are asked at all.
The other side of not looking is not knowing. If a rendezvous comes out wrong, ignores a hard no, or reads like it was written for somebody else, we cannot find that by going through your account. There is a note in your account for that, under Write to us. We read those on purpose. They never sit next to your answers. If you would rather not be signed in to say it, the box at the end of this page reaches the same desk.
Email is for signing back in, not a public identity. We also keep a country code and a device class, phone or computer, so we can see where the product is used. Page opens are counted as daily totals: the path with any id stripped, that same country code, and phone or computer. We do not count people. There is no analytics cookie and no visitor number. We do not store your IP or the raw browser string. We do not mix this with your answers, and we do not use it to retarget you.
There is no directory, no browse, no public profile of desire. Pairing is a code you choose to share: ORBIT-XXXXXX. A share card shows a nickname and an abstract constellation. It does not show what you like.
We do not sell your answers, pairing data, or the rows the constellation is derived from. We do not use them for advertising, retargeting, lookalike audiences, or data-broker lists. We will not email you promotions built from what you marked as a craving.
Signup is an adult checkbox. Birth year lives on setup, once, so we can keep the room adult. Setup also asks what you have and what your partner has, because a question about a prostate should not appear for someone who has not got one. That is a body fact used for filtering, not a gender, and Orbit never asks for one. No legal name. No social graph. A nickname is enough to find your own fingerprint again.
Settings lets you unpair by name, change your password, or delete the account. Delete wipes email, the answer rows the constellation is derived from, any pair, the written nights that belonged to it, the country and device we remembered, any note you sent us, and the address we use to tap your phone in the evening. Page totals stay, because they were never attached to you. Password reset mail is transactional only, never a campaign.
If you allow it, we send one push when a quest card is open. The lock screen names the kind of night. It does not name the card. We do not ask if you did it. A rest night stays quiet. You can mute it in Settings. Delete wipes the endpoint.
If someone opens /c/ORBIT-XXXXXX, they see a nickname, a constellation, and a way to start their own fingerprint. They do not see your interview. Hard nos never become decoration.
See how pairing worksA night that came out wrong, a hard no that got through, a privacy question, a delete request you cannot finish in settings, or a stolen code. This box goes straight to the desk. You do not need an account to use it, and you do not have to leave an address unless you want a reply.
A letter carries what you typed, nothing from your interview, and no address unless you gave one. We delete it once it has been dealt with. If you were signed in when you sent it, deleting your account takes it too. Delete itself still lives in settings, password required, no undo.