Privacy notice

Waitlist sections: version wl-2026-10-10 (effective 10 October 2026). Website and app sections: updated 11 November 2026.

Who we are

Orbtile ("we"), made in Europe. Contact: privacy@orbtile.com.

What we collect

• Your email address.
• Which waitlist you joined: other keypads, or a feature waitlist (and, for entries made before Orbtile for Windows shipped in 0.2.17, Windows).
• The keypad devices and AI coding agents you optionally select, and the short "other device" text if you type one.
• The time you gave consent and the version of this notice (wl-2026-10-10).
• A one-way keyed hash of your IP address, used to block abuse. It is scheduled for removal 30 days after sign-up; cleanup runs when someone submits the form.

We do not collect your name through the waitlist. Announcement emails will not use tracking pixels or click tracking.

Why, and on what legal basis

To (a) email you when Orbtile is available for the platform or device you chose, or when early access opens for the feature you chose, including an invitation to try it, and (b) count how many people chose each device, agent and feature to decide what we build next. Legal basis: your consent (GDPR Art. 6(1)(a)). The IP hash and the anti-bot check rely on our legitimate interest in keeping the form free of spam (Art. 6(1)(f)).

How the list works

You enter your email and submit the form. That is your sign-up; we do not send a confirmation email. We store your entry so we can write to you when the product, platform, device or feature you asked for is ready. We will write at most once per announcement, and every announcement email will have an unsubscribe link.

Bot protection

The form uses Cloudflare Turnstile, which processes technical signals from your browser to tell humans from bots. See Cloudflare's privacy policy.

Who processes it for us

• Cloudflare, Inc.: hosting, the database (stored in the EU), and anti-bot checks.
• Email delivery provider (when announcement emails are sent).
• Google: optional website analytics, only after you allow analytics cookies.

The Orbtile operator can view waitlist email addresses in the private admin dashboard, which requires Cloudflare Access. A separate read-only statistics credential can view counts, but not email addresses. We never sell your data. We share data with the processors listed here only to provide these services.

How long we keep it

• Waitlist entries: scheduled for deletion 730 days after sign-up, unless you unsubscribe sooner. After a launch announcement, earlier removal is handled manually by the operator.
• IP hashes: scheduled for removal after 30 days. Rate-limit counters: scheduled for deletion after 2 days. These cleanups run when someone submits the form, so an idle form or failed cleanup can delay deletion.
• Unsubscribing deletes your entry immediately.

Your rights

You can withdraw consent with the unsubscribe link in an email if we send one, or write to privacy@orbtile.com before then. This deletes your entry and does not affect earlier processing. You can also ask for access, correction, deletion, restriction or portability, or object, at the same address. We answer within one month. You can complain to the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt) or to your local authority.

Automated checks

We do not use your information to profile you. Automated anti-bot and rate-limit checks can reject a form submission or request to protect the service.

This website

Our server counts page views and installer downloads. These server counters use no cookies or browser tracking script. Eligible page loads add to UTC hour counters for the page, the country (from Cloudflare’s network), the referring site (a short list of well-known sites by name; any other site is counted only as other), and the browser and operating system family. A valid short campaign source tag in the URL is counted with page views and carried through site links to the installer download. Installer download counters keep only the UTC hour, the installer (Mac, Windows or Android), version, country, campaign source tag and operating system family. Source tags describe shared links, not individual visitors. Status fetches are counted separately by UTC hour and app version. From app 0.2.12, when usage reports are on, the app’s status fetch also carries the same pseudonymous machine ID as the usage report, so those fetches are additionally counted per re-keyed machine ID and version; with usage reports off it carries no identifier. When a visitor opens the first-open help on the download page, the page sends one cookieless beacon with no identifier, and the opened help is counted by UTC hour and country. When a visitor clicks the I want this! button on a feature waitlist page (these pages are no longer on the site) (or, before 0.2.17, the Windows interest button), the page sends the same cookieless beacon with no identifier, and the click is counted by UTC hour and country. Cookieless page beacons also count home and download calls to action, share and copy clicks, iPhone interest, Google Play early access link clicks, installation help and home-page scroll milestones. Event counters keep only UTC day and hour, event name, country, operating system family, campaign source category and count, including these fields for help, Windows interest and feature interest events. Each event is attempted once per page load, with no browser identifier or visitor history. If you arrive from one of our ads on Google or Reddit, we keep the ad's click identifier (gclid, gbraid, wbraid or rdt_cid) with the install-button click, without cookies or your browser details, for up to 90 days, and we send that identifier back to Google or Reddit only to count that the ad led to an install-button click. Event counters retain no raw User-Agent or Referer. Historical events have an unknown operating system and an untagged source. Bots, prefetches and requests beyond the counter budget can be omitted. Cloudflare processes request addresses and technical headers to deliver and protect the service. The counters do not link requests into a visitor history. We keep them for 13 months. Hourly cleanup removes counts once their UTC day is older than 395 days; failed or delayed runs can delay deletion. Browsers can also send automatic security-policy reports about blocked content on orbtile.com. From these reports we keep a daily count of the rule type, the type or website address of the blocked item (without its path), the page path and whether the rule blocked the item or only reported it. These counts never hold browser details or full web addresses, and we delete them after 30 days. To limit abuse of the reporting address, we also keep a salted hash of the sender’s IP address with a count for up to 2 days.

If you come from one of our ads and choose the Microsoft Store or Google Play button, our server keeps one record of that click: a random code, the ad click ID from the link (Google’s gclid, gbraid or wbraid, or Reddit’s rdt_cid) and its type, a short source tag, the country (from Cloudflare’s network), the platform and the store, and when the record was created, when it expires and when it was used. It holds no browser details, referring page, cookie, machine ID or email address, and visits we recognise as internal or automated create no click record. If that install later starts a trial, opens Orbtile Mobile for Android for the first time or buys a licence, we report that event with the click ID to the ad platform the click came from (Google Ads or Reddit), so we can see which ads work; a purchase report includes the amount, and a full refund or a dispute withdraws it. A click record is deleted 90 days after the click, at the next hourly cleanup. A reported event keeps its click ID for 90 days, also after we send it, so that we can withdraw it. To limit abuse, we keep a salted hash of your IP address with a count for 2 days.

Separately, if you choose Allow analytics, this website loads Google Analytics 4 to understand how visitors use it. Before you allow it, no Google Analytics script loads and no request is sent to Google Analytics. Analytics may collect pages visited, referring sites, approximate location, device and browser information. Depending on the Google Analytics settings, it may also collect interactions such as outbound link clicks and file downloads. After you allow analytics, Google Analytics also receives a download event when you click Download. Google processes this information for us. It uses cookies named _ga and _ga_* to distinguish browsers and sessions. We do not enable advertising consent: advertising storage, advertising user data and advertising personalisation remain denied. The legal basis for this optional analytics is your consent (GDPR Art. 6(1)(a)). See Google's privacy policy.

Your analytics choice is remembered in this browser's local storage. The Appearance control also saves your System, Light or Dark display preference here; it sends no account or tracking data. Use Cookie settings in any page footer to change it. Choosing No thanks withdraws permission, disables further Google Analytics collection on the current page and removes analytics cookies accessible to this website. Future page loads do not load Google Analytics unless you allow it again. Withdrawal does not affect earlier processing. Orbtile on your computer does not use Google Analytics.

Feedback

When you choose to send feedback, we receive the message and category, whether it came from the app or website, and an optional email address if you want a reply. App feedback also includes the app version and the same pseudonymous machine ID used by usage reports, re-keyed on our server for abuse limits. The machine ID is not stored with the feedback item. We store a random submission ID and a keyed fingerprint of the submitted fields to avoid saving duplicate retries.

In the app you can choose to include diagnostics: app build, macOS version, keypad connection status, enabled built-in agents, and four settings (automatic keypad takeover, key actions, background sessions and handover on sleep). Versions before 0.2.16 also include the keypad theme. You can review this before sending. Diagnostics contain no prompts, transcripts, paths, host names, or account names. Feedback messages contain what you type and are stored as submitted; please leave out secrets, personal information and private task text.

We use feedback to answer requests and improve Orbtile, based on our legitimate interest in maintaining and improving the product (GDPR Art. 6(1)(f)). The Orbtile operator can view messages, optional email addresses, diagnostics and triage notes in the private feedback dashboard behind Cloudflare Access. Feedback, optional email, diagnostics and internal triage notes are kept for 365 days and deleted on the next hourly cleanup run. Keyed IP and machine abuse counters are kept for two days and deleted on the next hourly cleanup run. Cloudflare hosts the database in the EU. Website feedback uses Turnstile. Delayed or failed cleanup runs can delay deletion.

If an app submission cannot be delivered, the app keeps a local queued draft and retries hourly until the server accepts it. Contact privacy@orbtile.com to request access or deletion; include your feedback reference if available.

Accounts and connected computers

Orbtile 0.2.7 to 0.2.10 required an account and approval of each Mac. From 0.2.11, an account is optional for the keypad and is used for encrypted settings sync and the phone pad. You can register at orbtile.com/account with an email address and password, or choose Google sign-in. We store your verified email address, display name, account role, notification preference and account creation time. Passwords are stored as salted Argon2id hashes. Google sign-in supplies a verified email, name and Google account identifier; we do not request access to your mail, files or contacts. A Google account with the same email as an existing verified password account must be linked after signing into that account.

The app opens your account page in a browser. You sign in there and explicitly approve the computer shown on the page; email verification and password reset do not sign the app in. We store keyed computer identifiers, this Mac's computer name as set in macOS (sent automatically by the app, shortened to 40 characters and shown on the approval page), app version and sign-in times to manage connected computers. Licences with your verified billing email belong to your account. You can revoke computer access and sign-ins from the account page. A Windows PC signs in the same way and uses the same account and sync services as a Mac. On Windows, the app's account credential is stored encrypted for your Windows user with Windows data protection (DPAPI).

Browser sign-ins expire after 30 days. In Orbtile 0.2.10 and earlier, app sign-ins on a Mac expire 30 days after sign-in; from 0.2.11 they renew while the computer is online and expire after 30 days without contact. Computer approval requests expire after 10 minutes; verification and reset links expire after 15 minutes. Expired credentials are removed in bounded cleanup batches when the account service receives requests. Profiles, connected computer records, licence ownership and administrative audit records remain until removed in response to an account request or retention review. Contact privacy@orbtile.com for access or deletion; payment and licence records may need to be retained separately.

Orbtile Mobile signs in to your Orbtile account with Google (in your browser) or a one-time email code. It cannot create an account. For each signed-in phone we store a server-assigned ID, the label you see (default: the phone model), platform, app version, its public key, sign-in method and times, and when it was last seen. Phone sign-ins expire after 90 days without use; you can remove a phone at any time on your account page or in Orbtile on your computer. Email codes are stored only as keyed hashes and expire after 10 minutes; they are sent through Cloudflare Email Sending. We email you when a phone signs in. Every signed-in computer stores its name and Orbtile version in your account; with Phone pad on it also stores the fingerprint of its local certificate, so your phones can recognize it. Pad images and touches go directly between your phone and computer on your local network and are never sent to our servers. Phones and computers keep a copy of the account list for up to 7 days offline; a removed phone stops working within 5 minutes when your computer is online. Phones never count toward a licence's computers.

Release news and product-update emails are enabled by default for new accounts. You can turn them off under Email preferences on your account page; existing accounts keep their saved choice. Only verified, active accounts with update emails enabled receive announcements. Each message includes an unsubscribe link, valid for 90 days. We use an email delivery provider for verification, reset and account announcements, without tracking pixels or click tracking. Cloudflare hosts account data and protects the private administration pages. Operators with verified administrative access can manage accounts, licences, connected computers and delivery records; a statistics read token cannot read these records. The account page loads no Google Analytics script, even if you allowed analytics elsewhere.

Settings sync keeps your synced settings with your Orbtile account, separately from your profile. Each computer encrypts them before upload with a key derived from your account's sync code. Our server stores that code encrypted with a key Orbtile holds, and gives it to the computers signed in to your account. Sync is therefore not end-to-end: Orbtile, with both its database and that server key, could decrypt your synced settings, and so could anyone who signs in to your account; access to the database alone could not. From 0.2.17 you no longer enter a sync code, and an existing sync group moves to your account by itself. Only look, keys and sessions, and menu bar and hand-over settings sync. Hooks and their token, remote hosts, keypad approvals, the adapter API and adapter permissions, system permissions, launch at login, licence state, device and usage IDs, phone pairing and anything about your code or projects never sync. Removing synced settings from every computer marks the shared settings as removed and deletes the sync code stored with your account at once. Orbtile Enterprise has no settings sync; use Export and Import. On a Mac, Orbtile stores the sync code and pending removal or revocation capabilities in owner-only files in its Application Support folder (readable only by your macOS user account, so also by other apps running as you); they are not synchronized through iCloud. Joining saves a local copy of previous settings for 30 days. Expired backups are deleted at startup and during hourly maintenance, including while sync is off; if Orbtile is closed, deletion occurs at its next startup. Encrypted server records expire after 395 days without a write and are purged during later service requests; quiet periods can delay deletion.

Account and administration requests run on our Atlas service. Cloudflare continues to host the public site and the existing EU databases, and forwards account and API requests without caching them. Google sign-in, email registration and app account connections use this account service.

Buying a licence

When you buy a licence, Stripe sells it to you as the merchant of record and handles your card and payment details; they never reach us. From the purchase we keep your email address, your country, which licence you bought (the 1.x licence, the Founder licence or Orbtile Enterprise), the date, the amount and currency, and Stripe’s references for the checkout, the payment and you as a customer. We also keep the licence’s status (issued, refunded or revoked), a hash of your licence key and the key itself, so we can show it to you again or send it again if you ask. It carries your email address and a name taken from it (the part before the @). The only email we send you about a purchase is the one with your licence key.

Why: to deliver your licence, support it and handle refunds (contract, GDPR Art. 6(1)(b)). How long: we keep purchase records with no end date, also after a refund.

Activating a licence

When you enter your licence key, Orbtile sends orbtile.com the key, your computer’s pseudonymous machine ID, your computer’s name as set in macOS or Windows (for example “Alex’s MacBook Pro”), shortened, and whether it’s a reactivation. For each computer, we keep a further keyed hash of the machine ID, the computer’s name, when it was first activated and last seen, and when and how it was deactivated. The name is there so you can tell your computers apart. A licence covers up to 3 active computers; deactivating one, in Orbtile or on your account page, frees its place.

To keep your licence active, Orbtile checks in about once a month. An activation lasts 60 days; from day 30, Orbtile renews it, at most once a day until it succeeds, so it keeps working offline for up to 60 days.

We delete a deactivated computer’s record 30 days after it’s deactivated. Our database backups can still hold it after that: a recovery copy of recent changes for 30 days, daily exports for up to 12 months, and encrypted backups of those exports for up to 6 months more, so for up to about 18 months in all.

To prevent abuse, we rate-limit activation with keyed hashes of your IP address and of the key.

The trial. Once the 15-day trial is switched on, orbtile.com keeps a trial record for each computer that starts one: a keyed hash of its machine ID (the same scheme as licence activation), which trial it belongs to, and when the computer was first and last seen. It’s created only for computers on a trial, and kept with no end date, so reinstalling Orbtile doesn’t start a new trial. When you press the button of a licence offer in the app, it sends orbtile.com your computer’s pseudonymous machine ID, which trial it belongs to and when it started, and whether the app is the Mac or the Windows one, and opens the pricing page in your browser.

Orbtile Enterprise. The Orbtile Enterprise app contacts orbtile.com for two things only: licence checks and update checks. It has no account, sign-in or settings sync, and sends no usage reports, analytics or crash reports.

Licence checks. At its first launch with a key, at every launch and every 24 hours, Orbtile Enterprise sends the licence key, a device ID and the app version (and, after a computer was removed from the licence, that it asks to be activated again). The device ID is a hash of the computer's hardware UUID on a Mac, or its Windows machine identifier (MachineGuid), made with a key that only Orbtile Enterprise uses, so it never matches the machine ID of usage reports. If the hardware ID can't be read, a random ID kept on that computer is used instead. It sends no computer name. For each computer, we keep the licence it belongs to, a further keyed hash of the device ID made separately for each licence, when it was activated and last checked, and the app version. We keep that record while the computer is activated and for 30 days after. A computer that hasn't checked its licence for 30 days is deactivated by itself. To prevent abuse, we rate-limit licence checks with keyed hashes of the IP address and of the key.

The licence. For each organisation's licence we keep the organisation's name, the contact email, the number of computers it covers, its status, any note we add about it for our own records, and the licence key itself, so we can send the key again.

Update checks. Orbtile Enterprise fetches the signed update status from its own address. The request carries no device ID, version header or usage data. Downloading an update sends the computer's current activation, so our server can check the licence. Your organisation can turn update checks off.

Installer downloads. Each download of an Orbtile Enterprise installer, from the link in the licence email, from the app, with the licence key (for example by your IT team's scripts) or by us, writes one line to our server log: the licence ID (or that we downloaded it ourselves), the file name, the time and which of those ways it was downloaded. We use it for support. Like our other server logs, it has no fixed deletion date: each service keeps a set amount of log data and overwrites the oldest lines when it fills up.

Why: to deliver, check and support your organisation's licence (contract, GDPR Art. 6(1)(b)).

The Orbtile app

The sections above cover the waitlist, website and voluntary feedback. This section covers the Orbtile app for macOS, which runs locally on your computer.