Privacy policy

Effective 29 October 2026. Orbit is operated by DrSTEM. Questions and data requests can be sent to drstem@drstem.cc.

Information we use

We store your full name, email address, and date of birth with your private account. Your date of birth is used to check that you meet the minimum age of 13. Supabase Auth processes your password and sign-in session when you use email and password. If you choose Google or Apple, that provider shares a verified email address and sign-in identity with Supabase; Apple may share a private relay address. When you sign up, we also store a broad category for how you reached Orbit and the entry page, if available. We do not store the referring URL, search terms, campaign IDs, or a visitor identifier for this purpose. When you connect the desktop app, it uploads your local deck names, flashcard questions and answers, and review timing to your private hosted library.

Plugin waitlist

The plugin waitlist is separate from an Orbit library account. If you join with Google, Google shares a verified email address, Google account identifier, and display name. We store these with your place in the 100-person list and any optional feature suggestion. We use them to prevent duplicate places, send a signup confirmation and one ready notice, and consider your suggestion. Resend delivers the confirmation email. The public website shows only the total number of places filled. We keep waitlist details until we close the list or you ask us to remove them. Contact the support address above to request a copy or removal; removing your place may let someone else join.

How we use it

We use this information to provide accounts, private flashcard storage, study status, and the actions you request through the Orbit MCP server. Supabase hosts authentication, the database, and the MCP endpoint. Vercel hosts the website. These services may process technical request logs needed to operate and secure the service.

Vercel Web Analytics counts anonymous visits to Orbit's home page, guides, signup, and login. Its aggregate reports may show the page, referring site, country, and device or browser. It does not use cookies. We remove URL queries and fragments before analytics events are sent, and exclude the private library, email verification, and connection pages. We use these reports to improve the public site.

ChatGPT connection

When you authorize a ChatGPT connection, ChatGPT can request your flashcards through Orbit and receive the data returned by the tools you use. It can create, edit, review, and delete cards on your behalf while authorized. You can disconnect the plugin in ChatGPT or ask us to help revoke its access.

How long we keep it

We keep your account and flashcards while your account exists. If you ask us to delete your account, we remove its data from the active service after verifying your request. Deleted data can remain in Supabase backups for up to 30 days. Technical request logs held by Supabase and Vercel are retained for up to 30 days under their current hosting settings.

Your choices

You can ask us for a copy or deletion of your hosted account and flashcard data at the support address above. Signing out on your desktop stops further sync but does not delete your online library.