Contents3. Why we use it (and the legal basis)
4. AI processing (Google Gemini)
Automated moderation decisions
Automated privacy protection (personal-data detection)
5. Who receives your data (sub-processors)
6. International data transfers
8. Your rights and how to use them
9. Minimum age and children
11. Cookies and similar technologies
12. Changes, contact, and authority info
13. United States — California (CCPA/CPRA)
14. Korea (PIPA) and Japan (APPI) specifics
•Account — email, display name, date of birth, country, and which social provider you signed up with (Google / Apple / Kakao / LINE / Facebook) together with that provider's account identifier.
•Profile — avatar, bio, language preference, service country.
•Content — diaries, media (images and video), comments, likes, friend lists, direct messages, blocks, reports. How AI review applies to content is described in Section 4.
•Usage — device type, IP address, locale, app version, crash reports, and product-analytics events. In the consent audit log the IP is stored only as a SHA-256 hash; the analytics tools in Section 5 receive events under their own IP-minimization settings.
•Derived / activity data — reading activity (which diaries you viewed, kept about 90 days), the detected language of your posts, and a personalization vector built from your activity (see Section 4). Search terms are processed transiently to run the search and are not stored as a history.
•Privacy ledger — names, places, and contact details of other people you mention in diaries, detected automatically, with the pseudonym chosen for each. This ledger is private to you and you can edit or delete it (see Section 4).
•Payments — subscription status, provider transaction ID, and the payment method's type, brand, and last 4 digits (as shown by the provider). Orbnit never stores full card numbers or CVCs.
•Location-related — place names you choose to add to a diary (via Google Places). Orbnit does not collect your GPS coordinates.
•Reports — when content is reported, Orbnit keeps a snapshot of the reported text at the time of the report so the review remains possible even if the content is later edited or deleted.
•Sign-in, profile, posting diaries, messaging — basis: Contract.
•Security, fraud prevention, rate-limiting, account recovery — basis: Legitimate interest. Keeping you and the service safe.
•Content moderation (Gemini) — basis: Legitimate interest and legal obligation. Required for safety and laws such as the EU Digital Services Act.
•Automated privacy detection of other people's data in diaries (Gemini) — basis: Legitimate interest and legal obligation. Detecting and pseudonymizing personal data about third parties before a diary is shown publicly protects their rights; you can turn the pre-publication review off in Settings.
•Analytics cookies on the web (GA-4, PostHog) — basis: Consent. Off by default; you opt in via the cookie banner. Orbnit does not send marketing emails.
•Operational telemetry — basis: Legitimate interest. Independent of the cookie banner, Orbnit's own servers record key service events tied to your account ID — for example that a subscription was activated or refunded, a moderation decision was made, or an account was deleted — in the product-analytics tool (PostHog) to operate the service, investigate problems, and prevent abuse. These are server-side operational records, not browsing trackers, and they follow a strict property allowlist that excludes free-text content.
•Age verification, tax records, law-enforcement requests — basis: Legal obligation.
•AI translation of public diaries (Gemini) — basis: Legitimate interest (display); you can disable it per diary.
•Personalization and meaning-based search — basis: Legitimate interest, applied transparently under GDPR Art. 5(1)(a) and Art. 13. Orbnit builds a 768-dimension preference vector from the posts you write and engage with to rank your home feed and power meaning-based search. This is profiling for ranking only; it does not produce legal or similarly significant effects under GDPR Art. 22.
•Public and friends-only diaries and comments are sent to Gemini for these purposes. Your direct messages are not.
•Visual moderation: uploaded images, avatars, book covers, and short-lived video frames from public and friends-only diaries are sent to Gemini to check for unsafe imagery. Video frames are sampled and deleted right after the check — except where child-safety law requires Orbnit to preserve evidence. Private-diary media is never sent to Gemini; private media is scanned only if and when you switch a diary to public.
•Reported content is re-checked: when someone reports a diary or comment, its text (and images, for a diary) is sent to Gemini again for a fresh review, together with the reporter's stated reason.
•Private diaries are never used to train external AI models.
•You can opt out of automatic translation per diary in the editor.
•Gemini processing happens under a data-processing agreement and follows the EU AI Act's transparency duties.
•What is sent to Gemini: only the diary's title and body text. Your privacy ledger (below) is not sent — matching a detected word against your existing entries happens inside Orbnit's own servers. No account identifiers, email, or separate contact records are attached either. Direct messages and private diaries are never sent for this.
•What it finds: real names and honorifics, specific addresses or places, affiliations (a school, workplace, or clinic), contact or account identifiers, and other wording that would single out another person you mention. Your own name is not the target.
•How it is used: when Orbnit shows your diary to someone else, the detected wording is replaced on screen with a pseudonym. Your own copy always shows your original words; the original wording of a detected item is never placed in another reader's copy, translation, or share preview.
•Review before publishing: for a new diary the scan runs before it is published, in the writing screen. If anything is detected you see it as a list before the publish completes, and the diary goes out only after you have confirmed each item (apply the suggested pseudonym, keep the original, or edit it). Leave without confirming and nothing is published — the entry stays a draft. When you edit a diary that is already public, the scan runs just after you save, and the diary is hidden from others until it finishes.
•Publication hold (fail-safe): if something is found on a diary that reached publication another way, or if the AI provider errors, the diary is held from others' view rather than published — the system fails safe, exactly like moderation.
•No training, nothing retained by the provider: scan requests are stateless and are not used to train external AI models; Google processes them under the same data-processing agreement as the other Gemini calls (Section 5).
•The privacy ledger (`privacy_entities`): Orbnit keeps a per-user ledger of the people, places, and contact details it has detected in your diaries and the pseudonym chosen for each, so the same person reads consistently across your diaries. This ledger is private to you, enforced by Row-Level Security, and it is your record — you can view, rename, merge, add, or delete any entry in Settings → Account → Privacy, and you can also switch an entry to show the original everywhere without deleting it. Deleting forgets the entry, so the next time that name appears it starts over as a new one; showing the original keeps the entry and only lifts the pseudonym. Either way your original wording reappears immediately. The ledger is deleted when you delete your account.
•You stay in control: you can turn the pre-publication privacy review off in Settings; with it off, new public diaries — and any currently held — are shown with your original wording. Comments are not scanned for personal data.
•Supabase — database, storage, real-time sync (Japan, Tokyo).
•Google Cloud — hosting, background jobs, caching (Redis), secret storage, scheduled jobs, video transcoding (US and Japan, Tokyo).
•OneSignal — push notifications; receives your device push token, linked to your account ID (US).
•Sentry — error monitoring, PII automatically redacted (US).
•Google Analytics 4 — pseudonymous usage statistics, only if you consent (US).
•PostHog — product analytics and the operational telemetry in Section 3 (US).
•Google Gemini — AI translation, moderation, language detection, embeddings, and privacy detection (US).
•Google Places — place search for diary locations (US).
•Paddle — the seller (Merchant of Record) for web subscriptions in both Korea and Japan (UK / US). Paddle is an independent seller rather than a processor acting on Orbnit's instructions: it receives the data needed to process your purchase and issues your receipt.
•Apple — iOS app distribution, and in-app purchases if offered (US).
•Google Play — Android app distribution, and in-app purchases if offered (US).
•Cloudflare — DNS resolution (Global). Service traffic does not pass through Cloudflare.
•From the EU / EEA / UK / Switzerland: transfers to each provider rest on an adequacy decision or on the Standard Contractual Clauses (SCC 2021, with the UK Addendum where applicable) incorporated in that provider's data-processing agreement.
•From Korea: cross-border transfers follow PIPA Art. 28-8 (and Art. 28-9), based on the separate consent you give at signup or another lawful ground under that article. For each provider, Section 5 states who receives the data, in which country, what for, and Section 7 how long it is kept; transfers happen continuously while you use the service, over encrypted connections. This includes Korean users' payment data — the seller (Paddle) is in the UK and US, so payment-related information is transferred abroad.
•From Japan: APPI Art. 28 — Orbnit transfers to countries with adequate protection or under written agreements ensuring an equivalent standard.
•From other countries: Orbnit uses SCC-equivalent contracts and follows local rules.
•Active account — until you delete your account.
•Deleted account, grace period — 30 days (you can change your mind and restore).
•Diaries, media, messages after grace — permanently deleted. Comment text is erased, leaving a "[deleted]" placeholder so other people's threads stay readable.
•Photos sent in direct messages, full-size original — 1 year from sending. After that Orbnit automatically deletes the full-size original; the message is not deleted and continues to display the smaller preview copy that was stored alongside it. This is irreversible, and it applies to both the sender's and the recipient's view of the message.
•Administrative audit logs — kept permanently in a tamper-proof form, as the integrity record of administrative and data-protection actions (GDPR Art. 30).
•Consent records — kept while your account exists (an append-only audit log proving what you agreed to and when); deleted when your account is erased. The log stores a SHA-256 hash of your IP, not the IP itself, plus user-agent, version, and country.
•Payment records — Orbnit's own payment ledger is deleted with your account; the seller (Paddle) and the app stores retain transaction records for the periods their tax and commerce laws require.
•Report records — the report and its content snapshot are kept as a permanent moderation record, also where the law requires it.
•Translation caches — cached diary translations are removed after about 60 days without use; cached place-name translations after about 30 days.
•Notifications — removed after about 90 days. Reading activity and reading positions are also removed after about 90 days.
•De-identified analytics — per the retention configured in GA-4 (at most 14 months).
•Personalization vector — kept while you use Orbnit; a daily job removes vectors of accounts inactive for over a year with almost no interactions, and deletion of your account deletes it.
•Privacy ledger — kept while your account is active; you can delete individual entries or the whole ledger in Settings, Account, Privacy; deleted on account deletion.
•Know what we hold — email cto@orbnit.com and Orbnit sends you a copy of your data (GDPR Art. 15 / PIPA Art. 35 / CCPA).
•Get a copy (portability) — email cto@orbnit.com; Orbnit provides your data in a portable, machine-readable format within the statutory deadline (GDPR Art. 20).
•Correct mistakes — Settings, Edit profile, or email Orbnit for data not shown in-app (GDPR Art. 16 / PIPA Art. 36).
•Delete your account — Settings, Delete account; 30-day grace, then permanent (GDPR Art. 17 / PIPA Art. 37).
•Restrict or object — email cto@orbnit.com (GDPR Art. 18, 21).
•Withdraw consent — cookie banner, or Settings → Account → Allow analytics cookies (web) (GDPR Art. 7(3)).
•Manage detected personal data — view, edit, add, or delete the privacy ledger of other people you mention in diaries, in Settings, Account, Privacy (see Section 4).
•Complain — to your local data-protection authority; see contacts in Section 12 (GDPR Art. 77 / PIPA Art. 62).
•Korea — minimum age 14 (PIPA Art. 22-2; Orbnit does not process children under 14 there).
•Japan — minimum age 16 (APPI sets no fixed children's-consent age; this is Orbnit's own minimum).
•United States and elsewhere — Orbnit is not directed to children under 13 and does not knowingly collect their personal information (COPPA). If Orbnit opens a market that requires guardian consent (for example under GDPR Art. 8), the minimum age there will be set at or above that threshold before launch.
•HTTPS everywhere, with HSTS (preload list enrollment in progress).
•Authentication: short-lived JWT access tokens; admin accounts require TOTP MFA.
•Database: Row-Level Security enforced on every public table; your data is invisible to other users by default, even at the database layer.
•Payments: Orbnit stores no payment instrument. Your card is held by the seller of record, and Orbnit never sees your card number — only the method type, brand, and last four digits, so you can tell which card is on file.
•Monitoring: source maps stripped from production builds; Sentry automatically redacts PII (emails, tokens, names) from error reports.
•Vendors: signed data-processing agreements with every sub-processor and, for EEA-origin transfers, the safeguards in Section 6.
•Essential — sign-in session (set by Orbnit's own servers), CSRF protection, and language preference. Always on; Orbnit does not function without them.
•Analytics — pseudonymous usage statistics (Google Analytics 4, PostHog). Off by default; they run only after you accept.
•On-device convenience storage — your cookie choice itself (`orbnit-cookie-consent`) and in-progress diary drafts are kept in your browser's local storage, on your device only.
•No sale or sharing. Orbnit does not "sell" personal information and does not "share" it for cross-context behavioral advertising as the CCPA/CPRA defines those terms, so there is no opt-out of sale or sharing to provide.
•Sensitive personal information. Orbnit does not use sensitive personal information to infer characteristics, so the right to limit its use does not apply.
•Your California rights. You have the right to know, delete, and correct your personal information, and the right not to be discriminated against for exercising your rights — exercise them as described in Section 8. Orbnit does not discriminate in price or quality because you exercised a privacy right.
•Representative: Yeonju Shin (신연주)
•Registered address: 226 Dongpangyo-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
•Business registration number: 135-62-00885
•Hosting providers: Google Cloud Platform, Supabase
