Privacy Policy

Orbily ("we", "us") is an AI-powered study application and website (orbily.net), run by the Orbily project. The publisher is an individual who has not formed a company yet; the full legal identity will be published as soon as the entity exists.

For any privacy request: contact@orbily.net. You can also describe your request in the contact form on this site.

Your study content (courses, notes, documents, chats) lives on your device. In the study app, we receive your account email, a few study preferences, activity metadata, and what you explicitly send us through forms or AI features. The creator space handles connected social account data as described below.

We do not sell data. There is no social feed and no public profile.

Website forms. Support: your email address, messages, automatically assigned topic, ticket status and interface language. Waitlist: your email address and language. When you submit these forms, we compute a salted hash of your IP address to rate-limit spam; the raw IP is never stored.

To route support requests, message text (without the email field and with common identifiers removed where detected) may be sent through OpenRouter (United States) to Typesafe Jev. Our team reviews uncertain classifications. Replies are stored in the ticket and may be emailed through Resend. A private ticket link lets you read and reply; anyone holding that link can access the conversation.

App account. Your email address and an encrypted password (or the identifier your Google or Apple account shares when you sign in with them). If you sign in with Apple, we request your name and email only.

Study profile. Session duration preference, days per week, daily activity goal, streak dates and best streak, subscription status, product and billing period, AI usage records (operation type, model, token counts, cost estimate, timestamps) kept for up to 400 days for billing integrity and abuse prevention.

Learning activity metadata. Each time you complete an activity we store its type (quiz, flashcards, correction, timer, reading time and so on), duration, the folder name you attached it to, and scores. We never receive the content of your courses or documents through this log.

Onboarding telemetry. During onboarding, answers you give to product questions (study level, motivation, blockers and similar), plus an anonymous device identifier, app language, platform and version. This starts before you create an account and gets linked to your account only if you sign up. A optional gender question exists for aggregated statistics; leaving it empty is supported.

Error reports. When the app crashes or hits an unexpected error, we store the error message, a stack trace, the app version and the platform. Reports deliberately avoid serialising your content.

Payments. Purchases go through Apple. We never see card numbers. Apple and our subscription processor RevenueCat tell us your subscription details (entitlement, status, expiry date, product identifier).

If you choose to connect your YouTube channel in the Orbily creator space, you authorize read-only access through Google OAuth (youtube.readonly). We retrieve the channel identifier, name, handle, profile image, subscriber and video counts, and the list of uploaded videos. For each video, we may retrieve its identifier and URL, title, description, tags, publication date, duration, thumbnail, and view, like and comment counts.

We store and periodically update these data on our servers to populate your creator profile, My Content and performance statistics, and to identify videos about Orbily. Videos classified as Orbily-related may contribute to aggregate trend statistics. Whether an individual video appears to other creators in Inspiration depends on its sharing setting.

For this classification, the video title and description may be sent to OpenRouter (United States), which routes the request to the Typesafe Jev model. The current YouTube connection does not retrieve video audio or subtitles. OAuth access and refresh tokens are stored encrypted on our servers and are not sent to OpenRouter.

You can disconnect the channel from the creator space at any time. This stops future synchronization and deletes the stored OAuth tokens. Previously imported video records and statistics are retained after disconnection; to request their deletion or exercise your data rights, contact contact@orbily.net.

We do not use data obtained through the YouTube API for targeted advertising or sell it to third parties. Connecting YouTube is optional and does not allow Orbily to publish, modify or delete content on your channel.

Your imported documents, generated chapters, multi-lesson courses, flashcards, chat history with Orby and preferences live in local storage (SQLite and AsyncStorage) on your device, scoped per account.

None of this content is synchronised to our servers. It leaves the device only at the moment you use an AI feature that needs it (for example generating a course from an imported document), and only the relevant excerpt is sent.

AI features in the study app run through our server proxy, so provider keys never live in the app. When you use one, the relevant text, images or audio are sent to AI providers chosen by us:

OpenRouter (United States) is our single AI gateway. It routes each request to the model provider selected for the task: DeepSeek models for text generation and Orby’s answers, Qwen models for reading photos and images, and Whisper for transcribing audio recordings. In the creator space, it routes video-text classification to Typesafe Jev.

Document transcription (PDF, Word, PowerPoint files) goes directly to Mistral AI (France).

What the study app sends: the content you choose to import (photos, documents, audio recordings), the questions you ask Orby, and the work you submit for correction. We send only what the requested feature needs and never add your data to advertising profiles.

Before the first AI feature in the study app is used, the app shows you this list and asks for your permission. Study content is not sent to an AI provider until you accept, and this policy can be opened from that screen. The separate creator-space classification is described above.

In the app, product analytics run on PostHog (European Union cloud). Events are pseudonymous: they carry a random identifier, never your email. Examples: sign-up method, which AI feature was used, paywall views, quota warnings. Lifecycle events are recorded automatically; nothing else is captured.

On this website, Google Analytics 4 loads only if you accept cookies in the banner. As long as you have not accepted, and after you decline, no measurement request is sent to Google. Two cookieless tools always measure aggregate traffic and page speed without identifying anyone: Vercel Web Analytics and Speed Insights. Details on the Cookies page.

To provide the service you asked for: account management, generation of your study tools, streaks, quotas, subscription entitlements (performance of contract).

To keep the service safe and improve it: rate limiting, error reports, aggregated telemetry about onboarding and feature usage (legitimate interests).

To measure the website audience with Google Analytics: your consent, collected before any cookie is set and withdrawable at any time.

To answer your messages sent through the contact form (steps prior to entering a contract, or legitimate interests).

Supabase (European Union, Stockholm region): database, authentication and edge functions for both the app and this website.

Vercel (United States): hosting of this website, plus its cookieless analytics.

OpenRouter (United States): single gateway through which the AI model providers (DeepSeek, Qwen, Whisper) process requests.

Mistral AI (France): document transcription.

PostHog (European Union cloud): app product analytics.

RevenueCat (United States): subscription infrastructure; it receives your opaque user identifier and purchase events from Apple.

Google and Apple: authentication when you use those sign-in buttons; Apple for in-app purchases.

Resend (SMTP provider): delivery of transactional emails such as verification codes.

These providers act under contract as processors or independent controllers for their own infrastructure; we share only what each one needs.

Your account data is stored in the European Union. Some providers above are based in the United States. Where required, transfers rely on the European Commission Standard Contractual Clauses or an adequacy framework (such as the EU-US Data Privacy Framework).

Account data is kept while your account is active. Deleting your account from the app settings immediately deletes your profile, activity history and quota counters on our servers, and anonymises error reports and onboarding telemetry linked to you.

Contact messages are kept only as long as needed to handle your request. Waitlist addresses are kept until launch communications end or you ask for removal.

Error reports and telemetry are kept only as long as useful to fix bugs and improve onboarding; ask us anytime to erase them.

Data travels over TLS. Database access is locked by row-level security so no user can read another user's rows. Administrative access requires an allowlisted account plus two-factor authentication, and every administrative action is logged. Provider secrets live only on servers, never inside the app.

You can access, correct, export or delete your personal data.

Export: the app settings contain "Export my data" (a JSON archive of your profile, activity and locally stored content) and "Export my stats" (CSV).

Deletion: Settings then Account then Delete account removes your server-side data as described above. Uninstalling the app removes everything stored on the device.

For anything else, email contact@orbily.net. Under the GDPR you may also lodge a complaint with your supervisory authority (in France, the CNIL).

Orbily is a study tool used by students of many ages. If you are below the age at which your country lets you consent to data processing on your own (15 in France), ask a parent or guardian before creating an account.

If you believe a child under that age gave us personal data without parental consent, write to contact@orbily.net and we will delete it.

We update this policy when the service changes. The date under the title reflects the latest revision; material changes will be announced in the app or on this site.