Privacy Policy

1. Overview

Orbit (“the App”) is provided by wikivn (“we”, “us”, or “the developer”). This Privacy Policy explains what information the App accesses, how it is used, where it is stored, and the choices available to you.

Orbit works on your Android device. We operate no server of our own.

• The App contains no advertising and no tracking. It does use Google Firebase to send us crash reports and anonymous usage statistics — how often the App is used, which settings are changed, and how the Pro screen is used — so we can fix bugs and improve the App. These are not linked to your name, email or Google account, never include which apps you use, and are never used for advertising. See Advertising, crash reports and usage statistics below.
• Information about installed apps is used only on your device, to provide Orbit’s app list, search, Quick launch dock, groups, notifications, Bubbles, edge panel, floating dock, home-screen widget, and launcher shortcuts.
• Orbit Pro is sold and processed by Google Play, either as an auto-renewing subscription or as a one-time purchase. Your payment details go to Google, never to us. Orbit keeps only a few yes-or-no flags on your device recording whether Pro is active and how it was bought.
• Orbit may ask Google Play to show its in-app rating card. Google decides whether it appears and does not tell Orbit what you chose.
• We do not sell your information, and we do not collect your name, email, contacts, location, advertising ID, or the list of apps on your device. Apart from the crash reports and statistics above, the only way anything reaches us is if you choose to email us.

Android’s backup and device-transfer services may copy the limited preferences described below to your own backup account or another device. Your Pro status is excluded from both. The developer cannot access those backups.

2. Permissions the App requests

Orbit requests the following. Several are declared by the Google Play Billing Library the App includes in order to sell Orbit Pro, or by Google Firebase, rather than by Orbit’s own code; they are listed here anyway, because they appear on your device’s permission screen and you are entitled to know what they are for.

Orbit does not request QUERY_ALL_PACKAGES.

Orbit also removes the advertising permissions that Firebase Analytics would otherwise add — the advertising ID (AD_ID), Android’s Privacy Sandbox advertising and attribution permissions, and Google Play’s install-referrer service — so the App cannot read your advertising ID or learn which ad or link led you to install it.

You can deny or revoke POST_NOTIFICATIONS, SYSTEM_ALERT_WINDOW and notification access in Android Settings at any time. Quick launch, Bubbles, the edge panel and Bubble on notification stop working without them; nothing else in the App is affected.

3. Notification access

“Bubble on notification” is an optional Pro feature that shows an app’s Bubble, collapsed at the edge of the screen, when that app posts a notification. To know that a notification was posted, Orbit has to hold Android’s notification access (a notification listener). Because this is the most far-reaching access the App ever asks for, here is exactly what it does with it:

• It is off by default. Nothing runs until you switch the feature on in Orbit’s settings and approve Orbit on Android’s own “Notification access” page. Switching the feature off, or Pro lapsing, makes Orbit’s listener disconnect itself, so the approval on Android’s page carries no running code behind it.
• It answers only for apps you chose. There is no default list. A notification from any app you have not chosen is ignored on the first line.
• For a chosen app, it reads only what it needs to decide. That is the sender’s package identifier; two flags that say whether the notification is an ongoing one or a group summary; the notification’s system key, which Android uses to identify it; and the time the app stamped on it. When a notification is removed from the shade, the listener reads the sender’s package identifier and the key once more, and nothing else. It never reads the title, text, images, actions, people or any other contents of a notification — except under Preview, below — and it never asks Android for the list of notifications currently in the shade.
• It keeps nothing on disk. No notification, and nothing derived from one, is written to Orbit’s storage or transmitted. To avoid announcing the same notification over and over when an app re-posts it unchanged, the listener remembers, in memory only, the key and time stamp of the last 64 notifications it answered (and, for an app with Preview on, a numeric fingerprint of the words, never the words themselves) for up to 90 seconds. All of it is gone when the App’s process ends. For troubleshooting, the listener writes short debug lines to Android’s temporary system log naming the sending app’s package identifier and what Orbit did (for example, that a Bubble was shown); these lines never contain a notification’s contents.
• What it produces. The only thing the App does with the event is post a Bubble notification of its own, on the same device, aimed at the sending app’s launcher entry. That Bubble’s own line says “new notification”, with a count of how many the app has posted since the Bubble appeared; Android shows it beside the Bubble for a few seconds, after which Orbit hides its own card from the notification shade again. The count is held in memory only, starts over when the app’s notification leaves the shade, and is gone when the App’s process ends.
• The Bubble replaces the notification while you are using the phone. Once Orbit has decided a Bubble is coming for a notification — Bubbles are on, and the app is one Android will draw in one — it dismisses the app’s own notification from the shade, so the event appears once, as the Bubble, and the Bubble’s own notification alerts in its place with your device’s default sound and vibration. This happens only while the phone is awake and unlocked. With the screen off or locked, the app’s notification is left exactly as the app posted it and stays there after you unlock; Orbit’s own Bubble is put up silently, with no “new notification” line. Orbit never snoozes, replies to or otherwise changes another app’s notification.
• One optional, per-app setting widens what is read, and only for the apps you switch it on for. Preview, chosen next to an app in the list, has the listener read that app’s notification title and text (for a conversation, the latest message and who sent it, up to 200 characters each) so that the Bubble’s own line can show them instead of “new notification”. This happens only while the phone is unlocked; with the phone locked the words are not read at all. They are held in memory for the length of that one post and are never stored, logged or transmitted. For every app without Preview, which is every app by default, Orbit never reads a notification’s contents.

Orbit does not use notification access for any other purpose, and does not use it in the free tier at all.

4. Network access

Orbit has no server of its own. None of your app list, searches, Quick launch selections, groups, hidden apps or notifications is transmitted anywhere by the App.

The App does send crash reports and usage statistics to Google Firebase, as described in Advertising, crash reports and usage statistics. Firebase connects to Google’s servers directly.

The INTERNET, ACCESS_NETWORK_STATE and WAKE_LOCK permissions come from the Google Play Billing Library, which Orbit includes so that Orbit Pro can be offered and purchased. Orbit also includes the Google Play In-App Review library, which shows Google Play’s rating card. Both libraries talk to the Google Play Store app installed on your device, which is what actually contacts Google. Anything sent in the course of that is handled by Google under Google’s own Privacy Policy, not by us, and we receive none of it.

5. Purchases

Orbit Pro is offered through Google Play in two forms: an auto-renewing subscription, and a one-time purchase that does not renew. Which forms are available can vary by country and over time.

What Google does. Google Play collects and processes everything to do with the payment: your payment method, billing details, tax information and the transaction itself. We never see any of it. Google’s handling of that data is governed by Google’s own Privacy Policy and the Google Play Terms of Service.

What the App does. When you open the Pro screen, or start the App, Orbit asks Google Play what Orbit Pro costs in your currency, and whether this Google account already owns it. Google Play answers with the prices and offers, and with a purchase record for anything owned — a product identifier, a purchase token, an order identifier, a timestamp and Google’s signature over them. Orbit uses these only to decide whether Pro is active and how it was bought, and to confirm Google really issued the record.

What the App stores. In a private storage file of its own, kept apart from Orbit’s other preferences: whether Pro is active; whether it was bought as the one-time purchase; whether a subscription is currently active; and whether Google Play currently offers the subscription and the one-time purchase, so the Pro screen can show the right choices before Google Play answers. Purchase tokens, order identifiers and payment details are not written to Orbit’s storage, and are not sent to the developer or to any third party. This file is excluded from Android backup and device transfer, so Pro status is never copied to another device; Google Play confirms it there instead.

What the statistics record. When you open the Pro screen, try to buy or restore Pro, or reach a free-tier limit, the usage statistics record that it happened, which plan you chose, whether it succeeded, was cancelled or is pending, and which limit was reached. Firebase Analytics also records Google Play purchases automatically: the product, its price and currency. Whether Pro is active is attached to the statistics as a yes-or-no property. None of this includes your payment details, purchase token or order identifier.

Cancelling, refunds and promo codes. Subscriptions are managed entirely in Google Play, under Google’s refund and cancellation policies. The developer cannot see, alter or cancel your subscription. If your account holds the one-time purchase and a subscription is still renewing beside it, Orbit tells you so and opens Google Play’s subscription page, where you can cancel it. Redeeming a promo code opens Google Play’s redeem page. When Pro ends, Orbit’s flags are cleared the next time Google Play tells the App it is no longer active.

6. Ratings, sharing and feedback

In-app rating. After you have used the App for at least two days, Orbit may ask Google Play to show its rating card — at most three times, and at least 20 days apart. Google Play decides whether the card actually appears, and reports nothing back: Orbit never learns whether it was shown, or whether and how you rated. To keep to that schedule, Orbit stores on your device when you first opened the App, when it may next ask, and how many times it has asked.

Rate. The “Rate” row in Settings opens Orbit’s page on Google Play.

Share. The “Share” row opens Android’s share sheet with a short message and a link to Orbit’s Google Play page. Orbit does not see which app you share to or with whom.

Feedback. The “Feedback” row opens your email app with a message addressed to the developer. Below the space for your message, it pre-fills the App’s name and version, your Android version and your device model, to help diagnose problems. Nothing is sent unless you send the email yourself, and you can edit or delete any of it before you do. If you do email us, we receive your email address and whatever the message contains, and use them only to reply to you.

7. Information the App accesses

Installed and launchable apps

Orbit reads the list of apps on your device that have a launcher activity. For each visible app, Orbit accesses:

• the app name;
• the package identifier;
• the launcher activity;
• the app icon; and
• the app’s version code, used only to notice when an app Android refused to open as a Bubble has been updated and should be tried again.

Orbit uses this information to display and search your app list, let you choose apps for Quick launch and groups, open apps through Android Bubbles, and create local notifications, the edge panel, the home-screen widget and launcher shortcuts.

On first run, Orbit fills Quick launch and a first group with a few widely used apps, if they are installed and Android will open them as Bubbles. It does this by checking a fixed list of well-known package identifiers built into the App against the apps on your device; you can remove them at any time.

This list is read and used on your device only. Orbit does not request the QUERY_ALL_PACKAGES permission; it declares a <queries> element granting visibility of launchable apps, alongside the entries the Google Play libraries add so they can reach the Play Store.

Search

The App’s search, on its main screen and in the edge panel, matches what you type against the apps on your device (and, in the edge panel, your group names). What you type is held in memory only while you search; it is cleared when the search closes and is never stored or transmitted.

Preferences stored on your device

Orbit stores only the preferences needed to provide its features:

• package identifiers for apps you add to Quick launch;
• the groups you create, their names, and the package identifiers of the apps in them;
• package identifiers for apps you hide;
• package identifiers and version codes for apps Android has refused to open as a Bubble, so the App can mark them, and the Bubble permission state at the time, so the marks can be re-checked when it changes;
• your Quick launch notification mode;
• your light, dark, or system theme choice;
• whether the edge panel is on; whether it opens from a handle at the screen’s edge or from a floating button; which side the handle is on and where along it; where the floating button sits; and the sizes, transparency and colour you chose for them;
• whether Bubble on notification is on, the package identifiers of the apps you chose for it, and the ones you switched Preview on for;
• whether you dismissed the in-app tips and notices, whether you accepted the in-app explanation of Preview, and whether the first-run starter apps have been added;
• when you first opened the App, and when and how often it has asked Google Play for a rating (see Ratings, sharing and feedback); and
• whether Orbit Pro is active and how it was bought (see Purchases).

These are kept in Orbit’s own private app storage, which other apps cannot read. Your per-app language selection is not stored by Orbit — it is managed by Android’s own system language service.

8. Information the App does not access

Orbit does not access, collect, or process:

• a history of which apps you open. Orbit checks, while it runs, which of its own Bubbles are currently open, so it can mark them; this is not recorded;
• the contents of notifications from other apps, except from an app you switch Preview on for. With Bubble on notification switched on and approved, Orbit’s listener otherwise sees only which app posted a notification — see Notification access above — and nothing about what it says;
• the contents of any app the edge panel or the floating dock is drawn over. They are windows Orbit draws on top; they do not read, record or capture what is beneath them;
• your contacts, messages, call logs, location, photos, files, camera, or microphone;
• your payment method or billing details;
• your ratings or reviews on Google Play;
• your advertising ID, Android ID, or any account information.

9. Advertising, crash reports and usage statistics

Advertising

Orbit contains no advertising and no advertising SDK. Orbit is paid for by Orbit Pro, and will not be paid for by advertising.

Crash reports and usage statistics

Orbit uses two Google services, provided by Google LLC as part of Google Firebase, to find out when the App breaks and how it is used.

Firebase Crashlytics sends a report when the App crashes, or when it records an error it recovered from. A report contains the technical details of the error (which part of the App’s code failed), the App version, your device model and Android version, the device’s orientation and free memory and storage at the time, and a random identifier for this installation of the App.

Google Analytics for Firebase records usage statistics:

• events the SDK collects by itself: the App being opened for the first time, updated or used, how long it is used for, which of the App’s screens is shown, and Google Play purchases (see Purchases);
• events Orbit records: which setting you changed and what you changed it to (for example the theme, the Quick launch notification mode, the language, the edge panel’s switch, side, sizes, transparency and colour, or Bubble on notification’s switch); how the Pro screen is used; and which free-tier limit sent you to it;
• whether Pro is active;
• with each of these: the App version, your device model, Android version, language, an approximate country or region, and a random identifier for this installation of the App.

What is never sent. The names or package identifiers of apps on your device, the apps you add to Quick launch, groups, hidden apps or Bubble on notification, your group names, what you type into search, the contents of any notification, your name, email address or Google account, your advertising ID, or your Android ID.

What it is not used for. Orbit turns off the advertising features of Google Analytics: no advertising ID or Android ID is collected, consent to use the data for advertising, ad storage and ad personalisation is set to “denied”, and the data is not linked to Google advertising products or Google Signals. We use the statistics only to understand how the App is used and which features to improve, and the crash reports only to fix bugs.

Google processes this data on our behalf under the Firebase data processing terms, and describes how it handles it in Privacy and Security in Firebase. Data may be processed on Google’s servers outside your country.

10. Android notifications, Bubbles, widget and launcher shortcuts

Orbit uses Android system services to show the Quick launch notification, create Bubbles, draw its home-screen widget, and publish launcher shortcuts. App names, icons, and package identifiers are provided to Android system components and to your launcher on the same device, only as needed to render and operate those features. The widget shows the same Quick launch apps and groups as the App and is drawn from data on your device.

The App requests the POST_NOTIFICATIONS permission on supported Android versions. You can deny or revoke it in Android Settings, though Quick launch and Bubbles will not work without it.

11. Links that leave the App

Several places in the App hand you to another app or a web page: the privacy policy link and “Rate” in Settings, managing a subscription or redeeming a promo code from the Pro screen, “Share”, and “Feedback”. Opening one hands the address or message to whichever browser, store, share target or email app you have chosen; what happens there is governed by that app’s own privacy policy, not by Orbit.

12. Backup and device transfer

If Android backup is enabled on your device, Android may back up the preferences listed above, including package identifiers for apps you added to Quick launch, placed in groups, or hid. Android may also transfer those preferences directly to a new device. Your Pro status is excluded from both; Google Play confirms it on the new device instead.

These operations are controlled by Android and your backup provider. Backup data is associated with your own device or backup account, is not sent to the developer, and cannot be accessed by the developer. You can manage or disable backup through your device or account settings.

13. Data sharing and sale

Orbit does not sell user data and does not share it with third parties for their own purposes. The developer does not receive your installed-app list, your searches, your Quick launch selections, your groups, your hidden-app selections, or your notifications. No third-party service receives them either.

The crash reports and usage statistics described in Advertising, crash reports and usage statistics are processed by Google Firebase as our service provider, and are not shared with anyone else.

Android platform services process this information locally on your device, or provide the backup and device-transfer functionality described above. Google Play receives what is necessary to sell and maintain Orbit Pro and to show its rating card, as described above.

14. Data retention and deletion

Preferences remain on your device until you:

• remove or change them in the App;
• clear Orbit’s storage in Android Settings; or
• uninstall the App.

Backups previously created by Android may remain in your backup account according to the backup provider’s retention rules. You can manage or delete those backups through your device or account settings.

Purchase records are held by Google Play under Google’s retention policies, and are requested from Google Play whenever the App needs to know whether Pro is active. The developer does not hold your installed-app list, your Orbit preferences, or your purchase history.

Crash reports are kept by Firebase Crashlytics for 90 days. Usage statistics are kept by Google Analytics for up to 14 months, and then deleted automatically. Because neither is linked to your identity, we cannot find your data from your name or email address; uninstalling the App stops anything more from being sent.

If you email us, we keep your message and email address only as long as needed to answer you and handle any follow-up. You can ask us to delete that correspondence at the address below.

15. Security

Orbit relies on Android’s application sandbox and permission model to protect its local data. Purchase records received from Google Play are checked against the App’s Play licensing key before they are acted on, so a record Google did not issue is discarded. No storage method can be guaranteed completely secure.

16. Children’s privacy

Orbit is a general-purpose utility and is not directed to children under 13. The App does not knowingly collect personal information from children or other users. Purchases are made through Google Play, which applies its own family and parental-approval controls.

17. Changes to this Privacy Policy

We may update this Privacy Policy when the App’s features or data practices change. The revised policy will show a new effective date. Material changes will be reflected in the App or its Google Play listing as appropriate.

18. Contact

For privacy questions about Orbit, contact wikivn: