1. Who this covers
This policy covers the Orbit iPhone app and the Orbit website at orbit-three-gilt.vercel.app, including the web app at /app. In this policy, “Orbit”, “we” and “us” mean the team that runs Orbit. We decide how the data described here is used, so we are its controller. You can reach us at support@example.com.
2. What stays on your iPhone
Most of Orbit runs on your phone. The following are stored on your device only and are never sent to us:
- Your profile: name, email, phone, address, university, course, graduation year, skills, links and work authorisation, plus any optional equal-opportunity answers you choose to add (such as gender, ethnicity, veteran or disability status).
- A résumé or CV file you import.
- Your application pipeline: saved roles, stages, dates, checklists, notes, contacts and timeline.
- Your Autopilot answers library and preferences (roles, locations, terms, filters).
- App settings such as theme and lock-in timer preferences.
- A cached copy of the public internship listings, so the app works quickly and offline.
Sign-in tokens for the anonymous account are kept in the iOS Keychain. Deleting the app removes the data it stored on the phone. You can also clear sample or saved data from the You tab.
Applying with Autopilot. When you open a posting in Orbit’s apply screen and tap Fill with my profile, the app fills the employer’s application form with details from your profile and can attach your résumé file. This happens on your phone. If you import a résumé PDF, it is read on your phone only to suggest profile fields. Orbit fills only fields the form asks for, and equal-opportunity answers only if you have added them. The details reach the employer only when you check the form and press the site’s own submit button. Orbit never presses submit, and it does not receive or keep a copy of what you send. The employer’s or applicant tracking system’s privacy policy applies to anything you submit to them, including through Open in Safari.
3. What is sent to our servers, and why
Some features need a server. Our backend runs on Supabase. This is what it receives:
| Data | When | Why |
|---|---|---|
| Anonymous account ID | The first time you use a lock-in, a crew mission on your own CV or another feature that needs an account | A random ID created by anonymous sign-in. It links your lock-ins, XP, streaks, your own crew missions and any night-shift schedule to you, without a name or email. |
| App device ID | When you use the CV rater or subscribe | A random identifier the app creates when it is installed. It is not your Apple advertising ID or the vendor ID. We use it to apply the free daily CV-rating limit and to attach a subscription to your install. |
| CV text and mission preferences | When you start a crew mission or rate a CV | To match roles and draft applications, or to score your CV. Contact details are removed by our server before anything is stored or sent to AI. The fictional sample student contains no real person’s data. |
| Night-shift schedule (Pro and Max) | Only if you turn on scheduled crew runs | Your CV lines with contact details removed, your preferences and goal, and the schedule (daily or weekly, time and time zone), so the crew can run while you sleep. Deleted when you remove the schedule. |
| Lock-in sessions | When you start, pause, resume, finish or cancel a lock-in | Start and end times, planned minutes and pauses, so the server can credit focus minutes, XP, streaks and achievements fairly. |
| Optional campus details | Only if you choose them | University and city, and whether you take part in university, city or public leaderboards. Each leaderboard is off until you turn it on, and turning it off takes effect immediately. |
| Subscription status | When you subscribe, renew, cancel or restore | Product, status, transaction identifiers and renewal or expiry dates from Apple (or Stripe on the web), so we know which plan to unlock. |
| Usage and cost records | Every crew run, CV rating and AI call | How many runs, roles and ratings you have used in the current week, month or day (to apply plan limits), and which agent and model ran with token counts and timings. These records contain no CV text. Where no app or device ID is available, as on the website, free limits are keyed to a one-way hash of your IP address. |
The app also downloads public data that contains nothing about you: internship listings from public GitHub repositories, and company logos from Google’s favicon service. Only the company’s web address is sent to Google for a logo. As with any web request, these services can see your IP address.
4. How AI is used
Orbit’s crew (Orchestrator, Scout, Analyst, Writer, Guardian and Scheduler) and the CV rater use Claude models from Anthropic through Anthropic’s commercial API.
- Redaction comes first. Before any model call, our server replaces email addresses, phone numbers, web links, postcodes and street addresses with placeholders such as [EMAIL]. A name on the first line of a CV is reduced to initials. Redaction is automatic and pattern-based, so please don’t put sensitive details, such as health information or ID numbers, in your CV text.
- Grounded output. Drafts may only use facts from your CV. The Guardian agent checks every claim against your CV lines and blocks fabrication, personal-data leaks and prompt injection.
- No training on your data. Anthropic’s commercial terms do not allow it to train models on API inputs and outputs. We do not train models either.
- You stay in control. Orbit never sends an application for you. Fit scores and CV scores are heuristic, not predictions of hiring outcomes. AI output can be wrong, so always review it before you use it.
5. Subscriptions and payments
In the iPhone app, subscriptions are sold through Apple’s In-App Purchase. Apple processes the payment under its own privacy policy. Apple sends us subscription status for your purchase (for example, active, in a free trial, renewed, expired or refunded) through the App Store Server API. We never receive your Apple ID, name or card details.
On the website, subscriptions are sold through Stripe Checkout. Stripe collects your payment details and the email address you enter there. We store your Stripe customer and subscription IDs, the plan, its status and the end of the current billing period.
6. Phone permissions
Orbit asks for permissions only when a feature needs them, and every one is optional:
- Calendar (add events only). Lets Orbit add an interview, deadline or lock-in you choose to your calendar. Orbit cannot read your existing events.
- Notifications. Reminders are scheduled on your phone. We do not run a push-notification server.
- Files. If you import a résumé or CV, iOS lets you pick a single file. Orbit reads only that file. It stays on your phone, and is attached to an application form only when you use the apply screen.
Orbit does not use your location, contacts, camera, microphone, photos, health data or advertising identifier.
7. Our website
- The site is hosted on Vercel. We use Vercel Web Analytics and Speed Insights, which count page views and measure loading speed in aggregate. They do not use cookies or advertising identifiers.
- If you join the universities waitlist, we store the email address, organisation, role and note you submit, and use them only to contact you about Orbit.
- The web app at /app works the same way as the iPhone app for crew missions, CV ratings and campus boards.
8. Service providers
We use a small number of providers to run Orbit. Each one processes data only to provide its service to us:
| Provider | What for | Data involved |
|---|---|---|
| Supabase | Database, anonymous sign-in and server functions | Everything in section 3 |
| Anthropic | Claude models for the crew and the CV rater | Redacted CV lines, preferences and job descriptions |
| Apple | In-app subscriptions and app distribution | Purchases, under Apple’s privacy policy |
| Stripe | Web subscriptions | Payment details and checkout email, under Stripe’s privacy policy |
| Vercel | Website hosting and aggregate analytics | Standard request data such as IP address and pages viewed |
Some providers process data in the United States and other countries. Where UK or EU data protection law applies, these transfers rely on the providers’ standard contractual clauses or equivalent safeguards.
9. How long we keep data
| Data | Kept for |
|---|---|
| Crew missions (redacted CV lines, matched roles, drafts, Guardian checks, logs) | Expire 24 hours after creation, then deleted by a clean-up that runs every 15 minutes |
| Night-shift schedule and its redacted CV lines | Until you delete the schedule |
| CV ratings | Expire 24 hours after creation, then deleted by a clean-up that runs every 15 minutes |
| Usage counters (runs, roles, ratings; no CV text) | As long as needed to apply plan limits and keep cost records |
| Lock-ins, XP, streaks and campus choices | Until you delete them in the app or ask us to |
| Subscription records | While the subscription is active, then as long as tax and accounting law requires |
| Anonymous account ID | Until you ask us to delete it |
| Waitlist entries | Until you ask us to remove them, or once we no longer need them to contact you |
10. What we never do
- Sell your data, or share it with advertisers or data brokers.
- Track you across other companies’ apps or websites.
- Include advertising, analytics or crash-reporting SDKs in the iPhone app.
- Submit job applications or contact employers on your behalf. Autopilot fills forms, but you always press submit.
- Let a model invent qualifications that are not in your CV. The Guardian blocks them.
11. Your choices and rights
- Delete lock-in data: on the Lock-in screen, choose Delete my focus data. This removes your lock-ins, XP, streaks, achievements and campus choices from our servers.
- Crew runs and CV ratings expire on their own after 24 hours.
- Night-shift schedule: delete it from the schedule screen, which removes its stored CV lines.
- On-device data: clear it from the You tab, or delete the app.
- Subscriptions: manage or cancel in iPhone Settings → your name → Subscriptions.
Depending on where you live (for example under the UK GDPR, the EU GDPR or California law), you may have the right to access, correct, delete or port your data, and to object to or restrict how it is processed. Email support@example.com to make a request. Because Orbit accounts are anonymous, we may need you to send identifiers from the app before we can find your records. We process the data in this policy to provide the service you asked for (contract) and, for security and abuse prevention, for our legitimate interests. If you are in the UK, you can also complain to the Information Commissioner’s Office (ico.org.uk), or to your local data protection authority elsewhere.
12. Security
All traffic is encrypted with HTTPS. Row-level security means a crew mission can be read only by the account that started it. Missions on the fictional sample student are the exception and can be viewed by anyone. Lock-in, CV-rating, schedule and subscription records can be read only by our server. Sign-in tokens are stored in the iOS Keychain.
No system is perfectly secure, but we limit what we collect and keep it for as short a time as we can.
13. Age
Orbit is built for students preparing for internships and graduate roles. It is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has used Orbit, contact us and we will delete the related data.
14. Changes and contact
If we change this policy, we will update the effective date above, and for significant changes we will tell you in the app. Questions or requests: support@example.com.